diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
index fd98809..2fe43b1 100644
--- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
+++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md
@@ -136,7 +136,7 @@ assignee: codex
 needs_human: true
 decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
 depends_on: [SECRETS-WP-0015-T03, SECRETS-WP-0015-T05, NK-WP-0049-T33]
-blocking_reason: "Source plan (T03) and signed-admission check (T05) delivered. Await NK-WP-0049-T33 original TLS/archive/private admission, the founder's signed attempt admission for the exact case, and original OpenBao/custody recovery for actual consumer continuity."
+blocking_reason: "Anchor installed on the attempt host 2026-10-23 and NK-WP-0049-T33 done. Await the founder's signed attempt admission for the exact case (NK-WP-0049-T40) and original OpenBao/custody recovery for actual consumer continuity."
 state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73"
 ```
 
@@ -175,3 +175,9 @@ NK49 should rehearse on LE staging first. T33 no longer needs original kc-tls ke
 custody. net-kingdom and railiance-cluster were notified; railiance-cluster was asked
 to re-scope RCLUSTER-WP-0018-T02 to the outage prerequisites. Remaining for T33:
 the T35 metadata and the NK49 attempt assembly (deadline, receipt location, verifier).
+
+2026-10-23: the founder installed the anchor on the attempt host, the workstation. `/etc/secrets-engine/admission/allowed_signers`
+is root:root 0644 with a single entry: principal `bernd`, namespaces=`secrets-engine-recovery-attempt`, key
+`SHA256:NekDABfw8K8IBYznjREg7jPpcK/BzCgO1pH1ebT/FXM`. A self-test signature verified Good. This is not
+the runtime host anchor for SECRETS-WP-0014-T04 (different namespace and host). No selector, service_auth.py or
+check-tool file was edited, so the NK49 pins stand.