diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index d7c51c4..12fdaab 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -12,7 +12,7 @@
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
 | workplan | RAILIANCE-WP-0018 | finished | — | workplans/RAILIANCE-WP-0018-first-wave-repo-family-materialization.md |
 | workplan | RAILIANCE-WP-0019 | finished | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
-| workplan | RAILIANCE-WP-0020 | active | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| workplan | RAILIANCE-WP-0020 | backlog | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | ADHOC-2026-07-30-T01 | done | — | workplans/ADHOC-2026-07-30.md |
 | task | RAILIANCE-WP-0017-T01 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
 | task | RAILIANCE-WP-0017-T02 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
@@ -44,4 +44,4 @@
 | task | RAILIANCE-WP-0020-T05 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T06 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T07 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
-| task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| task | RAILIANCE-WP-0020-T08 | todo | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
diff --git a/activity-definitions/openbao-retention-closeout.md b/activity-definitions/openbao-retention-closeout.md
new file mode 100644
index 0000000..02b49e5
--- /dev/null
+++ b/activity-definitions/openbao-retention-closeout.md
@@ -0,0 +1,32 @@
+---
+id: "e274defb-28f2-571e-abcb-c17b57eab473"
+name: "RAILIANCE-WP-0020 OpenBao Retention Closeout"
+type: activity-definition
+version: "1.0"
+enabled: true
+owner: railiance-master
+governance: custodian
+status: active
+created: "2026-08-04"
+trigger:
+  type: scheduled
+  at: "2026-08-17T08:00:00+02:00"
+  timezone: Europe/Berlin
+---
+
+# RAILIANCE-WP-0020 OpenBao retention closeout
+
+One-shot reactivation after the shortened 14-day reversible-retirement window.
+It emits a claimable Activity Core ops run for the remaining cleanup task; it
+does not delete CoulombCore resources automatically.
+
+```rule
+id: reactivate-openbao-retention-closeout
+condition: ""
+action:
+  task_template: "Reactivate RAILIANCE-WP-0020 for OpenBao retention closeout"
+  description: "Move RAILIANCE-WP-0020 from backlog to active, run the railiance01 disaster-recovery drill, verify retained rollback requirements, and request fresh explicit approval before any destructive CoulombCore cleanup. Remaining task: RAILIANCE-WP-0020-T08."
+  target_repo: railiance-master
+  priority: medium
+  labels: ["railiance", "openbao", "retention", "reactivation", "RAILIANCE-WP-0020-T08"]
+```
diff --git a/docs/openbao-coulombcore-to-railiance01-runbook.md b/docs/openbao-coulombcore-to-railiance01-runbook.md
index f682e96..0197abd 100644
--- a/docs/openbao-coulombcore-to-railiance01-runbook.md
+++ b/docs/openbao-coulombcore-to-railiance01-runbook.md
@@ -21,7 +21,7 @@ not run on Knative or scale to zero.
 - The source remains unsealed and authoritative until the target passes two
   restart/unseal cycles and all private consumer waves pass. During cutover it
   is write-frozen, then scaled to zero while its PVCs, audit PVC, manifests,
-  TLS material, and encrypted snapshot remain retained for at least 30 days.
+  TLS material, and encrypted snapshot remain retained for at least 14 days.
 
 ## Proven preparation
 
@@ -94,7 +94,7 @@ railiance01 API and reviewer identity before use.
   snapshot over the retained source without a new reviewed recovery plan.
 - Target RTO is 60 minutes from an abort decision. RPO is the bounded final
   write-freeze window; the intended RPO is zero acknowledged writes.
-- Keep the stopped source state and final encrypted snapshot for at least 30
+- Keep the stopped source state and final encrypted snapshot for at least 14
   days. PVC, Raft, Secret, audit, or TLS deletion requires fresh explicit
   approval after a successful railiance01 disaster-recovery drill.
 
diff --git a/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md b/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
index 6212114..b6b46f7 100644
--- a/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
+++ b/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Migrate authoritative OpenBao from CoulombCore to reef-railiance"
 domain: financials
 repo: railiance-master
-status: active
+status: backlog
 owner: codex
 topic_slug: railiance
 created: "2026-07-30"
@@ -237,7 +237,7 @@ post-retirement public probe returned HTTP 200 from railiance01 with valid TLS.
 
 ```task
 id: RAILIANCE-WP-0020-T08
-status: wait
+status: todo
 priority: medium
 state_hub_task_id: "1dc50d98-64e8-4755-a52e-2b94b765019e"
 ```