diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index b8d9a37..abfc764 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -151,5 +151,5 @@
 | task | USER-WP-0020-T04 | progress | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
 | task | USER-WP-0020-T05 | progress | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
 | task | USER-WP-0020-T06 | wait | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
-| task | USER-WP-0020-T07 | progress | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
+| task | USER-WP-0020-T07 | done | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
 | task | USER-WP-0020-T08 | wait | — | workplans/USER-WP-0020-self-service-and-user-administration-portal.md |
diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
index 0d327d1..a25f705 100644
--- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
+++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
@@ -197,6 +197,11 @@ the provider permits, and make authenticator labels identify the account.
 privacyIDEA's future enrollment label is now `Coulomb: {user}@{realm}` at the
 otpauth issuer/account level; existing wallet entries require a local rename.
 
+2026-07-29 follow-up: the first-factor edge now accepts either stable directory
+uid or full email using Authelia's documented LLDAP uid/mail filter. The
+resolved subject remains the uid, so this improves login comprehension without
+changing identity keys.
+
 Live `/api/v1/me` acceptance confirmed the canonical KeyCape issuer,
 `tenant:friendly:binky`, Binky-only users/admins groups, roles `user` and
 `tenant-admin`, and AAL2 `pwd` + `otp` assurance with `mfa: true`. Attempts to