diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 229360c..e1002c6 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -25,7 +25,7 @@
 | workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
 | workplan | SECRETS-WP-0015 | active | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md |
 | workplan | SECRETS-WP-0016 | finished | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
-| workplan | SECRETS-WP-0017 | proposed | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
+| workplan | SECRETS-WP-0017 | ready | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
 | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
 | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
 | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@@ -104,9 +104,9 @@
 | task | SECRETS-WP-0016-T03 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
 | task | SECRETS-WP-0016-T04 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
 | task | SECRETS-WP-0016-T05 | done | — | workplans/SECRETS-WP-0016-engine-manifestations.md |
-| task | SECRETS-WP-0017-T01 | wait | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
+| task | SECRETS-WP-0017-T01 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
 | task | SECRETS-WP-0017-T02 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
-| task | SECRETS-WP-0017-T03 | wait | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
+| task | SECRETS-WP-0017-T03 | todo | — | workplans/SECRETS-WP-0017-bounded-executor-lanes.md |
 | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |
diff --git a/workplans/SECRETS-WP-0017-bounded-executor-lanes.md b/workplans/SECRETS-WP-0017-bounded-executor-lanes.md
index f770434..ed90690 100644
--- a/workplans/SECRETS-WP-0017-bounded-executor-lanes.md
+++ b/workplans/SECRETS-WP-0017-bounded-executor-lanes.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Catalog and guard bounded-executor CAS rotation lanes (NK-WP-0056 pilot)"
 domain: infotech
 repo: secrets-engine
-status: proposed
+status: ready
 flavor: implementation
 owner: secrets-engine
 topic_slug: custodian
@@ -25,11 +25,9 @@ auth role and policy through its own CCR, and the executor holds only its own
 
 ```task
 id: SECRETS-WP-0017-T01
-status: wait
+status: todo
 needs_human: true
 decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
-blocked_on: human
-blocking_reason: "founder approval of the Q1 lane shape (docs/bounded-executor-credential-lanes.md)"
 priority: high
 state_hub_task_id: "d921d92f-38ed-5da7-8820-8a9e614c84de"
 ```
@@ -60,11 +58,9 @@ can run it on the CCR policy file before an attended apply. No OpenBao call.
 
 ```task
 id: SECRETS-WP-0017-T03
-status: wait
+status: todo
 needs_human: true
 decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
-blocked_on: human
-blocking_reason: "platform CCR for the executor role/policy, and founder choice of LLDAP credential shape"
 priority: medium
 state_hub_task_id: "2b751e4c-6cbc-54b9-8cb2-0e78d4a59739"
 ```
@@ -74,3 +70,7 @@ as non-secret entries that reference the platform CCR and NK-WP-0056. If the
 founder chooses the fallback LLDAP account, also add
 `nk-bind-executor-lldap-credential` (high risk). Use `route` for readiness
 pointers only.
+
+## Founder decision 2026-10-31
+
+Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder choices: the executor write role is window-scoped (hub c29c6eda; CCR-2026-0058 approved as amended) and the bind rotates its own password (hub 3d0c8f86), so no `lldap_password_manager` lane is needed; T01 and T03 are unblocked.