docs: distinguish remaining custody callers from repaired SOPS paths

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md

@@ -84,8 +84,9 @@ Concrete uncovered callers remain (T02 stays progress):
   updates, retained rollback custody and native multi-consumer acceptance. The
   legacy replacement paths now refuse before mutation; this is not rotation closure.
 - PostgreSQL/privacyIDEA/LLDAP/Authelia generators and the batch apply caller
-  are repaired below. Other diagnostic/bootstrap/key-export callers and direct
-  SOPS edit/encrypt/rotate are repaired below; native effect/recovery evidence is mandatory.
+  and direct SOPS edit/encrypt/rotate are repaired below. Other diagnostic,
+  bootstrap and key-export callers remain open; native effect/recovery evidence
+  is mandatory.
 
 2026-10-12 Make caller repair: sops-setup now validates only the public recipient;
 creds-init no longer requires or installs a permanent private key. sops-decrypt