diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md
index ca2ba1e..0d3035a 100644
--- a/workplans/RPF-WP-0035-credential-lane-implementation.md
+++ b/workplans/RPF-WP-0035-credential-lane-implementation.md
@@ -44,14 +44,15 @@ the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
 ```task
 id: RPF-WP-0035-T02
 status: wait
-needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-depends_on: [KEY-WP-0037-T02, KEY-WP-0037-T03, KEY-WP-0037-T04]
-blocking_reason: "CCR-2026-0038 applied 2026-10-08. The login proof passed 2026-10-10 (secrets-engine a963a77, message 0dba7e04), and the consumer contract is published at docs/contracts/secrets-engine-openbao-jwt-login.yaml. No-fallback check passed 2026-10-10 (secrets-engine 9ec4e0b). Still waits on the claim refusals (key-cape KEY-WP-0039 probe session, scripts/openbao_negative_probe.py bae9f85) and capabilities-self deny on the guarded paths, then ops-mason MASON-WP-0009-T05."
+depends_on: [KEY-WP-0039-T02, MASON-WP-0009-T05]
+blocking_reason: "Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05."
 priority: high
 state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
 ```
 
+2026-10-11: requalified — the remaining waits are other owners' tasks, not a human gate. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
 Supersedes RPF-WP-0032-T02. Design:
 `docs/credential-lane-designs/secrets-engine-service-jwt.md`.
 
@@ -174,13 +175,15 @@ and ops-mason MASON-WP-0009-T05 rechecks invariant (ii).
 ```task
 id: RPF-WP-0035-T03
 status: wait
-needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "Founder session done 2026-10-09: CCR-2026-0039 applied (readback matched), custody moved to coulomb, duplicate retired (docs/evidence/2026-10-09-fluid-telegram-t03-founder-session.json). Waits on ops-mason verification (MASON-WP-0005-T05: positive matrix, sibling/agent/non-member denial) and the owner salt CAS probe (FT-WP-0002)."
+blocking_reason: "Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe."
 priority: high
+depends_on: [MASON-WP-0005-T05, FT-WP-0002]
 state_hub_task_id: "f47e5bc5-6f3c-54bb-aa35-260ad03892ba"
 ```
 
+2026-10-11: requalified — founder part done; remaining waits are owner tasks. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
 Supersedes RPF-WP-0033-T02. Design:
 `docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
 
@@ -534,15 +537,17 @@ into this client-identity grant.
 ```task
 id: RPF-WP-0035-T08
 status: wait
-needs_human: true
 decision_id: "ab85ae8a-12a0-4945-ae64-1d3d86d5b26f"
-blocking_reason: "Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens."
+blocking_reason: "Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core."
 priority: high
 assignee: railiance-platform
 intervention_note: null
+blocked_on: message-from:audit-core
 state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
 ```
 
+2026-10-11: requalified — ab85ae8a resolved under the standing build-mode change rule. See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
 2026-10-03 correction (CUST-WP-0075, informed-decision sitting draft `55fb078`): the D1 routing was wrong. First provision and delivery already ran on 2026-09-11, with seed and delivery receipts, and the review packet says not to repeat them. The task is not a provisioning-window act. It was taken off decision D1, and its blocking_reason now names what actually remains. railiance-platform should re-qualify it further if the receiver rollout has since happened.
 
 2026-10-03 (CUST-WP-0075): re-qualified. The receiver rollout already happened: Audit Core c82e0442de0f carries evidence_kind and native producer accepted/duplicate and scope/read-refusal checks passed 2026-09-11 10:42 UTC (`docs/credential-lane-designs/factory-audit-senders-review.md`, `factory-native-acceptance.md`). Remaining: independent archive readback and audit bearer-revocation acceptance. Still not a provisioning-window act.