diff --git a/workplans/EMAIL-WP-0007-ledger-backup-recovery.md b/workplans/EMAIL-WP-0007-ledger-backup-recovery.md
index 8a2d41e..82bff71 100644
--- a/workplans/EMAIL-WP-0007-ledger-backup-recovery.md
+++ b/workplans/EMAIL-WP-0007-ledger-backup-recovery.md
@@ -128,7 +128,8 @@ monitoring stay waiting. CSOC-WP-0015-T03 is the product acceptance follow-up.
 
 Founder admitted `backup-pair-writer` on 2026-10-08. The OpenBao policy is
 installed and matches its source file. Version 2 is current on both backup-primary paths and the placeholders are
-gone. The live bucket policy still allows only the existing resource-control
-application under `platform-pg/*`. No primary.env, receiver pause, upload or
-timer. T03/T04 stay wait. Review:
+gone. The bucket policy now also names the email-connect publisher, limited to
+`platform-pg/application-archives/email-connect/`, without object delete.
+A prefix proof aborted its own upload and denied the other prefixes. No
+primary.env, receiver pause, upload or timer. T03/T04 stay wait. Review:
 railiance-platform/docs/credential-lane-designs/application-backup-pair-custody-2026-10-08.md.