diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 3a03053..9020824 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -376,7 +376,7 @@
 | task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T05 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
-| task | NK-WP-0058-T07 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
+| task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T09 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
 | task | NK-WP-0058-T10 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
diff --git a/workplans/NK-WP-0058-bounded-execution-operability.md b/workplans/NK-WP-0058-bounded-execution-operability.md
index 7811f25..3a0d504 100644
--- a/workplans/NK-WP-0058-bounded-execution-operability.md
+++ b/workplans/NK-WP-0058-bounded-execution-operability.md
@@ -479,7 +479,7 @@ The open check from 2026-11-05 on the overnight window is T11.
 
 ```task
 id: NK-WP-0058-T07
-status: todo
+status: done
 priority: medium
 assignee: claude-code
 state_hub_task_id: "a99424ed-ee8b-5db4-9fa7-2ae5fc32c39c"
@@ -502,6 +502,38 @@ Prefer a lint or a test over prose, and remove the hard-coded and duplicated bit
 **Done when:** the conventions are enforced by a test or lint in CI for the net-kingdom and rapp runbooks and tools,
 and the owner requests for other repos are sent and recorded.
 
+**Result, 2026-11-06.** `tools/conventions/lint.py` (`make conventions-lint`) has five rules:
+
+- `server-side-apply`;
+- `one-wait-condition`;
+- `one-cluster-route`;
+- `tool-numbered-receipts`;
+- `managing-controller`, which reads the paths Argo owns from railiance-platform's `argocd/`.
+
+Records (evidence, history, proposals, workplans, wiki) are not checked. Seven exceptions are listed in the tool,
+each with its reason: two quoted or legacy texts, three node-local commands, three completed one-time runbooks, and
+the inventory itself. The lint runs in net-kingdom's contract suite (with 14 tests) and in the rapp's packaging CI
+(rapp `78ed50c`).
+
+**Fixed here:**
+- 21 runbook applies are now server-side.
+- `portal-client-rollout.py` (and so `keycape-client.py` and the KeyCape rollout tools) and
+  `identity-provisioner-reconcile.py` use `NK_KUBECONFIG`, default `~/.kube/config-railiance01`. They no longer
+  use a second kubeconfig with a `--server` override to the same API.
+- The T06 runbook's section 4 note and the bind-split runbook's `K=` line follow the same route.
+- `bx` already numbers receipts and polls instead of using `kubectl wait`.
+
+**Owner requests:**
+- the lint findings in six repos: railiance-platform 57 (`c8371e0d`), audit-core 14 (`9e57fd89`),
+  informed-decision 4, including one `managing-controller` in its own release runbook (`7da9abe8`), approval-engine
+  3 (`41b19d89`), access-engine 2 (`abe7e149`) and key-cape 2 (`573f56a1`);
+- warden stripping every token variable: ops-warden (`4acb653c`, from T10 O2);
+- audit-core's seeder hard-coded path: the lint reports it under `one-cluster-route` in `9e57fd89`.
+
+**Observed, not caused here:** `sso-mfa/k8s/keycape` and `sso-mfa/k8s/lldap` have 7 failing tests and 11 that can't
+be collected (`warden` not importable), identical before and after this change. No CI runs them. That's a candidate
+for an ad hoc task.
+
 ### Multi-repo worker protocol
 
 ```task