diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 3b7497f..9133a10 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -282,7 +282,7 @@
 | task | NK-WP-0049-T30 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T31 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T32 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
-| task | NK-WP-0049-T33 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
+| task | NK-WP-0049-T33 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T34 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T35 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
 | task | NK-WP-0049-T36 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index e1f9998..39818ce 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -1023,11 +1023,10 @@ retained, and scanner policy/exemptions are unchanged.
 
 ```task
 id: NK-WP-0049-T33
-status: wait
+status: done
 priority: high
 assignee: codex
 depends_on: [NK-WP-0049-T32, NK-WP-0049-T34, NK-WP-0049-T35, NK-WP-0049-T36, NK-WP-0049-T39]
-blocking_reason: "Packet complete in source 2026-10-23 (ceremony steps 1-5: admission, selector preflight, ACME reissue TLS, launcher, verify-keycape-attempt-receipt.py + retained location; deadline = signed admission window). LE staging rehearsal run green 2026-10-23 (railiance-cluster aad0e70, receipt in docs/keycape-tls-le-staging-rehearsal.md). Waiting only on: attempt-host admission anchor install (SECRETS-WP-0015-T04, founder/root-owned)."
 state_hub_task_id: "56c8d469-7a10-5d50-a30e-95cbf3cd4756"
 ```
 
@@ -1073,6 +1072,14 @@ fingerprint `D5:DB:2B:55…` and the `sso/kc-tls` resourceVersion 66444692 were
 and cleanup was done. The receipt is in railiance-cluster aad0e70. Only the anchor install
 (SECRETS-WP-0015-T04) remains before the attended attempt.
 
+2026-10-23: the attempt-host anchor was installed by the founder on the workstation, which is the attempt host.
+`/etc/secrets-engine/admission/allowed_signers` is root:root 0644 under a root:root 0755
+directory. It holds one entry: principal `bernd`, namespaces=`secrets-engine-recovery-attempt`,
+ED25519 `SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM` (approver key), file sha256
+`1964e942…c489`. A throwaway self-test signature in that namespace resolved to `bernd`
+and verified Good, and was then deleted. A placeholder line left at 07:12 was replaced. Packet
+prerequisites are complete, so T33 is done. Next: the founder signs the attempt admission (T40).
+
 ## Deliver attended custody, metadata preflight and private manifest preparation source
 
 ```task
@@ -1298,7 +1305,7 @@ assignee: founder
 needs_human: true
 decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
 depends_on: [NK-WP-0049-T33]
-blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission only once T33's packet is ready."
+blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission now: T33 packet done 2026-10-23, anchor installed and self-tested."
 state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
 ```