diff --git a/docs/native-signer-workload.json b/docs/native-signer-workload.json
--- a/docs/native-signer-workload.json
+++ b/docs/native-signer-workload.json
@@ -42,8 +42,15 @@
   },
   "managed_package_limit": {
     "rapp_declaration_ref": null,
-    "status": "Existing managed-deployable migration debt remains unknown under security-zones_v0.1 \u00a76; no matching authoritative rapp declaration was established. Existing source tenancy declaration supplies owner identity binding but cannot substitute for managed-package admission.",
-    "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule."
+    "status": "Access selected a minimal package for the independently rolled-back retained Secrets lifecycle PDP under FLEX-WP-0024-T06. Draft source package and exact-source renderer validate locally. Managed-workload identity remains unknown until the reviewed authoritative package declaration is committed and available to the exact Repo Manager resolver; source preparation grants no custody, placement, native rollout or trust.",
+    "no_fiction": "Do not invent a rapp tuple or describe this Helm-managed Deployment as an independent operational unit to bypass the rule.",
+    "proposed_owner_selected_reference": {
+      "rapp_id": "rapp-flex-auth-secrets-engine",
+      "name": "flex-auth-secrets-engine",
+      "deployable": "flex-auth-secrets-engine",
+      "declaration_ref": "rapp-flex-auth-secrets-engine/declarations/rapp.yaml",
+      "state": "Owner-selected draft extraction; not yet committed/published or independently admitted. Current authoritative resolution stays unknown until reviewed declaration exists."
+    }
   },
   "unchanged_limits": [
     "tenancy and zones grades are unchanged",
diff --git a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
--- a/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
+++ b/workplans/FLEX-WP-0024-decision-envelope-authenticity.md
@@ -272,3 +272,19 @@
 Retained-registry HTTP and production serve proofs and negative joins pass.
 R3 preserves precise notbefore pending separate Approval-owner timestamp fidelity
 repair; no rounding waiver, copied registry algorithm or empty-registry workaround.
+
+2026-10-16 owner package extraction preparation: Access selects
+`rapp-flex-auth-secrets-engine` / workload `flex-auth-secrets-engine` / deployable
+`flex-auth-secrets-engine`, owned by `access-engine`, for the independently
+rolled-back retained Secrets lifecycle PDP only. The draft thin package pins
+current chart/values source and retained image separately; release, namespace,
+ServiceAccount, policy, registry, audience and caller binding are preserved.
+Tenant/user/canary deployments and retired `rapp-secrets-engine` are excluded.
+Normative Railiance Master schema/family validation and exact Repo Manager
+resolution pass locally; global target ownership is unique. Existing unrelated
+fleet declaration findings remain visible. Draft readiness and empty reef
+bindings claim no placement. Package owner review, authoritative declaration
+commit/availability and exact source-to-runtime join precede managed-workload
+custody admission. No unmanaged bypass, remote repo/publication, native change
+or future signer image activation is authorized by this extraction. T06 remains
+`progress`; no second work item duplicates this bounded dependency.