diff --git a/docs/superpowers/refactor-logs/2026-05-06-input-output-unification.md b/docs/superpowers/refactor-logs/2026-05-06-input-output-unification.md
index 0f22a26..29d302b 100644
--- a/docs/superpowers/refactor-logs/2026-05-06-input-output-unification.md
+++ b/docs/superpowers/refactor-logs/2026-05-06-input-output-unification.md
@@ -72,7 +72,8 @@ auth: signIn and signUp each have 2 new R25 tests — one verifying that a malfo
 auth: 2 new R26 tests in router.test.ts — UNAUTHORIZED on missing user (AuthenticationError translation), BAD_REQUEST on Zod schema failure (schema validation at procedure boundary).
 
 ### 6.3 R27/R28 — presenter shape tests
-(populated when controllers with non-identity presenters add view-shape assertions)
+
+- auth (Task 3): sign-in and sign-up controllers reshape `{ session, cookie }` → `cookie`. Controller tests assert cookie shape (`result.name`, `result.value`, etc.) — not the full use-case output — proving the presenter ran. Same assertions in `tests/sign-in-flow.feature.test.ts`. sign-out controller has no presenter (void return), so no view-shape test applies.
 
 ## 7. Open issues / deferred decisions