diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
index 74e10fc..27013ae 100644
--- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
+++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
@@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04.
 
 ```task
 id: RESOURCE-WP-0002-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```
@@ -258,16 +258,18 @@ handed at
 OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1).
 Positive S3 list/get and prefix put/get/delete succeeded. Negative:
 bogus secret denied; IAM/billing/k8s list denied. Distinct from the
-bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok,
-sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this
-token 403), ESO Secret `platform-pg-backup-s3` (absent on
-railiance01). WAL still off.
+bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage`
+and AppRole `external-secrets-backup-object-storage` applied.
+ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret
+synced Secret `databases/platform-pg-backup-s3` (keys present, values
+not read). Prefix `platform-pg/` is empty (0 objects). Cluster still
+has no `barmanObjectStore`. WAL remains T05.
 
 ## T05 — Prove backup, full restore, and PITR
 
 ```task
 id: RESOURCE-WP-0002-T05
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
 ```