diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md
index dc66bab..3d52460 100644
--- a/workplans/USER-WP-0026-account-recovery.md
+++ b/workplans/USER-WP-0026-account-recovery.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: codex
 topic_slug: user-engine
 created: "2026-09-12"
-updated: "2026-10-03"
+updated: "2026-10-09"
 state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
 ---
 
@@ -62,8 +62,8 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
 ```task
 id: USER-WP-0026-T03
 status: wait
-blocked_on: message-from:net-kingdom
-blocking_reason: "Needs a provider-owned workload catalogue and application access decisions for the signed-in identity; the membership store cannot represent the allow list."
+blocked_on: message-from:access-engine
+blocking_reason: "Needs access-engine's per-identity decision/grant/revocation/readback contract and a readable protected-system registry (with key-cape client binding) as the workload catalogue; the membership store cannot represent the allow list."
 priority: high
 state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
 ```
@@ -76,6 +76,17 @@ never turn a tenant membership, platform role, application registration or a
 missing access record into an inferred grant. Current UI displays recorded
 workload memberships only; no complete fleet entitlement inventory is claimed.
 
+2026-10-09: net-kingdom answered (hub message 19a0cbcd, 2026-10-03) that it
+owns neither record. Decisions, scoped grants, revocation and readback belong to
+access-engine, the only PDP. The workload catalogue is the binding of three
+records: access-engine protected-system registration, key-cape OIDC client
+(entry points) and the user-engine application record. A workload is listed
+only when all three exist and are bound. "Unavailable" is the PEP outcome when
+no decision is returned, never an inferred allow. Wait retargeted to
+access-engine. Ask filed for the decision/readback contract and a readable
+protected-system registry. If access-engine declines, return to net-kingdom
+for an orchestration workplan.
+
 ### Live recovery rollout — 2026-09-12
 
 Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993