diff --git a/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md b/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
new file mode 100644
index 0000000..2640fc0
--- /dev/null
+++ b/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
@@ -0,0 +1,43 @@
+# NK-WP-0049-T21 caller dispositions — builder-mode acceptance draft
+
+**Status:** draft for founder acceptance, 2026-10-27. Nothing here is accepted until the founder says so.
+**Source:** [T02 caller ledger](../2026-10-23-nk49-t02-caller-ledger/caller-ledger.json) (93 entries, complete
+per-entry reconciliation). All rows are owned by net-kingdom. Two also name another owner: one is shared with key-cape, and the
+backup-profile row's job belongs to railiance-platform.
+
+## Proposed disposition by category
+
+| Category | Rows | Proposed builder-mode disposition |
+|---|---|---|
+| current | 59 | Accept as current callers. 52 have no follow-up; their documented route is the acceptance. The other 7 are covered under **Follow-up elsewhere** below. |
+| current diagnostic | 12 | Accept as read-only diagnostics. They prove no recovery and grant nothing. |
+| retired | 11 | Accept retirement. Their refusing entry points are covered by `tests/test_retirement_and_bundle_boundaries.py`. |
+| current (recovery tooling / internal / repair) | 6 | Accept. They were exercised by the actual T16–T20 owner runs, and the drill rows feed NK-WP-0049-T24 G3. |
+| owner-deferred, greenfield only | 4 | Accept the deferral. These are `create-secrets.py`, privacyIDEA `bootstrap-admin*.py` and `authentication-policy-rollout.py`. None of them runs on the current estate, and any re-run needs its own owner decision. |
+| superseded on 1.3 admission | 1 | Accept. `vergabe-client-rollout.py` retires when NK-WP-0048-T16 admits 1.3. |
+
+## Follow-up already tracked elsewhere (no new task)
+
+| Row | Live work record |
+|---|---|
+| `keycape-client.py` | NK-WP-0048-T16 (1.3 re-freeze) |
+| `openbao-signin-diagnosis-rollout.py` | NK-WP-0051-T02 / KEY-WP-0041-T02 |
+| `activate-onboarding-policy.py`, `deploy-onboarding-guard.py`, `enable-factor-confirmation.py` | NK-WP-0042 pilot reuse |
+| `deploy-factor-recovery.py` | NK-WP-0042 step-up/recovery journey |
+| `identity-backup-profile.json` | NK-WP-0049-T24 (second provider) |
+| recovery inventory/fetch tools | NK-WP-0049-T24 G3 recurring drill |
+
+## T21's named checks: builder-mode position
+
+| Named in T21 | Position | Residual |
+|---|---|---|
+| Dedicated factor-diagnostic admission | Delivered as its own lane (NK-WP-0051 / KEY-WP-0041). It does not borrow KeyCape's reader. | Native acceptance stays in NK-WP-0051-T02. |
+| Reserved LDAP group denial | `manage-group-members.sh` is a current, documented route. | A live native denial check of the reserved group is not re-run here. It goes into the T44 pre-production drill. |
+| Resolver/cutover input provenance | `resolver_cutover.py` and the `*-lldap-resolver-live.sh` scripts are documented routes. NK-WP-0022 (finished) carried the cutover. | No new functional proof is claimed. Re-proof belongs in T44. |
+| Bootstrap, root-output and isolation callers | Covered by T01 (secret output removed), the retirement tests and the T16–T20 isolated runs. | None. |
+
+## What acceptance means
+
+Acceptance means the founder, as owner, accepts each row's recorded disposition for the builder-mode estate. It does
+not claim fresh native positive/negative checks for every current caller. Those checks are named above and assigned
+to the T44 drill or the owning workplan. No write, cutover, credential change or new grant results from this record.
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 0e4e7ea..39fa144 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -714,6 +714,8 @@ bootstrap/root-output/isolation callers. Fixtures, an existing tty and historica
 bootstrap receipts are not current authority. Propose exact write/cutover actions
 before execution; record deferred actions separately rather than faking a pass.
 
+
+2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. T21 stays waiting until the founder accepts.
 ## Resolve historical credential and configuration-preserving rotation dispositions
 
 ```task