diff --git a/workplans/ADHOC-2026-09-12.md b/workplans/ADHOC-2026-09-12.md
new file mode 100644
index 0000000..7d1db99
--- /dev/null
+++ b/workplans/ADHOC-2026-09-12.md
@@ -0,0 +1,28 @@
+---
+id: REEF-RAILIANCE-WP-ADHOC-2026-09-12
+type: workplan
+title: "Record the admitted demo and portal hostnames"
+domain: financials
+repo: reef-railiance
+status: finished
+owner: the-custodian
+topic_slug: railiance
+created: "2026-09-12"
+updated: "2026-09-12"
+---
+
+## Record the two operator-selected application exposure grants
+
+```task
+id: REEF-RAILIANCE-WP-ADHOC-2026-09-12-T01
+status: done
+priority: medium
+```
+
+The operator added A records for vergabe-teilnahme.coulomb.social and
+users.coulomb.social to 92.205.62.239. Authoritative and recursive DNS agree;
+both exact certificates are Ready. Record hostname grants under the existing
+public 80/443 substrate admission, with railiance-apps and rapp-user-engine as
+application owners. No new substrate ports or firewall grants are introduced.
+RAPPS-WP-0014, RAPP-USER-ENGINE-WP-0002 and VERGABE-WP-0019 retain runtime,
+operator verification and product welcome/identity/recovery work.
diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
index 0476d4d..c6af93e 100644
--- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
+++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
@@ -117,6 +117,8 @@ redaction behavior. The reef binding is now `verified`, not
 ```task
 id: REEF-RAILIANCE-WP-0003-T04
 status: wait
+needs_human: true
+blocking_reason: "Production approval requires mitigation or explicit acceptance of the single-node/shared-control-plane risk."
 priority: high
 state_hub_task_id: "9d792070-5f2b-5b3d-ba52-92c8b0d4a6b8"
 ```