diff --git a/AUDIT_SCOPE.md b/AUDIT_SCOPE.md
index fb7a043e..fc28966a 100644
--- a/AUDIT_SCOPE.md
+++ b/AUDIT_SCOPE.md
@@ -132,13 +132,18 @@ make hello-gpu
 ## Dependencies and provenance
 
 - No lockfile at the root; C with no external libraries beyond libc and libm for the library.
-  `native/learn53/omega653.lock` is a sub-component lock.
+  Sub-component pins: `om/omega-bridge.lock` (omega-bridge commit for the Omega bindings and CI),
+  `om/pipeline/dependencies.lock`, `native/learn53/omega653.lock`,
+  `native/learn53/moe-closure.lock` and `tools/c5/omc.pin`.
 - Vendored: `third_party/nvidia-open-580.173.02/` (67 NVIDIA headers, MIT, unchanged,
   `SHA256SUMS` in that folder). Mesa NVK/NAK is cited in comments for hardware facts, no code
   copied. Notices in `THIRD_PARTY.md` and `NOTICE`. History and licence audit in `docs/AUDIT.md`,
   `docs/LICENSE_PROVENANCE.md`, `docs/LICENSING_TRANSITION.md`.
 - AGENTS.md: no NVIDIA binary, cubin, PTX, firmware or NVIDIA tool listing goes in the repository.
-- Omega builds the same sources at a pinned commit (`cudapp.lock` in omega-mv).
+- Omega does not build these sources at a pin yet. omega-mv main has no `cudapp.lock`; it still
+  builds its own diverged copy of the GPU code (#106) and takes the driver client from physics-mv
+  (#107). The lock, with its `check-cudapp` target and `tools/cudapp-stage.sh`, is proposed in
+  the open draft omega-mv#924.
 - No network access at build or test time is documented. At the described revision the repository
   had no GitHub Actions workflow files; the audit-readiness change adds `.github/workflows/ci.yml`
   (item 10 above), whose only network use is fetching the pinned actions on the runner.
diff --git a/docs/START_HERE.md b/docs/START_HERE.md
index 3a51f3c3..854c5838 100644
--- a/docs/START_HERE.md
+++ b/docs/START_HERE.md
@@ -62,10 +62,13 @@ blob, with refusal controls. Originals and historical commits are unchanged.
 On x86-64 the same target is outside `make test` and exits 2, because the
 pinned compiler is not part of the portable suite.
 
-Canonical consumer integration uses the existing single-commit `cudapp.lock`,
-not a second artifact or qualification registry. The isolated Omega consumer
-cutover builds an authenticated committed source archive and links its actual
-callers to that canonical library:
+Canonical consumer integration is meant to use one single-commit `cudapp.lock`
+in Omega, not a second artifact or qualification registry. That lock does not
+exist on omega-mv main yet: `cudapp.lock`, the `check-cudapp` make target and
+`tools/cudapp-stage.sh` are proposed in the open draft
+[omega-mv#924](https://github.com/aien-dev/omega-mv/pull/924). That isolated
+Omega consumer cutover builds an authenticated committed source archive and
+links its actual callers to that canonical library; with #924 checked out:
 
 ```sh
 OMEGA_OMC=/absolute/path/to/pinned/omc \