diff --git a/docs/keycape-openbao-consumer-custody.md b/docs/keycape-openbao-consumer-custody.md
index 70ebc05..74d4d94 100644
--- a/docs/keycape-openbao-consumer-custody.md
+++ b/docs/keycape-openbao-consumer-custody.md
@@ -67,9 +67,25 @@ Run only after **all** of: founder approval of the ops-mason plan (A1), the
 revised CCR-2026-0033 applied by railiance-platform (A2/A3: KV entry written,
 operator OIDC role and policy, ESO reader, JWT role), the KeyCape
 `secrets-engine-openbao` registration live and KeyCape restarted after the KV
-write (KEY-WP-0037), and the platform JWT login contract file published. This
-is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and plan
-verification item 6.
+write (KEY-WP-0037), and the platform JWT role applied (CCR-2026-0038, applied
+2026-10-08). This is the evidence step for KEY-WP-0037-T04 / RPF-WP-0035-T02 and
+plan verification item 6.
+
+CCR-2026-0038 publishes the consumer contract file only after the login proof
+passes, so the probe cannot wait for it. Write the non-secret probe input
+locally from the applied CCR values first:
+
+```bash
+mkdir -p ~/.secrets-engine/keycape && (umask 077; cat > ~/.secrets-engine/keycape/openbao-jwt-login.yaml <<'YAML'
+mount: keycape-services
+role: secrets-engine-openbao
+bound_issuer: https://kc.coulomb.social
+YAML
+)
+```
+
+This file is the probe's input, not the platform's publication. railiance-platform
+replaces or confirms it after the proof passes.
 
 ```bash
 cd /home/worsch/secrets-engine && \
diff --git a/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md b/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
index 7cec104..d577111 100644
--- a/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
+++ b/workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: claude-code
 topic_slug: custodian
 created: "2026-10-06"
-updated: "2026-10-06"
+updated: "2026-10-09"
 related_workplans:
   - SECRETS-WP-0008
 state_hub_workstream_id: "143de42b-b568-5070-add0-d5e71eabd436"
@@ -93,7 +93,7 @@ status: wait
 needs_human: true
 priority: high
 blocked_on: founder
-blocking_reason: "Founder runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md after plan approval A1-A3, the revised CCR-2026-0033 objects applied by railiance-platform, the KeyCape registration live (KEY-WP-0037) and the JWT login contract published."
+blocking_reason: "All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Founder writes the non-secret local login contract file and runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md."
 state_hub_task_id: "1c3afd34-4aa3-5484-a9c7-2db577225269"
 ```