Name the login and sign-in address at onboarding handoff (USER-WP-0035-T01).

From the 2026-09-23 operator run: recipients try the email address, and the
admin user entry gave no sign-in address to pass on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 58902@bnt-lap001
Assistant-Session: 7ac7f865-2dc5-4aa7-8eb7-27a342109c2f

src/user_engine/web.py

@@ -2053,6 +2053,9 @@ Use the login name they provide; it may differ from your display name.</p></sect
             hidden = "".join(f'<input type="hidden" name="{escape(k)}" value="{escape(v)}">' for k,v in fields.items())
             return f'<form method="post" action="{root}/{action}"><input type="hidden" name="csrf_token" value="{escape(csrf_token)}">{hidden}<button type="submit">{label}</button></form>'
         login = (f'<p>Login name: <strong>{escape(self._directory_login(directory.subject))}</strong></p>'
+                 '<p>Pass this name on with the sign-in address. It is not the email address, '
+                 'and signing in by email does not work.</p>'
+                 f'<p>Sign-in page: <a href="{escape(self.login_url)}">{escape(self.login_url)}</a></p>'
                  '<p>Password and authenticator status are not available here.</p>') if directory else '<p>Login not created. Prepare a login before asking this person to sign in.</p>'
         actions = ""
         if not inactive:
@@ -2244,11 +2247,13 @@ Use the login name they provide; it may differ from your display name.</p></sect
         return self._page_html(
             "Password setup",
             "<h1>Login ready for password setup</h1>"
-            + f"<p>Login name: <strong>{escape(self._directory_login(subject))}</strong>. Use this name when signing in; it may differ from the display name.</p>"
+            + f"<p>Login name: <strong>{escape(self._directory_login(subject))}</strong>. Use this name when signing in; it may differ from the display name, and it is not the email address.</p>"
             + "<p>The password is handled only by the NetKingdom identity "
             "surface. This short-lived link is single use.</p>"
             f'<p><a class="button" rel="noreferrer" href="{escape(setup_url)}">'
             "Continue to password setup</a></p>"
+            + f'<p>After the password is set, sign in at <a href="{escape(self.login_url)}">{escape(self.login_url)}</a>. '
+            "This portal does not deliver the setup link; pass it and the login name on yourself.</p>"
             f'<p><a href="/admin/{escape(tenant)}">'
             "Return to tenant administration</a></p>",
         )

tests/test_journey_roles.py

@@ -76,6 +76,15 @@ class UserJourneys(JourneyFixture):
         self.assertIn(b'Login name: <strong>actual.login</strong>',body)
         self.assertIn(b'may differ from the display name',body)
         self.assertEqual(1,len(self.app.service.store.identities_for_user(user.user_id)))
+        # 2026-09-23 operator run: the recipient must be told where to sign in,
+        # and that the email address is not the login name (USER-WP-0035-T01).
+        self.assertIn(self.app.login_url.encode(),body)
+        self.assertIn(b'not the email address',body)
+        response,listing=invoke(self.app,f'/admin/{TENANT}',cookie='ue_session=admin')
+        self.assertEqual('200 OK',response['status'])
+        self.assertIn(b'Sign-in page:',listing)
+        self.assertIn(self.app.login_url.encode(),listing)
+        self.assertIn(b'signing in by email does not work',listing)
 
 class TenantAdminJourneys(JourneyFixture):
     def test_wrong_role_or_tenant_never_calls_provider(self):

workplans/USER-WP-0035-onboarding-handoff-findings.md

@@ -0,0 +1,59 @@
+---
+id: USER-WP-0035
+type: workplan
+title: "Onboarding handoff findings from the 2026-09-23 operator run"
+domain: communication
+repo: user-engine
+status: active
+flavor: implementation
+owner: claude-code
+topic_slug: user-engine
+created: "2026-09-23"
+updated: "2026-09-23"
+related: [USER-WP-0027, USER-WP-0028, NK-WP-0036, NK-WP-0041]
+---
+
+Intake for the net-kingdom findings from the human onboarding run on
+2026-09-23 (NK-WP-0036-T05, net-kingdom@6c4fcaf; hub message 21b0b7e4).
+Provider sign-in, Create login, single-use setup link, password set and
+portal sign-in all worked. Three findings touch journeys U04 and T03 in
+`docs/account-journeys.md`. This records them against user-engine; the
+provider-side items stay with net-kingdom.
+
+## Name the login and the sign-in address at every handoff point
+
+```task
+id: USER-WP-0035-T01
+status: done
+priority: high
+```
+
+Findings 2 and 3. The derived login name (`bernd.worsch-99` from a
+plus-addressed mail) is not obvious to the recipient, users try the email
+address first, and the tenant-admin user entry offered no sign-in address to
+pass on. Plus-addressed email sign-in additionally fails at Authelia, which
+net-kingdom tracks as NK-WP-0041-T02; user-engine must therefore not imply
+that the email address works.
+
+2026-09-23: the tenant-admin user entry now shows the sign-in address next to
+the login name and states that the email address is not the login name. The
+password-setup handoff page repeats the sign-in address for after the
+password is set and says plainly that this portal does not deliver the link.
+Regression coverage is in
+`test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry`.
+No claim about password or factor state is added, and no delivery is claimed.
+
+## Deliver the setup link to the recipient
+
+```task
+id: USER-WP-0035-T02
+status: wait
+priority: high
+```
+
+Finding 1: the setup link reaches the provider's screen only. A real handoff
+depends on the operator passing it on out of band. Closing this needs the
+governed transactional mail lane (`email-connect` plus the OpenBao delivery
+token) that SCOPE records as operator-owned; U04 and T02 in
+`tests/journey-coverage.json` stay `external-blocked` until then. Do not
+substitute a portal-rendered link for delivery evidence.