diff --git a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml
index 135ecfb..7255cb6 100644
--- a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml
+++ b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml
@@ -3,7 +3,7 @@ spec:
     spec:
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
           env:
             - name: PASSWORD_SETUP_TENANT_RETURNS
               value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}'
diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml
index 04cd50d..baa404d 100644
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@@ -23,7 +23,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: provisioner
-          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6
+          image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
diff --git a/workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md b/workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md
index 953f4cb..6b274dc 100644
--- a/workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md
+++ b/workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md
@@ -4,11 +4,12 @@ type: workplan
 title: "Tenant-scoped identity lifecycle for account journeys"
 domain: infotech
 repo: net-kingdom
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "c0fd56ef-edde-57ab-904f-6d1ff567f74a"
 ---
 
 ## Implement scoped directory access changes
@@ -17,9 +18,10 @@ updated: "2026-09-13"
 id: NK-WP-0038-T01
 status: done
 priority: high
+state_hub_task_id: "6470d6cd-c983-59c7-b13a-ba93672a3eda"
 ```
 
-Support USER-WP-0029 T06: /v1/identities/tenant-access changes only the target
+Support USER-WP-0029-T01/T02 (journey T06): /v1/identities/tenant-access changes only the target
 tenant's users/admins groups, never deletes the identity, clears global suspension
 or touches other tenants. Validate tenant/role/status; verify readback before
 reporting success. Repeated desired-state requests converge. Preserve original
@@ -29,8 +31,9 @@ identity-wide owner operations for explicitly global use.
 
 ```task
 id: NK-WP-0038-T02
-status: progress
+status: done
 priority: high
+state_hub_task_id: "e36392f0-31e1-5e02-b2c0-e0efd8b15693"
 ```
 
 Run provider regression and new isolation/readback/retry tests, build a pinned
@@ -41,3 +44,5 @@ credentials remain a separate NK-WP-0033/KEY-WP-0035 dependency.
 Provider regression: 20 tests passed, including tenant-group isolation, repeated
 desired-state updates, failed readback/retry and preservation of global suspension.
 CI now runs the provider suite for changes to identity-provisioner.
+
+Deployed source a0cc947, image sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6; Ready 1/1, live implementation confirmed. CI provider run 228 passed. Detailed receipt: user-engine/docs/evidence/2026-09-13-journey-release.md. Separate OTP work remains live in NK-WP-0033 and KEY-WP-0035; no OTP completion or real-user lifecycle mutation is claimed.