diff --git a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
index 486e071..ea0c54e 100644
--- a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
+++ b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
@@ -163,10 +163,7 @@ access or secret.
 
 ```task
 id: RAIL-HO-WP-0011-T05
-status: wait
-needs_human: true
-decision_id: 83263d8d-d6ee-4395-ac84-86b71e967648
-blocking_reason: "Attended refresh on 2026-10-05 installed the Goss surface. Railiance01 still lacks ChallengeResponseAuthentication no (1 of 48). CoulombCore lacks executable /usr/local/bin/age and the same SSH line (2 of 28). Opening 83263d8d does not edit sshd or install age."
+status: done
 priority: high
 state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5"
 ```
@@ -354,9 +351,18 @@ install. Railiance01 failed 1 of 48 checks:
 `ChallengeResponseAuthentication no`. CoulombCore failed 2 of 28 checks:
 `/usr/local/bin/age` is not executable, and the same SSH line is absent.
 Firewall checks passed, including CoulombCore iptables INPUT DROP. A failed
-check is not a green handoff. Remediation of those two controls waits on
-decision `83263d8d-d6ee-4395-ac84-86b71e967648`. Opening that decision does
-not edit sshd, install age, enable UFW, or rerun the refresh.
+check is not a green handoff.
+
+2026-10-05 later: the founder accepted review
+`review-9eb3b31f-cd08-4141-af7f-48e151bdebbf`. The remediation added only
+`ChallengeResponseAuthentication no` to `/etc/ssh/sshd_config.d/10-hardening.conf`
+on both hosts and reloaded ssh after `sshd -t`. CoulombCore had no
+`/usr/local/bin/age` (`/usr/bin/age` was already on PATH, so the role's
+install guard would skip it); the pinned age v1.1.1 binary was placed at that
+path and is executable. UFW was not enabled and the refresh was not rerun.
+`make s1-handoff` then passed for both hosts. Receipt
+`reports/s1-handoff-20261005T223719Z.json`, status pass, source revision
+`3930f28db6c1978a3b35e1ce1192f83c93189d9d`. T08 remains the live wait.
 
 T08 remains `wait`: source tests and metadata checks pass, but this workstation
 has no SOPS executable or approved decryption session for the repository's