diff --git a/.custodian-brief.md b/.custodian-brief.md
index 739c57e..4be7fc6 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-apps
 
 **Domain:** financials  
-**Last synced:** 2026-10-17 09:25 UTC  
+**Last synced:** 2026-10-17 09:32 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -19,7 +19,7 @@ Progress: 0/5 done  |  workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`
   *(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)*
 - ! T04 — Decide on local password sign-in  `728786c9`
   *(wait: Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record.)*
-- · Tasks  `98004ed0`
+- ► Tasks  `98004ed0`
 
 ### Coulomb-social persistent personal workspace release
 Progress: 3/4 done  |  workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1`
@@ -36,8 +36,8 @@ Progress: 2/3 done  |  workplan_id: `c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57`
 
 ## Inbox Hygiene
 
-**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 4 unread message(s) lack supersession chains.
+**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index deccb0e..f56782b 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -38,7 +38,7 @@
 | task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
 | task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
 | task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
-| task | RAPPS-WP-0016-T01 | todo | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
+| task | RAPPS-WP-0016-T01 | progress | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
 | task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
diff --git a/docs/evidence/2026-10-17-forgejo-breakglass-signin.json b/docs/evidence/2026-10-17-forgejo-breakglass-signin.json
new file mode 100644
index 0000000..8a208f4
--- /dev/null
+++ b/docs/evidence/2026-10-17-forgejo-breakglass-signin.json
@@ -0,0 +1,18 @@
+{
+  "schema": "railiance-apps.forgejo-breakglass-signin.v1",
+  "task": "RAPPS-WP-0016-T01",
+  "forgejo": "https://forgejo.coulomb.social",
+  "account": "forgejo_admin",
+  "auth": "local password (API basic auth)",
+  "http_status": 200,
+  "login_matches": true,
+  "is_admin": true,
+  "custody": {
+    "openbao_path": "platform/workloads/forgejo/break-glass-admin",
+    "field": "PASSWORD",
+    "version": "1"
+  },
+  "verified_at": "2026-10-17T09:41:18Z",
+  "result": "pass",
+  "values_emitted": false
+}
diff --git a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
index dc11cf9..4640b64 100644
--- a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
+++ b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
@@ -48,9 +48,7 @@ side is key-cape `KEY-WP-0038`.
 
 ```task
 id: RAPPS-WP-0016-T01
-status: progress
-needs_human: true
-blocking_reason: "Tooling and runbook ready; founder runs make forgejo-breakglass-seal and make forgejo-breakglass-verify."
+status: done
 priority: high
 state_hub_task_id: "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7"
 ```
@@ -65,11 +63,16 @@ sign-in and record it without the credential.
 Acceptance: a recorded break-glass sign-in, with the recovery path written down.
 This is the "never lock ourselves out" floor for every later step.
 
+Done 2026-10-17: founder sealed `forgejo_admin` into OpenBao
+`platform/workloads/forgejo/break-glass-admin` (version 1) and verified a local
+sign-in (HTTP 200, site admin): `docs/evidence/2026-10-17-forgejo-breakglass-signin.json`.
+Recovery path: `docs/forgejo-on-railiance01.md` § Break-glass administrator.
+
 ```task
 id: RAPPS-WP-0016-T02
 status: wait
 depends_on: [RAPPS-WP-0016-T01, KEY-WP-0038-T02]
-blocking_reason: "Needs break-glass in place and the NetKingdom client registered with its secret in custody."
+blocking_reason: "Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02)."
 priority: high
 state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
 ```