diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
index 6dceacb..c223a47 100644
--- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
+++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md
@@ -341,6 +341,12 @@ blocking_reason: "Founder signs (ssh-keygen -Y sign, namespace railiance-openbao
 state_hub_task_id: "a954eaf9-855b-5458-9f13-c6cfed289934"
 ```
 
+2026-10-23: the founder accepted the three T02 design choices before signing: (1) readback through
+a temporary root credential generated from the two entered shares, revoked and checked dead before
+teardown; (2) unauthenticated generate-root enabled only on the target's own loopback listener inside
+the networkless container; (3) strict match of restored role/policy objects against current source,
+so a snapshot older than a later source edit yields `refused`. Signing T05 still confirms them per attempt.
+
 ## T06 — Owner confirmation of package pin
 
 ```task