diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
index 62be5bb..bf2c3de 100644
--- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md
+++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
@@ -165,7 +165,7 @@ Remote agents and the documented port map must be repointed *before* removal.
 
 ```task
 id: CUST-WP-0067-T03
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "29977448-1a74-5a4d-b729-974c15b6bbde"
 ```
@@ -184,6 +184,32 @@ Acceptance: `--confirm-primary` fails against a non-primary instance and names
 what it reached; a hub reports its role; `statehub status` shows role alongside
 the API base.
 
+**Built (2026-08-25).** The hub can now declare what it is: `instance_role` and
+`instance_label` in settings, surfaced on `/state/health`, defaulting to
+`unknown` — an instance that has not declared itself is not the primary.
+Production values declare `primary` / `railiance01`; the chart default stays
+`unknown` because a chart can be installed anywhere.
+
+`_check_primary` now requires `instance_role=primary`. An instance declaring
+nothing is refused with a message naming what to set, and proceeding anyway
+requires an explicit `--allow-unverified-primary` rather than a silent default —
+the same principle as `--api-base` having no default.
+
+Verified against the live hub, not only in tests: it refuses central today
+(which declares nothing yet) and accepts with the explicit flag. Four tests
+cover `_check_primary` directly; the existing suite monkeypatched it and never
+exercised it, which is why it never caught the original defect. repo-manager
+126 passed, state-hub 656 passed.
+
+Worth recording: `registrar-reconcile` returns `noop` before reaching the
+authority check when there is nothing to write. That is correct — no write, no
+authority needed — but it means a live test on a clean repo proves nothing
+about the guard.
+
+**Remaining:** one deploy. Central declares no role until a `helm upgrade`
+picks up the ConfigMap, so `--confirm-primary` needs the explicit flag until
+then. CI is building `19fab26`.
+
 ## Give Repo Manager a real onboarding write path
 
 ```task