diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index d07c189..73b0bf4 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -769,7 +769,8 @@ evidence: paste the same lines. The receipt stays outside Git (mode 0400).
 ### Founder runbook: production SSO-down walk (read-only)
 
 The walk uses the static-key `k3s-api-railiance01` tunnel and the admin kubeconfig. Local port 18200 is taken by
-a tunnel, so the port-forward uses 18210. There is no unseal, no generate-root attempt and no token on
+a tunnel, so the port-forward maps the break-glass listener 8210 to 18210 and the main listener 8200 to 18201
+(RAPP-OPENBAO-WP-0003, live since 2026-10-28). There is no unseal, no generate-root attempt and no token on
 production.
 
 ```bash
@@ -778,12 +779,14 @@ export KUBECONFIG=~/.kube/config-railiance01
 kubectl -n openbao get pod openbao-0 -o wide
 kubectl -n openbao exec openbao-0 -- bao status -format=json \
   | jq '{initialized, sealed, t, n, version, ha_enabled}'          # exit 2 only means sealed
-kubectl -n openbao port-forward pod/openbao-0 18210:8200 >/dev/null 2>&1 & PF=$!; sleep 3
-curl -sS http://127.0.0.1:18210/v1/sys/seal-status | jq '{initialized, sealed, t, n}'
-curl -sS -o /dev/null -w 'generate-root status GET: %{http_code}\n' \
-  http://127.0.0.1:18210/v1/sys/generate-root/attempt                # 405 = unauthenticated generate-root disabled
+kubectl -n openbao port-forward pod/openbao-0 18210:8210 18201:8200 >/dev/null 2>&1 & PF=$!; sleep 3
+curl -sS http://127.0.0.1:18201/v1/sys/seal-status | jq '{initialized, sealed, t, n}'
+curl -sS -o /dev/null -w 'break-glass listener generate-root status GET: %{http_code}\n' \
+  http://127.0.0.1:18210/v1/sys/generate-root/attempt                # expect 200: ceremony available
+curl -sS -o /dev/null -w 'main listener generate-root status GET: %{http_code}\n' \
+  http://127.0.0.1:18201/v1/sys/generate-root/attempt                # expect 405: refused without a token
 kill "$PF"; unset KUBECONFIG
 ```
 
-**Paste back** the pod line, the two `jq` outputs and the `generate-root status GET` code. Record them in the
+**Paste back** the pod line, the two `jq` outputs and both `generate-root status GET` codes. Record them in the
 NK-WP-0055-T13 post-event review record. The GET only reads status and starts nothing.