diff --git a/workplans/FLEX-WP-0035-per-identity-application-readback.md b/workplans/FLEX-WP-0035-per-identity-application-readback.md
index fad9509..41c7eda 100644
--- a/workplans/FLEX-WP-0035-per-identity-application-readback.md
+++ b/workplans/FLEX-WP-0035-per-identity-application-readback.md
@@ -158,10 +158,8 @@ readback over the shipped files. The live lifecycle pin still runs v1 (image
 
 ```task
 id: FLEX-WP-0035-T04
-status: wait
-needs_human: true
+status: done
 depends_on: [FLEX-WP-0035-T05]
-blocking_reason: "Founder go given 2026-10-10; repo side done (bb14ec6). The helm rollout must be run by the operator."
 priority: medium
 state_hub_task_id: "82a8a7e6-54e9-5262-a271-24ce2f161362"
 ```
@@ -184,5 +182,12 @@ pin moves to `e8c57c18` (`main-b5da745`, v2). Rollback target is `bdac62bc`.
 `TestReadbackPinMatchesParticipantPins` checks that the readback pin uses the same
 image and package path as each participant's own pin. Rollout order: the lifecycle
 pin, then the readback pin.
+
+2026-10-10 done. The founder ran both helm upgrades: the lifecycle pin is at
+revision 2 and `flex-auth-application-readback` at revision 1, both on `e8c57c18`.
+Verified: both Ready, `/healthz` 200 on both, the readback routes return 401
+without a token, `/v1/check` returns 404 on the readback pin, anonymous lifecycle
+`/v1/check` returns 401, and ingress admits only `user-engine/user-engine`.
+user-engine's live check with its own token is still to come.
 The pin ships with the image that contains `serve-readback`. Hand user-engine
 the evidence that unblocks `USER-WP-0026-T03`.