diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json
index 6b53866..2d1a1cd 100644
--- a/docs/work/_system/_state.json
+++ b/docs/work/_system/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-19T12:53:53.314Z",
+  "updated_at": "2026-05-19T13:01:41.058Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -277,7 +277,7 @@
           "status": "in-progress",
           "title": "core-consent implementation — Payload impl, DI binders, migration helpers, tRPC router",
           "ac_total": 3,
-          "ac_completed": 1,
+          "ac_completed": 2,
           "depends_on": [
             "03-core-consent-foundation"
           ],
diff --git a/docs/work/epics/dsr-consent-and-cookie-banner/04-core-consent-implementation/_story.md b/docs/work/epics/dsr-consent-and-cookie-banner/04-core-consent-implementation/_story.md
index ec6b847..784e27d 100644
--- a/docs/work/epics/dsr-consent-and-cookie-banner/04-core-consent-implementation/_story.md
+++ b/docs/work/epics/dsr-consent-and-cookie-banner/04-core-consent-implementation/_story.md
@@ -13,7 +13,7 @@ blocks:
     10-auth-signup-migration,
   ]
 created: 2026-05-19T12:00:00Z
-updated: 2026-05-19T12:53:53.146Z
+updated: 2026-05-19T13:01:40.900Z
 ---
 
 ## Goal
@@ -53,5 +53,5 @@ Story 03 established the type surface and structural enforcement. This story del
 ## Tasks
 
 - [x] Add `PayloadConsent` Payload-backed implementation in `core-consent/` reading/writing `users.consentState` and emitting `CONSENT_GRANT`/`CONSENT_WITHDRAW` audit entries via injected `core-audit` + `RecordingConsent` test double in `packages/core-testing/` + DI binders `core-consent/di/bind-production.ts` and `core-consent/di/bind-dev-seed.ts`; contract tests covering grant/withdraw/isGranted round-trip, audit entry shape, and `getCategories`; all gates pass.
-- [ ] Add `extractAnonymousConsent(cookieHeader: string)` + `migrateAnonymousConsent({ userId, cookieState, bannerVersion, policyVersion })` helpers in `core-consent/` with tests covering the happy path (cookie present → calls `IConsent.grant` with `method: "signup-migration"`) and the absent-cookie no-op; all gates pass.
+- [x] Add `extractAnonymousConsent(cookieHeader: string)` + `migrateAnonymousConsent({ userId, cookieState, bannerVersion, policyVersion })` helpers in `core-consent/` with tests covering the happy path (cookie present → calls `IConsent.grant` with `method: "signup-migration"`) and the absent-cookie no-op; all gates pass.
 - [ ] Add protocol-agnostic handlers in `core-consent/handlers/` + `consentRouter` tRPC router in `core-consent/consent.router.ts` exporting `grant`, `withdraw`, `isGranted`, `getCategories` procedures with auth checks; integration tests asserting response shapes and auth error passthrough; all gates pass.