diff --git a/workplans/RAIL-FAB-WP-0013-path-scoped-duplicate-identity.md b/workplans/RAIL-FAB-WP-0013-path-scoped-duplicate-identity.md
index a7a5b4c..dadaaed 100644
--- a/workplans/RAIL-FAB-WP-0013-path-scoped-duplicate-identity.md
+++ b/workplans/RAIL-FAB-WP-0013-path-scoped-duplicate-identity.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Path Scoped Duplicate Identity"
 domain: railiance
 repo: railiance-fabric
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 planning_priority: high
@@ -76,7 +76,7 @@ source anchors before emitting duplicate conflicts.
 
 ```task
 id: RAIL-FAB-WP-0013-T03
-status: in_progress
+status: done
 priority: high
 state_hub_task_id: "0d6cad1d-16f8-4ac7-b8d3-b62a2f8e4549"
 ```
@@ -84,11 +84,25 @@ state_hub_task_id: "0d6cad1d-16f8-4ac7-b8d3-b62a2f8e4549"
 Rerun the three-repo controlled rescan against the local registry and confirm
 that `repo-scoping` no longer reports the seven lockfile duplicate conflicts.
 
+Verification result:
+
+- Command: `registry scan-manifest registry/local-repos.yaml --repo-slug
+  repo-scoping --repo-slug llm-connect --repo-slug railiance-fabric
+  --previous-from-registry --ingest --no-lock`.
+- Report:
+  `registry/.fabric-discovery/reports/2026-05-20t214250z-deterministic.rescan-report.json`.
+- Result: 3 scanned, 1 unchanged, 2 changed, 0 retired, 0 conflicted, 0 review
+  required.
+- `repo-scoping` snapshot `5` still reports 7 changed lockfile candidates, but
+  none are conflicted; the previous false `possible_duplicate_node` warnings
+  are gone.
+- `registry rescan-status --review-only --json` shows 0 review-required repos.
+
 ### T04 - Rollout Recommendation
 
 ```task
 id: RAIL-FAB-WP-0013-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "4be31147-b060-4b47-9589-8d3d8024879d"
 ```
@@ -96,6 +110,16 @@ state_hub_task_id: "4be31147-b060-4b47-9589-8d3d8024879d"
 Record whether broad all-local-repo baseline ingestion is ready after the
 identity refinement, or whether another targeted blocker remains.
 
+Recommendation:
+
+- Broad all-local-repo baseline ingestion is ready to attempt as an ingest-only
+  operational run.
+- Keep `--previous-from-registry`, `--ingest`, and no `--accept` for the broad
+  pass; review `registry rescan-status --review-only` before any projection.
+- Use safe projection only for clean repos with accepted repo-declaration
+  candidates. Do not project candidate-only repositories until their discoveries
+  are reviewed or explicitly accepted.
+
 ## Close Criteria
 
 - Unit tests cover path-scoped duplicate identity.