diff --git a/workplans/USER-WP-0021-portal-product-expansion.md b/workplans/USER-WP-0021-portal-product-expansion.md
index 084e238..c7bbe6e 100644
--- a/workplans/USER-WP-0021-portal-product-expansion.md
+++ b/workplans/USER-WP-0021-portal-product-expansion.md
@@ -173,3 +173,19 @@ state_hub_task_id: "05046780-9625-47c2-8caf-f57e9239c603"
 When a tenant requires SAML/OIDC federation, SCIM, directory synchronization,
 just-in-time provisioning, or customer-owned lifecycle, create a dedicated
 cross-repository plan against the provider-neutral contracts.
+
+## Production rollout (2026-08-08)
+
+Commit `8229c6d` passed 115 tests with three external-provider skips, was
+published as
+`forgejo.coulomb.social/coulomb/user-engine@sha256:cef2fdb19fd001a9d2a64742f58dacdcf2ff5868ce50685c91eaad7880645fd0`,
+and rolled out successfully on Railiance. Public health returns schema
+`0001_initial`, KeyCape login returns a PKCE redirect, and `/onboarding`,
+`/admin/{tenant}`, and `/platform` are recognized protected routes (403
+without a session, rather than 404). The rollout replaces in-memory OIDC
+sessions, so existing browsers must authenticate again.
+
+The tenant authority is not currently deployed in the cluster. Platform
+tenant creation therefore remains fail-closed behind the implemented optional
+`TenantManagementPort`; this is part of the remaining T01 tenant-management
+integration rather than a hidden local tenant registry.