diff --git a/docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json b/docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json
new file mode 100644
index 0000000..75acec3
--- /dev/null
+++ b/docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json
@@ -0,0 +1,27 @@
+{
+  "schema": "netkingdom.keycape-attempt-receipt-verification.v1",
+  "receipt_sha256": "16d72f7cb25700ab5e57b7e7536f1085239c402ad99a128def941ac06e311651",
+  "verdict": "verified",
+  "findings": [],
+  "claims_not_made": [
+    "consumer continuity (T18)",
+    "retained-factor MFA (T19)",
+    "owner acceptance"
+  ],
+  "invocation": {
+    "observed_at": "2026-10-23T17:35Z",
+    "verifier": "tools/bootstrap-recovery/verify-keycape-attempt-receipt.py",
+    "source_root": "clean git archive of net-kingdom a20dcfe tools/bootstrap-recovery",
+    "transfer_receipt": "fresh independent retrieval 2026-10-23 19:31 Berlin (private, outside Git), ciphertext 7117b3fe1e4840c86b301c94c85e6b16709e5626bb0884bd0580bde630e30e30",
+    "not_after": "2026-10-24T05:00:00+00:00",
+    "exit": 0
+  },
+  "attempt_inputs_public": {
+    "founder_admission_sha256": "f829795442a74c04de81032ebae84279f4c621891dc8e061aea461e58d26c157",
+    "launcher_admission_sha256": "a57c4c642d5abdbaac552deae0c3079062d3c8ed71544056380841a90e53a6ba",
+    "tls_cert_sha256": "0dd5d58264b552cfdffac6c003dddb789762ea6ba1013e0965c7979588135add",
+    "leaf_public_spki_sha256": "sha256:044daa6b300e8dc2a83bdac90e3a6df5d96c40a430c52043b69e2b9c4f188b0b",
+    "trust_sha256": "22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1",
+    "tls_reissue": "railiance-cluster 88b360b, RCLUSTER-WP-0018-T04, Let's Encrypt YR2, 2026-10-23T16:23:09Z to 2027-01-21T16:23:08Z"
+  }
+}
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 664bac7..0c486f2 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -615,6 +615,25 @@ positive/negative authentication using the restored dependencies; and isolation
 and cleanup hold. Confirm the actual dependency graph in T15. Do not route a
 production consumer to the isolated issuer or mint new client grants implicitly.
 
+2026-10-23 evening, attended by the founder (ceremony steps 3 to 5, inside the T40 window):
+step 3 production reissue through railiance-cluster `88b360b` (isolated namespace `tls-attempt-kc`,
+own Issuer; live `sso/kc-tls` resourceVersion 66444692 and fingerprint D5:DB:2B:55… unchanged; cleanup done),
+chain `0dd5d582…5add` to ISRG Root X1 `22b557a2…43d1`, key/cert public keys equal. Step 4: fresh
+independent Storage Share retrieval of ciphertext `7117b3fe…0e30`, then the six-argument launcher with
+launcher admission `a57c4c64…a6ba` (R1 template completed; `isolated-keycape.py` pin = reviewed T38
+`86f37add…`): `OK: isolated KeyCape native checks and cleanup passed`. The first launcher run was refused
+pre-key because two inputs were mode 0444; fixed to 0400 without changing bytes. Step 5: independent verifier
+from a clean export of `a20dcfe`, `--not-after 2026-10-24T05:00:00+00:00`: `verified`, no findings.
+Receipt `16d72f7c…1651` reports original JWKS signing key, original config/registry/policy receipts, native
+service registration, denied scopes and wrong-secret refusal, original HTTPS issuer/trust, plaintext/container
+cleanup, `production_contacted: false`. Evidence: `docs/evidence/2026-10-23-nk49-t18-keycape-attempt/verifier-output.json`.
+The receipt itself is not in Git: the local and Forgejo secret scanners flag its public source-file digests
+(`generic-api-key`, file names containing "keycape"), and the founder chose not to re-encode or exempt it. The exact
+original is retained outside Git on the founder workstation (mode 0400), bound by sha256 `16d72f7c…1651` in the
+verifier output. This deviates from the ceremony step 5 retention path by founder decision 2026-10-23.
+Still open for T18: selected current consumer acceptance against restored dependencies (the receipt claims
+no consumer continuity), and owner acceptance; MFA stays T19.
+
 ## Verify current caller and provider admission at their actual boundaries
 
 ```task