diff --git a/docs/nk49-phase-b-plan.md b/docs/nk49-phase-b-plan.md
index 2f1830b..b5a2f21 100644
--- a/docs/nk49-phase-b-plan.md
+++ b/docs/nk49-phase-b-plan.md
@@ -105,7 +105,9 @@ Not claimed: production continuity or redirect, new grants, a live OpenBao read
 secret data (`platform/workloads/keycape/secrets-engine-openbao` stays metadata only),
 human login through Authelia, or owner acceptance. T18 also needs its owner acceptance.
 
-## Open decisions for the founder and owners
+## Decisions (answered 2026-10-27; decision `e4db6c9f`) and remaining owner items
+
+Founder answers: 1 railiance-platform creates the network; 2 reissue via `letsencrypt-prod` once railiance-cluster confirms the duplicate count (no self-signed, no retained key); 5 one workload consumer suffices, no Authelia. Item 3 (secret custody) is secrets-engine's to propose and item 4 (ISRG trust) is confirmed in the owner rehearsal. The answers authorize nothing; windows and signatures stay separate.
 
 1. **Network creator.** railiance-platform (proposed) or NetKingdom?
 2. **TLS identity.** The T18 attempt reissued `kc.coulomb.social` through
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 06da2e0..cbda6e6 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -1597,7 +1597,7 @@ assignee: claude-code
 needs_human: true
 decision_id: "e4db6c9f-d464-4185-b5a1-ea71e21d1b42"
 depends_on: [NK-WP-0049-T18]
-blocking_reason: "Plan and unsigned admission template delivered 2026-10-24. Await the founder/owner choices in the decision (network owner, TLS identity, consumer secret custody, consumer scope); nothing is built or signed before they are answered."
+blocking_reason: "Decision answered 2026-10-27 (network: railiance-platform; TLS: reissue after railiance-cluster confirms the duplicate count; scope: one workload consumer, no Authelia). Await owner replies: secrets-engine on client-secret custody (shapes the module), railiance-cluster on the count, railiance-platform confirmation. Nothing is built or signed before the custody design."
 state_hub_task_id: "485468fd-d56e-54d1-9bc7-97220c0c4a38"
 ```