diff --git a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
index eaef3eb..bb91554 100644
--- a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
+++ b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml
@@ -22,22 +22,22 @@
       {
         "reviewer": "User (platform-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.372915+00:00"
       },
       {
         "reviewer": "User (net-kingdom-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.372938+00:00"
       },
       {
         "reviewer": "User (backup-share-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.372944+00:00"
       }
     ]
@@ -87,10 +87,12 @@
     "account_owner": "Backup",
     "folder": "/railiance-backups/net-kingdom-identity",
     "share_type": 3,
-    "share_permissions": 5,
+    "share_permissions": 21,
     "label": "net-kingdom-identity-publisher",
     "age_private_key_delivered": false,
-    "backup_account_password_delivered": false
+    "backup_account_password_delivered": false,
+    "provider_added_resharing_approved": true,
+    "scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971"
   },
   "delivery": {
     "surface": "ESO-managed Secret",
@@ -105,10 +107,11 @@
     "classification": "high",
     "notes": [
       "Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
-      "Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
+      "Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.",
       "Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
       "Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
-      "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
+      "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.",
+      "Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication."
     ]
   },
   "verification": {
diff --git a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
index f9c4729..b3c50f7 100644
--- a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
+++ b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml
@@ -22,22 +22,22 @@
       {
         "reviewer": "User (platform-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.374014+00:00"
       },
       {
         "reviewer": "User (net-kingdom-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.374033+00:00"
       },
       {
         "reviewer": "User (backup-share-owner)",
         "decision": "approved",
-        "source_ref": "statehub:decision:40bfae40-6108-4e51-8613-073339f5345f",
-        "comment": "Operator approved the exact prepared live packet in this conversation: Good, i approve. Native claim confirmation and archive recovery remain required before activation.",
+        "source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
+        "comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
         "reviewed_at": "2026-10-15T23:51:21.374039+00:00"
       }
     ]
@@ -87,10 +87,12 @@
     "account_owner": "Backup",
     "folder": "/railiance-backups/net-kingdom-identity",
     "share_type": 3,
-    "share_permissions": 9,
+    "share_permissions": 25,
     "label": "net-kingdom-identity-retention",
     "age_private_key_delivered": false,
-    "backup_account_password_delivered": false
+    "backup_account_password_delivered": false,
+    "provider_added_resharing_approved": true,
+    "scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971"
   },
   "delivery": {
     "surface": "ESO-managed Secret",
@@ -105,10 +107,11 @@
     "classification": "high",
     "notes": [
       "Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
-      "Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
+      "Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.",
       "Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
       "Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
-      "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
+      "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.",
+      "Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication."
     ]
   },
   "verification": {