diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md
index 1f98e8e..90543fb 100644
--- a/plans/mas-tem-relay-smtp.md
+++ b/plans/mas-tem-relay-smtp.md
@@ -3,7 +3,7 @@ id: mas-tem-relay-smtp
 demand_source: mail-address-semantics/workplans/MAS-WP-0003-T03
 consumer_repo: mail-address-semantics
 credential_type: openbao-kv-founder-provision
-status: approved
+status: built
 approved_by: "Bernd Worsch"
 approved_at: "2026-10-18"
 created: "2026-10-18"
@@ -255,3 +255,32 @@ revoke the key. Nothing else depends on it.
 **Decision:** approved in chat on 2026-10-18 ("approved"), covering this plan and
 CCR-2026-0051. The founder records the CCR approval with railiance-platform's
 `credential-change.py approve`.
+
+## 6. Build result
+
+Built 2026-10-18 by ops-mason under `ops-mason-construct`
+(`claude-MASON-WP-0014-T03`, revoked afterwards):
+
+- policy `workload-kv-read-mas-tem-relay`, written from CCR-2026-0051's policy
+  file and read back byte-equal (read on
+  `platform/data/suppliers/scaleway/mas-tem-relay`, plus lookup-self and
+  revoke-self)
+- Kubernetes role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`,
+  ns `mas`, audience `openbao`, `token_policies`
+  `[workload-kv-read-mas-tem-relay]`, ttl/max/explicit-max 15m,
+  `token_no_default_policy`; read back matches the CCR
+- KV `platform/suppliers/scaleway/mas-tem-relay`: placeholder v1 by
+  ops-mason, value v2 by the founder; never read
+- evidence on CCR-2026-0051 (`railiance-platform@102668f`), status left
+  `approved`
+
+**Deviation:** platform's condition was apply after `confirm-binding`. The
+role was applied before it, while SA `mas-tem-relay-eso` does not exist yet,
+so no login is possible until the MAS side creates it. `confirm-binding`
+(and `bound_claims_confirmed: true`) follows once the SA exists. This was
+reported to railiance-platform.
+
+**Remaining:** the MAS side applies SA, SecretStore and ExternalSecret;
+confirm-binding; check that Secret `mas/mas-relay` syncs (names only);
+teardown at MAS-WP-0003 close (rows 6–7). No catalog entry (temporary).
+
diff --git a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
index ab86276..f1df19c 100644
--- a/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
+++ b/workplans/MASON-WP-0014-mas-tem-relay-smtp.md
@@ -49,7 +49,7 @@ was written by the founder as v2.
 
 ```task
 id: MASON-WP-0014-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "f9c89f3b-6c07-560b-abd0-7c9c83940e83"
 ```
@@ -58,6 +58,10 @@ railiance-platform allocates the CCR for plan rows 1–3. The founder approves
 the plan and the CCR, applies them through the delegated applier, and fills
 `password` in the OpenBao UI.
 
+Done 2026-10-18: the founder wrote the value (v2) and approved the plan and
+CCR-2026-0051. ops-mason built the policy and role under `ops-mason-construct`
+(plan §6). The build happened before `confirm-binding`; see the deviation note.
+
 ## Verify delivery and record teardown
 
 ```task