diff --git a/workplans/MASON-WP-0004-credential-inventory-descriptions.md b/workplans/MASON-WP-0004-credential-inventory-descriptions.md
index d2fe465..f177eaf 100644
--- a/workplans/MASON-WP-0004-credential-inventory-descriptions.md
+++ b/workplans/MASON-WP-0004-credential-inventory-descriptions.md
@@ -87,10 +87,8 @@ proposed owner or an explicit reason, which is T01's acceptance.
 
 ```task
 id: MASON-WP-0004-T02
-status: wait
-needs_human: true
+status: done
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "29 descriptions applied 2026-10-09 (receipt 29/29 merged). Needs a survey grant to verify with custody-inventory."
 priority: medium
 state_hub_task_id: "a6a944d7-21c5-5043-a78d-b3809de0ee64"
 ```
@@ -135,13 +133,23 @@ drafts `skipped`. Remaining for T02 acceptance: re-run custody-inventory under
 a survey grant to confirm the 29 report without `!`. The 9 gaps go to owners
 in T03.
 
+2026-10-09 done: custody-inventory under grant `claude-MASON-WP-0004-T02`
+(revoked after): 49 paths, 16 undescribed (from 45); none of the 29 accepted
+paths is flagged, and the keycape entry kept its CCR-2026-0033 keys next to the
+five new ones. Each `rotation` names an existing CCR file or document. The 16
+left: the 9 drafts with gaps (T03), the four `infotech` fluid-telegram entries
+(moving, MASON-WP-0005-T04), the retiring `activity-core/default` duplicate,
+`forgejo/forgejo-mailer` (rapp-forgejo) and the deferred
+`target-revenue/runtime-secrets`.
+
 ## Resolve the rest with their owners
 
 ```task
 id: MASON-WP-0004-T03
 status: wait
 depends_on: [MASON-WP-0004-T01]
-blocking_reason: "Blocked on T01: owners answer what/what-breaks/what-if-lost per undescribed path."
+blocked_on: owners
+blocking_reason: "Owners fill the gaps in manifests/custody-descriptions.yaml for the 9 draft entries (asked 2026-10-09)."
 priority: low
 state_hub_task_id: "fff26914-d854-5854-b350-d7241812fb04"
 ```
@@ -157,6 +165,12 @@ before it is lost rather than after.
 Acceptance: `custody-inventory.py` exits 0 across both mounts, or the remainder
 is a short list with a recorded reason each.
 
+2026-10-09: asked railiance-platform (nextcloud x2, telemetry smtp,
+grafana-admin, agent-harness deploy key, whynot-design npm-publish),
+net-kingdom (keycape-factor-issuer) and key-cape (rapp-qonto keycape-client).
+user-engine/runtime's `on_loss` is ops-mason's own to write from the
+user-engine plan once its ESO rotation rehearsal is recorded.
+
 ## Make an undescribed path visible before it accumulates
 
 ```task