Close issuer pin prerequisite and prepare named custody review decisions

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/credential-lane-designs/keycape-approval-clients.md

@@ -117,9 +117,11 @@ Prerequisites before the window opens:
    The admitted probe passed signature/audience/time/nonce verification on
    2026-09-08 at 21:44:44 UTC, exited 0 and removed every temporary resource.
    [Receipt](../evidence/2026-09-08-keycape-upstream-issuer-proof.json).
-   The configuration owner must still ensure `authelia.issuer` is pinned to
-   that exact value before this window. The probe left normal configuration
-   unchanged. Keep the existing-human-login regression in the rollout checks.
+   NetKingdom completed the exact `authelia.issuer` pin on 2026-09-09,
+   with unchanged signing key and unrelated configuration; Secret revision
+   `58713343`. [Pin receipt](../evidence/2026-09-09-keycape-upstream-issuer-pin.json).
+   This prerequisite is closed. Keep the existing-human-login regression in
+   the separately admitted image/configuration rollout checks.
 
 In-window order:
 
@@ -178,3 +180,8 @@ Use an absolute path to the owner command if invoking from another directory.
 It emits no output or values; inspect its allowlisted capability metadata only
 after Warden has completed revocation and cleanup. No custody activation or
 approval is performed by this preflight.
+
+
+2026-09-09: the live issuer pin is complete. The next review is captured in
+[keycape-approval-clients-review.md](keycape-approval-clients-review.md), with
+one pending Hub decision per existing CCR and both required reviewer roles.