diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md
index 851f32e..6adf481 100644
--- a/workplans/RPF-WP-0035-credential-lane-implementation.md
+++ b/workplans/RPF-WP-0035-credential-lane-implementation.md
@@ -187,6 +187,22 @@ exact claim bindings with excess scopes denied (operator `consume`, human
 and every receipt is metadata-only. If either registration is abandoned, KeyCape
 disables it before the KV version is destroyed.
 
+### 2026-09-08 actual upstream issuer returned
+
+The admitted KeyCape one-shot probe verified the actual signed upstream issuer
+as **`https://auth.coulomb.social`** at 21:44:44 UTC. Signature, audience,
+validity window and nonce checks passed and the pinned Job exited 0. All
+five temporary resources and the Pod were removed; normal KeyCape Deployment
+and config Secret metadata are unchanged. See
+`docs/evidence/2026-09-08-keycape-upstream-issuer-proof.json`.
+
+T05's unknown-issuer input is resolved. The configuration owner still ensures
+`authelia.issuer` equals that exact HTTPS value before the custody window.
+Both CCRs remain proposed and await the named reviews; this probe grants no
+custody mutation or client-side read. Keep the current authority preflight and
+this signed-token proof as separate receipts. Live ESO/client/approval and
+separate audit/client-side custody acceptance remain open.
+
 ## Dependency review — 2026-09-06
 
 SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented
@@ -220,20 +236,3 @@ T05 remains wait: both CCRs are still proposed, the actual upstream ID-token
 issuer precondition remains open, and no verifier-side credential is provisioned.
 Client-side retrieval and audit-sender custody are still separate owner returns.
 The capability receipt is not a review approval or service readiness proof.
-
-
-### 2026-09-08 actual upstream issuer returned
-
-The admitted KeyCape one-shot probe verified the actual signed upstream issuer
-as **`https://auth.coulomb.social`** at 21:44:44 UTC. Signature, audience,
-validity window and nonce checks passed and the pinned Job exited 0. All
-five temporary resources and the Pod were removed; normal KeyCape Deployment
-and config Secret metadata are unchanged. See
-`docs/evidence/2026-09-08-keycape-upstream-issuer-proof.json`.
-
-T05's unknown-issuer input is resolved. The configuration owner still ensures
-`authelia.issuer` equals that exact HTTPS value before the custody window.
-Both CCRs remain proposed and await the named reviews; this probe grants no
-custody mutation or client-side read. Keep the current authority preflight and
-this signed-token proof as separate receipts. Live ESO/client/approval and
-separate audit/client-side custody acceptance remain open.