diff --git a/workplans/RPF-WP-0058-reuse-private-source-reader.md b/workplans/RPF-WP-0058-reuse-private-source-reader.md
index c498cbb..61497f6 100644
--- a/workplans/RPF-WP-0058-reuse-private-source-reader.md
+++ b/workplans/RPF-WP-0058-reuse-private-source-reader.md
@@ -17,9 +17,12 @@ state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
 Custody/Q1 work under platform INTENT.md: dependable shared secret custody and
 stable delivery with reviewed, delegated apply and revocation. Founder metadata
 consent is recorded separately and grants no credential or live rollout authority.
-Preparation occurs in isolated clone; no own supervision record means supervised
-preparation only. IDs CCR-2026-0046 and RPF-WP-0058 are provisional until integration
-rechecks the authoritative owner's latest allocation.
+Preparation began in an isolated clone; no own supervision record means supervised
+preparation only. CCR-2026-0046 and RPF-WP-0058 are now allocated and published in
+the authoritative platform source: restricted-reader preparation at
+6e8955fcd09b278a6f16c14beffd076b72d10c95 and attended-runner preparation at
+635daec6b4265ccbd066b96b53228919ac4cbd79. Both exact commits were verified on
+Forge main and the State Hub primary/railiance01 projection.
 
 ## Prepare bounded custody change
 
@@ -43,12 +46,18 @@ priority: high
 state_hub_task_id: "41d16c6e-9e0b-543b-b600-9288d5762879"
 ```
 
-Platform prepared-review covers own custody artifacts. Forge, apps and consumer
-owners independently review their scopes; their reviews remain pending. Founder
-credential provisioning approval must bind exact artifact hashes and confirmed
-ESO claims. No approval inferred from metadata disclosure. CCR stays proposed.
-Current consumer image cannot receive this credential: full authenticated
-redirect/HTTPS plus exact source URL allowlist patch and runtime config required.
+Independent preparation reviews are recorded within their owner scopes:
+platform custody and attended-runner R3; Forge restricted-reader R2 and
+attended-runner R3; reuse consumer CCR boundary R2 and hardened native consumer;
+apps release contract R2. These approve preparation/integration, not live action.
+Founder credential provisioning and rollout decisions remain pending and must
+bind exact artifacts and actual installed-role proof. No approval is inferred
+from metadata disclosure. CCR remains proposed and its claims unconfirmed.
+The published hardened image digest is
+sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0;
+actual deployment of that reviewed image plus the exact URL allowlist and native
+verification remain mandatory before reader delivery. The existing vulnerable
+runtime cannot receive this credential.
 
 ## Execute and verify restricted reader custody
 
@@ -101,3 +110,36 @@ SHA256 is e4a17ee59fb1691f7b99a09d2473178740721aad0c1394cae79b503118c97040.
 Forty-five targeted reader tests passed (17 attended-runner boundary cases).
 The handoff binds the owner-prepared task-local WSL opener and existing sanctioned
 OpenBao/Forgejo routes. No secret value or live state has been acquired or changed.
+
+
+## Rotate or revoke dedicated seven-source reader within 90 days
+
+```task
+id: RPF-WP-0058-T05
+status: wait
+priority: high
+due_date: "2027-01-13"
+```
+
+Manual platform-owned maintenance for Forgejo identity `reuse-surface-source`,
+team `reuse-surface-source-readers`, its exact named seven-repository PAT and
+OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, field
+`FORGEJO_SOURCE_TOKEN`. Forgejo PATs do not expire automatically; this live task
+is a human-attended rotation/revocation obligation, not an expiry mechanism or
+scheduled automation.
+
+The recorded date is provisional operational planning: 2027-01-13 is 90 days
+after an assumed activation on 2026-10-15, and no activation has occurred.
+Before delivering the credential, record the actual activation receipt/date,
+reset this task's due date to that actual date plus 90 days, and retain the
+owner/due-date binding in the activation receipt. If the actual deadline cannot
+be bound, do not activate delivery.
+
+At maintenance time prepare a separately approved bounded rotation/CAS plan,
+including expected existing KV version, sibling preservation, exact dedicated
+PAT identity, predecessor retention/cutover and native verification. Alternatively
+use the separately approved exact-token recovery helper for Basic-auth revocation
+with process-memory password and verified token inventory absence. Preserve the
+shared runtime writer/webhook fields and public registrations. Never remint or
+recover orphan/ambiguous requests automatically; reconcile authoritative state
+before any new approved action. No rotation/revocation is executed by this record.