diff --git a/docs/work/_system/_state.json b/docs/work/_system/_state.json
index 10f432f..012729c 100644
--- a/docs/work/_system/_state.json
+++ b/docs/work/_system/_state.json
@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T09:05:32.004Z",
+  "updated_at": "2026-05-20T09:27:20.316Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -616,10 +616,10 @@
           ]
         },
         "05-auth-signin-rate-limit-backfill": {
-          "status": "todo",
+          "status": "done",
           "title": "auth.signIn rate-limit backfill",
           "ac_total": 1,
-          "ac_completed": 0,
+          "ac_completed": 1,
           "depends_on": [],
           "blocks": []
         },
@@ -686,11 +686,6 @@
     }
   },
   "ready": [
-    {
-      "epic": "security-headers-rate-limit-sbom",
-      "story": "05-auth-signin-rate-limit-backfill",
-      "title": "auth.signIn rate-limit backfill"
-    },
     {
       "epic": "security-headers-rate-limit-sbom",
       "story": "06-security-headers-core-module",
diff --git a/docs/work/epics/security-headers-rate-limit-sbom/05-auth-signin-rate-limit-backfill/_story.md b/docs/work/epics/security-headers-rate-limit-sbom/05-auth-signin-rate-limit-backfill/_story.md
index ee6e965..3ace398 100644
--- a/docs/work/epics/security-headers-rate-limit-sbom/05-auth-signin-rate-limit-backfill/_story.md
+++ b/docs/work/epics/security-headers-rate-limit-sbom/05-auth-signin-rate-limit-backfill/_story.md
@@ -3,7 +3,7 @@ id: 05-auth-signin-rate-limit-backfill
 epic: security-headers-rate-limit-sbom
 title: auth.signIn rate-limit backfill
 type: technical-story
-status: todo
+status: done
 feature: auth
 depends-on:
   [
@@ -14,7 +14,7 @@ depends-on:
   ]
 blocks: []
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T08:14:55.907Z
+updated: 2026-05-20T09:27:20.152Z
 ---
 
 ## Goal
@@ -51,4 +51,4 @@ Apply the rate-limit primitive to `auth.signIn` as the canonical reference examp
 
 ## Tasks
 
-- [ ] Add `rateLimit: [{ name: "ip", window: "1m", budget: 5 }, { name: "account", window: "1h", budget: 10 }]` to the `signIn` entry in `packages/auth/src/feature.manifest.ts`; add `rateLimit: IRateLimit` to `signInUseCase` deps; add `TooManyRequestsError` to auth error types if absent; insert dual `rateLimit.consume` calls with `TooManyRequestsError` throws in the use-case body; update `bind-production.ts` + `bind-dev-seed.ts` to pass `ctx.rateLimit ?? new NoopRateLimit()` into signIn's `wireUseCase`; extend signIn unit tests with `RecordingRateLimit` dual-consume assertion and `InMemoryRateLimit` budget-1 rejection; all gates pass.
+- [x] Add `rateLimit: [{ name: "ip", window: "1m", budget: 5 }, { name: "account", window: "1h", budget: 10 }]` to the `signIn` entry in `packages/auth/src/feature.manifest.ts`; add `rateLimit: IRateLimit` to `signInUseCase` deps; add `TooManyRequestsError` to auth error types if absent; insert dual `rateLimit.consume` calls with `TooManyRequestsError` throws in the use-case body; update `bind-production.ts` + `bind-dev-seed.ts` to pass `ctx.rateLimit ?? new NoopRateLimit()` into signIn's `wireUseCase`; extend signIn unit tests with `RecordingRateLimit` dual-consume assertion and `InMemoryRateLimit` budget-1 rejection; all gates pass.
diff --git a/docs/work/epics/security-headers-rate-limit-sbom/_epic.md b/docs/work/epics/security-headers-rate-limit-sbom/_epic.md
index 4283c5f..1ea8fc8 100644
--- a/docs/work/epics/security-headers-rate-limit-sbom/_epic.md
+++ b/docs/work/epics/security-headers-rate-limit-sbom/_epic.md
@@ -7,7 +7,7 @@ status: in-progress
 features:
   [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T09:05:31.838Z
+updated: 2026-05-20T09:27:20.152Z
 ---
 
 ## Goal
@@ -24,7 +24,7 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
 - [x] [02 — Rate-limit implementations: Noop, InMemory, Recording](02-rate-limit-implementations/_story.md)
 - [x] [03 — `no-undeclared-rate-limit` ESLint rule](03-no-undeclared-rate-limit-eslint-rule/_story.md)
 - [x] [04 — `withRateLimit` wrapper and conformance extensions](04-with-rate-limit-wrapper-and-conformance/_story.md)
-- [ ] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
+- [x] [05 — auth.signIn rate-limit backfill](05-auth-signin-rate-limit-backfill/_story.md)
 - [ ] [06 — Security headers core module](06-security-headers-core-module/_story.md)
 - [ ] [07 — Per-framework security header adapters](07-security-header-adapters/_story.md)
 - [ ] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)