diff --git a/docs/release/platform-mail-custody-preparation-2026-10-31.md b/docs/release/platform-mail-custody-preparation-2026-10-31.md
new file mode 100644
index 0000000..85f6e53
--- /dev/null
+++ b/docs/release/platform-mail-custody-preparation-2026-10-31.md
@@ -0,0 +1,45 @@
+# Platform mailbox custody preparation
+
+CSOC-WP-0015-T02 remains in progress. Reply/bounce ownership is settled by decision
+9392ef52-3bfe-42fd-b6d5-ec0730656775: platform-root, with Bernd as human operator,
+including registration and invitation mail. No further ownership choice is needed.
+
+The credential owner now has a live workplan RPF-WP-0068
+(c042789b-4d7f-5c55-8d49-39dd16500f41) and proposed CCR-2026-0056. The fixed admission
+contract/helper and complete attended foundation controller are prepared. Two
+preparation tasks are done; attended admission and native custody return remain
+open. The existing application sender remains forgejo@coulomb.social.
+
+Review packet in the sibling repository:
+`railiance-platform/docs/email-connect-smtp-foundation-review-2026-10-31.md`.
+Foundation proposal:
+`sha256:f8da6c831160e1c6354ce54f936809d2d4fb48eb45eb23484dc0bcdfe0bb52f0`.
+
+The source controller creates only a dedicated service account, namespace store
+and password projection, after approved CCR and identity/absence checks. It
+verifies native binding before owner confirm-binding, preserves existing mailbox
+readers, proves workload login/scope/denials and revocation, and checks projection
+Ready and ownership. It journals progress privately and refuses blind retry over
+partial state. No application patch or email submission is included.
+
+Validation:41 synthetic SMTP tests pass; all three resources pass native server
+dry-run; the target Secret is absent by metadata-only query. No live admission,
+new resource, credential fetch by the agent or mail send occurred. The source
+preparation must not be treated as successful production credential delivery.
+
+The owner credential workflow requires shared-reader review, founder decision and
+owner/founder decision sync. That review concerns a new reader of the whole exact
+platform SMTP KV record, not merely the already settled mailbox ownership. Only
+the SMTP_PASSWORD field is projected; OpenBao's ACL applies to the whole record.
+
+After attended success, verify the durable receipt and Warden cleanup, read back
+native state, record CCR verification and shared-mailbox rotation inventory, then
+return custody to T02. The separate sender rollout, delivered-message
+authentication, inbox access, correlated reply/bounce handling, suppression
+authority and retention still need completion. WP-0015-T05 productive verdicts
+and T06 reset-authority return remain separate live tasks.
+
+The full four-workplan estimate remains approximately60% complete/40% remaining
+(35–50% plausible remaining range), as documented in the goal progress audit.
+This preparation advances a concrete dependency; it does not close an additional
+top-level acceptance task or justify a more precise percentage.
diff --git a/workplans/CSOC-WP-0015-communication-runtime-acceptance.md b/workplans/CSOC-WP-0015-communication-runtime-acceptance.md
index 8f6f3e7..a1f0e86 100644
--- a/workplans/CSOC-WP-0015-communication-runtime-acceptance.md
+++ b/workplans/CSOC-WP-0015-communication-runtime-acceptance.md
@@ -70,8 +70,9 @@ publication evidence, not delivered-message authentication.
 
 Prepared three scoped SMTP projection resources and exact sender/environment
 patches; all five native server dry-runs pass with unchanged image/PVC/caller
-policy and unrelated spec. New consumer custody and supervised rollout remain
-unimplemented, so execution_ready is false. Offline actual-owner-source proof
+policy and unrelated spec. New consumer custody now has the prepared owner
+controller below; live admission and supervised sender rollout remain pending,
+so execution_ready is false. Offline actual-owner-source proof
 shows accepted Message-ID/bounce correlation and scanner deduplication, but no
 scanner-to-transactional suppression bridge; the existing operator API works only
 under synthetic admission and affects a recipient across callers/tenants. No
@@ -81,6 +82,19 @@ docs/release/platform-mail-sender-review-2026-10-31.md. Owner identity need not
 asked again. Next: fixed owner SMTP admission and supervised sender rollout;
 bounded operator return handling plus retention and productive access proof.
 
+Owner follow-through is now a live dependency: railiance-platform RPF-WP-0068
+(c042789b-4d7f-5c55-8d49-39dd16500f41), CCR-2026-0056. Its T01 fixed reader/helper
+and T02 supervised foundation/controller preparation are complete; T03 waits for
+platform/consumer review and founder admission, and T04 owns the native return.
+The complete controller passed41 SMTP tests and three native server dry-runs.
+The target Secret is absent by metadata-only query. It verifies native SA binding,
+guarded read admission, workload login/denials/revocation and projection Ready,
+with a private durable phase journal and no sender change. Live execution has not
+occurred; this is not yet verified custody or delivered-message acceptance.
+See docs/release/platform-mail-custody-preparation-2026-10-31.md for the owner
+review packet and exact closure conditions. This dependency is tracked as work,
+not left only in this task's progress narrative.
+
 ## T03 — Complete independent ledger recovery and copy custody
 
 ```task