diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 6d546c3..bc3a20d 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -352,7 +352,7 @@
 | task | NK-WP-0056-T07 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T08 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T09 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
-| task | NK-WP-0056-T10 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0056-T10 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T11 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T12 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
diff --git a/docs/evidence/2026-10-31-nk56-t10-journey-only/README.md b/docs/evidence/2026-10-31-nk56-t10-journey-only/README.md
index a4277b9..a8811e3 100644
--- a/docs/evidence/2026-10-31-nk56-t10-journey-only/README.md
+++ b/docs/evidence/2026-10-31-nk56-t10-journey-only/README.md
@@ -33,3 +33,17 @@ rapp's `make journey`.
 - Fix: before the first login, the executor polls OpenBao's unauthenticated `sys/health` for up to 30 s
   (`operations.wait_reachable`). Only connection errors are retried, and any HTTP answer counts as reachable.
   This applies to both CLI modes.
+
+## Live run (2026-10-31): pass
+
+The founder started `make journey` (rapp `9826a24`, image `sha256:71da4a51…`). It created Job
+`sso/bounded-executor-journey-20261031-194719`:
+
+- The executor waited for OpenBao and logged in with the journey-read role only.
+- It read syn-journey and ran the journey against `https://kc.coulomb.social` in-cluster.
+- It passed all eight steps to an `aal2` ID token (`pwd` + `otp`), with the signature verified and the username
+  matching, in about 6 s.
+- `effects: false`. The Job reports `1 succeeded`.
+
+`live-receipt.json` is the pod's value-free receipt. The runner's sha256 `c6390545…` equals `journey.py` in the repo.
+No person took part in the journey.
diff --git a/docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json b/docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json
new file mode 100644
index 0000000..0625491
--- /dev/null
+++ b/docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json
@@ -0,0 +1,38 @@
+{
+  "job": "sso/bounded-executor-journey-20261031-194719",
+  "image": "forgejo.coulomb.social/coulomb/bounded-executor@sha256:71da4a51e331cb82a5bde1e44025dc3b1b7ea4019dd9dbd64e7196cd3dd21471",
+  "started_by": "founder (make journey); no person in the journey",
+  "job_status": "1 succeeded",
+  "result": {
+    "effects": false,
+    "mode": "journey-only",
+    "outcome": "pass",
+    "journey": {
+      "binds_on_path": {"authelia_first_factor": "svc-authelia", "keycape_otp": "svc-privacyidea", "keycape_token": "svc-keycape"},
+      "claims": {"assurance_level": "aal2", "assurance_methods": ["pwd", "otp"], "assurance_source": "key-cape",
+                 "kid": "key-1", "preferred_username_matches": true, "signature_verified": true},
+      "failed_step": null,
+      "finished_at": "2026-10-31T19:47:30Z",
+      "otp_time_step": 59782535,
+      "reason": null,
+      "result": "pass",
+      "run_id": "0a85f664-ac15-43c3-99d3-77d30da9880e",
+      "runner_sha256": "c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c",
+      "schema": "netkingdom.synthetic-journey.receipt/v1",
+      "started_at": "2026-10-31T19:47:24Z",
+      "steps": [
+        {"elapsed_ms": 4, "name": "discovery", "ok": true},
+        {"elapsed_ms": 2, "name": "keycape_authorize", "ok": true},
+        {"elapsed_ms": 554, "name": "authelia_first_factor", "ok": true},
+        {"elapsed_ms": 176, "name": "authelia_authorization", "ok": true},
+        {"elapsed_ms": 538, "name": "keycape_callback", "ok": true},
+        {"elapsed_ms": 4688, "name": "keycape_otp", "ok": true},
+        {"elapsed_ms": 163, "name": "keycape_token", "ok": true},
+        {"elapsed_ms": 2, "name": "id_token", "ok": true}
+      ],
+      "target": {"acr_values": "urn:netkingdom:aal2", "client_id": "nk-synthetic-journey",
+                 "host_mapped": ["https://auth.coulomb.social", "https://kc.coulomb.social"],
+                 "issuer": "https://kc.coulomb.social", "username": "syn-journey"}
+    }
+  }
+}
diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md
index 833000d..d2d3872 100644
--- a/workplans/NK-WP-0056-bounded-executor-path.md
+++ b/workplans/NK-WP-0056-bounded-executor-path.md
@@ -395,7 +395,7 @@ partial run was removed with `lane.py teardown`. Next: T10 needs the executor id
 
 ```task
 id: NK-WP-0056-T10
-status: todo
+status: done
 priority: medium
 assignee: claude-code
 depends_on: [NK-WP-0056-T03, NK-WP-0056-T09]
@@ -489,7 +489,13 @@ NetworkPolicy to a new pod about 3 s late. The executor now waits up to 30 s for
 first login (`15c9cdb`). The image `sha256:71da4a51e331cb82a5bde1e44025dc3b1b7ea4019dd9dbd64e7196cd3dd21471` is
 verified and pinned in the rapp.
 
-Left for T10: a rerun of `make journey` against live (founder-run).
+**Done 2026-10-31** ([evidence](../docs/evidence/2026-10-31-nk56-t10-journey-only/README.md)):
+
+- The founder started `make journey`, which created Job `sso/bounded-executor-journey-20261031-194719`.
+- It ran unattended against live with no person in the journey and passed all eight steps to an `aal2` ID token
+  (`pwd` + `otp`), with the signature verified. `effects: false`. The runner's hash equals the repo.
+- The fail-closed half is the synthetic proof: a broken svc-authelia bind fails at `authelia_first_factor`.
+- CCR-2026-0059 is now `verified`.
 
 For T06, separately: the approval-engine and audit-core replies, and the token Secret.