docs(custody): record attended KeyCape first-provision authority proof

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/credential-lane-designs/keycape-approval-clients.md

@@ -156,3 +156,25 @@ platform side; the window needs roughly 60–90 minutes with both owners present
   (KEY-WP-0009-T04) or to RPF-WP-0035-T02's service-JWT lane.
 - No approval for `approval:consume` on the operator client, now or by later
   scope edit. Adding it is a new lane decision.
+
+
+## Attended authority return — 2026-09-08
+
+The metadata-only first-provision preflight is now observed on the exact six
+policy/role/data paths: create/update capabilities are present. The successful
+session self-revoked and its helper was removed. This settles the availability
+of the named operator authority, not the CCR approvals or the upstream issuer
+precondition. See
+[the receipt](../evidence/2026-09-08-keycape-approval-custody-preflight.json).
+
+For a repeat after a role/policy change, use the existing contained WSL wrapper:
+
+```bash
+python3 scripts/openbao-attended-exec.py -- /usr/bin/python3 \
+  scripts/keycape-approval-custody-preflight.py --receipt /tmp/<new-private-receipt>.json
+```
+
+Use an absolute path to the owner command if invoking from another directory.
+It emits no output or values; inspect its allowlisted capability metadata only
+after Warden has completed revocation and cleanup. No custody activation or
+approval is performed by this preflight.