diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index bfef88a..5428e0e 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -237,7 +237,7 @@
 | task | RPF-WP-0069-T08 | done | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0069-T09 | wait | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
 | task | RPF-WP-0070-T01 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
-| task | RPF-WP-0070-T02 | progress | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
+| task | RPF-WP-0070-T02 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
 | task | RPF-WP-0070-T03 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
 | task | RPF-WP-0070-T04 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
 | task | RPF-WP-0070-T05 | todo | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
diff --git a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
index f9e80d7..5a09257 100644
--- a/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
+++ b/credential-change-requests/CCR-2026-0062-mas-backup-primary.yaml
@@ -178,6 +178,15 @@
         "details": [
           "Founder approved node execution for this delivery in an attended session. source_ref founder-node-admission-2026-11-03."
         ]
+      },
+      {
+        "at": "2026-11-03T04:53:27Z",
+        "actor": "User (platform-owner)",
+        "kind": "node_delivery",
+        "result": "passed",
+        "details": [
+          "Admitted export sha256 16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372; KV version 1 delivered to /etc/mas-backup/primary.env root:root 0600 in a 0700 directory; readback equal; token revoked. Receipt docs/evidence/mas-backup-node-delivery-2026-11-03.json."
+        ]
       }
     ],
     "activation_conditions": [
diff --git a/docs/evidence/mas-backup-node-delivery-2026-11-03.json b/docs/evidence/mas-backup-node-delivery-2026-11-03.json
new file mode 100644
index 0000000..128c667
--- /dev/null
+++ b/docs/evidence/mas-backup-node-delivery-2026-11-03.json
@@ -0,0 +1,28 @@
+{
+  "schema": "platform.application-backup-credential-delivery.v1",
+  "runner": "attended: founder ran /opt/railiance-platform/scripts/application_backup_credentials.py --execute as root on railiance01",
+  "delivery_source_sha256": "b4a9622f2afe122b3aadbb7d2a818b8b7a92d248f2c9d6a9105460f452b2872e",
+  "delivery": {
+    "application": "mas",
+    "ccr": "CCR-2026-0062",
+    "ccr_sha256": "16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372",
+    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+    "delivered_at": "2026-11-03T04:53:27.406627+00:00",
+    "directory_mode": "0700",
+    "kv_path": "platform/workloads/mas/backup-primary",
+    "kv_version": 1,
+    "mode": "0600",
+    "outcome": "created",
+    "owner": "root:root",
+    "readback_equal": true,
+    "status": "delivered",
+    "target": "/etc/mas-backup/primary.env",
+    "token_revoked": true
+  },
+  "node_check": {
+    "/etc/mas-backup": "root:root 700",
+    "/etc/mas-backup/primary.env": "root:root 600, 98 bytes",
+    "/etc/mas-backup/credential-reader.json": "admitted CCR export, root:root 600"
+  },
+  "values_recorded": false
+}
diff --git a/workplans/RPF-WP-0070-mas-evidence-recovery.md b/workplans/RPF-WP-0070-mas-evidence-recovery.md
index 69622af..78bde02 100644
--- a/workplans/RPF-WP-0070-mas-evidence-recovery.md
+++ b/workplans/RPF-WP-0070-mas-evidence-recovery.md
@@ -140,11 +140,11 @@ was not read or copied. Delivery admission stays false, and
 
 ```task
 id: RPF-WP-0070-T02
-status: progress
+status: done
 priority: medium
 needs_human: true
 depends_on: [RPF-WP-0070-T01]
-intervention_note: "Admission set 2026-11-03; admitted CCR export SHA256 16dbfe197b6f42e24bcd7d23e81e5d699ec7d3eb17e7a5177415e5d757a1a372. Next: attended root run of scripts/application_backup_credentials.py --application mas --expected-kv-version 1 --execute on railiance01, then record the metadata receipt."
+intervention_note: "Done 2026-11-03: /etc/mas-backup/primary.env delivered (KV v1, root:root 0600, readback equal, token revoked). Receipt docs/evidence/mas-backup-node-delivery-2026-11-03.json."
 state_hub_task_id: "c8a9ba31-9fb6-5412-90b7-dea658943053"
 ```
 
@@ -182,6 +182,15 @@ passes the delivery helper's execute-mode contract check. The delivery
 helper source is `b4a9622f2afe122b3aadbb7d2a818b8b7a92d248f2c9d6a9105460f452b2872e`.
 `/etc/mas-backup` does not exist on the node yet.
 
+2026-11-03 04:53Z: the founder installed the admitted export as
+`/etc/mas-backup/credential-reader.json` and the delivery helper at
+`/opt/railiance-platform/scripts/application_backup_credentials.py`. Both
+hashes were checked on the node. The delivery ran as root and recorded:
+status `delivered`, outcome `created`, KV version 1, `readback_equal`,
+`token_revoked`. The node check shows `/etc/mas-backup` root:root 0700 and
+`primary.env` root:root 0600 at 98 bytes. T02 is done. Receipt:
+`docs/evidence/mas-backup-node-delivery-2026-11-03.json`.
+
 ## Install the worker and publish the first offsite copy
 
 ```task