diff --git a/workplans/KEY-WP-0013-approval-engine-resource-audience.md b/workplans/KEY-WP-0013-approval-engine-resource-audience.md
index 110b20e..46169eb 100644
--- a/workplans/KEY-WP-0013-approval-engine-resource-audience.md
+++ b/workplans/KEY-WP-0013-approval-engine-resource-audience.md
@@ -4,12 +4,12 @@ type: workplan
 title: "Approval-engine resource audience and client registrations"
 domain: infotech
 repo: key-cape
-status: blocked
+status: finished
 flavor: implementation
 owner: codex
 topic_slug: approval-engine-resource-audience
 created: "2026-09-05"
-updated: "2026-09-09"
+updated: "2026-09-30"
 state_hub_workstream_id: "6e815d88-b0e3-5ce0-be5d-13ab15917f7f"
 ---
 
@@ -544,3 +544,11 @@ command ran as UID 65534 with no network and a read-only filesystem and produced
 the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md`
 and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and
 configuration-owner admission; no production resource or custody value changed.
+
+## Status 2026-09-30 (CUST-WP-0074)
+
+All tasks T01-T07 are `done`; nothing in this plan is waiting, so it is
+`finished` rather than `blocked`. Residual items live in other plans
+(RPF-WP-0035-T05/T06, AUDIT-WP-0009-T09, KEY-WP-0014-T04). The one open
+question recorded above, disabling the unpresented create+approve client, is a
+KeyCape deployment decision to be tracked in a new plan if taken up.