RPF-WP-0015-T02: record aborted attended window (two live lease handles), clean cleanup

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 680842@bnt-lap001
Assistant-Session: 54eb9e8e-7d6b-4f0c-b7a6-a6db62075883

workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md

@@ -434,3 +434,17 @@ catch-all in the window `main()` so it can never print; do not echo child stderr
 `--abort-reason`; distinct remote port; runbook: check `abort_cleanup_failed` after any
 non-zero exit; failing-pod diff by owning controller; namespaced SecretStores in the ESO
 inventory.
+
+T02 attended window 2026-10-14 (approval rpf-wp-0015-t02-20261014t1615z-founder-go,
+founder GO in session, window 16:15–16:30Z, founder as abort operator): one contained
+login; projection and port-forward succeeded (audit-core restart #1), then the exercise
+refused before revocation because `database/creds/audit-core-runtime` had two live
+handles (ESO refresh 15m vs lease TTL 15m/max 1h overlap). Abort cleanup removed the
+one synthetic identity, restarted audit-core (1/1) and shredded the bearer; no lease was
+revoked and no secret value observed. Two earlier same-day launches failed closed before
+any action (a standing `OPENBAO_TOKEN` exported in the operator's shell profile, then a
+start before the window). Evidence: docs/evidence/2026-10-14-rpf-wp-0015-t02-window/.
+Next: select the handle coherent with the Secret refresh instead of requiring exactly
+one (owner re-review), then a new window. Follow-ups: ops-warden must also strip
+OPENBAO_TOKEN for attended children; the standing shell-profile token should be revoked
+and removed (founder).