diff --git a/workplans/KEY-WP-0013-approval-engine-resource-audience.md b/workplans/KEY-WP-0013-approval-engine-resource-audience.md
index dfa6621..e93c2bc 100644
--- a/workplans/KEY-WP-0013-approval-engine-resource-audience.md
+++ b/workplans/KEY-WP-0013-approval-engine-resource-audience.md
@@ -249,6 +249,37 @@ client-side retrieval, which the provisioning packet records as **not admitted**
 attended operator action, not something to take by reading the secret. T02 stays
 `wait` on that run, not on custody.
 
+**Correction, same day.** The refusal above was right; the conclusion drawn from
+it was not. The attended run had already happened, on 2026-09-09T00:10Z, and its
+receipt is committed in this repository at
+`docs/evidence/2026-09-09-keycape-verifier-admission.json`. Per client — both
+`secrets-engine-approval` and `approval-engine-operator` —
+`live_jwks_signature_verified: true`, `exact_claims_verified: true`,
+`excess_scope_denied: true`, `wrong_secret_denied: true`,
+`lifetime_seconds: 900`, `maximum_future_iat_seconds: 30`,
+`pinned_artifact_verifier_passed: true`, `verifier_location: "attended owner
+process"`. `credential_values_emitted: false` and
+`client_side_read_admitted: false` throughout, so it was run the admitted way.
+The claim contract is established and T02's `status: done` is correct; it does
+not revert to `wait`.
+
+The reasoning error is worth naming because it is the third of its kind here in
+two days: "not admitted **for me**" was read as "not done **by anyone**", without
+checking `docs/evidence/`. The preceding paragraph's read-only observations are
+sound and its restraint about not reading the secret is exactly right — only the
+final sentence was wrong, and it is retained above rather than deleted so the
+correction has something to point at.
+
+What the receipt itself declines to claim, which is the honest residual and
+matches this task's earlier record: `real_predecessor_rotation_tested: false`,
+`observed_wall_clock_expiry: false`, and under `limits`,
+`actual_predecessor_rotation_observed: false` and
+`wall_clock_jwt_expiry_observed: false`. Natural expiry and a real predecessor
+rotation were not exercised by initial provisioning and are not claimed by
+anyone. Predecessor rejection is implemented and unit-tested in
+`keycape verify-client`; it has not been run against a real rotation, which is
+KEY-WP-0014-T04's territory and still has no admitted execution authority.
+
 ## Assign and register the human approver browser client
 
 ```task