diff --git a/sso-mfa/k8s/user-engine/runtime.yaml b/sso-mfa/k8s/user-engine/runtime.yaml
index 3ab171d..1997b67 100644
--- a/sso-mfa/k8s/user-engine/runtime.yaml
+++ b/sso-mfa/k8s/user-engine/runtime.yaml
@@ -45,7 +45,7 @@ spec:
         seccompProfile: {type: RuntimeDefault}
       containers:
         - name: portal
-          image: forgejo.coulomb.social/coulomb/user-engine@sha256:4eac10bf157e48eeadef16a2da83a00933914c9d37338f01679692008de21565
+          image: forgejo.coulomb.social/coulomb/user-engine@sha256:1402712e8f3ddc1397e83edb9627251b0ea362f1e3308d252d0d688ac589556e
           imagePullPolicy: IfNotPresent
           ports: [{name: http, containerPort: 8080}]
           env:
@@ -70,7 +70,14 @@ spec:
             - name: USER_ENGINE_MAIL_TOKEN
               valueFrom:
                 secretKeyRef: {name: user-engine-delivery, key: mail-token}
-            - {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "false"}
+            - {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "true"}
+            - {name: USER_ENGINE_REGISTRATION_VERIFICATION_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080"}
+            - name: USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN
+              valueFrom:
+                secretKeyRef: {name: user-engine-delivery, key: mail-token}
+            - {name: USER_ENGINE_REGISTRATION_CLIENTS, value: "coulomb-social"}
+            - {name: USER_ENGINE_REGISTRATION_TENANTS, value: "tenant:coulomb"}
+            - {name: USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS, value: "https://kc.coulomb.social"}
             - {name: USER_ENGINE_REGISTRATION_RATE_LIMIT, value: "10"}
             - {name: USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS, value: "60"}
             - {name: USER_ENGINE_PROVISIONING_URL, value: "http://identity-provisioner.sso.svc.cluster.local:8080"}
diff --git a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md
index 3f6e6a4..53278e3 100644
--- a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md
+++ b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md
@@ -54,7 +54,7 @@ gate; provider implementation status stays authoritative in the owning repos.
 
 ```task
 id: NK-WP-0024-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
 ```
@@ -75,6 +75,12 @@ validated user-engine policy package currently exists on railiance01.
 probe produced self-service allow and cross-tenant deny decisions. The portal
 runtime switch remains coupled to the event/mail activation gate below.
 
+Done 2026-08-14: the portal is live on the fail-closed HTTP adapter; its
+platform outbox dispatch was authorized by the deployed flex-auth policy and
+accepted into audit-core with correlated event IDs. Existing deployed allow,
+cross-tenant deny, missing-role deny, and wrong-system deny evidence remains
+valid.
+
 ## T02 - Add invitation and verification mail delivery
 
 ```task
@@ -97,7 +103,7 @@ entry; production is deliberately not pointed at a fabricated endpoint.
 
 ```task
 id: NK-WP-0024-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
 ```
@@ -167,3 +173,24 @@ reach flex-auth, audit-core, and email-connect with HTTP 200 through the
 declared NetworkPolicies. Remaining T04 evidence is application-level outbox
 delivery and the negative matrix; health reachability alone is not reported
 as delivery acceptance.
+
+2026-08-14 live outbox proof: nine existing durable non-mail events were
+dispatched through the deployed user-engine adapter. Three were accepted
+immediately. Six received HTTP 400 because audit-core's `user-engine` sender
+was limited to `tenant:friendly:binky`; the platform service legitimately
+emits for multiple tenants. The sender remains write-only and source-bound to
+`user-engine`, but its tenant claim scope is now `*`. After audit-core restart,
+explicit replay delivered all six with attempt count 2; user-engine reports
+zero pending events.
+
+The run also exposed a PostgreSQL retry defect: `pending_outbox()` filtered on
+`failed_at IS NULL`, unlike the in-memory contract, so bounded retries stopped
+after one failure. user-engine commit `0b6a57d` selects every undelivered,
+non-dead-letter event and adds regression coverage; the full suite passes 133
+tests with 3 external skips. The corrected immutable image is
+`sha256:1402712e8f3ddc1397e83edb9627251b0ea362f1e3308d252d0d688ac589556e`.
+
+T03 is complete: all nine durable source events are delivered, replay is
+idempotent at audit-core, user-engine reports zero pending events, and the
+corrected bounded-retry query is live and Ready. T04 remains open for the
+mail-producing application journey and its attended negative cases.
diff --git a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md
index 60dfe90..de2585c 100644
--- a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md
+++ b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md
@@ -118,7 +118,7 @@ provider failure after local completion, and run disposable live conformance.
 
 ```task
 id: NK-WP-0025-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
 ```
@@ -133,6 +133,15 @@ Done when direct NetKingdom registration and coulomb.social-initiated
 registration converge on the same verified identity flow without open
 redirects or client confusion.
 
+Done 2026-08-14: public registration is enabled only for client
+`coulomb-social` and `tenant:coulomb`; the password handoff permits only the
+HTTPS `kc.coulomb.social` origin. The user-engine `/register` page is live.
+railiance-apps commit `963de9c` publishes
+`NETKINGDOM_REGISTRATION_URL=https://users.92-205-62-239.nip.io/register`, and
+the live coulomb.social `/auth/register/` returns a 302 to that exact URL.
+Unknown-client and unknown-tenant API requests both return 400 before any mail
+request. The fresh OIDC flow remains provider-owned after password setup.
+
 ## T04 - Apply optional MFA policy safely
 
 ```task
@@ -155,6 +164,12 @@ Source implementation adds a per-client minimum override and honors explicit
 `acr_values=aal2`; only the coulomb-social static registration selects AAL1.
 Other clients retain provider-driven mandatory MFA. Live rollout remains.
 
+2026-08-14 rollout: public registration is live with a scoped verification
+token. An authenticated malformed consume request reaches email-connect and
+returns 400 rather than 401, proving the caller credential without exposing
+it. Repeated invalid opaque handles return the same redacted 400 response.
+Client and tenant allow-list negatives also fail before mail issuance.
+
 ## T05 - Prove both cases end to end
 
 ```task