diff --git a/intakes/intakes.md b/intakes/intakes.md
index 5adebc8..03e0c27 100644
--- a/intakes/intakes.md
+++ b/intakes/intakes.md
@@ -180,5 +180,21 @@ notes:
     live from this session.
   author: tenant-engine
   created: "2026-10-01"
+- content: >-
+    2026-10-03: founder approved the ops-mason delivery plan
+    (MASON-WP-0007, scope: declare only; no apply, no seed). Declared, none
+    applied: railiance-platform 8c44256 (policy + attended role script,
+    RPF-IN-0002, local, unpushed); rapp-tenant-engine c160be2 (ServiceAccount
+    tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender,
+    ExternalSecret, and the same audit-core wiring mirrored into its copy of the
+    Deployment). Open: founder runs the attended role script and the token seed
+    (plan row 7), then `make prerequisites` + `make deploy` from the rApp, then
+    confirm the ExternalSecret is Ready and 202s arrive. Also open: two repos
+    declare this Deployment (deploy/base here, manifests/ in the rApp) and have
+    drifted; the single source of truth is the founder's decision. ESO token
+    minting in namespace tenant-engine is unverified. The database token due
+    2026-10-25 is covered by the RPF-WP-0046 renewer, not Kubernetes auth.
+  author: tenant-engine
+  created: "2026-10-03"
 state_hub_intake_id: "01a0c277-3408-7cdb-984d-c40f697966f0"
 ```