diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
index a28ee01..5641858 100644
--- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
+++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
@@ -136,10 +136,19 @@ assignee: codex
 needs_human: true
 decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
 depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33]
-blocking_reason: "Issuer half filled 2026-10-23 (NK49 T40 admission, T18 isolated attempt verified). Still open: consumer claim compatibility (unimplemented NK49 callback) and actual consumer continuity, which waits on an independently recovered original OpenBao/custody graph owned by railiance-platform/rapp-openbao; no isolated OpenBao restore is prepared."
+blocking_reason: "Original OpenBao restored in isolation 2026-10-24 (RPF-WP-0064-T07, receipt 4e048dee). Await RPF-WP-0064 phase B (internal-only network with the isolated NK49 KeyCape) and a separately founder-admitted consumer run: KeyCape exchange, OpenBao JWT login, openbao:admin refusal, session revocation."
 state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
 ```
 
+2026-10-24 (RPF-WP-0064-T08 handoff): the original OpenBao was restored from the 2026-10-14 off-host snapshot in a
+networkless disposable target, founder attended, and independently verified (railiance-platform `7084b57`,
+receipt `sha256:4e048dee…579d`, kept outside Git). Cluster id `fd28df5d…` matched; this consumer's objects were
+present and equal to source: `keycape-services` JWT config, role `secrets-engine-openbao`, policy
+`secrets-engine-login-self`, and KV metadata `platform/workloads/keycape/secrets-engine-openbao` (no data read).
+This fills the "original OpenBao/custody recovery" dependency at configuration level. Consumer continuity is still
+open: a live JWT login needs RPF-WP-0064 phase B (internal network with the isolated NK49 KeyCape) and its own
+founder admission.
+
 Before any key prompt, the selector preflight must pass with `--admission` on the
 founder-signed attempt document for this exact case (T05).
 2026-10-21: decision d1ab097d resolved by the founder as approved in principle.