diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
index 36745ae..648f82e 100644
--- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
@@ -4,8 +4,8 @@ type: workplan
 title: "Coordinate audit-core temporary custody and recovery exercises"
 domain: financials
 repo: railiance-platform
-status: blocked
-flavor: implementation
+status: backlog
+flavor: residual
 owner: codex
 topic_slug: railiance
 created: "2026-08-22"
@@ -360,3 +360,8 @@ outage exercise; no historical window or terminal NO-GO may be reused.
 ## Loose-end review — 2026-09-27
 
 T02/T03 remain waiting on fresh attended execution windows, named abort operators, current custody/quorum evidence and owner execution. The implemented load driver and prior procedure approvals do not supply a fresh live recovery receipt. No expired window was reused.
+
+> 2026-10-11: demoted to `flavor: residual` / `backlog` by founder-authorized triage — off the
+> critical path (identity → authz → secrets → SecurityCase execution). Tasks are unchanged;
+> promote back when demand or risk appears. See the-custodian
+> `history/20261011-netkingdom-security-progress-assessment.md`.