diff --git a/workplans/WARDEN-WP-0043-platform-supplier-credentials.md b/workplans/WARDEN-WP-0043-platform-supplier-credentials.md
index ce8ac26..25c6c92 100644
--- a/workplans/WARDEN-WP-0043-platform-supplier-credentials.md
+++ b/workplans/WARDEN-WP-0043-platform-supplier-credentials.md
@@ -85,7 +85,7 @@ The IONOS CCR can now be drafted against this shape.
 
 ```task
 id: WARDEN-WP-0043-T03
-status: wait
+status: progress
 priority: medium
 needs_human: true
 state_hub_task_id: "87996bc7-2f7a-578d-9f7c-8bd876605a47"
@@ -96,3 +96,13 @@ terminal, into `platform/suppliers/<supplier>/<account>`. IONOS is the
 first account that still needs that home. Existing workload and rein
 readers keep their current paths until each one is retargeted. Values do
 not go into git, State Hub, workplans, logs, or chat.
+
+2026-10-09: the IONOS stub exists. The founder ran the write through the
+contained `openbao-platform-admin-login` envelope:
+`bao kv put -cas=0 platform/suppliers/ionos/main` as version 1, with keys
+`CUSTOMER_NUMBER`, `LOGIN`, `PASSWORD`, `API_KEY_PREFIX` and `API_KEY_SECRET`,
+each set to the placeholder `FILL_ME`. A metadata-only check through the same
+envelope exited 0. The founder fills the real values as version 2 in the
+OpenBao UI. This task closes once that is done. No reader policy exists for the
+path; a reader is requested through a railiance-platform CCR when a workload
+needs it.