diff --git a/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md b/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md
index abbb802..d32f2cd 100644
--- a/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md
+++ b/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Sign-in diagnosis: account-site and Authelia uid on the account page"
 domain: communication
 repo: user-engine
-status: active
+status: finished
 owner: claude
 topic_slug: communication
 created: "2026-10-14"
-updated: "2026-10-14"
+updated: "2026-10-15"
 related:
   - NK-WP-0051-T03
   - USER-WP-0036
@@ -53,7 +53,7 @@ the two uids are rendered; no email, token, cookie, or OTP. Tests in
 
 ```task
 id: USER-WP-0039-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "9ffe39bd-744b-513a-8539-c4e5daa0341a"
 ```
@@ -62,3 +62,12 @@ Build and roll the image through rapp-user-engine (no manifest change
 needed), check the two lines on `users.coulomb.social` with a mismatched
 session, and report the image digest to net-kingdom for the contract's
 evidence table (`user-engine change`).
+
+2026-10-15: live as `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70`
+(source `7f1db71`, pinned in rapp-user-engine). The first roll (`758af053`,
+`80f5870`) always showed the Authelia uid as unknown: the session-id check
+rejected the `%`, `^` and `!` that real Authelia ids contain. `7f1db71`
+accepts RFC 6265 cookie characters, and `468d4c0` adds the account-site
+session's aal1/aal2. Authelia's own level is not shown, because KeyCape checks
+the one-time code and Authelia reports level 1. Founder acceptance: the page
+showed `platform-root · aal2 one-time code verified` and Authelia `platform-root`.