diff --git a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md
index 440351d..f0ab891 100644
--- a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md
+++ b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md
@@ -8,7 +8,7 @@ status: active
 owner: claude
 topic_slug: railiance
 created: "2026-10-14"
-updated: "2026-10-15"
+updated: "2026-11-03"
 state_hub_workstream_id: "04f7c4aa-0a24-5d61-994d-2487ca6bfb91"
 ---
 
@@ -110,3 +110,16 @@ Validation: 64 platform tests passed; two unrelated existing failures concern
 CCR-2026-0035 schema and the core-hub expected resource inventory. The target
 CCR validates without warnings. NK-WP-0051's native diagnosis/refusal proof is
 accepted; this owner task retains the remaining UI control check.
+
+### Overlay regression — 2026-11-03
+
+The deployed workload-role choice is gone. On 2026-11-03,
+`make openbao-verify-login-overlay` failed on `presets.json offers the
+workload role selection`. The live `login.html`, `login.js` and
+`presets.json` match `rapp-openbao`'s copy byte for byte. That repo is the
+canonical owner of the overlay, and it never received this change; its
+`make openbao-deploy` for RAPP-OPENBAO-WP-0003 (around 2026-10-27) re-applied
+the older copy. The change is now ported there (`rapp-openbao` `32d6e92`,
+RAPP-OPENBAO-WP-ADHOC-2026-11-03). Future overlay changes must land in
+`rapp-openbao` first. T04 still needs the overlay applied from `rapp-openbao`,
+a passing verifier, and the attended clickthrough of both role controls.