diff --git a/docs/operations.md b/docs/operations.md
index 68e12db..fbfd31e 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -186,15 +186,19 @@ workload or customer data, any sign the transcript left the workstation, or a
 planned key rotation. The same workplan removes the problem class by giving
 agents a cluster identity that cannot read these objects at all.
 
-## Current image (2026-09-26)
+## Current image (2026-10-15)
 
 The live issuer is
-`sha256:82f1e5ac481e4f963dbd4b05256aee75412c9e9b465d31c9356f5d17f26a6897`,
-source `13afaa9`. The sign-out confirmation uses the NetKingdom Identity
-page design. Recorded as `ADMINISTER @ realm:kubernetes/railiance01`,
-`activation=APPROVED`. The patch replaced only the image. Strategy stayed
-Recreate and requests stayed 25m/32Mi. Rollback is
-`sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`.
+`forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`,
+source `8c6c071`. Over the previous live source `1164f65` it adds the
+duplicate-clientId startup check (`c528daa`), the lost-authenticator help link
+(`205a1c0`), and the opt-in sign-in diagnosis page with `uid`/`assurance` on
+`auth_success` (`af3b1b0`). Founder-run on 2026-10-15: `keycape check-config`
+on the live config was valid (13 clients, no errors), `kubectl diff` showed only
+the image, server dry-run passed, Recreate rollout succeeded, pod ready with 0
+restarts and discovery answering 200. The owner manifest is
+`net-kingdom/sso-mfa/k8s/keycape/deployment.yaml`. Rollback is
+`sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8`.
 
 ## Fail-closed startup changes from source 11ce29a
 
diff --git a/workplans/KEY-WP-0041-sign-in-diagnosis-page.md b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md
index b81cd4d..4182253 100644
--- a/workplans/KEY-WP-0041-sign-in-diagnosis-page.md
+++ b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md
@@ -8,7 +8,7 @@ status: active
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-10-14"
-updated: "2026-10-14"
+updated: "2026-10-15"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "092c7590-3700-524d-bbe0-a934e063be6b"
@@ -45,7 +45,7 @@ state_hub_task_id: "5947be07-bc84-5672-b807-608070a39d10"
 
 ```task
 id: KEY-WP-0041-T02
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "bd5db26c-b71c-5291-bdc3-7c0f718651db"
 ```
@@ -55,3 +55,8 @@ on the OpenBao browser client in `sso/keycape-config`, roll the issuer under
 the usual live-change approval, and send the digest to net-kingdom for the
 evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
 session: deployment needs operator approval.
+
+2026-10-15: image `sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
+(source `8c6c071`) is live; see `docs/operations.md`. Remaining: set
+`signInDiagnosis: true` on the OpenBao browser client in `sso/keycape-config`
+and restart the issuer. Until then the page is off for every client.