diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md
index c4e814b..652cd0a 100644
--- a/workplans/MASON-WP-0010-security-case-materialization.md
+++ b/workplans/MASON-WP-0010-security-case-materialization.md
@@ -217,10 +217,10 @@ check on the next grant.
 
 2026-10-10: checked. `auth/kubernetes/role/external-secrets-keycape-forgejo`
 exists as applied (external-secrets/external-secrets, audience openbao, 15m,
-policy `workload-kv-read-keycape-forgejo-eso`, no default policy). It was missing
-from the plan's "already present" list because the live survey reads role
-lists only for the mount named in the role body, which this run did not
-resolve; the collision review is unaffected (it never flagged it).
+policy `workload-kv-read-keycape-forgejo-eso`, no default policy). Why the plan's
+"already present" list omitted it is not yet confirmed (the survey should list
+`auth/kubernetes/role`); reproduce under the next grant. The collision review
+is unaffected: it never flagged the role.
 
 2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the
 consumer-enforces-groups verification and tightens redirect URIs; the case is