diff --git a/docs/keycape-exposure-resolver-reconciliation.md b/docs/keycape-exposure-resolver-reconciliation.md
index 10d56d8..c64b5b3 100644
--- a/docs/keycape-exposure-resolver-reconciliation.md
+++ b/docs/keycape-exposure-resolver-reconciliation.md
@@ -5,7 +5,7 @@ Workplan: `NK-WP-0033`
 NetKingdom procedure: `sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh` (repaired 2026-08-27 in `4a38511`; the previously pinned revision could not complete a run — see NK-WP-0033 T05)
 Platform recovery contract: railiance-platform `453fed3`  
 Owner cutover receipt: State Hub message `45b236c8-052f-43d3-a472-44f8e9694da2`
-Exercise status: unexercised to successful completion — attempted 2026-08-27 by Bernd Worsch; four defects found and fixed (`4a38511`), no green receipt. The 2026-09-05 shared transport refactor also awaits an attended run. See `attended-procedure-standard.md`.
+Exercise status: `--check --predecessor-unavailable` exercised to PASS on 2026-09-23 by Bernd Worsch (railiance01 checkout `6096c395`, receipt in NK-WP-0033). `--apply` last ran on 2026-08-27 before the fixes in `4a38511`. Run it from your own terminal with `ssh -t`: Claude Code's `!` prefix has no TTY, and the script refuses to run without one. Take the pi-admin and LLDAP values from OpenBao `operators` custody (`privacyidea/pi-admin`, `lldap/admin`). See `attended-procedure-standard.md`.
 
 This is the remaining attended provider-admin operation after the owner-reported
 four-class cutover. It updates only privacyIDEA resolver `lldap-coulomb` so the
diff --git a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
index e642814..2f034ac 100644
--- a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
+++ b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Contain and rotate the exposed KeyCape credential bundle"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 flavor: implementation
 owner: codex
 topic_slug: net-kingdom
@@ -96,7 +96,7 @@ unrelated routes do not authorize execution.
 
 ```task
 id: NK-WP-0033-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "f0f6d6c3-9c45-56b7-9fd6-52fb0ea9054a"
 ```
@@ -159,7 +159,7 @@ privacyIDEA resolver still awaits attended provider-admin reconciliation.
 
 ```task
 id: NK-WP-0033-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "41e55d5c-ae28-5ee2-be25-b9a3758428f7"
 ```
@@ -231,3 +231,37 @@ nothing else is required.
 
 The custody gap (rotation does not retain the outgoing value) is a
 rotation-runbook fix. It is not a reason to reopen this incident.
+
+### Attended receipt 2026-09-23 — incident closed
+
+Operator Bernd Worsch was both the attended driver and the abort operator.
+That is acceptable because `--check` performs no mutation. The run used
+railiance01 checkout `6096c395` (script `4a38511` plus the shared transport),
+platform contract `453fed3` and owner receipt `45b236c8`. The command was:
+
+`reconcile-lldap-resolver-live.sh --check --predecessor-unavailable`
+
+Both values were taken from operator custody: `operators/privacyidea/pi-admin`,
+and `operators/lldap/admin` version 1, created 2026-08-28. Sanitized receipt:
+
+> NK-WP-0033 receipt PASS: read-only resolver lookup, privacyIDEA MFA,
+> predecessor denial=NOT-PROVEN, readiness, health, cleanup=PASS
+
+Two earlier attempts in the same session failed closed, and cleanup passed
+on both. Neither was a defect in the script:
+
+1. `phase=replacement-lldap-auth`: an LLDAP admin value that was not current
+   was typed. A probe with a known-wrong value returned 401, which confirmed
+   the endpoint was healthy.
+2. `phase=privacyidea-auth`: the pi-admin prompt got the wrong value.
+
+The lesson for the runbook is to take both values from `operators` custody,
+not from memory.
+
+Custody gap closed: `operators/lldap/admin` exists (KV v2; delete is withheld
+by the `operator-custody` policy, so predecessors are retained as versions).
+The 2026-09-11 identity-provisioner repair confirmed
+`provider_password_changed: false`, so version 1 is current.
+
+Predecessor disposition follows the operator ruling above. T03 and T05 are
+done, and the incident `KEYCAPE-EXPOSURE-20260823-01` is closed.