diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
index 294f528..44dc5d9 100644
--- a/workplans/RPF-WP-0025-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -140,3 +140,10 @@ envelope. Public Ingress still present. CLI `bao login` used the contained
 OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
 `http://127.0.0.1:18200` before guarded retraction. Evidence:
 `docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json`.
+
+Operator reported 2026-09-15 loopback UI MFA at `http://127.0.0.1:18200`
+succeeded (boolean only; no token or screenshot). Named tunnel remains
+lifecycle-healthy and public Ingress is still present. Guarded retraction is
+the next hold: it requires the exact confirm phrase
+`RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER`. Do not treat the UI
+login "yes" as that phrase.