diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
index 4088b79..a102e92 100644
--- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
+++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md
@@ -168,6 +168,15 @@ assign only the Binky tenant-admin membership, and prove denial for
 `tenant:platform`, `tenant:coulomb`, and unrelated tenants. Confirm the same
 admin can invite and lifecycle-manage a disposable Binky test user.
 
+2026-07-28: the deployed versioned portal API created the Binky tenant-admin
+user and membership, invoked the provider-neutral provisioning adapter, and
+persisted the LLDAP subject link with `password_setup_required`. A live
+newline-bearing proxy Secret exposed an HTTP transport bug; commit `0ef2ae5`
+normalizes required runtime values, adds regression coverage, passes all 105
+tests (three integration skips), and is deployed on railiance01. The remaining
+acceptance gate is a reusable first-password handoff and MFA enrollment:
+LLDAP SMTP is not configured, and no one-shot operator password was used.
+
 ## T08 - Closure and next-stage handoff
 
 ```task