diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md
index 68de8f4..dc66bab 100644
--- a/workplans/USER-WP-0026-account-recovery.md
+++ b/workplans/USER-WP-0026-account-recovery.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: user-engine
 created: "2026-09-12"
-updated: "2026-09-27"
+updated: "2026-10-03"
 state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
 ---
 
@@ -92,3 +92,11 @@ Need registered HTTPS entry points, exact identity/tenant/action mapping,
 authoritative allow/deny/unavailable results, and scoped mutation/readback
 semantics from the application and authorization owners. Continues jointly with
 USER-WP-0028-T02; no local grant inference or substitute catalogue was added.
+
+2026-10-03 (CUST-WP-0075 inbox sweep): the net-kingdom reply of 2026-09-29
+(`f1b61ee9`) concerns root-grant custody for USER-WP-0037-T02 and does not
+address the workload catalogue. No request had ever been sent for this task
+despite its `message-from:net-kingdom` qualifier (added 2026-09-28). Sent one
+now (message `db1b7d6e`): does NetKingdom own the workload catalogue/admission
+record and the scoped access-decision contract, and if not, who does. The
+qualifier stays on net-kingdom until it answers or names another owner.
diff --git a/workplans/USER-WP-0037-hub-authority-lookup.md b/workplans/USER-WP-0037-hub-authority-lookup.md
index 5b16cfd..e144b79 100644
--- a/workplans/USER-WP-0037-hub-authority-lookup.md
+++ b/workplans/USER-WP-0037-hub-authority-lookup.md
@@ -8,7 +8,7 @@ status: blocked
 owner: codex
 topic_slug: communication
 created: "2026-09-28"
-updated: "2026-09-28"
+updated: "2026-10-03"
 related:
   - HUB-WP-0012
 state_hub_workstream_id: "54d99faf-4c53-5927-a82c-feca41de2cf3"
@@ -49,8 +49,10 @@ production deployment was added. T02/T03 retain those outstanding owner gates.
 ```task
 id: USER-WP-0037-T02
 status: wait
-blocked_on: message-from:net-kingdom
-blocking_reason: "Specify with NetKingdom the root-grant custody/revocation and platform:root to tenant:platform mapping."
+depends_on: [NK-WP-0045-T01, NK-WP-0045-T04]
+needs_human: true
+decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
+blocking_reason: "Mapping specified in proposed NK-ADR-0017; awaits founder acceptance (NK-WP-0045-T01) and the custody-record read surface (NK-WP-0045-T04)."
 priority: high
 state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
 ```
@@ -68,14 +70,29 @@ consumer like the Hub. Requested via State Hub message
 `379d266b-b738-4772-82c0-318e67a50bc8` to `net-kingdom`. `AccountAuthority`
 deliberately still carries no root-grant field pending that decision.
 
+2026-10-03 (CUST-WP-0075 inbox sweep): net-kingdom replied (message
+`f1b61ee9`) with proposed NK-ADR-0017: the custody record is the sole root-grant
+authority (LLDAP/JWT are projections, revocation is a recorded custody action);
+the grant is relation `platform-root-custodian` in `tenant:platform` only,
+`owner_system: net-kingdom-custody`; retainable evidence is subject, grant,
+source record id+revision, observed_at, revoked_at/expires_at, cached at most
+15 minutes, fail closed. No machine-readable read surface exists yet. user-engine
+confirmed the mapping is sufficient (reply `60acf176`), stated the intended
+optional `root_grant` observation shape and fail-closed behaviour, and asked
+for exact (issuer, subject) keys and a monotonic revision. The wait moved from
+`blocked_on: message-from:net-kingdom` to `depends_on` NK-WP-0045-T01 (founder
+accepts or amends NK-ADR-0017) and NK-WP-0045-T04 (read-surface decision), both
+routed to hub decision cef97ccd (packet D10). No code changed: the field is
+added once the read surface exists; until then no root grant is returned.
+
 ## Authenticated workload transport and private acceptance
 
 ```task
 id: USER-WP-0037-T03
 status: wait
 depends_on: [USER-WP-0037-T02]
-blocked_on: message-from:net-kingdom
-blocking_reason: "Real caller credentials are admitted through their owner after the T02 contract."
+blocked_on: message-from:state-hub
+blocking_reason: "Real Hub workload credential admission requested from state-hub (message f3bcc516, unanswered); private acceptance also needs the T02 contract."
 priority: high
 state_hub_task_id: "c5d67725-c685-50f6-9db8-28114a34014b"
 ```
@@ -103,3 +120,10 @@ repo only consumes it. Requested via State Hub message
 `f3bcc516-7241-4050-ba52-5723bb174936` to `state-hub`. Withdrawal, outage,
 and private-integration verification with the real credential are still
 owed once it exists.
+
+2026-10-03 (CUST-WP-0075 inbox sweep): the net-kingdom reply (`f1b61ee9`)
+does not bear on this task's own gate; the `message-from:net-kingdom`
+qualifier was stale. The NetKingdom dependency is carried through
+`depends_on: [USER-WP-0037-T02]`; the outstanding owner request is the
+credential admission message `f3bcc516` to `state-hub`, still unanswered, so
+the qualifier now names `state-hub`.