diff --git a/docs/keycape-tls-le-prod-nk49-attempt.md b/docs/keycape-tls-le-prod-nk49-attempt.md
index 60bd2da..81daf06 100644
--- a/docs/keycape-tls-le-prod-nk49-attempt.md
+++ b/docs/keycape-tls-le-prod-nk49-attempt.md
@@ -117,3 +117,24 @@ The exported key was used only as NK49 launcher input (NK-WP-0049-T18, verified
 receipt `16d72f7c…1651`) and is then destroyed by the founder. This reissue used
 one of the 5-per-week duplicate-certificate allowance. It is not original-key
 recovery and not a change to live TLS.
+
+## Duplicate-certificate allowance check (2026-10-27, read-only, answers NK-WP-0049-T43)
+
+Limit: 5 certificates per exact identifier set (`kc.coulomb.social`) per rolling 7 days.
+
+| Item | Status |
+| --- | --- |
+| 2026-10-23T16:23:09Z production issuance (commit `88b360b`, receipt above) | proven: repo receipt, Order `valid`, first order, no retry |
+| Staging rehearsal 2026-10-23 | not counted (staging directory) |
+| Live `sso/kc-tls` issued 2026-09-25T17:57Z (served cert, YR1) | proven by live TLS; outside the window |
+| Other issuances 2026-10-20..27 | not disproven: `kubectl get certificate -A` is Forbidden for `ops-mason-builder`, and crt.sh returned no entries after 2026-07-27 (it lacks even the 09-25 cert, so it lags and is no evidence of absence) |
+
+Count: at least 1 proven; expected exactly 1 (estimate: cert-manager renewal of the
+live cert is not due until about 2026-11-24, and the isolated attempt was the only
+documented order). Remaining allowance: 4 expected, 0 in the worst case of an
+undocumented 4 extra issuances.
+
+Earliest safe date: a single further issuance is within the limit today (2026-10-27)
+on the estimate. Guaranteed-safe regardless of unknown issuances: 2026-10-30T16:23:09Z
+(the proven issuance leaves the window). Not authorization to issue. Verification by
+the admin kubeconfig: `kubectl get certificate,certificaterequest,order -A | grep kc`.