diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index c83eb72..b089e21 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -199,8 +199,8 @@
 | task | RPF-WP-0064-T04 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T05 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | task | RPF-WP-0064-T06 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
-| task | RPF-WP-0064-T07 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
-| task | RPF-WP-0064-T08 | wait | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
+| task | RPF-WP-0064-T07 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
+| task | RPF-WP-0064-T08 | done | — | workplans/RPF-WP-0064-isolated-original-openbao-restore.md |
 | intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
 | intake | RPF-IN-0002 | open | — | intakes/intakes.md |
 | intake | RPF-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index 4c15daf..f05a467 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -369,11 +369,10 @@ rather than repair. rapp-openbao was informed and may object; no rapp-openbao ch
 
 ```task
 id: RPF-WP-0064-T07
-status: wait
+status: done
 priority: high
 needs_human: true
 depends_on: [RPF-WP-0064-T05, RPF-WP-0064-T06]
-blocking_reason: "Requires the founder in attendance holding the offline railiance-backup.key, 2 of 3 original Shamir shares and the encrypted snapshot from railiance-backups/openbao/, inside the T05-signed window. No agent handles custody material."
 state_hub_task_id: "96e88167-c484-527c-84aa-0464dd0f5597"
 ```
 
@@ -402,6 +401,19 @@ source now carries production's file audit device, and a native regression case
 reseal (`leader_not_elected`, `sealed: true`), while the full restore passes with it. Offline 19 and native 13 pass.
 A `-03` admission is needed for the new adapter commit.
 
+2026-10-24 attempt `-03` (admission `3ef17fd1…4cc9`, adapter `7084b57`, founder attended): **`restored`,
+`all_required_objects_match`** in 46 s. Independently verified from a clean clone at `7084b57`: receipt
+`sha256:4e048deedda21aa35ea4ff811e437f9c0e546fbefe4eb8a2025a74bf65e2579d`, retained outside Git on the founder
+workstation (mode 0400). Original cluster id `fd28df5d…` matched, applied index 6040604 (not behind 6040594),
+leader elected in 2 s, the throwaway init was invalidated, the original shares unsealed, and all nine required
+objects were present and equal to the committed sources: auth mounts, secrets mounts, `keycape-services` JWT
+config and role `secrets-engine-openbao`, `netkingdom` OIDC config and role `platform-admin`, policy
+`secrets-engine-login-self`, and KV metadata `platform/workloads/keycape/secrets-engine-openbao` (no KV data read).
+The readback credential was revoked; networkless (`lo` only), no volumes, full teardown. Claims not made: consumer
+continuity, live JWT login, phase B network, owner acceptance, recurring restore assurance.
+T08 handoff: recorded in secrets-engine SECRETS-WP-0015-T04 and net-kingdom NK-WP-0049-T18 the same day.
+RPF-WP-0036-T03 may point to this receipt as a one-off; it is not recurring assurance.
+
 Run the admitted adapter once. The outcome is a T03 receipt verified
 independently. The receipt is kept outside Git and referenced by its hash. A
 missing object or failed check is a valid `refused` outcome; it is not repaired
@@ -411,10 +423,9 @@ in this attempt.
 
 ```task
 id: RPF-WP-0064-T08
-status: wait
+status: done
 priority: medium
 depends_on: [RPF-WP-0064-T07]
-blocking_reason: "Needs the verified T07 receipt."
 state_hub_task_id: "94139cb1-037a-58ef-883c-dde71fe6bfde"
 ```