diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
index a952d59..6915679 100644
--- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
@@ -550,3 +550,20 @@ sender lane accepts its receipt as T03
 (`tests/test_rpf_wp_0015_e2_receipt.py`). The 2026-10-14/15 blocker was the
 KeyCape session at `aal1`. The window needs a fresh password+OTP (`aal2`)
 login, and its start must not fall within 20 minutes of 03:17 UTC.
+
+2026-11-03 E2 attempt blocked, then reviewed fix. The founder's preflight
+failed at `read node state`. Since RCLUSTER-WP-0019 (2026-10-20) the node
+account `tegwick` cannot read the k3s admin kubeconfig, so every `ssh
+railiance01 kubectl` call in these scripts fails. The fix (`17fdc27`,
+`dad91e8`) adds the opt-in `AUDIT_KUBECONFIG`: the attended admin file from
+ops-warden route `kubernetes-railiance01-admin`, set for one command. Cluster
+reads, the port-forward and the sender lane's sync, restart and rollback then
+run locally; host reads stay on ssh. The round-10 railiance-platform review
+requested changes because the lane's writes still went over ssh. That was
+fixed before round 11. Round 11 (contract `cd393e26`, base `dad91e8`)
+reviews approve from all five owners: audit-core, rapp-postgres,
+railiance-cluster, railiance-infra and railiance-platform. These are
+owner-scoped sub-agent reviews. The founder posts the hash-bound receipts with
+`wp0024-owner-review.py approve` under `AUDIT_KUBECONFIG`, because `approve`
+runs the live preflights. Open non-blocking residuals: `created_at` ordering
+is a string comparison, and hub `from_agent` is self-declared.