diff --git a/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
index ae64d9c..dfdca0c 100644
--- a/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
@@ -245,6 +245,22 @@ role, but this receipt authorizes no seal, unseal, restore, reboot, or other
 live execution; the final scenario still requires the independent quorum gate,
 fully parameterized green preflight, and an exact human GO.
 
+**WP0027 live attempt terminal NO-GO (2026-08-23):** State Hub decision
+`449a697a-5303-4582-aa9e-b0bc8b35ab2d` opened the bounded live window and the
+fully parameterized preflight reran green at `2026-08-22T22:55:11Z`. At the
+live hold point, the governed attended-login adapter authenticated but could
+not persist its token helper into the agent's read-only home and unexpectedly
+emitted the short-lived credential into captured output despite the no-print
+contract. The token was immediately self-revoked and the drill stopped before
+seal. Post-abort status proved OpenBao remained initialized and unsealed with
+zero unseal progress; no seal, unseal, reboot, restore, policy, PVC, or general
+workload mutation occurred. Metadata-only NO-GO receipts were sent to
+ops-warden (`b04e92bc-4523-4c3e-8d14-78de5da4e67e`) and railiance-infra
+(`5264d499-0ee2-40b5-bffd-f1f875718153`). The decision is consumed and must not
+be retried. A future window requires a login adapter that proves isolated
+writable token-helper state and output suppression on persistence failure,
+followed by fresh owner receipts and a fresh human decision.
+
 ## T04 — Route the contracts and approval gates
 
 ```task