diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
index bc50382..bfaacd2 100644
--- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
+++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
@@ -127,8 +127,8 @@ exist yet" whenever `bao policy read` failed, including when the founder's
 ```task
 id: MASON-WP-0009-T05
 status: wait
-blocked_on: message-from:railiance-platform
-blocking_reason: "Plan section 4 checks 1-3 and 6 need live lane tokens and the secrets-engine-openbao service-JWT mount and policy (RPF-WP-0035-T02), which are not applied yet; then recheck invariant (ii) and propose the pointer-only ops-warden route."
+blocked_on: human
+blocking_reason: "Founder applies CCR-2026-0038 (railiance-platform 0b2e7dd: mount auth/keycape-services, role secrets-engine-openbao, policy secrets-engine-login-self); then SECRETS-WP-0012-T03 login proof; then checks 1-3 and 6, invariant (ii) (expect deny on both guarded paths), pointer-only route."
 priority: medium
 state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
 ```
@@ -138,3 +138,12 @@ collect owner-run evidence for checks 1-3 and 6 (operator and ESO token
 capabilities, non-member refusal, a secrets-engine `service-jwt` run), then
 propose the pointer-only ops-warden entry for the operator lane
 (`resolvable: false` until those pass).
+
+2026-10-09: railiance-platform packaged the lane as CCR-2026-0038 (proposed,
+`0b2e7dd`, message `029a6ee2`): isolated JWT mount `auth/keycape-services`,
+role `secrets-engine-openbao` (KeyCape registration claims, 5m, 8 uses, no
+default policy), policy `secrets-engine-login-self` (self endpoints only, with
+explicit deny on `platform/data/` and `platform/metadata/` for
+`workloads/keycape/secrets-engine-openbao`, so invariant (ii) holds by
+construction). New `service-jwt-login` applier with read-back; 8 tests. Waits
+on the founder's approve, confirm-binding and delegated apply.