diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index cf7a96a..8bd4ddb 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -120,7 +120,7 @@ id: MASON-WP-0007-T05
 status: wait
 needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "Attended founder sitting, reviewed sequence in railiance-platform docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md (commit e7eb9db): 1) scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role), 2) scripts/tenant_engine_audit_core_sender_seed.py --dry-run, 3) the same helper without --dry-run, each under warden openbao-platform-admin-login. Silent CAS-0 copy of the tenant-engine token from the registry; never overwrites. Founder approves as one memo."
+blocking_reason: "APPROVED by founder 2026-10-03; remaining: the founder runs the attended sitting. Reviewed sequence in railiance-platform docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md (commit e7eb9db): 1) scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh (policy + k8s-auth role), 2) scripts/tenant_engine_audit_core_sender_seed.py --dry-run, 3) the same helper without --dry-run, each under warden openbao-platform-admin-login. Silent CAS-0 copy of the tenant-engine token from the registry; never overwrites. Founder approves as one memo."
 priority: high
 state_hub_task_id: "1bb05319-25a5-579f-8b63-897ec583bc3e"
 ```
@@ -138,6 +138,8 @@ the plan. Blocking reason widened to cover both steps; gate unchanged
 
 2026-10-03 (CUST-WP-0075): re-qualified. The reviewed silent seed helper now exists: railiance-platform `scripts/tenant_engine_audit_core_sender_seed.py` (commit e7eb9db, offline fake-bao tests in `tests/test_tenant_engine_audit_core_sender_seed.py`). It is the user-engine wrap-migrate technique: one platform-admin process reads the registry, selects sender `tenant-engine` (refuses unless exactly one token and write-only), and writes `{token}` to `platform/workloads/tenant-engine/audit-core-sender` with CAS 0. No output, value only on the bao child's stdin, receipt holds versions and booleans. Exit 0 ok/identical, 2 precondition refused, 3 target differs, 4 write failed, 5 verify failed, 6 dry-run target present. Exact founder commands are in the lane doc. No dependency remains besides the human gate (decision 62aa95e4).
 
+2026-10-03: founder approved the three-child sequence in the custodian session ("APPROVE MASON-WP-0007-T05"); recorded in railiance-platform docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md. What remains is the attended run. Close T05 on the final seed receipt; T01 can close on the dry-run receipt.
+
 ## Verify and hand off
 
 ```task