diff --git a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
index fd0fc46..b22aa6a 100644
--- a/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
+++ b/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md
@@ -143,8 +143,12 @@ operator/ESO capability and nonmember checks remain independent acceptance.
 acknowledgment): the [infrastructure assessment](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/key39-infra-finalization-r1/ASSESSMENT.md)
 confirms all 14 executable/test/producer-decision pins and three Platform source
 pins still match. Source reviews remain complete: T01/T03 done, T02 wait. Existing
-source acceptance, resolved registration go caafe4be and the standing attended
-rule remain valid; no new protocol or blanket approval request is needed. The
+source acceptance remains valid. Resolved registration go caafe4be covers only
+the original secrets-engine-openbao client (KEY-WP-0037-T03, deployed 6f79a2af,
+NK-WP-0046 exact-match helper); it does not authorize new probe clients or
+coding-client custody, and no renewed original-client approval is requested.
+The standing attended rule remains separate, for reviewed commands within
+existing scope; no new protocol or blanket approval request is introduced. The
 remaining sequence is KEY-WP-0038-T02/T03 first-case registration/claims proof,
 admission of the existing coding-client proposal with sanitized owner readiness
 returns, then one attended negative/revoke/cleanup receipt committed with probe