diff --git a/inventory/history-exposure-2026-10-08.md b/inventory/history-exposure-2026-10-08.md
index 230a91e..05eda5a 100644
--- a/inventory/history-exposure-2026-10-08.md
+++ b/inventory/history-exposure-2026-10-08.md
@@ -14,8 +14,8 @@ invalidated at the provider in September; everything else is benign.
 
 | Repository | File | Since | In current HEAD |
 | --- | --- | --- | --- |
-| railiance-bootstrap | `tools/cmd/railiance-backup` line 11 | commit `4381a07`, 2026-02-25 | yes |
-| railiance-cluster | `tools/cmd/railiance-backup` line 11 | same value; file last changed 2026-07-07 | yes |
+| railiance-bootstrap | `tools/cmd/railiance-backup` line 11 | commit `4381a07`, 2026-02-25 | removed 2026-10-08 (`25d2154`) |
+| railiance-cluster | `tools/cmd/railiance-backup` line 11 | same value in history; removed from the file on 2026-07-07 | no |
 
 `NC_TOKEN`, next to a Nextcloud URL, is the upload target for the backup tool. It
 has been readable anonymously since February.
@@ -31,10 +31,12 @@ Value identity was not compared (RPF-WP-0029 forbids recording fingerprints),
 so the founder confirms in Nextcloud that no personal share remains on the
 backup folder.
 
-Remaining: **cleanup, not rotation.** Remove the literal from both
-`railiance-backup` copies (read the governed lane, as `forgejo-backup` does) or
-retire the script. Routed to railiance-bootstrap and railiance-cluster (hub
-messages, with a correction to the first "revoke now" wording).
+**Cleanup done 2026-10-08.** railiance-cluster's HEAD was already clean: since
+2026-07-07 it reads `RAILIANCE_BACKUP_NC_TOKEN` or the governed lane, and only
+its history holds the literal. railiance-bootstrap's copy still had the literal;
+it now matches railiance-cluster's version (commit `25d2154`) and refuses to run
+without credentials. The founder confirmed the provider side is settled. History
+keeps the dead value; nothing further is required.
 
 ### Benign (no action)
 
diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
index 86b94f9..b295b49 100644
--- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
+++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md
@@ -200,8 +200,9 @@ backup token (`NC_TOKEN`) hardcoded in `tools/cmd/railiance-backup` in
 railiance-bootstrap and railiance-cluster, public since 2026-02-25 and still in
 HEAD. It is the predecessor credential of railiance-platform RPF-WP-0029,
 whose old share was attested unshared on 2026-09-15; what remains is removing
-the literal (routed to both owners), plus a founder check in Nextcloud that no
-personal share remains. The
+the literal: railiance-cluster had already done it (2026-07-07), and
+railiance-bootstrap was cleaned on 2026-10-08 (`25d2154`). The founder confirmed
+the provider side. The
 rest is benign (identifiers, digests, test fixtures, placeholders). Record and
 limits: `inventory/history-exposure-2026-10-08.md`. The rotation is tracked with
 the owners.