diff --git a/docs/evidence/2026-09-21-overview-read-refusal.json b/docs/evidence/2026-09-21-overview-read-refusal.json
new file mode 100644
index 0000000..b68833b
--- /dev/null
+++ b/docs/evidence/2026-09-21-overview-read-refusal.json
@@ -0,0 +1,16 @@
+{
+  "task": "INFD-WP-0004-T01",
+  "observed_by": "operator, read-only query of live policy_observations",
+  "checks": "4 latest read checks at 2026-09-21T20:37:40Z (memo:infd-20260914-d02, d03, d04, memo:infd-20260921-b01), all policy_denied",
+  "subject_attributes_match_policy": {
+    "groups_contains_net_kingdom_admins": true,
+    "tenant_source": "directory-asserted",
+    "principal_type_source": "authentication-derived",
+    "level": "aal2",
+    "methods": ["pwd", "otp"]
+  },
+  "auth_age_at_check_seconds": 1744,
+  "policy_maximum_age_seconds": 900,
+  "finding": "The only failing condition is MFA freshness. The operator reported a fresh sign-in, but the assurance timestamp KeyCape supplied was about 29 minutes old at check time. This is consistent with INFD-IN-0005 (a reused session, or a prior timestamp carried forward). There is no identity or group regression. The three SECRETS-WP-0010-T03 memos are additionally outside the served compact-sitting v2 package.",
+  "consequence": "A browsing overview cannot rely on the binding-grade read bar. Pursue the list action (INFD-IN-0008) and continue INFD-IN-0005 separately for binding."
+}
diff --git a/docs/flex-auth-request-list-action.md b/docs/flex-auth-request-list-action.md
index bae2000..a0a5484 100644
--- a/docs/flex-auth-request-list-action.md
+++ b/docs/flex-auth-request-list-action.md
@@ -28,7 +28,9 @@ consequences:
    previous session's timestamp even after an actual MFA (`INFD-IN-0005`).
    Authelia 4.38 cannot be made to force reauthentication (`cbea539`). So a
    browsing session usually cannot meet a bar designed for binding.
-   Confirming this against the live policy observations is pending.
+   Confirmed on 2026-09-21: all four latest checks matched every identity
+   condition except age, which was 1744 seconds against 900
+   (`docs/evidence/2026-09-21-overview-read-refusal.json`).
 2. **The three `SECRETS-WP-0010-T03-*` memos are out of scope for good.** They
    were admitted under `informed-decision.t03-review`. The served sitting
    package does not name them, so their own reviewer cannot see their outcome.
diff --git a/workplans/INFD-WP-0004-comfortable-decision-review.md b/workplans/INFD-WP-0004-comfortable-decision-review.md
index 9e58a54..a9e2702 100644
--- a/workplans/INFD-WP-0004-comfortable-decision-review.md
+++ b/workplans/INFD-WP-0004-comfortable-decision-review.md
@@ -41,7 +41,7 @@ split *seeing your decisions* from *reviewing one for binding*:
 
 ```task
 id: INFD-WP-0004-T01
-status: wait
+status: done
 priority: high
 state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8"
 ```
@@ -53,6 +53,10 @@ If a group, level or method differs from the rule, that is a separate identity
 regression and needs fixing regardless of `list`. Record the finding under
 `docs/evidence/`.
 
+**Finding (2026-09-21):** only freshness fails. `auth_age_at_check_s` was
+1744 against 900, and groups, sources, level and methods all match. See
+`docs/evidence/2026-09-21-overview-read-refusal.json`.
+
 ## Request the `list` policy from flex-auth
 
 ```task