diff --git a/plans/fluid-telegram-operator-credential-lane.md b/plans/fluid-telegram-operator-credential-lane.md
index 5f77372..6858447 100644
--- a/plans/fluid-telegram-operator-credential-lane.md
+++ b/plans/fluid-telegram-operator-credential-lane.md
@@ -48,59 +48,103 @@ different, narrower need and is intentionally excluded from this plan.
   only `request_type: workload-kv-read`; its validator also requires the
   `workload-kv-read-` policy prefix and `-workload-kv-read` OIDC role suffix.
 
-### Live survey pending
+### Live survey (2026-10-08)
 
-No valid scoped OpenBao session was available during intake, so the required
-live outputs from `bao secrets list`, `bao auth list`, `bao policy list`, and
-the relevant `auth/netkingdom/role/*` reads are not yet attached. Phase 2 must
-repeat the survey with `./scripts/bao-session.sh grant MASON-WP-0005-T01`.
+Generated by `scripts/plan-survey.py` at 2026-10-08T21:53:55Z against `BAO_ADDR=http://127.0.0.1:18200`, token display_name `token-claude-MASON-WP-0005-T01` (policies: default, ops-mason-survey). Metadata only: no `kv get` and no `*/data/*` read was issued; policy bodies were read with `bao policy read` for name-matched candidates only.
 
-**Existing-lane answer:** none is known from source state. This remains a
-draft finding until the live survey confirms it.
+Demand: KV path `platform/workloads/coulomb/fluid-telegram/hall-of-helix`, proposed policy `workload-kv-fluid-telegram-hall-of-helix-operator`, AppRole `-`, Kubernetes role `-`, consumer `fluid-telegram`. Match terms: `fluid-telegram`, `hall-of-helix`, `telegram`, `coulomb`.
 
-## 3. Proposed changes
+#### `bao secrets list` (10 mounts, 1 relevant)
 
-The recommended CLI prefix is
-`platform/workloads/coulomb/fluid-telegram/hall-of-helix`. `coulomb` is a
-recommendation from the existing owner precedent, not an authorization; T01
-must replace this paragraph with railiance-platform's explicit decision before
-review.
+```text
+platform/                kv         version=2
+```
 
-The recommended objects are:
+#### `bao auth list` (5 auth mounts, 2 relevant)
 
-| # | Action | Object | Rationale |
-|---|---|---|---|
-| 1 | create | Policy `workload-kv-fluid-telegram-hall-of-helix-operator` | A new exact-path matrix is required; no read-only lane can satisfy the writes. |
-| 2 | create | OIDC role `fluid-telegram-hall-of-helix-workload-kv` at `auth/netkingdom` | The caller is an attended operator; AppRole and Kubernetes auth are the wrong identity shapes. |
-| 3 | modify | ops-mason executor with an approved OIDC KV matrix spec | The current executor cannot safely express OIDC or per-path capabilities. |
-| 4 | modify | railiance-platform CCR schema/validator with an approved read/write request type and naming rules | The platform owner explicitly rejects this shape today; bypassing that gate is forbidden. |
-| 5 | modify | railiance-platform agent high-risk boundary with exact data and metadata denies for all four paths | Agent-bound identities must not inherit this lane through another policy. |
-| 6 | propose | ops-warden entry `fluid-telegram-operator`, pointer-only, `status: draft`, `resolvable: false` | A concrete selector is useful before activation; no placeholder prefix becomes routable. |
+```text
+approle/                 approle
+kubernetes/              kubernetes
+```
 
-### Exact policy matrix
+#### `bao policy list` (81 policies, 0 relevant)
 
-All entries are individual KV-v2 API paths. There is no `*` grant, parent
-`list`, metadata mutation, delete, destroy, undelete, or sudo capability.
+```text
+(no relevant entries)
+```
 
-| CLI entry | KV-v2 data-path capabilities | Risk and reason |
-|---|---|---|
-| `.../operator-app` | `read` | High confidentiality: Telegram application id/hash; entered only through sanctioned attended value entry. |
-| `.../operator-session` | `create,read,update` | High: full-account MTProto credential. Provisioning only; never adapter-visible. |
-| `.../bot-token` | `create,read,update` | High: controls Bot API publication. Provisioner writes immediately after BotFather issues it. |
-| `.../redaction-salt` | `create,read` | High integrity and sensitive pseudonymisation material. Overwrite, patch, and deletion are denied. |
+#### `bao list auth/approle/role` (approle) (14 roles, 0 relevant)
 
-OpenBao KV v2 documents that it honors the ACL distinction between `create`
-and `update`; it also documents CAS `0` as create-if-absent. The fluid-telegram
-client currently performs a read followed by a normal POST. The ACL therefore
-supplies the decisive server-side write-once boundary: the first POST is a
-create and a later POST is an update, which this policy denies. The client
-should still add CAS `0` to make its intent race-safe and explicit, but this
-plan does not depend on client-only behavior.
+```text
+(no relevant entries)
+```
 
-This is operational write-once for the provisioner, not immutable storage.
-A platform administrator can recover from a corrupt first write through a
-separately approved attended action. That action must preserve the old version
-until recovery is verified and must never be exposed through this OIDC role.
+#### `bao list auth/kubernetes/role` (kubernetes) (27 roles, 0 relevant)
+
+```text
+(no relevant entries)
+```
+
+#### `bao policy read` of name-matched candidates (target `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix`)
+
+```text
+(no relevant entries)
+```
+
+#### `bao kv metadata get` / `bao kv list` (metadata only)
+
+```text
+platform/workloads/coulomb/fluid-telegram/hall-of-helix: no metadata (path unused)
+platform/workloads/coulomb/fluid-telegram/: request failed (output suppressed)
+```
+
+#### ops-warden routing catalog `/home/worsch/ops-warden/registry/routing/catalog.yaml` (42 entries, 4 relevant)
+
+```text
+whynot-design-npm-publish  owner=railiance-platform  status=active  matches: coulomb
+    path_template: platform/workloads/coulomb/whynot-design/npm-publish
+    policy_ref: flex-auth check secret.read:whynot-design
+    auth_method: bao login -method=oidc -path=netkingdom role=whynot-design-workload-kv-read
+reuse-surface-hub-write-token  owner=railiance-platform  status=active  matches: coulomb
+    path_template: platform/workloads/reuse/reuse-surface/runtime-secrets
+    policy_ref: flex-auth check secret.read:reuse
+    auth_method: caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)
+inbound-library-imap-approle  owner=ops-mason  status=active  matches: coulomb
+    path_template: platform/workloads/inbound-library/imap
+    auth_method: AppRole login role=inbound-library (role_id+secret_id in ~/.local/inbound-library/approle, config/library.json credential.approle_dir)
+coulomb-social-runtime-env  owner=railiance-platform  status=active  matches: coulomb
+    path_template: k8s:coulomb-social/coulomb-social-env
+    auth_method: kubectl as platform operator (or bao OIDC when OpenBao lane is provisioned)
+```
+
+#### Does an existing lane already satisfy this demand?
+
+**Draft answer: no.** Review before committing; this is generated, not a decision.
+
+- no surveyed policy grants `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix`, the proposed names are free, the KV path is unused and no catalog entry routes it
+- policy grants were checked only for name-matched candidates; a policy with an unrelated name that covers `platform/data/workloads/coulomb/fluid-telegram/hall-of-helix` is not detected
+
+
+#### Additions by hand (same grant)
+
+- `bao list auth/netkingdom/role` (12 roles): no `fluid-telegram*` role; the
+  proposed `fluid-telegram-hall-of-helix-workload-kv` is free. The generator
+  did not flag the `netkingdom` OIDC mount as relevant; it is the one this lane
+  reuses.
+- All 81 policy bodies scanned (closing the generator's name-match gap): only
+  `platform-admin` (`platform/*`) covers the target. No workload policy does.
+- Live reference role `keycape-secrets-engine-openbao-operator-workload-kv-read`
+  has exactly the binding this plan renders: `bound_claims_type=string`,
+  `bound_claims={groups:[net-kingdom-admins], /assurance/level: aal2}`,
+  `groups_claim=groups`, `token_no_default_policy=true`. The executor's role
+  document matches that shape.
+- Naming: live OIDC roles end `-workload-kv-read` and their policies start
+  `workload-kv-read-`. This lane writes, so it drops `-read`
+  (`workload-kv-fluid-telegram-hall-of-helix-operator`); that is why the CCR
+  schema extension (T02) is needed.
+
+**Existing-lane answer: none.** Confirmed live: path unused, names free, no
+covering workload policy, no catalog route.
 
 ### OIDC role shape
 
diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
index 9841fcf..4ce9b4d 100644
--- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
+++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
@@ -45,7 +45,7 @@ consumer workplan `FT-WP-0002` (`f2373858-c932-5a4d-81b6-db9a3595135a`).
 id: MASON-WP-0005-T01
 status: wait
 blocked_on: message-from:net-kingdom
-blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Also needs a scoped OpenBao grant (bao-session.sh grant MASON-WP-0005-T01) for the live survey."
+blocking_reason: "Founder go given 2026-10-08 (group fluid-telegram-operators, member tegwick); net-kingdom creates it and returns metadata-only evidence. Live survey done 2026-10-08."
 priority: high
 state_hub_task_id: "18c9099f-882f-575c-93b9-cc68d7fbc2af"
 ```
@@ -87,6 +87,13 @@ members, and a scoped grant for the live survey (no operator session today).
 net-kingdom (message `259ec26d`), which owns directory acts; ops-mason does not
 write LLDAP. Waiting for net-kingdom's metadata-only evidence.
 
+2026-10-08: live survey run under grant `claude-MASON-WP-0005-T01`
+(`ops-mason-survey`), recorded in the plan's section 2: path unused, proposed
+policy and OIDC role names free, all 81 policy bodies scanned and only
+`platform-admin` covers the path, no catalog route. The live
+`keycape-secrets-engine-openbao-operator` role confirms the binding shape. Only
+the group evidence remains for T01; the plan can then move to `reviewed`.
+
 ## Extend the construction and credential-change contracts
 
 ```task