diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 821b8cb..96e32b6 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -19,8 +19,8 @@
 | task | RESOURCE-WP-0001-T03 | done | — | workplans/RESOURCE-WP-0001-statehub-bootstrap.md |
 | task | RESOURCE-WP-0002-T01 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T02 | progress | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
-| task | RESOURCE-WP-0002-T03 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
-| task | RESOURCE-WP-0002-T04 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
+| task | RESOURCE-WP-0002-T03 | done | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
+| task | RESOURCE-WP-0002-T04 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T05 | wait | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T06 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
 | task | RESOURCE-WP-0002-T07 | todo | — | workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md |
diff --git a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
index 026da81..8ec4e6e 100644
--- a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
+++ b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md
@@ -14,9 +14,9 @@ Object Storage policy attached, list/get succeeded. Private bucket
 2026-08-14T16:21:56Z), versioning on, 30-day lifecycle applied, ACL
 owner-only. Live attributes are in
 `reef-storage/substrate/object-stores/platform-audit-storage.yaml`.
-The bootstrap key cannot `write billing_budgets`; founder still sets a
-€20 monthly project budget in the Scaleway console. Scoped Barman key is
-T04.
+Founder set a Scaleway billing alert (email). Scaleway has no euro
+hard-stop that refuses usage; that gap is accepted. Scoped Barman key
+is T04.
 
 ## Recommendation
 
diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
index 5e58e72..1a27aa1 100644
--- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
+++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
@@ -219,15 +219,14 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is
 `ordered_on: 2026-08-14`, `provider_resource_id` = bucket name).
 Operating facts live on
 `reef:storage/substrate/object-stores/platform-audit-storage.yaml`.
-Residual: founder must create a €20 monthly Scaleway budget in the
-console — this bootstrap key cannot `write billing_budgets`. Scoped
-Barman key remains T04.
+Founder set a Scaleway billing alert (email). Scaleway has no
+euro hard-stop; that gap is accepted. Scoped Barman key remains T04.
 
 ## T04 — Establish credential custody and hand off to rapp-postgres
 
 ```task
 id: RESOURCE-WP-0002-T04
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
 ```
@@ -245,6 +244,15 @@ Done when credential delivery is renewable/revocable, a negative credential
 cannot access the bucket, and `rapp-postgres` can perform the storage preflight
 without disclosing a value.
 
+Started 2026-08-14: bootstrap key cannot create IAM applications. Lane
+prepared — `CCR-2026-0012` (proposed), policy file, mason plan
+`platform-pg-backup-s3` (draft), founder put instructions, non-secret
+destination handed at
+`rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
+Waiting on founder: approve the CCR, mint the project-scoped IAM
+application and key, put values in OpenBao, say “the Barman key is in
+bao.” Do not enable WAL yet.
+
 ## T05 — Prove backup, full restore, and PITR
 
 ```task