diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 39818ce..6f3517a 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -1312,6 +1312,20 @@ state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
 The signed document is T33's required `--admission` input and T18's surviving
 offline authorization. The signature does not run the attempt.
 
+2026-10-23 handoff: the session is scheduled for 19:00 Berlin (17:00Z) today. The unsigned admission is prepared
+at `~/nk49-attempt-20261023/attempt.json` (outside Git, dir 0700, file 0444, sha256
+`f8297954…c157`). It binds case `secrets15-nk49-readiness`, issuer `https://kc.coulomb.social`,
+selector `sha256:02077af3…7012`, service_auth `sha256:c0ade429…86c0`, and window
+2026-10-23T17:00:00Z to 2026-10-24T05:00:00Z (12 h, ending 07:00 Berlin). Pins were rechecked against secrets-engine
+HEAD `a14fbc0`, with no change to the selector, service_auth.py, the checker or founder_admission.py
+since `0f44fbe`. A dry check passed every field and window rule, and refused only the missing signature.
+Evening order:
+(1) confirm that sha256 is unchanged;
+(2) founder signs: `ssh-keygen -Y sign -f ~/.ssh/gexec_approver_ed25519 -n secrets-engine-recovery-attempt ~/nk49-attempt-20261023/attempt.json`;
+(3) ceremony step 2, selector preflight with `--admission`, must report `founder_admitted_attempt_not_native_acceptance`;
+(4) ceremony steps 3 to 5 (production ACME reissue under RCLUSTER-WP-0018-T04, launcher, independent receipt verifier with `--not-after 2026-10-24T05:00:00+00:00`) under T18.
+If the window lapses, write a new file and sign again. Never edit the signed bytes.
+
 ## Verify actual SOPS compatibility and sealed-descriptor read/write custody
 
 ```task