docs: record verified personal tenant before real protocol import

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

docs/release/personal-login-500-2026-10-06.md

@@ -53,3 +53,11 @@ Final acceptance: the user replied “I reach my workspace” after revision11
 deployment. This confirms actual interactive personal workspace access;
 CSOC-WP-0008-T11 / CSOC-WP-0010-T03 complete. ReichelAg migration and paired
 restore acceptance remain separate open tasks.
+
+Read-only post-acceptance identity check: exactly one Member for the existing
+issuer/subject, active user, last_login_at within15minutes, platform link present.
+Verified issuer tenant is tenant:platform rather than app fallback tenant:coulomb;
+current code uses verified issuer tenant. Before real protocol transfer,
+CSOC-WP-0008-T03 must reconcile that tenant with target-space ownership and
+explicit memberships. No cross-tenant grant or automatic data reassignment was
+made. This does not invalidate personal workspace/login acceptance.

workplans/CSOC-WP-0008-production-transfer-acceptance.md

@@ -119,6 +119,12 @@ role assignments and additional pre-existing grants before real import; content
 replacement is additive for membership and does not revoke old grants.
 Close CSOC-IN-0003 only after real cohort receipts and exception disposition.
 
+Personal account pre-import prerequisite (2026-10-06): successful verified
+sign-in records tenant:platform, whereas app fallback/demo records used
+tenant:coulomb. Reconcile target-space tenancy and explicit memberships with
+the issuer owner before real ReichelAg transfer; verify isolation/denial. Do not
+rewrite the signed tenant claim or grant broad access to bridge the difference.
+
 ## T04 — Close access and member-portability gaps
 
 ```task