diff --git a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
index 53f03e2..8ddebb0 100644
--- a/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
+++ b/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md
@@ -218,7 +218,7 @@ id: MASON-WP-0005-T05
 status: progress
 depends_on: [MASON-WP-0005-T04]
 blocked_on: human
-blocking_reason: "ops-mason checks and the non-member refusal pass (2026-10-09). tegwick has no MFA factor, so it cannot reach aal2: founder enrolls TOTP for tegwick in privacyIDEA self-service, then runs scripts/verify-fluid-telegram-lane.sh member; fluid-telegram runs the salt create-once probe (FT-WP-0002)."
+blocking_reason: "ops-mason checks and the non-member refusal pass (2026-10-09). tegwick has no MFA factor: it enrolls through user-engine self-service MFA (message ab89a591, USER-WP-0028-T03), then the founder runs scripts/verify-fluid-telegram-lane.sh member; fluid-telegram runs the salt create-once probe (FT-WP-0002)."
 priority: high
 state_hub_task_id: "4c205be7-4f1f-5dd1-aafa-fc112fdd640e"
 ```
@@ -260,6 +260,12 @@ KeyCape asks for an OTP it cannot satisfy, and the role requires `aal2` anyway.
 `tegwick` enrolls TOTP through privacyIDEA self-service (net-kingdom
 platform-root-custody.md steps 6-7, same procedure), then the member run.
 
+2026-10-10: founder direction: MFA setup becomes a convenient self-service
+journey for all users, not a one-off. Asked user-engine (message `ab89a591`) to
+deliver it (USER-WP-0028-T03 / USER-WP-0027-T04, decision cef97ccd), with
+`tegwick` as the first attended real-user acceptance, and to reply when
+`tegwick` has an active factor.
+
 ## Hand off routing and keep the adapter lane separate
 
 ```task