diff --git a/workplans/NK-WP-0041-onboarding-journey-usability.md b/workplans/NK-WP-0041-onboarding-journey-usability.md
index 3a04261..db861e7 100644
--- a/workplans/NK-WP-0041-onboarding-journey-usability.md
+++ b/workplans/NK-WP-0041-onboarding-journey-usability.md
@@ -59,7 +59,7 @@ to a user; note it here if the password manager still misbehaves.
 
 ```task
 id: NK-WP-0041-T02
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "83633649-3e5c-57e7-8207-609380a29c25"
 ```
@@ -73,6 +73,24 @@ escapes `+` DN-style inside the filter, and fix it through the reference
 configuration or the version. Users who use plus-addressing cannot sign in
 by email until then.
 
+Diagnosis, 2026-09-24. This is an upstream Authelia defect.
+`internal/authentication/ldap_util.go` `ldapEscape()` in v4.38.0 through
+v4.38.19 (the last 4.38 release) and in v4.39.0 applies `ldap.EscapeFilter`
+and then DN-escapes `, # + < > ; " =` as `\c`. Inside a filter, an escape
+must be `\XX` hex, so the go-ldap filter compile fails for any username or
+email containing one of those eight characters. v4.39.28 (2026-09-17) builds
+the filter with `ldap.EscapeFilter(input)` only (`ldap_user_provider.go:720`).
+No configuration workaround exists.
+
+Upgrade prepared. The target is `authelia/authelia:4.39.28`, pinned as
+`sha256:bd97cff4…`. The live image is the floating tag `4.38`
+(`sha256:46021dc2…`). The live `authelia-config` was validated locally with
+placeholder secrets under both versions: each returned exit 0 with no errors
+and the same set of auto-mapped deprecation warnings. Storage is SQLite on
+the PVC, and 4.39 migrates the schema on start. The rollback therefore needs
+the pre-upgrade copy (`backups/db.sqlite3.pre-4.39.28`) as well as the old
+digest. The daily backups continue.
+
 ## Route the portal findings to user-engine
 
 ```task