diff --git a/docs/keycape-exposure-rotation-approval.example.json b/docs/keycape-exposure-rotation-approval.example.json
index d7cda83..6f4dfd6 100644
--- a/docs/keycape-exposure-rotation-approval.example.json
+++ b/docs/keycape-exposure-rotation-approval.example.json
@@ -23,6 +23,13 @@
     "predecessor_jwt": "reject-after-cutover",
     "forward_only": true
   },
+  "post_rotation_observation": {
+    "jwks_kid": "key-1",
+    "jwks_sha256": "3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06",
+    "observed_at": "2026-08-23",
+    "source_revision_binding": "REQUIRED",
+    "downstream_refresh_confirmation": "REQUIRED"
+  },
   "revisions": {
     "key_cape": "REQUIRED",
     "net_kingdom": "REQUIRED",
diff --git a/docs/keycape-live-secret-exposure-recovery.md b/docs/keycape-live-secret-exposure-recovery.md
index e01040e..e601bec 100644
--- a/docs/keycape-live-secret-exposure-recovery.md
+++ b/docs/keycape-live-secret-exposure-recovery.md
@@ -75,6 +75,11 @@ revocation. Use expiry-based predecessor denial unless a separate global
 signing-secret invalidation is explicitly approved. These acknowledgements do
 not constitute a live GO; the approval template remains pending.
 
+A fresh public JWKS read on 2026-08-23 found kid `key-1` and SHA-256
+`3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06`.
+Treat this as an observation only until KeyCape binds it to the source
+revision and confirms downstream cache refresh.
+
 ## Ownership
 
 | Boundary | Owner | Required contribution |