diff --git a/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md b/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md
index d417e02..46a4c4d 100644
--- a/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md
+++ b/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md
@@ -81,7 +81,7 @@ cross-repo ownership notes.
 
 ```task
 id: NK-WP-0009-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"
 ```
@@ -101,7 +101,7 @@ so the live stage records "not deployed" honestly. The task closes on a run rece
 
 ```task
 id: NK-WP-0009-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"
 ```
@@ -115,7 +115,7 @@ integration, leases, unseal, backup, and break-glass.
 
 ```task
 id: NK-WP-0009-T04
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"
 ```
@@ -177,3 +177,11 @@ requires executable safe fixtures or repeatable outcome checks; never teach
 operators to apply the stale tenant-engine reference YAML.
 
 Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
+
+## Rehearsal receipts — 2026-10-02
+
+Bernd ran three packs cleanly in project `nk-rehearsal` (rehearsal environment, no deviations); the engine derives `rehearsed`:
+`nk.object-storage-sts` (run 20261002-223449-dfa0b3, T02), `nk.ssh-certificates` (20261002-225810-0d8ab7, T04; first `sign` attempt failed
+and was retried with the missing `WARDEN_CONFIG`), `nk.openbao-operating-path` (20261002-234245-d73656, T03). T02, T03 and T04 are done.
+Limits: the S3 pack proves the contract offline, not a live service; the SSH tunnel stage is recorded not proven and the rehearsal config
+bypasses the flex-auth policy gate; the OpenBao pack is read-only. T05 (`nk.protected-system-flex-auth`) has no run yet.
diff --git a/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md b/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md
index 079bf3d..c428a67 100644
--- a/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md
+++ b/workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md
@@ -120,6 +120,12 @@ evidence): state the rehearsal-config requirement as its own step with a check t
 (structured `env:`, `must_exist` datapoints, `rtut smoke`, failure hints, failures as pack defects) sent to runbook-tutorials
 (`37848b4c-1b30-410f-bcc3-3a79a4d59ab1`).
 
+**Rehearsal status 2026-10-02**: `nk.object-storage-sts`, `nk.ssh-certificates` and `nk.openbao-operating-path` are `rehearsed` (one clean
+rehearsal run each, records sealed, exported by Bernd). `nk.protected-system-flex-auth` has not been run. T05 stays open for it. Pack
+fixes are batched until that run is in: explicit rehearsal-config step and config check (ssh), `route` step BrokenPipe noise, plus whatever
+pack 4 surfaces. Feedback so far: ssh "more understandable"; openbao "Soso, we need to make it easier to use, but it helps" (neutral; needs
+specifics).
+
 ## Retire the markdown verifier
 
 ```task