diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
index bfaacd2..472dcba 100644
--- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
+++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
@@ -127,8 +127,8 @@ exist yet" whenever `bao policy read` failed, including when the founder's
 ```task
 id: MASON-WP-0009-T05
 status: wait
-blocked_on: human
-blocking_reason: "Founder applies CCR-2026-0038 (railiance-platform 0b2e7dd: mount auth/keycape-services, role secrets-engine-openbao, policy secrets-engine-login-self); then SECRETS-WP-0012-T03 login proof; then checks 1-3 and 6, invariant (ii) (expect deny on both guarded paths), pointer-only route."
+blocked_on: message-from:secrets-engine
+blocking_reason: "CCR-2026-0038 applied by the founder 2026-10-08T22:42Z (readback matched). Waits on the login proof with a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao); then ops-mason checks 1-3 and 6 and invariant (ii) (deny on both guarded paths) and proposes the pointer-only route."
 priority: medium
 state_hub_task_id: "1b1a0566-add7-59c1-94b0-6bb81d2d1537"
 ```
@@ -147,3 +147,8 @@ explicit deny on `platform/data/` and `platform/metadata/` for
 `workloads/keycape/secrets-engine-openbao`, so invariant (ii) holds by
 construction). New `service-jwt-login` applier with read-back; 8 tests. Waits
 on the founder's approve, confirm-binding and delegated apply.
+
+2026-10-09: already applied. railiance-platform `1b36e14` records the founder's
+approval, binding confirmation and delegated apply at 2026-10-08T22:42Z, with a
+matching value-free readback (evidence in the CCR). RPF-WP-0035-T02 now waits
+only on the login proof (SECRETS-WP-0012-T03).