diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 232eb9d..d25ec53 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -47,7 +47,7 @@
 | workplan | RPF-WP-0065 | proposed | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
 | workplan | RPF-WP-0066 | proposed | — | workplans/RPF-WP-0066-openbao-durable-audit-snapshots-conformance.md |
 | workplan | RPF-WP-0067 | active | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
-| workplan | RPF-WP-0068 | active | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | workplan | RPF-WP-0070 | blocked | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
 | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
@@ -225,8 +225,8 @@
 | task | RPF-WP-0067-T03 | wait | — | workplans/RPF-WP-0067-netkingdom-identity-receipt-and-metadata-answers.md |
 | task | RPF-WP-0068-T01 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0068-T02 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
-| task | RPF-WP-0068-T03 | wait | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
-| task | RPF-WP-0068-T04 | todo | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| task | RPF-WP-0068-T03 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
+| task | RPF-WP-0068-T04 | done | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0069-T01 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T02 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T03 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
diff --git a/docs/telemetry-smtp-custody.md b/docs/telemetry-smtp-custody.md
index e71162e..e9f1236 100644
--- a/docs/telemetry-smtp-custody.md
+++ b/docs/telemetry-smtp-custody.md
@@ -73,10 +73,22 @@ Native store/projection and SMTP package readiness verified; actual user inbox
 acceptance is NK-WP-0047-T03 / CSOC-WP-0010-T03.
 
 Future mailbox rotation must preserve the public entry fields and account for
-both admitted consumers. Coordinate provider rotation/overlap with the owner,
-verify both scoped ESO projections refreshed without reading values, then reload
+every admitted consumer. Coordinate provider rotation/overlap with the owner,
+verify each scoped projection refreshed without reading values, then reload
 telemetry's consumer and restart Authelia so its startup password-file read uses
 the new credential. Verify TLS/SMTP readiness for both before retiring a
 predecessor. Never rotate by overwriting only one consumer Secret or by copying
 the telemetry Secret into sso. Native authentication notifications use this
-scoped SMTP lane; email-connect admission is a separate future change.
+scoped SMTP lane.
+
+## Additional admitted consumer — email-connect, 2026-11-01
+
+CCR-2026-0056 / RPF-WP-0068 admitted email-connect/email-connect-platform-smtp-eso
+as a third reader of the same mailbox entry. No duplicate KV entry and no
+password change. The dedicated role reads that record; the projection supplies
+only SMTP_PASSWORD, with a 15-minute token. The private foundation journal
+records projection Ready, exact read, native consumer authentication, sibling
+denial, wrong-audience denial, and workload-token revocation. SMTP
+authentication was checked and no message was sent. The application sender
+remains forgejo@coulomb.social until the consumer's own sender step. A future
+rotation must refresh this projection as well as telemetry and Authelia.
diff --git a/workplans/RPF-WP-0068-email-connect-platform-smtp.md b/workplans/RPF-WP-0068-email-connect-platform-smtp.md
index 233d107..5862c58 100644
--- a/workplans/RPF-WP-0068-email-connect-platform-smtp.md
+++ b/workplans/RPF-WP-0068-email-connect-platform-smtp.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Admit the email-connect platform mailbox consumer"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-10-31"
@@ -68,10 +68,10 @@ Exact packet: docs/email-connect-smtp-foundation-review-2026-10-31.md.
 
 ```task
 id: RPF-WP-0068-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-intervention_note: "Review CCR-2026-0056 and docs/email-connect-smtp-foundation-review-2026-10-31.md as platform owner/founder; owner decision sync and attended Warden execution remain required. No live reader admitted."
+needs_human: false
+intervention_note: "Attended Warden execution completed 2026-11-01T22:40:38Z. Reader admitted, SMTP authentication checked, no message sent, sender unchanged."
 depends_on:
 - RPF-WP-0068-T02
 state_hub_task_id: "50df1d39-28be-564d-b93a-678877a03399"
@@ -96,7 +96,7 @@ and the source slug corrected to that native topic.
 
 ```task
 id: RPF-WP-0068-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "da56d175-3126-5eaa-90c5-dd1e9da050d5"
 ```
@@ -108,6 +108,14 @@ verified custody result to CSOC-WP-0015-T02/email-connect. The application sende
 rollout, selected-message authentication, inbox access, correlated return handling,
 suppression operator and retention remain those live consumer obligations.
 
+Done 2026-11-01. The final foundation record is
+`foundation_admitted_projection_ready`: projection Ready, exact read, native
+binding and consumer authentication, 15-minute bound, other service account
+denied, wrong audience denied, and workload token revocation verified. CCR-2026-0056
+carries the binding confirmation. The third reader is recorded in
+`docs/telemetry-smtp-custody.md`. No message was sent and the sender was not
+changed. The consumer may now seal its sender proposal.
+
 ## Completion
 
 Finish only on native admitted reader/projection proof and the explicit consumer