diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
index 100fcc5..2837e78 100644
--- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
+++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
@@ -89,6 +89,14 @@ resumable onboarding. Authentication and factor screens must redirect or
 handoff to NetKingdom-owned surfaces; the portal must never handle provider
 admin credentials or store password/MFA secrets.
 
+2026-07-28 increment: the deployed portal presents an HTTPS-only interstitial
+to NetKingdom's 15-minute, single-use password setup surface after provisioning
+and lets an authorized administrator renew that handoff for an already-linked
+identity. The portal never receives the password. Adapter and browser
+regressions are included in the 105-test passing suite. Invitation,
+verification, consent/profile, tenant selection, MFA enrollment, and full
+accessibility breadth remain.
+
 ## T04 - Implement tenant-admin and platform-admin UX
 
 ```task
@@ -174,8 +182,12 @@ persisted the LLDAP subject link with `password_setup_required`. A live
 newline-bearing proxy Secret exposed an HTTP transport bug; commit `0ef2ae5`
 normalizes required runtime values, adds regression coverage, passes all 105
 tests (three integration skips), and is deployed on railiance01. The remaining
-acceptance gate is a reusable first-password handoff and MFA enrollment:
-LLDAP SMTP is not configured, and no one-shot operator password was used.
+reusable first-password gate is now deployed: an authorized portal action
+creates or renews a 15-minute, single-use NetKingdom URL. Live disposable-user
+conformance proved revocation, validation without consumption, OPAQUE password
+registration, directory login, replay denial, and cleanup. Remaining Binky
+acceptance is the human-selected password, MFA enrollment, and tenant
+claim/denial evidence; no one-shot operator password was used.
 
 ## T08 - Closure and next-stage handoff