diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index 73b0bf4..335e938 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -708,6 +708,19 @@ No live run is part of the source preparation.
   fake held token (`drilled`, `valid: false`) and a wrong re-entered share (`aborted`, `generate_root_failed`).
   The native rehearsal uses local Docker with `--network none`, the pinned 2.5.4 image and generated material.
 
+### Drill result (2026-10-28)
+
+Attempt `RPF-WP-0064-T10-20261027-01`, admission `sha256:741fa571…ce7a`, adapter `3727f8b`, founder-run:
+**`drilled`** (`break_glass_drill_complete`) in 101 s. Receipt
+`sha256:e4591346e99b23e405f1cb69f6f5158dbdb7b5d69b2d1d7709c563a74cc18397` (outside Git, mode 0400) verified
+`PASS` in-run and again from a clean clone at `3727f8b`. Held initial root token valid as of the 2026-10-14
+snapshot (root, ttl 0, no expiry, orphan); fresh generate-root complete with re-entered shares, `sys/auth`
+read-only action ok, revoke-self 204, post-revoke lookup 403, cancel drilled; teardown complete, no volumes.
+The snapshot ciphertext was retrieved again from Storage Share (`/dev/shm` had been cleared) and the
+admission was rebuilt from the template with the `-03` receipt's snapshot facts. NetKingdom post-event
+record: `net-kingdom/docs/evidence/2026-10-28-king-path-drill.md`. Still open for T10: the read-only
+production SSO-down walk and the founder's decision on revoking the held root token on production.
+
 ### Founder runbook: drill (isolated restore on the workstation, never production)
 
 Run each block in your own terminal. Nothing below needs the cluster. Snapshot facts are reused from the