diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 47f74a5..c4c6c74 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -375,9 +375,9 @@
 | task | NK-WP-0058-T03 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T05 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
-| task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| task | NK-WP-0058-T06 | wait | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
-| task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| task | NK-WP-0058-T08 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T09 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T10 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T11 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md
index 750399a..b874c0d 100644
--- a/workplans/NK-WP-0058-bounded-execution-operability.md
+++ b/workplans/NK-WP-0058-bounded-execution-operability.md
@@ -505,9 +505,11 @@ to ask the founder for on 2026-11-04/05 is then readable, or explicitly founder-
 
 ```task
 id: NK-WP-0058-T06
-status: todo
+status: wait
 priority: medium
 assignee: claude-code
+blocked_on: message-from:railiance-platform
+blocking_reason: "OpenBao role net-kingdom-bounded-executor-window-watch (CCR) requested in 50c86169; then image re-pin and make deploy-window-watch."
 depends_on: [NK-WP-0058-T09]
 state_hub_task_id: "6a4c7413-0675-5a06-b471-5f849ce0c721"
 ```
@@ -523,6 +525,14 @@ The open check from 2026-11-05 on the overnight window is T11.
 
 **Done when:** an unclosed window is closed or flagged without human memory, and this is tested on a stub.
 
+**2026-11-06: built and tested; waits for railiance-platform.** Contract row O5.
+- `bounded-executor/window_watch.py` (`c63aa39`): if the write role exists, no run Job is active and none started
+  in the last 10 minutes, it flags (exit 3) or closes (deletes the role, proves it gone). 8 stub tests.
+- rapp `manifests/window-watch.yaml` (`df61bd0`): a CronJob every 10 minutes in flag mode, list Jobs only, no
+  Secret, deployed with its own `make deploy-window-watch`.
+- **Open:** railiance-platform's CCR for the OpenBao role (read-only first, `50c86169`), the image built from
+  `c1df8ec` re-pinned in the rapp, then the founder's `make deploy-window-watch`.
+
 ### Runbook and tooling conventions
 
 ```task
@@ -586,7 +596,7 @@ for an ad hoc task.
 
 ```task
 id: NK-WP-0058-T08
-status: todo
+status: done
 priority: low
 assignee: claude-code
 depends_on: [NK-WP-0058-T02]
@@ -598,3 +608,10 @@ touch, and the single owning script per step. Each worker's result is then check
 T02 tests. This prevents the competing seeders and mismatched names seen on 2026-11-04.
 
 **Done when:** the protocol is in the agent instructions, and its first use is checked by the contract tests.
+
+**Result, 2026-11-06.**
+- **The protocol:** `.claude/rules/worker-protocol.md`, imported by `CLAUDE.md` and pointed to from `AGENTS.md`.
+- **The tool:** `tools/contract-tests/excerpt.py`.
+- **Its test** requires every table row to have details and a contract test; it found O4 missing details.
+- **First use:** T06. Row O5 was added first, and the excerpt for O5, E1, C1, E8, E9 and R2 guided the change. The
+  result is checked by the contract suite (125 passed) and the rapp's CI.