diff --git a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
index e84f1c6..1f76818 100644
--- a/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
+++ b/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md
@@ -167,3 +167,8 @@ policies equal their files; mount `keycape-services/` is type jwt. Reading the
 role was refused: `ops-mason-survey` did not cover `auth/keycape-services/role/*`.
 Added to `policies/ops-mason-survey.hcl`; the founder reinstalls it (AGENTS.md
 command), then the role check runs.
+
+2026-10-10 15:45Z: founder reinstalled `ops-mason-survey`; the installed policy's
+sha256 equals the repo file's (`c845bc79…`, receipt
+`~/.local/state/railiance/receipts/ops-mason-survey.sha256`). Role check runs
+under the next grant.