diff --git a/docs/identity-service-restore-packet.md b/docs/identity-service-restore-packet.md
index 0f5aead..0645d68 100644
--- a/docs/identity-service-restore-packet.md
+++ b/docs/identity-service-restore-packet.md
@@ -208,8 +208,12 @@ Existing-token MFA remains T19; event completeness is not claimed.
   images independently of production and the failed registry.
 - A retained user and MFA token available in private owner custody; exact native
   verification commands reviewed against the chosen service versions.
-- T02 current-caller ledger and T21 per-caller owner admission, including legacy
-  token, diagnostic, resolver and LDAP-group boundaries.
+- T21 per-caller owner admission, including legacy token, diagnostic, resolver
+  and LDAP-group boundaries. The T02 current-caller ledger is delivered
+  ([caller-ledger.json](evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json),
+  2026-10-23). Submit the acceptance from its `current` rows. Its two historical
+  Secrets (`sso/keycape-pi-token`, `mfa/privacyidea-trigger-admin`) are excluded
+  from restore scope: they are retired in source, with revocation routed to T22.
 - Service-owner acceptance of network/config translations and all required
   grants. New grants or production effects require their own owner decisions.
 
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index ba381d0..9f22b1f 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -454,6 +454,12 @@ credential or production effect has its own owner decision. The verifier deletes
 its plaintext; it is not a production importer. This task prepares authority and
 inputs for T16–T20, not an automatic production restore.
 
+2026-10-23: the T02 ledger is incorporated into
+`docs/identity-service-restore-packet.md`. Acceptance for current callers uses
+its `current` rows, and the two historical Secrets are excluded from restore
+scope. Still owner-held: a named disposable target and route, archive/runtime
+image lineage, private existing-user/MFA inputs, and service-owner acceptance.
+
 ## Prove restored LLDAP directory and existing-user authentication
 
 ```task