Reconcile public registration acceptance residuals

docs/intakes/csoc-residuals.md

@@ -12,7 +12,7 @@ id: CSOC-IN-0001
 kind: intake
 title: "Enable Create account and Case B registration smoke on app.coulomb.social"
 lane: blue
-status: open
+status: closed
 priority: medium
 owner: coulomb-social
 repo: coulomb-social
@@ -35,8 +35,10 @@ description: |
 
   DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
 notes: |
-  Depends on NK-WP-0025 (registration orchestration + mail path).
-  Related: CSOC-IN-0002 (identity negatives after Case B).
+  Closed 2026-08-14. NK-WP-0025 published the registration URL and completed
+  disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login
+  evidence. The live app redirect uses the configured URL only.
+  Related: narrowed CSOC-IN-0002 for two focused regression checks.
 state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```
 
@@ -47,7 +49,7 @@ state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
 ```yaml
 id: CSOC-IN-0002
 kind: intake
-title: "Record identity negatives: state replay, collision, step-up"
+title: "Add callback replay and email-only takeover regressions"
 lane: green
 status: open
 priority: low
@@ -56,19 +58,17 @@ repo: coulomb-social
 origin: residual
 origin_ref: CSOC-WP-0003
 description: |
-  CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
-  in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
-  offline/dev if useful):
+  Case B, repeat-login issuer+subject idempotency, registration redirect
+  confinement, and AAL1/AAL2 isolation are now proven. Add direct application
+  regressions for the two checks not yet independently covered:
 
-  - OIDC state/nonce replay
-  - issuer+subject collision (single Member)
-  - email-only must not take over another subject
-  - step-up ACR rejection when assurance insufficient
-  - registration redirect allow-list only
+  - a consumed/replayed OIDC callback state fails closed; and
+  - the same email with a different issuer+subject cannot take over a Member.
 
-  Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
+  Capture the results in docs/identity/smoke.md and close this intake.
 notes: |
-  Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
+  Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked
+  on the registration or mailbox path.
 state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
 ```
 
@@ -136,4 +136,3 @@ notes: |
   Pickup: docs/session-pickup.md
 state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7"
 ```
-