diff --git a/docs/superpowers/plans/2026-09-08-hermes-agent-mibook.md b/docs/superpowers/plans/2026-09-08-hermes-agent-mibook.md
index d9032a9..77c79d8 100644
--- a/docs/superpowers/plans/2026-09-08-hermes-agent-mibook.md
+++ b/docs/superpowers/plans/2026-09-08-hermes-agent-mibook.md
@@ -178,11 +178,15 @@ This removes the `placeholder` secret declared here — it was an explicit throw
 
 Run: `nixfmt-rfc-style modules/environments/hermes-agent/default.nix machines/configuration.nix machines/mibook/secrets.nix machines/mibook/environments.nix flake.nix`
 
-- [ ] **Step 10: Build-check (this is the "test")**
+- [ ] **Step 10: Build-check (this is the "test", with a known-expected failure until Task 3)**
 
 Run: `nix build '.#nixosConfigurations.mibook.config.system.build.toplevel'`
-Expected: builds successfully. This succeeds even though `secrets/mibook.yaml` doesn't yet contain a `hermes-env` key — `sops.validateSopsFiles` only checks the file is valid sops-encrypted YAML, not that every declared secret name exists inside it; that check happens at activation (Task 4), not build.
-If it fails on an unknown `services.hermes-agent.*` option, reconcile against the actual module: `nix eval --raw '.#nixosConfigurations.mibook.config.system.build.toplevel'` errors will name the bad option; cross-check against `website/docs/getting-started/nix-setup.md` in the `NousResearch/hermes-agent` repo at the locked revision.
+**Correction (found during Task 1 implementation, 2026-09-08):** this does **not** build cleanly yet, and that's expected — `sops.validateSopsFiles = true` (set repo-wide in `machines/core/sops.nix`) makes secret-key existence a **build-time** dependency of `config.system.build.toplevel` (via a `manifest.json.drv` step), not an activation-time check as originally assumed here. Since `secrets/mibook.yaml` still only has the `placeholder` key at this point in the plan (Task 3 adds `hermes-env`), the build correctly fails with:
+```
+> .../sops-install-secrets: manifest is not valid: secret hermes-env in .../mibook.yaml is not valid: the key 'hermes-env' cannot be found
+```
+Do **not** treat this as a wiring defect, and do not weaken `sops.validateSopsFiles` to work around it — that's a repo-wide safety invariant, not this task's to change. Instead, confirm the wiring is correct by two other means: `nix build ... --dry-run` (should complete with no eval errors and the full derivation list) and Step 11 below. A fully green (non-dry-run) `nix build` of the toplevel is only reachable after Task 3 populates the real secret — treat that as the actual end-to-end checkpoint, revisited in Task 4 Step 1.
+If `--dry-run` itself fails on an unknown `services.hermes-agent.*` option, reconcile against the actual module: the error will name the bad option; cross-check against `website/docs/getting-started/nix-setup.md` in the `NousResearch/hermes-agent` repo at the locked revision.
 
 - [ ] **Step 11: Confirm the option evaluates on**