--- a/workplans/RMGR-WP-0021-secret-detection-controls.md
+++ b/workplans/RMGR-WP-0021-secret-detection-controls.md
@@ -8,7 +8,7 @@
 owner: codex
 topic_slug: repo-manager
 created: "2026-10-12"
-updated: "2026-10-12"
+updated: "2026-10-17"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "5aa6f84a-c682-5996-ae26-96daef670833"
@@ -149,3 +149,39 @@
 execute founder-deferred rotations or treat suppressed output as remediation.
 Close only after native coverage and response evidence are adequate for the
 applicable DSM-DETECT requirements; retain residuals as live work records.
+
+
+## Publish measured staged-scanner batching and verify runtime routing
+
+```task
+id: RMGR-WP-0021-T05
+status: todo
+priority: medium
+```
+
+2026-10-17 prepared refinement for the local staged-object adapter. Independent
+review and a coordinator-executed generated-fixture run cover the exact source
+SHA256 `e709c658f779534fcab093207b0a78e49d54fc584c515fdf7ac535ce75f6c400`:
+42 tests, 13 exact old/new summary parity cases, immutable scanner snapshot,
+volatile-only bounded batches, watchdog and parent-loss refusal/cleanup. Warm
+p50 for 1/16/64 distinct 1 KiB blobs is 0.835/0.884/0.904 seconds, compared with
+0.702/12.065/49.172 seconds in the retained baseline. The one-blob case regressed;
+this is descriptive local fixture evidence, not aggregate workload or tail
+acceptance. Larger blobs retain the original stdin route.
+
+Publish the reviewed patch against the exact owner base, verify the configured
+shared and Custodian hooks still resolve to the admitted owner source, then run
+clean/private-key/scanner-unavailable generated alternate-index probes without
+reading or changing user source/indexes. Verify actual CLI import routing; the
+repo-local `.venv/bin/rmgr` imports owner source, but the previously advertised
+`/home/worsch/.local/bin/rmgr` is absent in the read-only observation and must not
+be described as installed operational coverage. Reconcile that exact CLI route
+before claiming CLI publication. Preserve existing hook guards and routing;
+retain rollback to the exact prior adapter bytes. Source publication and runtime
+acceptance must have separate receipts.
+
+Review packet: Custodian
+`docs/changes/netkingdom-target-2026-10-16/scanner-batch-r1/`.
+No canonical owner mutation or runtime admission has occurred in the packet.
+This task does not close T03/T04, independent receive/CI coverage, source-control
+bypass limits or whole TSA15.