diff --git a/docs/account-journeys.md b/docs/account-journeys.md
index 3c9ead2..6fe239d 100644
--- a/docs/account-journeys.md
+++ b/docs/account-journeys.md
@@ -68,7 +68,7 @@ headless capability alone does not mean a journey is usable or verified live.
 | P02 — Create tenant and first administrator | Confirm tenant identifier/type/name and first admin; show tenant created versus admin onboarding pending | Conflict/partial failure readback avoids duplicate tenant; resume only missing stages | Existing platform creation/result routes; live end-to-end drill pending |
 | P03 — Find and inspect a tenant | Search exact identifier or disambiguate matching names; clearly state selected scope | Unknown/ambiguous name presents choices without guessing authority | Existing tests for unknown/ambiguous names and tenant selection |
 | P04 — Recover a tenant administrator | Verify request and affected scope; audited, bounded account/factor recovery returns control | Insufficient proof denies; provider outage yields pending state and named owner | Identity-recovery route exists; lost-factor recovery and audited browser acceptance pending |
-| P05 — Operate sign-in, factor and notification services | See degraded component and impacted journeys; renew scoped credentials; verify recovery | Expired factor-read credential blocks assurance decision; missing mail uses explicit assisted setup; no hidden MFA bypass | Current incident: rejected factor-read credential; custody/renewal and mail delivery unresolved |
+| P05 — Operate sign-in, factor and notification services | See degraded component and impacted journeys; renew scoped credentials; verify recovery | Expired factor-read credential blocks assurance decision; missing mail uses explicit assisted setup; no hidden MFA bypass | Factor-read custody, automatic renewal and mounted delivery verified (RPF-WP-0040); provider expiry/revocation drills and mail delivery remain open |
 | P06 — Set authentication policy | Distinguish optional-after-enrollment, mandatory, and application step-up; preview impact and rollback | Unsupported/ambiguous policy rejected; avoid locking out unenrolled users or weakening privileged actions | KeyCape optional policy source tested; scoped rollout and privileged-portal policy acceptance pending |
 | P07 — Suspend/retire/reactivate tenant | Confirm blast radius and resulting tenant lifecycle; applications reflect effective policy | Stale version or partial propagation provides readback/retry; recovery retains audit | Existing tenant lifecycle APIs; browser confirmation/propagation drill pending |
 | P08 — Review audit and service recovery | Follow correlation reference without exposing secrets; see actor, tenant, action and result; prove rollback | Missing telemetry or unknown state visible; no success until authoritative readback | Existing service events/references; unified browser audit/support workflow pending |
diff --git a/workplans/USER-WP-0030-platform-admin-journeys.md b/workplans/USER-WP-0030-platform-admin-journeys.md
index f1d921e..926ada3 100644
--- a/workplans/USER-WP-0030-platform-admin-journeys.md
+++ b/workplans/USER-WP-0030-platform-admin-journeys.md
@@ -41,7 +41,7 @@ P02/P04/P07: preserve first-admin setup on retry without duplication, explicit t
 
 ```task
 id: USER-WP-0030-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "07510026-caee-54d7-998c-a8d2b2f17773"
 ```
@@ -70,3 +70,13 @@ Provider gate rechecked: net-kingdom-privacyidea-admin-token remains non-resolva
 T04 release evidence: docs/evidence/2026-09-13-platform-admin-support.md. Source b8506ef, 216 regression tests (seven optional skips), 19 platform tests, 16 browser checks; CI and rollout verified. T03 stays waiting; P04/P05/P06 completeness is not claimed.
 
 Provider consumer progress: KeyCape source 632b1f1 implements exclusive adminTokenFile renewal without issuer restart, fresh credential reads for both factor lookup and validation, no stale fallback, bounded/sanitized errors, request timeout and redirect refusal. OTP validation now requires successful provider status as well as a positive value. All Go suites pass; owner custody/issuance and live factor/policy acceptance remain T03. KEY-WP-0035-T04 tracks release evidence.
+
+2026-09-13: the user authorized establishing custody and authenticated through
+the contained OpenBao lane. RPF-WP-0040 / CCR-2026-0023 now provide a dedicated
+realm-scoped provider credential, separate issuer custody, automatic renewal,
+namespace-restricted ESO delivery and KeyCape mounted-file activation. Native
+scope denial, per-user factor lookup and mounted renewal passed; fourteen
+offline tests pass and exact-commit CI is configured. This supersedes the earlier
+missing-owner gate for factor reads. T03 remains in progress for P04 audited
+factor/account recovery, P05 notification operations and remaining expiry drills,
+and P06 scoped policy/onboarding acceptance. Historical NK-WP-0033 is separate.