diff --git a/docs/playwright-identity-handoff.md b/docs/playwright-identity-handoff.md
index 2eec238..dd6a7cd 100644
--- a/docs/playwright-identity-handoff.md
+++ b/docs/playwright-identity-handoff.md
@@ -78,8 +78,19 @@ Existing implementation follow-ups: railiance-cluster
 Coordination requests sent October 13: cluster
 `f643ce05-b71d-4492-83a3-ae142d0d3535`, KeyCape
 `60b22d25-a573-4957-aaae-3a66f5713466`, NetKingdom
-`94a0096c-f34c-463c-b336-b13cf629b968`. No reply had arrived when preparing
-this source. Owner source/activation receipts remain necessary.
+`94a0096c-f34c-463c-b336-b13cf629b968`.
+
+KeyCape source acceptance arrived 2026-10-14 (`0e65b962`): the public candidate
+`playwright-cli` matches the supported authorization-code shape (PKCE S256, no
+secret, redirect `http://127.0.0.1:18764/callback`, scopes `openid profile
+groups playwright:connect`, access-token audience `playwright-kubernetes`).
+Code-flow lifetime follows the server default of 15 minutes; a per-client
+`tokenLifetime` does not change it. Human `sub` is the directory subject.
+Absent a client tenant and a directory tenant, the claim is `tenant:coulomb`
+with `tenant_source` default, not `tenant:platform`. A per-agent caller is a
+separate confidential client. No client was registered. Live registration of
+either client stays on the NetKingdom registry path. Cluster and ops-bridge
+activation receipts are still absent.
 
 The candidate uses issuer `https://kc.coulomb.social`, dedicated audience
 `playwright-kubernetes`, access scope `playwright:connect`, and a constant mapped
diff --git a/workplans/RPF-WP-0056-playwright-consumer-admission.md b/workplans/RPF-WP-0056-playwright-consumer-admission.md
index 8294627..80fc213 100644
--- a/workplans/RPF-WP-0056-playwright-consumer-admission.md
+++ b/workplans/RPF-WP-0056-playwright-consumer-admission.md
@@ -161,9 +161,11 @@ contract is docs/playwright-identity-handoff.md. Existing workstation API tunnel
 uses its own SSH actor and is not a general per-consumer transport entitlement.
 Dedicated coding-agent registration and governed secret delivery remain pending.
 
-T03 stays wait: cluster/KeyCape/NetKingdom activation replies have not arrived,
-the authenticator candidate has not been natively validated or activated, and
-neither a real human nor agent consumer receipt exists. Do not update provider
+T03 stays wait. KeyCape accepted the public candidate in source only
+(2026-10-14, `0e65b962`); no client is registered. Cluster and NetKingdom
+activation replies have not arrived, the authenticator candidate has not been
+natively validated or activated, and neither a real human nor agent consumer
+receipt exists. Do not update provider
 managed availability to ready from this preparation. No new membership approval
 is required. Evidence: docs/evidence/2026-10-13-playwright-consumer-preparation.json.