diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index 2525254..3f83349 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -156,7 +156,7 @@ id: MASON-WP-0007-T06
 status: wait
 depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
 blocked_on: human
-blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
+blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token (via railiance-platform secret_annotation_maintenance.py inspect mode only, never a go-template/jsonpath against the Secret, per the 2026-09-28 standing notice); negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
 priority: medium
 state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
 ```