diff --git a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
index a5d2bab..0067955 100644
--- a/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
+++ b/workplans/CUST-WP-0064-sbom-controlled-scan-inputs.md
@@ -10,7 +10,7 @@ topic_slug: custodian
 planning_priority: high
 planning_order: 64
 created: "2026-08-22"
-updated: "2026-08-22"
+updated: "2026-08-23"
 quality_dor: DoR-Ok
 quality_dor_at: "2026-08-22"
 quality_dor_by: codex
@@ -91,6 +91,26 @@ package changes, additive skip reasons, safety limits, durable replay rule,
 and rollback sequence. Implementation handoffs now carry one shared contract
 instead of separate mechanism proposals.
 
+**Implementation checkpoint (2026-08-23):** three indexed child workplans are
+now committed and pushed. `SBOM-WP-0003` (`dc07cc14`) implements migration
+`0002`, durable operation receipts/replay, controlled full-SHA fetch and safe
+extraction, provenance, source projection, and additive outcomes at application
+revision `879012c` (25 tests passed, one conditional PostgreSQL skip; Ruff
+clean; real archive scan returned 33 entries and zero errors).
+`RAPP-SBOM-NEXUS-WP-0002` (`63ba3813`) stages the feature dark with a 768 MiB
+ephemeral volume and Forgejo-only egress at package revision `7d8f76e` (6 tests
+passed; server-side cluster admission dry-run passed). `ACTIVITY-WP-0034`
+(`409c06c0`) freezes and submits the exact source reference across retries and
+accepts the new terminal outcomes at revision `e690170` (434 tests passed, one
+conditional integration skip; 28 focused tests passed). No production digest,
+migration, feature flag, or schedule was changed. Remaining T02 work is the
+reviewed image build/pin, migration `0002`, dark verification, and attended
+one-repository canary. Repo Manager subsequently reported its direct producer
+interface ready at revision `e6cc18b`: `rmgr sbom source-ref` resolves and
+projects the full-SHA reference, verifies Nexus returns it unchanged, and
+projects no workstation path. T03 therefore waits only on the Nexus/package
+dark canary rather than new Repo Manager implementation.
+
 ## Retarget bounded catch-up without widening it
 
 ```task