diff --git a/workplans/MAS-WP-0003-provider-live-test.md b/workplans/MAS-WP-0003-provider-live-test.md
index 792cf69..c19b0ab 100644
--- a/workplans/MAS-WP-0003-provider-live-test.md
+++ b/workplans/MAS-WP-0003-provider-live-test.md
@@ -139,8 +139,16 @@ address and what envelope recipient arrives.
   the chroot lacked resolv.conf, which is why rDNS showed "unknown".
   Tested locally against the real TEM endpoint with dummy credentials:
   TLS verified, SASL rejected as expected.
-  Pending: TEM domain verification and DNS at IONOS (operator), Secret,
-  redeploy, then the reply send.
+  Relay login: OpenBao platform/suppliers/scaleway/mas-tem-relay, synced
+  by ExternalSecret `mas-relay` (ops-mason MASON-WP-0014, CCR-2026-0051).
+  The ExternalSecret needs explicit target metadata because of
+  reject-secret-last-applied. The first relay attempt got 535 from TEM
+  until the operator added the missing TEM IAM policy.
+  Reply leg 1 (2026-10-18): Gmail → `ticket!callback@` created ticket
+  GS-85QJ8WC09P. The service reply From
+  `ticket=GS-85QJ8WC09P@mas.coulomb.social` was accepted by TEM at 11:23:46Z
+  and arrived at Gmail with SPF pass, DKIM pass (d=mas.coulomb.social) and
+  DMARC pass. Gmail displays the `=` From address unmodified.
 
 ## Forwarding and list paths