diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 9dc28cc..a227f8a 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -204,7 +204,7 @@
 | task | RPF-WP-0064-T07 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T08 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T09 | todo | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
-| task | RPF-WP-0064-T10 | progress | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
+| task | RPF-WP-0064-T10 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0065-T01 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
 | task | RPF-WP-0065-T02 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
 | task | RPF-WP-0065-T03 | done | — | workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md |
diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index f570b61..cef42b8 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -588,7 +588,7 @@ packet or of the other three services.
 
 ```task
 id: RPF-WP-0064-T10
-status: progress
+status: done
 priority: high
 depends_on: [RPF-WP-0064-T08]
 state_hub_task_id: "5facf182-91fb-58bc-a2dd-c6724049e70f"
@@ -718,8 +718,11 @@ snapshot (root, ttl 0, no expiry, orphan); fresh generate-root complete with re-
 read-only action ok, revoke-self 204, post-revoke lookup 403, cancel drilled; teardown complete, no volumes.
 The snapshot ciphertext was retrieved again from Storage Share (`/dev/shm` had been cleared) and the
 admission was rebuilt from the template with the `-03` receipt's snapshot facts. NetKingdom post-event
-record: `net-kingdom/docs/evidence/2026-10-28-king-path-drill.md`. Still open for T10: the read-only
-production SSO-down walk and the founder's decision on revoking the held root token on production.
+record: `net-kingdom/docs/evidence/2026-10-28-king-path-drill.md`. Production SSO-down walk (2026-10-28, founder-run, read-only, static-key tunnel plus admin kubeconfig):
+`openbao-0` Running, OpenBao 2.5.4 initialized and unsealed, threshold 2 of 3, HA enabled; break-glass listener
+8210 `generate-root` status **200**, main listener 8200 **405**. Root-token disposition: founder decision
+`7ce684ec`, escrowed until production entry, then revoked with `scripts/openbao_revoke_initial_root_token.py`
+(NK-WP-0055-T16). T10 is done.
 
 ### Founder runbook: drill (isolated restore on the workstation, never production)