diff --git a/deploy/FRESH-AUTH.md b/deploy/FRESH-AUTH.md
index 48a7ad7..049060f 100644
--- a/deploy/FRESH-AUTH.md
+++ b/deploy/FRESH-AUTH.md
@@ -1,5 +1,10 @@
 # Fresh review authentication rollout candidate
 
+Deployed on founder instruction "please deploy", 2026-10-03 18:39 UTC.
+Deployment revision 17 Ready; public health/readiness and fresh-login redirect
+verified. Native human browser proof pending. Evidence:
+`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
+
 INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
 Published immutable candidate:
 `forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
diff --git a/deploy/sitting-admission.json b/deploy/sitting-admission.json
index 14c80dc..231fc2e 100644
--- a/deploy/sitting-admission.json
+++ b/deploy/sitting-admission.json
@@ -1,5 +1,5 @@
 {
-  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
   "policy": {
     "origin": "http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080",
     "package": "informed-decision.compact-sitting",
diff --git a/docs/evidence/2026-10-03-fresh-auth-live-rollout.json b/docs/evidence/2026-10-03-fresh-auth-live-rollout.json
new file mode 100644
index 0000000..b658e1a
--- /dev/null
+++ b/docs/evidence/2026-10-03-fresh-auth-live-rollout.json
@@ -0,0 +1,58 @@
+{
+  "at": "2026-10-03T18:39:16.801706+00:00",
+  "authority": {
+    "actor": "founder",
+    "instruction": "please deploy",
+    "mode": "ADMINISTER",
+    "scope": "realm:kubernetes/railiance01",
+    "activation": "APPROVED"
+  },
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
+  "previous_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8",
+  "deployment_revision": "17",
+  "strategy": "Recreate",
+  "ready_replicas": 1,
+  "resources": {
+    "limits": {
+      "cpu": "500m",
+      "memory": "256Mi"
+    },
+    "requests": {
+      "cpu": "5m",
+      "memory": "64Mi"
+    }
+  },
+  "node_preflight": {
+    "ip": "92.205.62.239",
+    "cpu_requests_millicores": 3445,
+    "cpu_allocatable_millicores": 4000,
+    "additional_cpu_requests_millicores": 0
+  },
+  "public_checks": {
+    "/healthz": {
+      "status": 200
+    },
+    "/readyz": {
+      "status": 200
+    },
+    "/auth/start": {
+      "status": 303,
+      "issuer_origin": "https://kc.coulomb.social",
+      "issuer_path": "/authorize",
+      "prompt": [
+        "login"
+      ],
+      "max_age": [
+        "0"
+      ]
+    }
+  },
+  "store_readback": {
+    "schema_version": 2,
+    "p01_memo_count": 1,
+    "policy_version": "v7",
+    "policy_package_digest": "sha256:2490955f175c52574543e210be06f468a01e56c778d38d4fdcad731875e37cc7"
+  },
+  "native_browser_proof": "awaiting founder password/OTP login and exact p01 read",
+  "agent_performed_human_act": false
+}
diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md
index 10c6527..74cc683 100644
--- a/workplans/ADHOC-2026-10-03.md
+++ b/workplans/ADHOC-2026-10-03.md
@@ -40,7 +40,7 @@ id: INFD-WP-ADHOC-2026-10-03-T02
 status: wait
 needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "p01 is loaded, but repeated browser read attempts retain KeyCape MFA time 17:08:08 UTC and fail the 900-second policy limit. Obtain genuinely fresh password/OTP authentication; if fresh OTP still emits the old time, KeyCape owns the correction (INFD-IN-0005). Then founder reviews, acknowledges and chooses a disposition."
+blocking_reason: "p01 is loaded and fresh-login fix deployed; founder must sign in at decisions.coulomb.social/auth/start with password/OTP, open p01, acknowledge the required highlight and choose a disposition. If actual fresh MFA still emits old assurance, KeyCape owns correction under INFD-IN-0005."
 priority: high
 state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
 ```
@@ -130,3 +130,9 @@ it with a completed browser journey. Retain all policy freshness limits.
 Evidence: `docs/evidence/2026-10-03-provisioning-window-review-refusal.json`.
 `INFD-WP-0006` implements an explicit fresh-authentication request from review
 sign-in; its narrow image rollout and native browser proof remain blocked.
+
+Fresh-login image rollout completed under founder instruction "please deploy"
+at 18:39 UTC (INFD-WP-0006). Revision 17 is Ready; public login now requests
+fresh authentication from KeyCape. p01 and policy pins remain intact. Native
+read and the founder's disposition are still pending. See
+`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
diff --git a/workplans/INFD-WP-0006-fresh-review-authentication.md b/workplans/INFD-WP-0006-fresh-review-authentication.md
index 1e8f815..9c61427 100644
--- a/workplans/INFD-WP-0006-fresh-review-authentication.md
+++ b/workplans/INFD-WP-0006-fresh-review-authentication.md
@@ -44,7 +44,7 @@ id: INFD-WP-0006-T02
 status: wait
 priority: high
 needs_human: true
-blocking_reason: "Narrow pinned review image and rollback are published/prepared; obtain founder approval for the live rollout, then complete human password/OTP login and verify a new signed authentication time and p01 read allowance."
+blocking_reason: "Fresh-login image deployed on founder approval; founder must complete review password/OTP login so we can verify a new signed authentication time and p01 read allowance."
 state_hub_task_id: "dfcc2723-42bd-5b8f-b1b8-e205dc506764"
 ```
 
@@ -64,3 +64,14 @@ Installed fresh-login parameter check, base-layer equality check and all 11
 container lifecycle checks pass. Concrete rollout/rollback and acceptance
 requirements are in `deploy/FRESH-AUTH.md`; image-only strategic patches are
 prepared alongside it. Live deployment has not changed.
+
+2026-10-03 18:39 UTC: founder instructed "please deploy".
+ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
+Image-only patch deployed successfully as Deployment revision 17, one Ready
+replica, Recreate, unchanged 5m CPU/64Mi memory requests. Node preflight showed
+3445m of 4000m CPU requested; no additional request introduced. Public health
+and readiness return 200; public sign-in redirects to the exact KeyCape issuer
+with `prompt=login` and `max_age=0`. Read-only store verification confirms
+schema 2, retained p01 and v7 policy digest. All process-local sessions reset.
+Evidence: `docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
+T02 remains wait solely for native human browser proof; no agent bound a memo.