diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index 3f83349..e1e571c 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -151,12 +151,23 @@ the plan. Blocking reason widened to cover both steps; gate unchanged
 
 ## Verify and hand off
 
+2026-10-09: founder applied rapp-tenant-engine (`make prerequisites`). Checked
+without touching the Secret: SA `tenant-engine/tenant-engine-eso` exists;
+ClusterSecretStore `openbao-tenant-engine-audit-core-sender` Ready=True
+(Valid); ExternalSecret `tenant-engine/tenant-engine-audit-core-sender`
+Ready=True (SecretSynced), which means ESO wrote the target. A direct presence
+check on the Secret was refused by the guard-secret-reads hook, as intended;
+the founder runs it if wanted. The declared policy grants exactly `read` on
+`platform/data/workloads/tenant-engine/audit-core-sender` plus self
+lookup/revoke, so it cannot reach the registry path; comparing it with the
+live policy needs a survey grant.
+
 ```task
 id: MASON-WP-0007-T06
-status: wait
+status: progress
 depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
 blocked_on: human
-blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token (via railiance-platform secret_annotation_maintenance.py inspect mode only, never a go-template/jsonpath against the Secret, per the 2026-09-28 standing notice); negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
+blocking_reason: "Applied by the founder 2026-10-09; store Ready and ExternalSecret SecretSynced. Open: Secret presence (founder runs the check; the agent hook blocks Secret reads), live policy compare under a survey grant, ops-warden pointer, tell tenant-engine."
 priority: medium
 state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
 ```
diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md
index 72c7d0b..4e02ddf 100644
--- a/workplans/MASON-WP-0010-security-case-materialization.md
+++ b/workplans/MASON-WP-0010-security-case-materialization.md
@@ -95,11 +95,13 @@ With 1-4 applied, the section is acceptable to ops-mason for NK-WP-0048-T05.
 `508e2a12`); its schema/validator now require a body on policy and role items.
 NK-WP-0048-T05 still waits on WARDEN-WP-0044-T01 and a founder answer.
 
+2026-10-09: the founder accepted memo r4; hub decision `e418263e` resolved and
+the type is `acknowledged` (net-kingdom `0e86f95`). T02 is unblocked.
+
 ```task
 id: MASON-WP-0010-T02
-status: wait
+status: todo
 depends_on: [MASON-WP-0010-T01, NK-WP-0048-T05]
-blocking_reason: "Rendering waits for net-kingdom to fold in the T01 review and acknowledge the type (NK-WP-0048-T05)."
 priority: high
 state_hub_task_id: "fd385537-7378-5539-8a6e-f45851296f42"
 ```