diff --git a/workplans/CUST-WP-0067-hub-authority-target-resolution.md b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
index ebe3893..62be5bb 100644
--- a/workplans/CUST-WP-0067-hub-authority-target-resolution.md
+++ b/workplans/CUST-WP-0067-hub-authority-target-resolution.md
@@ -494,7 +494,7 @@ depending on it is the documented registration, which has been repointed.
 
 ```task
 id: CUST-WP-0067-T09
-status: progress
+status: done
 priority: high
 state_hub_task_id: "45a2ba22-9d50-5ba8-9fa7-6e345ddce395"
 ```
@@ -568,3 +568,15 @@ done < <list of onboarded repos>
 
 After that the local cache database holds nothing unique except the 11
 dispositioned records.
+
+**Done (2026-08-25).** Operator ran the upgrade; release 20 on `main-ac21acc`
+with the vocabulary mounted and `REPO_CLASSIFICATION_ALLOWED_PATH` set.
+
+Classification writes against central now succeed — the first time they have
+been possible from anywhere but a workstation. All 33 onboarded repositories
+were re-run through `rmgr repo-onboard` and projected their classification;
+every one returned `updated` with no warnings, where before each returned
+`created-unclassified`. Central holds 111 repositories, 100 of them classified.
+
+The idempotence mattered here: the same command that onboarded them projected
+their classification later, with no separate backfill path to write or trust.