diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index c6fc4f5..889628a 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -227,11 +227,12 @@
 | task | RPF-WP-0068-T03 | wait | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0068-T04 | todo | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
 | task | RPF-WP-0069-T01 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
-| task | RPF-WP-0069-T02 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
+| task | RPF-WP-0069-T02 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T03 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T04 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T05 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
-| task | RPF-WP-0069-T06 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
+| task | RPF-WP-0069-T06 | cancel | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
+| task | RPF-WP-0069-T07 | todo | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
 | intake | RPF-IN-0002 | open | — | intakes/intakes.md |
 | intake | RPF-IN-0003 | open | — | intakes/intakes.md |
diff --git a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml
index 79bcaf2..67f904d 100644
--- a/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml
+++ b/credential-change-requests/CCR-2026-0058-net-kingdom-bind-executor-svc-authelia-write.yaml
@@ -24,6 +24,13 @@ review:
     decision: approved
     comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
       role, bind self-rotation) for NK-WP-0056-T06.
+  - at: '2026-10-31T14:27:33+00:00'
+    reviewer: net-kingdom-owner
+    decision: approved
+    comment: Approved by the founder in session 2026-10-31 as amended (window-scoped
+      role, bind self-rotation) for NK-WP-0056-T06. Recorded by hand in the approve
+      tool's format; the tool refuses the second approval for this request type once the
+      first sets status approved.
 target:
   domain: infotech
   tenant: platform
diff --git a/workplans/RPF-WP-0069-bounded-executor-lanes.md b/workplans/RPF-WP-0069-bounded-executor-lanes.md
index 2cb4d53..77825ae 100644
--- a/workplans/RPF-WP-0069-bounded-executor-lanes.md
+++ b/workplans/RPF-WP-0069-bounded-executor-lanes.md
@@ -43,7 +43,7 @@ dispatch in `scripts/credential-change.py`); CCR-2026-0058 drafted `proposed` wi
 
 ```task
 id: RPF-WP-0069-T02
-status: wait
+status: done
 priority: high
 needs_human: true
 decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
@@ -105,7 +105,7 @@ ESO into `sso/nk-bind-executor-audit`, ClusterSecretStore restricted to `sso`.
 
 ```task
 id: RPF-WP-0069-T06
-status: wait
+status: cancel
 priority: medium
 needs_human: true
 decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
@@ -116,3 +116,24 @@ state_hub_task_id: "1456b467-f7c9-529d-9f3e-39404aaa36c6"
 
 After secrets-engine answers the lane shape for the executor's LLDAP credential (its Q2),
 draft the custody CCR here.
+
+## Founder decisions 2026-10-31
+
+Approved as `ready`. CCR-2026-0058 amended to a window-scoped role (created per admitted run, deleted after the
+receipt; hub decision c29c6eda) and approved by platform-owner and net-kingdom-owner. T06 is cancelled: the bind
+rotates its own password (hub decision 3d0c8f86), so the executor needs no LLDAP custody lane.
+
+## Approve tool refuses the second approval for workload-kv-write-next-version
+
+```task
+id: RPF-WP-0069-T07
+status: todo
+priority: medium
+```
+
+`credential-change.py approve` sets `status: approved` after the first reviewer; for this request type, validation
+then requires every role approval, so the second `approve` is refused before it can record itself (CCR-2026-0058's
+net-kingdom-owner approval was recorded by hand in the tool's format). Make validation accept an `approved` request
+that is still collecting role approvals, or have `approve` set `approved` only once all required roles are present,
+with a test.
+