diff --git a/docs/evidence/2026-09-15-openbao-public-listener-retract.json b/docs/evidence/2026-09-15-openbao-public-listener-retract.json
new file mode 100644
index 0000000..ce0646f
--- /dev/null
+++ b/docs/evidence/2026-09-15-openbao-public-listener-retract.json
@@ -0,0 +1,16 @@
+{
+  "schema": "railiance-platform.openbao-public-listener-retract.v1",
+  "observed_at": "2026-09-15T00:35:25.995371+00:00",
+  "confirm_phrase_used": "RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER",
+  "operator_login_verified": true,
+  "ingress_name": "openbao/openbao-ui-gateway",
+  "ingress_present_after": false,
+  "public_url": "https://bao.coulomb.social/",
+  "public_http_code": "404",
+  "private_presets_http_code": "200",
+  "gateway_ready_replicas": "1/1",
+  "gateway_service_type": "ClusterIP",
+  "named_tunnel": "openbao-ui-railiance01",
+  "status_ok": true,
+  "credential_values_emitted": false
+}
diff --git a/docs/openbao-public-listener-transition.md b/docs/openbao-public-listener-transition.md
index 505c8c1..0ddd776 100644
--- a/docs/openbao-public-listener-transition.md
+++ b/docs/openbao-public-listener-transition.md
@@ -1,6 +1,8 @@
 # OpenBao public-listener transition
 
-Status: source implementation complete; live retraction held.
+Status: live retraction applied 2026-09-15. Public Ingress absent; private
+ClusterIP gateway and `openbao-ui-railiance01` remain. DNS withdrawal is a
+separate railiance-infra handoff.
 
 This is the S3-owner procedure for `RMASTER-WP-0020-T09`. It preserves the
 OpenBao Deployment, the `openbao-ui-gateway` Deployment, and its ClusterIP
diff --git a/workplans/README.md b/workplans/README.md
index bf7d86d..5737a07 100644
--- a/workplans/README.md
+++ b/workplans/README.md
@@ -9,7 +9,7 @@ plans is not a count of missing implementations or independent incidents.
 | --- | --- | --- |
 | [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
 | [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup cutover and full offsite application recovery complete; old share invalidation receipt remains | S3 retains custody acceptance; S1 and forge own their backup execution. |
-| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
+| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Public Ingress retracted 2026-09-15; private tunnel remains | DNS withdrawal with railiance-infra; rollback phrase still available. |
 | [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; registered load driver exists; fresh sender/window/abort approvals and custody readiness remain | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
 | [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | Three remaining lanes: secrets-engine JWT, Fluid operator KV, KeyCape approval clients | Signing T04 is complete; T05 admission answered and awaiting owner approval plus a founder-attended window. |
 | [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. |
diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
index 44dc5d9..cb25b84 100644
--- a/workplans/RPF-WP-0025-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Retract public OpenBao listener behind operator-only access"
 domain: financials
 repo: railiance-platform
-status: blocked
+status: active
 flavor: implementation
 owner: codex
 topic_slug: railiance
@@ -55,7 +55,7 @@ It deletes only the Ingress and provides an exact rollback path.
 
 ```task
 id: RPF-WP-0025-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
 ```
@@ -143,7 +143,12 @@ OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
 
 Operator reported 2026-09-15 loopback UI MFA at `http://127.0.0.1:18200`
 succeeded (boolean only; no token or screenshot). Named tunnel remains
-lifecycle-healthy and public Ingress is still present. Guarded retraction is
-the next hold: it requires the exact confirm phrase
-`RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER`. Do not treat the UI
-login "yes" as that phrase.
+lifecycle-healthy. Guarded retraction ran after the exact confirm phrase
+`RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER`. Ingress
+`openbao/openbao-ui-gateway` is absent; ClusterIP gateway 1/1 Ready; named
+tunnel healthy; private presets HTTP 200; public `https://bao.coulomb.social/`
+HTTP 404. Evidence:
+`docs/evidence/2026-09-15-openbao-public-listener-retract.json`.
+Remaining T03: public DNS withdrawal with railiance-infra and non-secret
+acceptance to Railiance Master. Rollback phrase remains available during the
+observation window.