diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 898a02b..c9db352 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -160,8 +160,8 @@
 | task | USER-WP-0021-T03 | done | — | workplans/USER-WP-0021-portal-product-expansion.md |
 | task | USER-WP-0021-T04 | done | — | workplans/USER-WP-0021-portal-product-expansion.md |
 | task | USER-WP-0021-T05 | wait | — | workplans/USER-WP-0021-portal-product-expansion.md |
-| task | USER-WP-0022-T01 | wait | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
-| task | USER-WP-0022-T02 | wait | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
+| task | USER-WP-0022-T01 | progress | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
+| task | USER-WP-0022-T02 | done | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
 | task | USER-WP-0022-T03 | cancel | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
 | task | USER-WP-0022-T04 | cancel | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
-| task | USER-WP-0022-T05 | todo | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
+| task | USER-WP-0022-T05 | progress | — | workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md |
diff --git a/workplans/USER-WP-0021-portal-product-expansion.md b/workplans/USER-WP-0021-portal-product-expansion.md
index 4676d32..b0b8610 100644
--- a/workplans/USER-WP-0021-portal-product-expansion.md
+++ b/workplans/USER-WP-0021-portal-product-expansion.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: netkingdom
 created: "2026-07-30"
-updated: "2026-08-08"
+updated: "2026-08-10"
 depends_on:
   - USER-WP-0020
 state_hub_workstream_id: "ba217f48-5fa5-4178-9c79-73aa225f3f2e"
@@ -193,3 +193,9 @@ also deployed and has live self-service-allow/cross-tenant-deny evidence, but
 the portal runtime switch remains gated on approved event and mail receivers.
 T01 remains open only for broader tenant update/retirement operations and the
 final outbox transport activation.
+
+2026-08-10 rollout evidence: the current source image now fails closed when
+the required flex-auth and delivery settings are absent. A guarded deployment
+was restored to the last known-good revision without service loss. Final T01
+activation remains blocked on approved OpenBao audit/mail receiver tokens and
+transactional SMTP credentials; no placeholder or reused credential was added.
diff --git a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
index 667c337..79fb827 100644
--- a/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
+++ b/workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
@@ -75,6 +75,14 @@ Responses remain non-enumerating. The full suite passes 128 tests with three
 environment-dependent skips. Cancellation, ingress rate limiting, and the
 credential-gated production enablement remain.
 
+The tested UI image is published at
+`forgejo.coulomb.social/coulomb/user-engine@sha256:2fdb60eec093a8c8a0bff1736ab515916cefac49348c0098d308728b72ab3594`.
+A guarded rollout correctly failed closed because the production manifest does
+not yet supply the required flex-auth/event delivery runtime configuration; the
+last known-good revision was restored and remained available. Do not activate
+this image or public registration until the OpenBao delivery and verification
+tokens plus transactional SMTP lane are installed.
+
 ## T02 - Orchestrate provider identity creation
 
 ```task