diff --git a/docs/operator-runbook.md b/docs/operator-runbook.md
index b9af8f6..9f3cefa 100644
--- a/docs/operator-runbook.md
+++ b/docs/operator-runbook.md
@@ -84,10 +84,10 @@ custody defect: stop and investigate.
 
 ## Sender credential rotation
 
-First deploy mints the registry in-cluster as Secret `audit-core-senders`
-(ops-mason plan `audit-core-openbao-runtime-custody`). The OpenBao path
-`platform/workloads/audit-core/senders` is the later authority after a
-wrap-migrate; do not `bao kv put` it by hand. Rotation is overlap-first:
+OpenBao path `platform/workloads/audit-core/senders` is the authority for
+ExternalSecret `audit-core-senders`. The initial in-cluster registry was
+wrap-migrated on 2026-08-14 without printing or staging its values; do not
+replace that path with a founder paste. Rotation is overlap-first:
 
 1. Add the replacement token to the sender's `tokens` list. Both work.
 2. Move the sender to the new token.
diff --git a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
index 163d36c..f6be215 100644
--- a/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
+++ b/workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
@@ -236,6 +236,13 @@ Findings fixed on the way:
 T02 done for the provisioned-lane + no-delivery-gap claim. Empty senders
 KV wrap-migrate is follow-on, not a founder paste.
 
+Follow-on completed 2026-08-14: the live registry was streamed directly from
+Kubernetes into `platform/workloads/audit-core/senders` under an attended
+KeyCape/MFA platform-admin session. ExternalSecret `audit-core-senders` is
+`SecretSynced`, owns the derived Secret, and preserved its pre-migration
+checksum. The receiver rolled successfully and `/readyz` remained durable
+`archive`; no sender token was printed or staged.
+
 ## T03 - Deploy the receiver
 
 ```task