USER-WP-0026/0028: record live MFA handoff, apply home and readback T04 values

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720

workplans/USER-WP-0026-account-recovery.md

@@ -113,6 +113,16 @@ Remaining before this task is done: access-engine T04 (readback pin values,
 digest-equality test, founder go), operator-installed readback URL and token
 file, and a live check against the pin.
 
+2026-10-10: access-engine gave the T04 values (hub 12cefad4), not live yet.
+URL `http://flex-auth-application-readback.flex-auth.svc.cluster.local.:8080`
+(the trailing dot is required). Projected service-account token audience
+`flex-auth`, the same as the /v1/check pin. The admitted caller is
+system:serviceaccount:user-engine:user-engine, for readback routes only. The
+operator change goes into the apply home, rapp-user-engine
+manifests/runtime.yaml: set `USER_ENGINE_READBACK_URL`, mount a second
+projected token, and set `USER_ENGINE_READBACK_TOKEN_FILE`. T04 itself waits on
+informed-decision accepting lifecycle v2, then the founder go.
+
 ### Live recovery rollout — 2026-09-12
 
 Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993

workplans/USER-WP-0028-user-journey-acceptance.md

@@ -96,3 +96,8 @@ a decision on whether tegwick joins the coulomb-social pilot.
 coulomb-social; there is no pilot member list, a first sign-in is enough. The
 handoff URL change was sent to net-kingdom (hub 58e999b3), env only. Next:
 net-kingdom's rollout reply, then the attended run with tegwick.
+
+2026-10-10: net-kingdom replied (7ee2459e) that the handoff URL was already
+live from rapp-user-engine manifests/runtime.yaml, the apply home. The net-kingdom
+file is migration input only. Public /security verified showing the
+pink-account link. Next: the attended run with tegwick.