diff --git a/docs/attended-procedure-standard.md b/docs/attended-procedure-standard.md
index f7e90f4..76c2f47 100644
--- a/docs/attended-procedure-standard.md
+++ b/docs/attended-procedure-standard.md
@@ -43,6 +43,10 @@ Every attended procedure carries this in its runbook, in the header:
 Exercise status: exercised 2026-08-27 by <operator> | unexercised
 ```
 
+> **Runbook packs (2026-09-29).** For runbook packs run by the `runbook-tutorials` engine this label is no longer a field in the
+> pack: the same idea is *maturity*, derived from clean runs in named environments and bound to the pack revision
+> (`runbook-tutorials/docs/maturity-and-projects.md`). Markdown procedures keep the header below.
+
 An unexercised procedure may still be the approved path — sometimes the incident
 *is* the first run. What it may not do is present itself as routine. Naming the
 status sets the operator's expectations correctly: run it expecting to debug it,
diff --git a/runbooks/openbao-operating-path/pack.yaml b/runbooks/openbao-operating-path/pack.yaml
index 310dce0..1a355ce 100644
--- a/runbooks/openbao-operating-path/pack.yaml
+++ b/runbooks/openbao-operating-path/pack.yaml
@@ -3,7 +3,6 @@ id: nk.openbao-operating-path
 title: "OpenBao: consume, attend, recover"
 owner: net-kingdom
 outcome: You can reach the already-deployed private OpenBao, know which owner serves a credential, know the custody model and the attended recovery path, and have seen the ceremony-record validator refuse a secret marker.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: need, label: The credential you need, type: text, default: read a database password, help: Plain words; used only to look up the owner.}
diff --git a/runbooks/protected-system-flex-auth/pack.yaml b/runbooks/protected-system-flex-auth/pack.yaml
index 2a01439..ef293d7 100644
--- a/runbooks/protected-system-flex-auth/pack.yaml
+++ b/runbooks/protected-system-flex-auth/pack.yaml
@@ -3,7 +3,6 @@ id: nk.protected-system-flex-auth
 title: Add a protected system to flex-auth
 owner: net-kingdom
 outcome: You have seen a protected system's manifests and policy evaluated offline, and a live flex-auth pin refuse callers with no credential, the wrong ServiceAccount, and the wrong audience. Expired-token refusal (negative N4) is not exercised here because it needs a ten-minute wait.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: flexauth_home, label: flex-auth checkout, type: path, default: ~/flex-auth}
diff --git a/runbooks/security-bootstrap-console/pack.yaml b/runbooks/security-bootstrap-console/pack.yaml
index fba5cdf..b155367 100644
--- a/runbooks/security-bootstrap-console/pack.yaml
+++ b/runbooks/security-bootstrap-console/pack.yaml
@@ -3,7 +3,6 @@ id: nk.security-bootstrap-console
 title: NetKingdom guided security bootstrap (existing console)
 owner: net-kingdom
 outcome: The platform-root custody, OpenBao ceremony evidence, and identity bootstrap gates are walked through in the existing guided console.
-exercise_status: unexercised
 engine: legacy-command
 legacy:
   command: [make, security-bootstrap-ui]
diff --git a/runbooks/ssh-certificates/pack.yaml b/runbooks/ssh-certificates/pack.yaml
index 27285ff..98c720c 100644
--- a/runbooks/ssh-certificates/pack.yaml
+++ b/runbooks/ssh-certificates/pack.yaml
@@ -3,7 +3,6 @@ id: nk.ssh-certificates
 title: Short-lived SSH credentials for admins, agents and automations
 owner: net-kingdom
 outcome: An actor obtains a short-lived CA-signed SSH certificate and uses it through an ops-bridge tunnel, with no static key doing the work.
-exercise_status: unexercised
 engine: native
 parameters:
   - {id: actor, label: Actor name, type: string, default: agt-claude-railiance01, pattern: "(adm|agt|atm)-[a-z0-9-]+", help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h."}