diff --git a/workplans/ILIB-WP-0003-openbao-approle-imap.md b/workplans/ILIB-WP-0003-openbao-approle-imap.md
index 002302e..c3e81d3 100644
--- a/workplans/ILIB-WP-0003-openbao-approle-imap.md
+++ b/workplans/ILIB-WP-0003-openbao-approle-imap.md
@@ -43,7 +43,7 @@ created by `railiance-platform/scripts/inbound_library_imap_entry.py`
 
 ```task
 id: ILIB-WP-0003-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "8871112e-8643-5912-9bbd-93a0e3ed482a"
 ```
@@ -75,6 +75,14 @@ cd ~/ops-mason && ./scripts/bao-session.sh grant MASON-WP-0008-T05
   --consumer inbound-library --keyword imap
 ```
 
+Done 2026-10-05: `ops-mason/plans/inbound-library-imap-approle.md` is in status
+`reviewed` (ops-mason f7d5624). The live survey found no existing lane for the
+path; the KV entry is at version 2. Proposed: a new policy (read on that entry
+only) and AppRole `inbound-library` with 15m/30m, `token_num_uses=4` and
+`secret_id_ttl=0`. Candidate digest
+`c62765c8a4505821e77b58c5e0daf0511dec39fb569a05e190ff51f5cdc3e2ba`. The
+executive summary is in section 5.
+
 ## Founder approval
 
 ```task