diff --git a/workplans/USER-WP-0025-operator-navigation-and-logout.md b/workplans/USER-WP-0025-operator-navigation-and-logout.md
index f057867..a287ae3 100644
--- a/workplans/USER-WP-0025-operator-navigation-and-logout.md
+++ b/workplans/USER-WP-0025-operator-navigation-and-logout.md
@@ -102,7 +102,7 @@ not claimed by this portal release.
 
 ```task
 id: USER-WP-0025-T03
-status: todo
+status: progress
 priority: medium
 state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"
 ```
@@ -114,3 +114,8 @@ KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation
 from User Engine's cookie deletion. Use registered return locations and verify
 same-account login cannot silently reappear after complete sign-out. Preserve
 session-only logout for users who intend to keep their other applications open.
+
+2026-09-12: shared sign-out implemented with USER-WP-0026 and KEY-WP-0034.
+Portal logout hands off to explicit issuer confirmation, then provider-owned
+Authelia logout with a fixed portal return. Actual signed-in account switching
+awaits operator browser evidence; already issued JWTs are not revoked.
diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md
index ba81267..281dd14 100644
--- a/workplans/USER-WP-0026-account-recovery.md
+++ b/workplans/USER-WP-0026-account-recovery.md
@@ -44,3 +44,28 @@ only after browser evidence. Existing application sessions may outlive provider
 logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.
 
 Source verification: 182 tests passed with three optional integration skips; layer conformance passed. Immutable publication and live checks are in progress.
+
+## Discover workload access from authoritative application records
+
+```task
+id: USER-WP-0026-T03
+status: todo
+priority: high
+```
+
+The requested cross-application allow list is not represented by the current
+User Engine membership store. Establish a provider-owned workload catalogue and
+read current application access decisions for the signed-in identity. Link only
+registered HTTPS workload entry points. Distinguish allow, deny and unavailable;
+never turn a tenant membership, platform role, application registration or a
+missing access record into an inferred grant. Current UI displays recorded
+workload memberships only; no complete fleet entitlement inventory is claimed.
+
+### Live recovery rollout — 2026-09-12
+
+Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
+(Helm revision 3). All three are Ready. Six provider checks, eleven product
+checks and six fresh anonymous Chromium checks pass, including actual provider
+logout POST and return to the portal without test overrides. Real-user identity
+switching is still awaiting operator evidence; no authenticated/MFA acceptance
+is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.