diff --git a/workplans/SECRETS-WP-0002-bootstrap.md b/workplans/SECRETS-WP-0002-bootstrap.md
index 1a89ced..9279929 100644
--- a/workplans/SECRETS-WP-0002-bootstrap.md
+++ b/workplans/SECRETS-WP-0002-bootstrap.md
@@ -7,7 +7,7 @@ repo: secrets-engine
 status: finished
 owner: codex
 created: "2026-06-28"
-updated: "2026-06-28"
+updated: "2026-09-28"
 state_hub_workstream_id: "6c9a8c0d-18b5-41ac-8cd5-a8e84fb286b4"
 ---
 
@@ -289,3 +289,19 @@ Acceptance:
   either working or blocked only on an explicit external condition.
 - ops-warden can route the request to secrets-engine and report readiness.
 - Bootstrap credentials are documented, bounded, and scheduled for removal.
+
+
+## Historical State Hub duplicate reconciled — 2026-09-28
+
+Historical duplicate of SECRETS-WP-0002. Canonical file binding:
+workplans/SECRETS-WP-0002-bootstrap.md, workplan UUID
+6c9a8c0d-18b5-41ac-8cd5-a8e84fb286b4. Reviewed 2026-09-28: all ten task record IDs,
+titles and done statuses match the canonical tasks. Archived duplicate only; task UUIDs
+and historical references retained. This record is not a second completed workplan. The
+canonical record retains its historical secrets-wp-0001 slug; file identity and UUID
+govern. C-08 remains expected historical information until State Hub supports
+reference-preserving deduplication.
+
+No task status or file UUID was changed. The public DELETE endpoint also only
+archives; it does not merge task/evidence references or remove the record. No
+new workplan was created to give the duplicate a misleading backing file.