diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
index 5e63c46..09862ad 100644
--- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md
+++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
@@ -165,7 +165,7 @@ Remote agents and the documented port map must be repointed *before* removal.
 
 ```task
 id: CUST-WP-0067-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "29977448-1a74-5a4d-b729-974c15b6bbde"
 ```
@@ -226,9 +226,14 @@ precedent so the env var the chart already sets is the one that binds.
 which is the check that would have caught this before deploy, plus the `unknown`
 default and rejection of invalid roles.
 
-**Remaining:** one more deploy for central to declare `primary`. Until then
-`--confirm-primary` requires the explicit flag — correctly, since central
-genuinely cannot prove it is the primary.
+**Done (2026-08-25).** Deployed and verified end to end. Central reports
+`instance_role=primary`, `instance_label=railiance01`; `statehub status` prints
+`Instance: primary (railiance01)`; and `--confirm-primary` now accepts it with
+no escape hatch, because authority is proven rather than assumed.
+
+The guard is what closes this workplan's failure mode rather than merely
+cleaning up after it: a future second instance cannot pass itself off as the
+primary by being healthy.
 
 ## Give Repo Manager a real onboarding write path