diff --git a/tests/test_wp_0013_0014_evidence.py b/tests/test_wp_0013_0014_evidence.py
index 356715b..fbddce2 100644
--- a/tests/test_wp_0013_0014_evidence.py
+++ b/tests/test_wp_0013_0014_evidence.py
@@ -102,6 +102,8 @@ def test_mas_delivery_check_stays_wait_until_metadata_grant():
     plan = (ROOT / "plans" / "mas-tem-relay-smtp.md").read_text()
     assert _frontmatter(workplan)["status"] == "proposed"
     assert _task_status(workplan, "MASON-WP-0014-T04") == "wait"
+    assert "needs_human: true" in workplan
+    assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
     assert _task_status(workplan, "MASON-WP-0014-T01") == "done"
     for text in (workplan, plan):
         flat = _flat(text)
@@ -125,6 +127,9 @@ def test_private_reader_stays_draft_without_survey_or_success():
         "MASON-WP-0013-T04",
     ):
         assert _task_status(workplan, task_id) == "wait"
+    assert "needs_human: true" in workplan
+    assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
+    assert "does not approve this plan" in _flat(workplan)
     flat_plan = _flat(plan)
     flat_workplan = _flat(workplan)
     assert "no ops-mason-survey grant" in flat_plan
diff --git a/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md b/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
index e03e776..62db1bd 100644
--- a/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
+++ b/workplans/MASON-WP-0013-reuse-surface-private-source-reader.md
@@ -42,6 +42,9 @@ and independent mechanism/owner reviews are missing.
 ```task
 id: MASON-WP-0013-T02
 status: wait
+needs_human: true
+decision_id: 0b55e53b-2531-466c-a2f9-282618b183f8
+blocking_reason: "Founder mints ./scripts/bao-session.sh grant MASON-WP-0013-T02. An agent does not log in or grant. This decision is not plan approval."
 priority: high
 state_hub_task_id: "a05e88da-9a75-516d-aab4-7a5d266f1ac6"
 ```
@@ -56,7 +59,8 @@ Do not use operator tokens or another agent supervision record.
 (`no ops-mason-survey grant`) and cites Forgejo-owner `sec_dsm_order` Q1–Q3
 from `forge-owner-review-r2.json` (2026-10-14T23:08:34Z). That citation is not
 a metadata survey. Exact installed path, policy, and role remain unconfirmed.
-Plan status stays `draft`.
+Plan status stays `draft`. Founder grant gate is hub decision
+`0b55e53b-2531-466c-a2f9-282618b183f8`. It does not approve this plan.
 
 ## Bind owner CCR and executable inputs to founder decision
 
diff --git a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
index 276100e..15ff698 100644
--- a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
+++ b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
@@ -67,6 +67,9 @@ CCR-2026-0051. ops-mason built the policy and role under `ops-mason-construct`
 ```task
 id: MASON-WP-0014-T04
 status: wait
+needs_human: true
+decision_id: 0b55e53b-2531-466c-a2f9-282618b183f8
+blocking_reason: "Founder mints ./scripts/bao-session.sh grant MASON-WP-0014-T04 so KV metadata can be re-read. ExternalSecret sync is already name-only Ready/SecretSynced. An agent does not log in or grant."
 priority: medium
 state_hub_task_id: "75eb71c8-5ac4-5512-bee3-6c0e4bee4dfd"
 ```
@@ -90,3 +93,6 @@ Record the teardown steps (plan rows 6–7) as a residual against MAS-WP-0003 cl
   `mas-relay`. The Secret object was not read.
 - Teardown rows 6–7 are live intake `MASON-IN-0007` (`origin: residual`,
   `origin_ref: MASON-WP-0014`), due at MAS-WP-0003 close. Not executed.
+- The metadata re-read waits on founder decision
+  `0b55e53b-2531-466c-a2f9-282618b183f8` (mint `ops-mason-survey` for this
+  task). That decision is not a new approval of the built lane.