diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 9a242d2..38f60df 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -191,7 +191,7 @@
 | task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
 | task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
 | task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
-| task | RPF-WP-0059-T04 | progress | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
+| task | RPF-WP-0059-T04 | wait | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
 | task | RPF-WP-0060-T01 | wait | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
 | task | RPF-WP-0060-T02 | done | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
 | task | RPF-WP-0060-T03 | wait | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
diff --git a/workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md b/workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md
index 71c56ea..573c9d0 100644
--- a/workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md
+++ b/workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: railiance-platform
 created: "2026-10-15"
-updated: "2026-10-15"
+updated: "2026-11-03"
 origin: cross-repo
 origin_ref: NK-WP-0035
 state_hub_workstream_id: "d57eeafb-c406-5e1e-841c-5d1288aacabf"
@@ -64,8 +64,9 @@ resume on interruption. No live effect or secret read occurred in preparation.
 
 ```task
 id: RPF-WP-0059-T04
-status: progress
+status: wait
 priority: high
+blocking_reason: "Independent reconciliation needs an audit-core release containing d46e89e (AUDIT-WP-0013-T06); the deployed b479801b refuses independent readers with source_not_allowed. Founder-run release: AUDIT-WP-0013-T07."
 state_hub_task_id: "7d8e5315-9470-5596-a865-d451284f6f50"
 ```
 
@@ -94,3 +95,27 @@ Exact root receipts copied to docs/evidence/2026-10-15-cadence-receiver/.
 The real hourly observation started19:36 UTC with authorized health polling;
 it is still running. No elapsed-hour or independent observer acceptance is
 claimed. T04 remains progress for actual timed capture and protected readback.
+
+### Independent readback attempt — 2026-11-03
+
+The founder ran `scripts/cadence_observer_readback.py` in the contained
+platform-admin login for `qonto-assistant` / `tenant:friendly:binky` /
+instance `b351fa6b…`, over the window 2026-10-15T19:36Z to now. The receiver
+check passed (image `b479801b`, all capability probes), and the existing
+`operator` reader was selected (registry v18; v17/v18 are the 2026-11-03 E2
+projection and cleanup). Reconciliation was refused with
+`403 source_not_allowed`. The founder's in-pod check shows the live `operator`
+identity is `may_read: true`, tenants `["*"]`, sources `["user-engine"]`,
+identical to KV, so the projection is correct. The deployed receiver (built
+from audit-core `5227fb1`) admits only the source itself to reconciliation.
+Independent full-scope readers arrive in audit-core `d46e89e` (2026-10-28,
+AUDIT-WP-0013-T06), which is not yet released. Its founder-run release is
+AUDIT-WP-0013-T07. Platform must not widen `operator`'s sources as a
+workaround.
+
+The readback now records the failing read kind, the HTTP status and
+audit-core's fixed refusal code (`645b529`, `2422226`). Receipts stay outside
+Git in `~/cadence-readback/`. Rerun the same command after AUDIT-WP-0013-T07.
+A new receiver release will also move the reviewed image pin in
+`scripts/audit-core-recovery-preflight.py` (RAILIANCE-WP-0024 owner contract)
+again, so the next attended recovery window needs a fresh owner round.