diff --git a/docs/keycape-tls-le-prod-nk49-attempt.md b/docs/keycape-tls-le-prod-nk49-attempt.md
index b4b1437..60bd2da 100644
--- a/docs/keycape-tls-le-prod-nk49-attempt.md
+++ b/docs/keycape-tls-le-prod-nk49-attempt.md
@@ -94,3 +94,26 @@ outside `tls-attempt-kc`; DNS or port 80 fails; the Certificate is not Ready in
 tls-attempt-kc describe challenge` first); the issuer CN contains `(STAGING)`;
 `openssl verify` is not `OK`; the public-key hashes differ; or the live
 fingerprint or `sso/kc-tls` resourceVersion changes.
+
+## Production reissue receipt (2026-10-23, attended by the founder)
+
+Run from railiance-cluster `88b360b` with the admin kubeconfig, inside the NK49
+T40 window. Certificate Ready and Order `valid` on the first order (37 s, no retry).
+
+| Check | Result |
+| --- | --- |
+| Issuer | `C = US, O = Let's Encrypt, CN = YR2` (production) |
+| Subject / SAN | `CN = kc.coulomb.social` / `DNS:kc.coulomb.social` |
+| Validity | 2026-10-23T16:23:09Z to 2027-01-21T16:23:08Z |
+| `openssl verify` against ISRG Root X1 | `OK` |
+| `tls_cert_sha256` (chain, public) | `0dd5d58264b552cfdffac6c003dddb789762ea6ba1013e0965c7979588135add` |
+| `leaf_public_spki_sha256` | `sha256:044daa6b300e8dc2a83bdac90e3a6df5d96c40a430c52043b69e2b9c4f188b0b` |
+| `trust_sha256` (ISRG Root X1) | `22b557a27055b33606b6559f37703928d3e4ad79f110b407d04986e1843543d1` |
+| Certificate/key public-key hashes | equal (`e4ced1bc…6de8`) |
+| Live fingerprint / `sso/kc-tls` resourceVersion | `D5:DB:2B:55…CE:5C` / `66444692`, unchanged |
+| Cleanup | namespace deleted, no solver ingress left |
+
+The exported key was used only as NK49 launcher input (NK-WP-0049-T18, verified
+receipt `16d72f7c…1651`) and is then destroyed by the founder. This reissue used
+one of the 5-per-week duplicate-certificate allowance. It is not original-key
+recovery and not a change to live TLS.