diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 1944d6c..26324d2 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -283,11 +283,11 @@
 | task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
-| task | NK-WP-0049-T35 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
-| task | NK-WP-0049-T36 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T35 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T36 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T37 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T38 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
-| task | NK-WP-0049-T39 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T39 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T40 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
 | task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 6abbc51..ada6dc7 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -962,7 +962,7 @@ status: wait
 priority: high
 assignee: codex
 depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36, NK-WP-0049-T39]
-blocking_reason: "Attempt order is assembled with the secrets-engine selector preflight --admission step required (2026-10-21). Still waiting on: T35 owner metadata (RCLUSTER-WP-0018-T02); founder TLS disposition T39; attempt-host admission anchor; fixed deadline/receipt location/verifier."
+blocking_reason: "T35/T36/T39 done (2026-10-23; TLS = ACME letsencrypt-prod reissue). Still waiting on: attempt-host admission anchor install (SECRETS-WP-0015-T04, founder/root-owned); an LE staging rehearsal of the kc.coulomb.social reissue before the real attempt; fixed deadline/receipt location/verifier."
 state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
 ```
 
@@ -1042,7 +1042,7 @@ attempt readiness; actual recovery/consumer acceptance remains T18 and MFA T19.
 
 ```task
 id: NK-WP-0049-T35
-status: progress
+status: done
 priority: high
 assignee: codex
 depends_on: [NK-WP-0049-T34]
@@ -1098,11 +1098,23 @@ unblocks when the owner records independent custody of the kc-tls key.
 Owner message dae2e1bb requests T02 metadata. Founder disposition gate is T39.
 T35 stays progress.
 
+2026-10-23: done. The founder resolved decision 9f9d0d88 on 2026-10-21 with
+option A (relayed by secrets-engine, message daa264e9). During recovery,
+kc.coulomb.social's TLS identity is the hostname chained to ISRG Root X1,
+reissued through letsencrypt-prod ACME HTTP-01. No self-signed substitute is
+allowed. Owner: railiance-cluster. Verify: the reissued leaf has SAN
+kc.coulomb.social and chains to ISRG Root X1 (trust sha256 22b557a2...43d1). The
+original key is not required. Abort if HTTP-01 cannot complete or the chain does
+not match. Rehearse against LE staging first to protect the 5/week duplicate
+limit; T33 carries that rehearsal as a prerequisite. RCLUSTER-WP-0018-T05 stays
+open for future archive coverage. This approves no production mutation and no
+recovery attempt.
+
 ## Prepare selected original service registration and private admission bindings
 
 ```task
 id: NK-WP-0049-T36
-status: progress
+status: done
 priority: high
 assignee: codex
 depends_on: [NK-WP-0049-T34]
@@ -1167,22 +1179,31 @@ custody, at attempt time. Evidence:
 `docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`.
 T36 stays progress until the owner confirms.
 
+2026-10-23: done. secrets-engine confirmed on 2026-10-21 (message 8d1ab5b7)
+that the pins match HEAD `0f44fbe` with no relevant drift. Installing the
+attempt-host anchor is now owned work under SECRETS-WP-0015-T04 (founder- and
+root-owned). SECRETS-WP-0015-T04 consumes the T33 packet unchanged. With the
+registration bindings, the 27 builder cases and T35's disposition in place, the
+metadata is ready for T33. No value, grant or attempt is implied.
+
 ## Founder disposition of original KeyCape TLS recovery
 
 ```task
 id: NK-WP-0049-T39
-status: wait
+status: done
 priority: high
 assignee: founder
 needs_human: true
 decision_id: "9f9d0d88-837a-433c-8a11-d30b633b0073"
 depends_on: [NK-WP-0049-T35]
-blocking_reason: "Founder decides: accept ACME letsencrypt-prod reissue as the kc.coulomb.social TLS disposition, or require original key custody via RCLUSTER-WP-0018."
 state_hub_task_id: "90f473db-bda6-5fe2-a2e1-7ddfaca815b7"
 ```
 
 Founder gate for T35. Approves no mutation and no attempt.
 
+2026-10-23: resolved 2026-10-21 = A (ACME letsencrypt-prod reissue, LE staging
+rehearsal first). Recorded under T35.
+
 ## Founder signs the exact KeyCape attempt admission
 
 ```task