diff --git a/.custodian-brief.md b/.custodian-brief.md
index 2df47aa..8a5b338 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-14 22:26 UTC  
+**Last synced:** 2026-10-14 22:34 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -70,11 +70,9 @@ Progress: 7/9 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
   *(wait: The next types follow once the first one is proven end to end.)*
 
 ### Show who a workload sign-in actually is
-Progress: 2/6 done  |  workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
+Progress: 3/6 done  |  workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
 
 **Open tasks:**
-- ! KeyCape shows the principal before the callback  `a78219bb`
-  *(wait: Implemented in key-cape af3b1b0 (KEY-WP-0041). Image cdec9dd7 and the openbao-admin signInDiagnosis flag are live (2026-10-15). Waits for one attended OpenBao login that shows the page.)*
 - ! Account site shows both sessions  `bdc8b414`
   *(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)*
 - ! Enroll the negative-login factor  `afb5816f`
diff --git a/docs/sign-in-diagnosis.md b/docs/sign-in-diagnosis.md
index b70c12f..e5413cc 100644
--- a/docs/sign-in-diagnosis.md
+++ b/docs/sign-in-diagnosis.md
@@ -25,6 +25,11 @@ authorization request and no earlier one**.
 `aal1` here unless this request asked for and verified the one-time code.
 Enrolling a factor is not `aal2`.
 
+Authelia's own `authentication_level` is not `assurance`. KeyCape checks the
+one-time code through privacyIDEA, so Authelia reports level 1 even for an
+`aal2` sign-in. Surfaces take `assurance` from KeyCape (the request or the
+token it issued), never from Authelia's `/api/state`.
+
 ## Never shown or logged
 
 Tokens (ID, access, refresh, OpenBao), authorization codes, email
@@ -38,7 +43,7 @@ not secret.
 | --- | --- | --- | --- |
 | KeyCape page before the redirect to the application. Opt-in per client (registration flag, default off), enabled first for the OpenBao client. One action: continue, plus how to sign in as someone else | `uid`, `groups`, `assurance`, `client_id` | key-cape | NK-WP-0051-T02 |
 | The existing KeyCape auth log line | `client_id`, `uid`, `assurance` | key-cape | NK-WP-0051-T02 |
-| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session) | user-engine | NK-WP-0051-T03 |
+| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session), `assurance` of the account-site session | user-engine | NK-WP-0051-T03 |
 | `lldap_admin.py groups --user <uid>` (read-only preview) | `uid`, `groups` | net-kingdom | NK-WP-0051-T04 |
 | ops-mason verifier receipt for an attended `bao login` | `uid`, `openbao_error` (and `assurance` when known) | ops-mason | NK-WP-0051-T06 |
 
@@ -63,6 +68,6 @@ OpenBao groups refusal.
 | Item | Value |
 | --- | --- |
 | key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis: true` set on live `openbao-admin` 2026-10-15 (`sso/keycape-config` rv 71655453 → 75372162, byte-preserving, issuer restarted). Accepted 2026-10-15: founder `bao login -method=oidc -path=netkingdom role=platform-admin` showed the page and completed |
-| user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 |
+| user-engine two-session lines | live 2026-10-15: `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` (source `7f1db71`, pinned in rapp-user-engine `a42c68f`). Also shows the account-site session `assurance`. Founder accepted: `platform-root · aal2` and Authelia `platform-root` |
 | ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
 | `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |
diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md
index 0b850bf..e22ab88 100644
--- a/workplans/NK-WP-0051-sign-in-diagnosis.md
+++ b/workplans/NK-WP-0051-sign-in-diagnosis.md
@@ -124,10 +124,8 @@ the T01 document.
 
 ```task
 id: NK-WP-0051-T03
-status: wait
+status: done
 depends_on: [NK-WP-0051-T01]
-blocked_on: message-from:user-engine
-blocking_reason: "Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check."
 priority: high
 state_hub_task_id: "bdc8b414-94fe-52cb-8e26-85c9914d4068"
 ```