diff --git a/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md b/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md
index cc2a03a4..073b16c1 100644
--- a/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md
+++ b/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md
@@ -309,7 +309,7 @@ Critical path ≈ 1B: **~4–6 weeks total**, matching the design estimate.
 - [x] Phase 0 DoD: suite green; rig unauthenticated ⇒ `PermissionDenied`, authenticated paths work; PR merged (#25, ff to `main` @ `3fa95555`; gate PASS in `2026-07-22-clusterclient-to-grpc-live-gate.md`)
 
 **Phase 1A — central control plane** (worktree, `feat/grpc-central-control`)
-- [ ] T1A.1 `central_control.proto` (7 RPCs; checked-in codegen) + `CentralControlDtoMapper` + round-trip golden tests
+- [x] T1A.1 `central_control.proto` (7 RPCs; checked-in codegen) + `CentralControlDtoMapper` + round-trip golden tests
 - [ ] T1A.2 Central hosting: `AddGrpc` + per-site-PSK interceptor (`x-scadabridge-site`), `CentralGrpcPort` h2c listener (8083), `CentralControlGrpcService` (Ask existing handlers), readiness gate
 - [ ] T1A.3 `ICentralTransport` (Akka extract + Grpc impl), `CentralChannelProvider` (sticky failover/failback, backoff, deadlines, PSK), `CentralTransport` flag default `Akka`, `CentralGrpcEndpoints` option + validator
 - [ ] T1A.4 Tests: actor-with-fake-transport ×7, TestServer transport tests, S&F/audit/health suites pass unmodified
diff --git a/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json b/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json
index 565cd9ea..df4bbe78 100644
--- a/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json
+++ b/docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json
@@ -87,17 +87,18 @@
       "id": "T1A.1",
       "phase": "1A",
       "subject": "central_control.proto (7 RPCs, checked-in codegen) + CentralControlDtoMapper + round-trip golden tests",
-      "status": "in_progress",
+      "status": "completed",
       "activeForm": "Authoring central_control.proto and its mappers",
       "blockedBy": [
         "P0.DoD"
-      ]
+      ],
+      "notes": "d7455577 on feat/grpc-central-control. 7 RPCs; ingest RPCs reuse sitestream AuditEventBatch/CachedTelemetryBatch/IngestAck by import. 32 goldens, verified to have teeth by mutation. PLAN CORRECTIONS FOUND: (1) actor sends IngestAuditEventsCommand/-Reply (IReadOnlyList<Guid>), NOT the batch/IngestAck types the plan's table claims - mapper bridges; (2) CachedTelemetryEntry carries SiteCall not SiteCallOperational, needed a new SiteCallDtoMapper.ToDto(SiteCall); (3) SiteHealthReport is ~33 members and 5 are INIT-ONLY props not ctor params - FromDto needs an object initializer or they silently drop; (4) 3 collections are nullable with load-bearing null, proto3 cannot express presence on repeated/map => wrapper messages; (5) ConnectionHealth has no Unspecified member, so naive mapping puts Connected on proto3 zero - reserved 0 and unknown decodes to Error, never Connected."
     },
     {
       "id": "T1A.2",
       "phase": "1A",
       "subject": "Central hosting: AddGrpc + per-site-PSK interceptor, CentralGrpcPort h2c listener, CentralControlGrpcService, readiness gate",
-      "status": "pending",
+      "status": "in_progress",
       "activeForm": "Hosting CentralControlService on central",
       "blockedBy": [
         "T1A.1"