diff --git a/docs/evidence/2026-09-23-eso-db-token-periodic.status b/docs/evidence/2026-09-23-eso-db-token-periodic.status
new file mode 100644
index 0000000..58a599a
--- /dev/null
+++ b/docs/evidence/2026-09-23-eso-db-token-periodic.status
@@ -0,0 +1,22 @@
+BAO_ADDR=http://127.0.0.1:18200 remote=railiance01 period=168h lanes=audit-core canned-prompts core-hub sbom-nexus tenant-engine
+  renewable=True period=604800 policies=default,external-secrets-audit-core orphan=True
+audit-core: minted periodic and verified
+audit-core: secret openbao-audit-core-eso-token applied
+audit-core: annotation check clean
+  renewable=True period=604800 policies=default,external-secrets-canned-prompts-database orphan=True
+canned-prompts: minted periodic and verified
+canned-prompts: secret openbao-canned-prompts-eso-token applied
+canned-prompts: annotation check clean
+  renewable=True period=604800 policies=default,external-secrets-core-hub-database orphan=True
+core-hub: minted periodic and verified
+core-hub: secret openbao-core-hub-eso-token applied
+core-hub: annotation check clean
+  renewable=True period=604800 policies=default,external-secrets-sbom-nexus-database orphan=True
+sbom-nexus: minted periodic and verified
+sbom-nexus: secret openbao-sbom-nexus-eso-token applied
+sbom-nexus: annotation check clean
+  renewable=True period=604800 policies=credential-broker-tenant-engine-migration,credential-broker-tenant-engine-runtime,default orphan=True
+tenant-engine: minted periodic and verified
+tenant-engine: secret openbao-tenant-engine-eso-token applied
+tenant-engine: annotation check clean
+exit 0
diff --git a/workplans/RPF-WP-0046-eso-database-token-renewal.md b/workplans/RPF-WP-0046-eso-database-token-renewal.md
index f9c1212..4febfb6 100644
--- a/workplans/RPF-WP-0046-eso-database-token-renewal.md
+++ b/workplans/RPF-WP-0046-eso-database-token-renewal.md
@@ -88,7 +88,7 @@ parity with the CronJob mounts is tested.
 
 ```task
 id: RPF-WP-0046-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "211bc548-34af-5f3a-ab2c-bf29d33f97ad"
 ```
@@ -145,7 +145,7 @@ extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not
 
 ```task
 id: RPF-WP-0046-T05
-status: wait
+status: done
 priority: high
 state_hub_task_id: "acf49bee-e40a-533c-b1f0-4152c989211d"
 ```
@@ -194,3 +194,19 @@ state_hub_task_id: "2f528e56-ebf0-547e-8d4f-3cb34c348d46"
 - **Rollback.** Suspend the CronJob, or delete the Application with prune.
   Re-minting 768h tokens with rapp-postgres `apply-eso-token-attended.sh`
   restores today's state.
+
+## Execution record — 2026-09-23 (founder go-ahead)
+
+- **T03 done.** Attended periodic re-mint at about 22:40Z. For all five lanes:
+  `renewable=True`, `period=604800`, policies unchanged, `orphan=True`, and
+  each Secret was applied clean (no last-applied annotation). The script
+  exited 0. Trace: `docs/evidence/2026-09-23-eso-db-token-periodic.status`.
+  After a forced refresh, all six stores are `Valid` and 13 ExternalSecrets
+  synced at 22:40:51–55Z. A second renewer Job returned `ttl: 604800` for
+  every lane.
+- **T05 done.** Rolling restarts, one at a time, all rolled out and 1/1 Ready:
+  canned-prompts, audit-core, sbom-nexus, tenant-engine. core-hub-api and
+  core-hub-api-candidate stayed 1/1 without a restart (credential watcher).
+  State Hub `/repos` returns 200. No workload now depends on a lease from the
+  replaced max-TTL tokens. Those tokens expire on their own, from about
+  2026-10-10.