diff --git a/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json
index 4147a5c..b7ef18b 100644
--- a/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json
+++ b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json
@@ -8,7 +8,7 @@
  "pending_columns": [],
  "summary": {
   "current": 59,
-  "retire-candidate": 1,
+  "owner-deferred (greenfield/initial activation only)": 1,
   "retired": 11,
   "owner-deferred (greenfield bootstrap only)": 3,
   "current, superseded on 1.3 admission": 1,
@@ -467,10 +467,10 @@
    "owner": "net-kingdom",
    "credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
    "consumers": "none after initial activation; later changes use the authenticated policy journey",
-   "native_evidence": "one-shot migration of two baseline registrations, completed",
-   "next_task": "NK-WP-0049-T22: convert to refusing entry point",
+   "native_evidence": "initial activation of the two baseline registrations; later changes use the authenticated policy journey; covered by test_authentication_policy_rollout.py",
+   "next_task": "none on the current estate; retained for greenfield/recovery rebuild of the issuer",
    "documented_in": [],
-   "disposition": "retire-candidate"
+   "disposition": "owner-deferred (greenfield/initial activation only)"
   },
   {
    "path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh",
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 3400d0c..6004792 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -404,9 +404,9 @@ the next task for all entries, and route checks to T21 and T22.
 2026-10-23 slices 2 and 3 are complete. T02 is **done**. Every one of the 93
 entries now records a disposition, owner, credential route, consumers, evidence
 and next task: 59 current, 12 current diagnostic, 7 current
-recovery/internal/repair, 11 retired, 3 owner-deferred greenfield bootstrap, 1
-retire-candidate (`authentication-policy-rollout.py`, a completed one-shot that
-should become a refusing entry point under T22), and 1 superseded once
+recovery/internal/repair, 11 retired, 4 owner-deferred greenfield/initial
+activation (including `authentication-policy-rollout.py`, retained because a
+recovery rebuild of the issuer needs its initial activation again), and 1 superseded once
 NK-WP-0048 admits 1.3 (`vergabe-client-rollout.py`). The 5 drifted entries are
 attributed to their reviewed commits. Historical objects: `sso/keycape-pi-token`
 and `mfa/privacyidea-trigger-admin` are retired in source (no current reader),