diff --git a/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md b/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
index 82ea46e..f5864bc 100644
--- a/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
+++ b/workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
@@ -70,6 +70,13 @@ template is published at
 `docs/keycape-exposure-rotation-approval.example.json`; no additional Secret
 apply is authorized by this receipt.
 
+NetKingdom has now pinned the remaining attended resolver procedure at
+`eec7007` (procedure checkout `f2e578c`, owner receipt
+`45b236c8-052f-43d3-a472-44f8e9694da2`). It performs one resolver-only POST,
+protected interactive inputs, boolean postchecks, replacement-success and
+predecessor-denial evidence, and forward-only abort. T03 is ready for the
+attended run; T04/T05 remain open until that run produces a sanitized receipt.
+
 ## T04 — Execute the attended rotation
 
 ```task