diff --git a/docs/keycape-live-secret-exposure-recovery.md b/docs/keycape-live-secret-exposure-recovery.md
index d44aaa2..e01040e 100644
--- a/docs/keycape-live-secret-exposure-recovery.md
+++ b/docs/keycape-live-secret-exposure-recovery.md
@@ -62,6 +62,19 @@ Recheck these fields before a window using metadata-only columns and public
 OIDC endpoints. A changed UID, resource version, source revision, image, or
 JWKS digest invalidates the prepared approval receipt and requires review.
 
+## Owner receipt update (2026-08-23)
+
+KeyCape reports that its emergency signing-key rotation completed with
+deliberate JWT invalidation; consumers must refresh JWKS/re-authenticate. The
+receipt contains no secret values, but it does not yet identify the reviewed
+non-secret client-config revision or the post-rotation public JWKS digest.
+NetKingdom published the value-safe dependency and provider sequence at
+`c24d67b`, noting that the LLDAP admin account is persistent and that the
+privacyIDEA admin token is an expiring session JWT without individual
+revocation. Use expiry-based predecessor denial unless a separate global
+signing-secret invalidation is explicitly approved. These acknowledgements do
+not constitute a live GO; the approval template remains pending.
+
 ## Ownership
 
 | Boundary | Owner | Required contribution |
@@ -174,4 +187,3 @@ provider access, unsafe helper output, an unverified cleanup trap, or no exact
 human GO. Abort forward after mutation on failed readiness, missing negative
 proof, an unexpected JWKS result, any captured value, or elapsed window. The
 abort operator may stop the sequence at any time.
-
diff --git a/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md b/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
index 0756360..bf3b625 100644
--- a/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
+++ b/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
@@ -12,7 +12,7 @@ updated: "2026-08-23"
 related:
   - KEY-WP-0011
 origin: routed
-origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d and acf98be3-ff6b-4270-bd21-0193bebd806b"
+origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d, acf98be3-ff6b-4270-bd21-0193bebd806b, aeb216b5-9f1b-404b-a483-fb08a00a49b1, and 71b1008a-7fd7-4500-85c6-e8893a6d80d4"
 ---
 
 # RAILIANCE-WP-0029 — KeyCape live Secret exposure recovery
@@ -57,10 +57,15 @@ status: progress
 priority: high
 ```
 
-KeyCape must pin the non-secret client-config revision and either a unique-kid
-overlap implementation or the exact immediate-invalidation/cache-refresh
-procedure. NetKingdom must pin the LLDAP, Authelia, and privacyIDEA provider
-steps. Railiance-platform must then issue one digest-bound approval template.
+KeyCape acknowledged emergency rotation with deliberate JWT invalidation and
+JWKS/cache refresh required (message `aeb216b5-9f1b-404b-a483-fb08a00a49b1`),
+but has not yet supplied the non-secret client-config revision or a post-change
+JWKS digest. NetKingdom pinned the value-safe dependency and provider sequence
+at `c24d67b` (message `71b1008a-7fd7-4500-85c6-e8893a6d80d4`), including the
+expiry-based privacyIDEA predecessor decision. The digest-bound approval
+template is published at
+`docs/keycape-exposure-rotation-approval.example.json`; all authorization
+gates remain false pending the missing receipts and an exact human GO.
 
 ## T04 — Execute the attended rotation