diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index c2c4fc4..e1793a7 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -84,8 +84,9 @@ Concrete uncovered callers remain (T02 stays progress):
   updates, retained rollback custody and native multi-consumer acceptance. The
   legacy replacement paths now refuse before mutation; this is not rotation closure.
 - PostgreSQL/privacyIDEA/LLDAP/Authelia generators and the batch apply caller
-  are repaired below. Other diagnostic/bootstrap/key-export callers and direct
-  SOPS edit/encrypt/rotate are repaired below; native effect/recovery evidence is mandatory.
+  and direct SOPS edit/encrypt/rotate are repaired below. Other diagnostic,
+  bootstrap and key-export callers remain open; native effect/recovery evidence
+  is mandatory.
 
 2026-10-12 Make caller repair: sops-setup now validates only the public recipient;
 creds-init no longer requires or installs a permanent private key. sops-decrypt