Finish portal account-switch acceptance.

Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f

workplans/USER-WP-0025-operator-navigation-and-logout.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Make operator navigation and portal logout usable during demo onboarding"
 domain: communication
 repo: user-engine
-status: active
+status: finished
 flavor: implementation
 owner: the-custodian
 topic_slug: user-engine
 created: "2026-09-11"
-updated: "2026-09-12"
+updated: "2026-09-25"
 related: [RAPPS-WP-0014, USER-WP-0020, KEY-WP-0025]
 state_hub_workstream_id: "85391398-f5be-551b-b90d-c8e987a00098"
 ---
@@ -103,7 +103,7 @@ not claimed by this portal release.
 
 ```task
 id: USER-WP-0025-T03
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"
 ```
@@ -118,5 +118,10 @@ session-only logout for users who intend to keep their other applications open.
 
 2026-09-12: shared sign-out implemented with USER-WP-0026 and KEY-WP-0034.
 Portal logout hands off to explicit issuer confirmation, then provider-owned
-Authelia logout with a fixed portal return. Actual signed-in account switching
-awaits operator browser evidence; already issued JWTs are not revoked.
+Authelia logout with a fixed portal return.
+
+2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer
+recorded one MFA refusal, then three new portal logins, each a fresh
+`auth_start` followed by `auth_success` and `token_issued`. Already issued
+JWTs are not revoked. Receipt:
+`key-cape/docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.