diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
index 010eaca..711668c 100644
--- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
@@ -422,3 +422,15 @@ Round 3 (2026-10-14): all five owners approved contract 1c08ba7a (railiance-plat
 railiance-infra 28d6a25a, railiance-platform 61b97f96. Procedure approval only.
 Founder checklist and remaining window gates: docs/rpf-wp-0015-attended-windows.md.
 T02 and T03 stay `wait` until their attended windows run.
+
+Round 4 (2026-10-14, railiance-platform 311aa86, contract 96deddba): T02 now runs only
+inside the contained ops-warden login (the harness had pointed at the retracted public
+OpenBao URL) via one silent `scripts/t02-attended-window.py`. All five owners approved:
+audit-core 5fe769a7, rapp-postgres f13ec9dd, railiance-cluster fb8f25df,
+railiance-infra 248e6f4d, railiance-platform 18e59587. ops-warden 6e14300 is pushed
+and installed; the installed-warden gate verifies (33 modules). Non-blocking hardening
+follow-ups (to batch with the next reviewed change): minimal driver environment;
+catch-all in the window `main()` so it can never print; do not echo child stderr into
+`--abort-reason`; distinct remote port; runbook: check `abort_cleanup_failed` after any
+non-zero exit; failing-pod diff by owning controller; namespaced SecretStores in the ESO
+inventory.