diff --git a/docs/evidence/2026-09-15-repository-rename-handoffs.md b/docs/evidence/2026-09-15-repository-rename-handoffs.md
index de6a05f..f299e9c 100644
--- a/docs/evidence/2026-09-15-repository-rename-handoffs.md
+++ b/docs/evidence/2026-09-15-repository-rename-handoffs.md
@@ -15,12 +15,12 @@ Shared identity for every request:
 
 | Owner | Surface | Required change / verification | Owner work-record |
 | --- | --- | --- | --- |
-| `railiance-fabric` | fabric-projection | Update `registry/local-repos.yaml`, `registry/railiance-repos.yaml`, live `fabric/**` `repo: flex-auth`; re-ingest; keep `flex-auth.*` runtime graph IDs | pending |
-| `ops-warden` | credential-route | Review `registry/routing/catalog.yaml` owner repository field; routing must still resolve; no secret in the reply | pending |
+| `railiance-fabric` | fabric-projection | Update `registry/local-repos.yaml`, `registry/railiance-repos.yaml`, live `fabric/**` `repo: flex-auth`; re-ingest; keep `flex-auth.*` runtime graph IDs | `RAIL-FAB-WP-0031` |
+| `ops-warden` | credential-route | Review `registry/routing/catalog.yaml` owner repository field; routing must still resolve; no secret in the reply | `WARDEN-IN-0003` |
 | `reuse-surface` | other | Update federation source URL/path, re-ingest, verify capability continuity | `REUSE-WP-0023` / `65c03b24-4349-5a60-b7d6-79cf54931d06` (active; T01/T02 wait) |
 | `policy-nexus` | other | Update `source-inventory.config.json` remote URL; re-ingest same publication lineage | `PNEX-IN-0001` / `01a0f266-ecb3-7f5d-b8e8-8db1ba2b5199` (open) |
-| `user-engine` | documentation | Update `wiki/ArchitectureBlueprint.md` absolute source path; adapter/runtime vocabulary stays `flex-auth` | pending |
-| `net-kingdom` | deployment | Verify three live `flex-auth-*` Deployments and `sso-mfa/k8s/**`; no runtime rename | pending |
+| `user-engine` | documentation | Update `wiki/ArchitectureBlueprint.md` absolute source path; adapter/runtime vocabulary stays `flex-auth` | `USER-WP-0034` |
+| `net-kingdom` | deployment | Verify three live `flex-auth-*` Deployments and `sso-mfa/k8s/**`; no runtime rename | `NK-WP-0039` / `284a8ac2-61dc-5bee-b74a-0a62d9808edb` (T01/T02 done; T03 waits on rename-landed notice) |
 | `tenant-engine` | consumer | Verify docs/client config keep the retained product/runtime contract | `TEN-IN-0004` / intake `01a0c14b-b2f7-78f1-8f6c-e36c952fe004` (open) |
 | `sbom-nexus` | sbom | Re-ingest new canonical checkout; snapshots remain related to the UUID above | `SBOM-IN-0001` / `01a0f267-b25a-7681-8d41-9627aa0b78ce` (open) |
 | `repo-manager` | other | Reconcile new canonical path; do not rewrite archived UUID-migration evidence | `RMGR-IN-0004` / `01a0f268-335d-7db0-b630-a4b451c73fde` (open) |
diff --git a/workplans/FLEX-WP-0020-repository-identity-migration.md b/workplans/FLEX-WP-0020-repository-identity-migration.md
index bd7c192..1b064a3 100644
--- a/workplans/FLEX-WP-0020-repository-identity-migration.md
+++ b/workplans/FLEX-WP-0020-repository-identity-migration.md
@@ -223,14 +223,12 @@ have their own workplan or residual handoff.
 
 ```task
 id: FLEX-WP-0020-T04
-status: wait
-blocked_on: message-from:net-kingdom
+status: done
 priority: high
-blocking_reason: "Handoff records exist for reuse-surface (REUSE-WP-0023), net-kingdom (NK-WP-0039), railiance-fabric (RAIL-FAB-WP-0031), user-engine (USER-WP-0034), tenant-engine, secrets-engine, ops-warden (intake). Only handoff CREATION gates T05; those plans complete after T06, not before. Created 2026-09-30 by flex-auth: policy-nexus PNEX-IN-0001, sbom-nexus SBOM-IN-0001, repo-manager RMGR-IN-0004. Remaining gate: the net-kingdom reply and the other six consumer confirmations."
 state_hub_task_id: "9bb138e1-5edb-5714-8d89-3b1b7039a7ce"
 ```
 
-2026-09-30: handoff records now exist for all three previously missing owners (see evidence file). Still waiting on the net-kingdom reply before T04 closes.
+2026-09-30: T04 closed. Every discovered external change has a named owning-repository handoff: net-kingdom replied (NK-WP-0039, message 92e9c4a5, deployments verified read-only, no runtime change); railiance-fabric RAIL-FAB-WP-0031, user-engine USER-WP-0034, ops-warden WARDEN-IN-0003, reuse-surface REUSE-WP-0023, and the intakes listed in the evidence file. Owners close their records after T06; that is their evidence, not this gate.
 
 Owner: `flex-auth` for inventory and handoff creation only.
 
@@ -315,8 +313,8 @@ Reviewed inventory baseline:
 ```task
 id: FLEX-WP-0020-T05
 status: wait
-depends_on: [FLEX-WP-0020-T04]
-blocking_reason: "Preflight runs once the downstream handoff inventory (T04) is complete."
+needs_human: true
+blocking_reason: "Preflight ok 2026-09-30 (operation 82b6e0ba-c25c-4ade-86c0-a6e7e22f6bf9, source 216df1f, private file not committed); needs the founder decision approving operation, commit, window, rollback limits and the confirm string. Rerun preflight if the source commit changes."
 priority: high
 state_hub_task_id: "86fecbb6-b008-5354-8d70-0f4ba5077a58"
 ```
@@ -334,6 +332,8 @@ availability, every risk-register row, and no queued edge writes. Record a
 human decision approving exact operation ID, source commit, target slug, owner,
 window, rollback limits, and confirmation `rename:fda8ad85-a7d7-4055-8f21-902a533e59df:flex-auth:access-engine`.
 
+2026-09-30: preflight re-run after T04 closed: ok, next safe action `start-operation` (requires confirmation; not started). Awaiting human approval.
+
 Gate: a current private preflight and explicit human approval exist. Never
 commit the private preflight file or its token.