diff --git a/workplans/REEF-STORAGE-WP-0001-bootstrap.md b/workplans/REEF-STORAGE-WP-0001-bootstrap.md
index 5d0eb31..2243449 100644
--- a/workplans/REEF-STORAGE-WP-0001-bootstrap.md
+++ b/workplans/REEF-STORAGE-WP-0001-bootstrap.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Bootstrap reef-storage"
 domain: financials
 repo: reef-storage
-status: active
+status: finished
 owner: grok
 topic_slug: railiance
 created: "2026-08-14"
-updated: "2026-08-14"
+updated: "2026-08-15"
 related:
   - RMASTER-WP-0022
   - RESOURCE-WP-0002
@@ -42,3 +42,5 @@ priority: high
 
 `schemas/object-store-attributes.schema.json` and a planned
 `platform-audit-storage.yaml` with null operating fields until purchase.
+
+Completed 2026-08-14. Both tasks done. Marked `finished` 2026-08-15.
diff --git a/workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md b/workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md
index 4320070..ecf4182 100644
--- a/workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md
+++ b/workplans/REEF-STORAGE-WP-0002-fill-after-purchase.md
@@ -8,9 +8,10 @@ status: active
 owner: grok
 topic_slug: railiance
 created: "2026-08-14"
-updated: "2026-08-14"
+updated: "2026-08-15"
 related:
   - RESOURCE-WP-0002
+  - ADR-0008
 ---
 
 # REEF-STORAGE-WP-0002 — fill after purchase
@@ -35,3 +36,23 @@ ACL). Attributes, topology member, and declaration `current_members`
 written. Reef `lifecycle_state` stays `planned` until RESOURCE-WP-0002-T05.
 Cost backstop is a founder email billing alert. Scaleway has no
 euro hard-stop; that gap is accepted.
+
+Scaleway S3 is a provider-native API. ADR-0008 does not apply a
+`public` grant to it. Do not set `exposure.posture: public` on this
+reef.
+
+## T02 — Wait for restore before lifecycle_state active
+
+```task
+id: REEF-STORAGE-WP-0002-T02
+status: wait
+priority: medium
+```
+
+Depends on `RESOURCE-WP-0002-T05` (first restore). This repo then sets
+`lifecycle_state: active`. Secrets stay in `railiance-platform`. Backup
+schedule stays in `rapp-postgres`.
+
+**Done when:** declaration `lifecycle_state` matches the first proven
+restore, or this task is cancelled if resource-control records that
+decision instead.