diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index 748c142..2525254 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -98,9 +98,7 @@ running the script is an attended founder step and joins T05.
 
 ```task
 id: MASON-WP-0007-T04
-status: wait
-blocked_on: message-from:tenant-engine
-blocking_reason: "tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD."
+status: done
 priority: high
 state_hub_task_id: "e56f0374-fede-5494-8266-a30f08896a6a"
 ```
@@ -115,6 +113,16 @@ ops-mason's approval notice (2026-10-02 22:17, message 207b94ce), which already
 tells it to proceed with rows 4-6 and not apply before the seed. No new
 question for ops-mason; still waiting on tenant-engine's declaration.
 
+2026-10-09 done: declared in rapp-tenant-engine `c160be2` (on origin/main),
+`manifests/tenant-engine-audit-core-sender.yaml`; checked field by field against
+plan rows 4-6 (SA without token automount, ClusterSecretStore on Kubernetes auth
+role `tenant-engine-audit-core-sender-eso` limited to namespace
+`tenant-engine`, ExternalSecret refresh 1h, key `token`). `make test` 15 passed,
+client dry-run clean. Correction: no ArgoCD Application covers
+rapp-tenant-engine; it is applied by the founder with `make
+prerequisites-dry-run` then `make prerequisites`. The OpenBao side (rows 1-3,
+7) is already live (T03, T05), so the apply can go now.
+
 ## Attended seed of the dedicated KV path
 
 ```task
@@ -147,7 +155,8 @@ the plan. Blocking reason widened to cover both steps; gate unchanged
 id: MASON-WP-0007-T06
 status: wait
 depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
-blocking_reason: "Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
+blocked_on: human
+blocking_reason: "Founder applies rapp-tenant-engine (make prerequisites-dry-run, then make prerequisites); then verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
 priority: medium
 state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
 ```