diff --git a/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md b/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
index 2640fc0..9cfb1b6 100644
--- a/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
+++ b/docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
@@ -31,7 +31,7 @@ backup-profile row's job belongs to railiance-platform.
 
 | Named in T21 | Position | Residual |
 |---|---|---|
-| Dedicated factor-diagnostic admission | Delivered as its own lane (NK-WP-0051 / KEY-WP-0041). It does not borrow KeyCape's reader. | Native acceptance stays in NK-WP-0051-T02. |
+| Dedicated factor-diagnostic admission | Source: `mfa_state.py` / `check-user-mfa-state.sh` accept only an owner-admitted private token file and never fetch KeyCape's reader. Live (2026-10-27, founder-run admin scan of Deployment/StatefulSet/DaemonSet/CronJob/Job/Pod specs): only `Deployment sso/keycape` and its pod `keycape-d66d674cd-9vgfw` reference `keycape-factor-read`. | **Deferred:** no admitted credential lane exists for the attended diagnostic (`sso-mfa/k8s/privacyidea/README.md:228-233`), so it is unavailable until its owner sets one up through credential routing. Not a T44 item. |
 | Reserved LDAP group denial | `manage-group-members.sh` is a current, documented route. | A live native denial check of the reserved group is not re-run here. It goes into the T44 pre-production drill. |
 | Resolver/cutover input provenance | `resolver_cutover.py` and the `*-lldap-resolver-live.sh` scripts are documented routes. NK-WP-0022 (finished) carried the cutover. | No new functional proof is claimed. Re-proof belongs in T44. |
 | Bootstrap, root-output and isolation callers | Covered by T01 (secret output removed), the retirement tests and the T16–T20 isolated runs. | None. |
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 39fa144..c86e1e0 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -715,7 +715,7 @@ bootstrap receipts are not current authority. Propose exact write/cutover action
 before execution; record deferred actions separately rather than faking a pass.
 
 
-2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. T21 stays waiting until the founder accepts.
+2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. Factor-diagnostic row corrected the same day: source shows the diagnostic takes only an owner-admitted private token and never KeyCape's reader; a founder-run admin scan shows only `sso/keycape` mounts `keycape-factor-read`; no admitted diagnostic lane exists, so that row is a deferral, not a T44 item. T21 stays waiting until the founder accepts.
 ## Resolve historical credential and configuration-preserving rotation dispositions
 
 ```task