diff --git a/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json b/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json
new file mode 100644
index 0000000..d051928
--- /dev/null
+++ b/docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json
@@ -0,0 +1,12 @@
+{
+  "schema": "railiance-platform.openbao-loopback-callback.v1",
+  "observed_at": "2026-09-15T00:25:52.017810+00:00",
+  "role": "auth/netkingdom/role/platform-admin",
+  "callback": "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
+  "status": "already_present",
+  "changed": false,
+  "credential_values_emitted": false,
+  "warden_exit": 0,
+  "session_revoked_by_envelope": true,
+  "ingress_mutated": false
+}
diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
index 9c8bad1..294f528 100644
--- a/workplans/RPF-WP-0025-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -131,3 +131,12 @@ required exact dict equality; that path was never live-proven and can fail on
 read-only/normalized fields. No retained helper. Retry uses the same envelope
 with `--receipt` and a field-preserving write. Do not retract Ingress from this
 failed attempt.
+
+Third attended attempt, 2026-09-15T00:25:52Z: Warden exit 0. Receipt status
+`already_present` for
+`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` on
+`auth/netkingdom/role/platform-admin`. No role write. Session revoked by the
+envelope. Public Ingress still present. CLI `bao login` used the contained
+OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
+`http://127.0.0.1:18200` before guarded retraction. Evidence:
+`docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json`.