diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
index 1f76818..5f7237a 100644
--- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
+++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
@@ -126,9 +126,9 @@ exist yet" whenever `bao policy read` failed, including when the founder's
 
 ```task
 id: MASON-WP-0009-T05
-status: wait
+status: progress
 blocked_on: human
-blocking_reason: "Check 6 passed 2026-10-10 (secrets-engine probe-openbao). Remaining: invariant (ii) and the policy/role checks under a survey grant; operator/ESO capability checks and non-member refusal are owner-run; then propose the pointer-only route."
+blocking_reason: "ops-mason checks complete (policies, roles, invariant ii, login proof). Owner-run: live operator/ESO token capability checks and a non-member refusal; ops-warden activates the proposed pointer."
 priority: medium
 state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
 ```
@@ -172,3 +172,13 @@ command), then the role check runs.
 sha256 equals the repo file's (`c845bc79…`, receipt
 `~/.local/state/railiance/receipts/ops-mason-survey.sha256`). Role check runs
 under the next grant.
+
+2026-10-10 (grant `claude-MASON-WP-0009-T05`, revoked): role
+`auth/keycape-services/role/secrets-engine-openbao` equals railiance-platform
+`openbao/auth/secrets-engine-jwt-role.json` on every field compared (jwt,
+`sub`, audience `secrets-engine-openbao`, subject `service:secrets-engine`,
+claims principal_type/roles/scope/tenant, policy `secrets-engine-login-self`
+only, 5m, 8 uses, no default policy). ops-mason's checks are complete. Pointer
+entry proposed to ops-warden as draft, non-resolvable (message `8ad8ed4e`).
+Left owner-run: capability checks with live operator and ESO tokens and a
+non-member refusal.
diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md
index 9bb70d3..c4e814b 100644
--- a/workplans/MASON-WP-0010-security-case-materialization.md
+++ b/workplans/MASON-WP-0010-security-case-materialization.md
@@ -215,6 +215,13 @@ is stale: net-kingdom's `{client_id:env}` change moves the render digest from
 present from this case's own bundle. The ESO role did not appear as present;
 check on the next grant.
 
+2026-10-10: checked. `auth/kubernetes/role/external-secrets-keycape-forgejo`
+exists as applied (external-secrets/external-secrets, audience openbao, 15m,
+policy `workload-kv-read-keycape-forgejo-eso`, no default policy). It was missing
+from the plan's "already present" list because the live survey reads role
+lists only for the mount named in the role body, which this run did not
+resolve; the collision review is unaffected (it never flagged it).
+
 2026-10-10: type 1.1 (net-kingdom `e2174ce`, message `af66538c`) adds the
 consumer-enforces-groups verification and tightens redirect URIs; the case is
 re-pinned to @1.1. The live re-render above was already 1.1. Bundle rebuilt