diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
index f08d281..85fbf72 100644
--- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
+++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
@@ -144,6 +144,14 @@ Before any key prompt, the selector preflight must pass with `--admission` on th
 founder-signed attempt document for this exact case (T05).
 2026-10-21: decision d1ab097d resolved by the founder as approved in principle.
 The remaining gate is the actual signed attempt approval once NK-WP-0049-T33 is ready.
+T04 also owns the admission anchor on the attempt host. Install root-owned
+`/etc/secrets-engine/admission/allowed_signers` there, with the founder approver
+key, per `docs/founder-admission.md`. If the attempt host is the secrets-engine
+runtime host, one anchor serves both this task and SECRETS-WP-0014-T04. NK-WP-0049
+pinned secrets-engine 0f44fbe and the selector and service_auth.py hashes from that
+commit, recorded in net-kingdom
+`docs/evidence/2026-10-21-nk49-t33-readiness/readiness-observation.json`. Those pins
+were confirmed 2026-10-21. T04 consumes the NK49 T33 packet unchanged.
 Only a separately admitted owner action can establish actual archived registration,
 issuer trust, native negative checks and consumer continuity. Source selector and
 historical provider proof do not fill this gate. No production consumer redirect,