diff --git a/docs/sign-in-diagnosis.md b/docs/sign-in-diagnosis.md
index 0b63c37..f9a54f2 100644
--- a/docs/sign-in-diagnosis.md
+++ b/docs/sign-in-diagnosis.md
@@ -17,7 +17,7 @@ authorization request and no earlier one**.
 | --- | --- | --- |
 | `uid` | The uid KeyCape resolved for this request | Authelia `preferred_username` (fallback `sub`), as KeyCape's Authelia adapter resolves it |
 | `groups` | Directory group display names, sorted | That uid's LLDAP `memberOf`, reduced to display names |
-| `assurance` | `aal2` if this request verified a one-time code, else `aal1` | KeyCape's assurance decision for this request (`MFAVerified`) |
+| `assurance` | `aal2` if this request verified a one-time code, else `aal1` | KeyCape: a one-time code verified within this request. Not `MFAVerified` alone, which is also true when a reused `aal2` session satisfies the request |
 | `client_id` | The relying party the login returns to | The authorization request |
 | `openbao_error` | OpenBao's error text, verbatim | ops-mason receipt only |
 
@@ -62,6 +62,7 @@ OpenBao groups refusal.
 
 | Item | Value |
 | --- | --- |
-| key-cape image digest with the page and log line | _pending NK-WP-0051-T02_ |
-| user-engine change | _pending NK-WP-0051-T03_ |
-| ops-mason / railiance-platform acceptance | _pending NK-WP-0051-T06_ |
+| key-cape page and log line | source `af3b1b0` (flag `signInDiagnosis`); image digest pending KEY-WP-0041-T02 |
+| user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 |
+| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
+| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |
diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md
index 3c5f8f2..29fb3f5 100644
--- a/workplans/NK-WP-0051-sign-in-diagnosis.md
+++ b/workplans/NK-WP-0051-sign-in-diagnosis.md
@@ -99,7 +99,7 @@ id: NK-WP-0051-T02
 status: wait
 depends_on: [NK-WP-0051-T01]
 blocked_on: message-from:key-cape
-blocking_reason: "After T01. key-cape implements the pre-redirect page and the uid log line. NetKingdom does not edit the issuer."
+blocking_reason: "Implemented in key-cape af3b1b0 (KEY-WP-0041). Waits for KEY-WP-0041-T02: image build, live signInDiagnosis flag on the OpenBao client, digest."
 priority: high
 state_hub_task_id: "a78219bb-2355-5a2e-8750-0b32a57f87bc"
 ```
@@ -124,7 +124,7 @@ id: NK-WP-0051-T03
 status: wait
 depends_on: [NK-WP-0051-T01]
 blocked_on: message-from:user-engine
-blocking_reason: "After T01. user-engine renders the account-site uid and the Authelia uid as two lines. NetKingdom does not edit the account page."
+blocking_reason: "Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check."
 priority: high
 state_hub_task_id: "bdc8b414-94fe-52cb-8e26-85c9914d4068"
 ```
@@ -179,7 +179,7 @@ id: NK-WP-0051-T06
 status: wait
 depends_on: [NK-WP-0051-T01]
 blocked_on: message-from:ops-mason
-blocking_reason: "After T01. ops-mason and railiance-platform own the caller proof and the UI role choice. NetKingdom does not change OpenBao."
+blocking_reason: "Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof."
 priority: medium
 state_hub_task_id: "86fb4a6b-6655-57c2-b166-38c18e183eb0"
 ```