diff --git a/wiggleverse-www/0010/SESSION-0010.0-TRANSCRIPT-2026-06-11T00-00--INPROGRESS.md b/wiggleverse-www/0010/SESSION-0010.0-TRANSCRIPT-2026-06-11T00-00--INPROGRESS.md
index 6ed82ad..2ffdd8a 100644
--- a/wiggleverse-www/0010/SESSION-0010.0-TRANSCRIPT-2026-06-11T00-00--INPROGRESS.md
+++ b/wiggleverse-www/0010/SESSION-0010.0-TRANSCRIPT-2026-06-11T00-00--INPROGRESS.md
@@ -17,8 +17,58 @@
 
 ```
 
+## Plan
+
+> Anchor: stored next-goal from session 0009 (operator ran the drafted `/goal`
+> line); runbook = infra/finances-refresh/README.md;
+> spec = docs/specs/2026-06-08-finances-open-book-automation.md.
+
+Provision the finances-refresh Cloud Run job per the runbook: scaffold GCP
+project (step 0), APIs (2), image (4), job (5), scheduler (6); billing export (1)
+and the Gitea token (3) are operator gestures; end-to-end verify (7) follows.
+
+## State (checkpoint, 2026-06-11 ~07:20 PST)
+
+DONE (agent):
+- GCP project `wiggleverse-www` created (org wiggleverse.org), gcloud profile
+  `wiggleverse-www` (--no-activate held; benstull-infra stayed active), billing
+  linked to NEW "Wiggleverse Marketing" account 01D1D1-1D7AFA-CB570B (operator
+  created it mid-session), APIs enabled (run, scheduler, artifactregistry,
+  bigquery, secretmanager, + cloudbuild), ADC quota project pinned.
+- Artifact Registry repo `jobs` (us-central1); image built+pushed twice
+  (cloudbuild.builds.builder had to be granted to the compute default SA first —
+  new-project IAM defaults).
+- SA `finances-refresh@wiggleverse-www.iam.gserviceaccount.com`: bigquery.jobUser
+  + dataViewer (project), secretAccessor on the secret, run.invoker on the job.
+- Secret `wgl-www-finances-git-token` created EMPTY (operator adds version via
+  stdin). Job `finances-refresh` (us-central1) deployed WITHOUT the secret ref
+  (Cloud Run refuses a secret with no version); wire with
+  `gcloud run jobs update --set-secrets GIT_TOKEN=wgl-www-finances-git-token:latest`
+  once the version exists.
+- BQ dataset `billing_export` (US). BILLING_TABLE uses the WILDCARD
+  `wiggleverse-www.billing_export.gcp_billing_export_v1_*` — operator chose
+  "all org accounts" for the ledger scope; the wildcard unions all five accounts'
+  export tables, no view needed.
+- Scheduler `finances-refresh-monthly` (0 9 2 * *, America/Los_Angeles) created
+  then PAUSED — runbook says let ≥1 full month of export accrue; resume ~Aug 1.
+- BUG FOUND+FIXED (PR #10, merged to `main`, image rebuilt + job repointed):
+  main.py left the literal $GIT_TOKEN in the git URL — git doesn't expand env
+  vars in URLs; now substituted in-process with redaction on failure.
+
+BLOCKED on operator: (1) enable billing export ×5 accounts in Console →
+project wiggleverse-www / dataset billing_export; (2) Gitea write token →
+`gcloud secrets versions add` via stdin. Then: wire secret, DRY_RUN execution
+test, full step-7 verify after a month of export data.
+
 ## Deferred decisions
 
-_Autonomous-mode low-confidence calls the driver made and would have
-liked operator input on. Appended as the session runs; surfaced at
-finalize. Empty if none._
+- **Scheduler created PAUSED** rather than live: the runbook says to let a full
+  month of export accrue before scheduling; a live Jul 2 run would report a
+  partial June (export starts mid-June). Resume around Aug 1 — or earlier if a
+  partial-month number is acceptable.
+- **BILLING_TABLE = wildcard** (`gcp_billing_export_v1_*`) instead of one table /
+  a union view — covers all five accounts' export tables automatically as they
+  appear.
+- **Cloud Build grant**: gave the compute default SA
+  roles/cloudbuild.builds.builder (required for `gcloud builds submit` under
+  new-project IAM defaults).