diff --git a/workplans/USER-WP-0021-portal-product-expansion.md b/workplans/USER-WP-0021-portal-product-expansion.md
index 2fba5e4..1c00370 100644
--- a/workplans/USER-WP-0021-portal-product-expansion.md
+++ b/workplans/USER-WP-0021-portal-product-expansion.md
@@ -162,6 +162,30 @@ focus; responsive viewport/mobile tables; provider handoff denial; and
 desktop/browser positive flows. The full suite passes 115 tests with three
 provider integration tests skipped when their external service is absent.
 
+## Upstream corrections consumed (2026-08-18)
+
+tenant-engine reported that production had been silently rolled back to the
+pre-lifecycle TEN-WP-0004 image between 2026-08-13 and 2026-08-16, so PATCH,
+retire, and reactivate returned 404 while flex-auth simultaneously ran a
+four-action policy that would have denied them anyway. Both are resolved and
+verified live. Our conformance suite passed throughout because it was right
+about the contract and production was not serving it — which is precisely the
+gap the handoff note flagged. The live cross-service check from a user-engine
+pod is now owed as part of the next rollout; contract-level evidence cannot
+see a pin rollback.
+
+tenant-engine also corrected the contract: `grouping` is no longer immutable.
+It changes only through the authority's own reclassification route under a
+separate `tenant.grouping.set` action, because grouping resolves a tenant's
+guardrail spend ceiling and must not ride on a rename. The identifier's
+grouping segment is now historical — a tenant created as `tenant:small:acme`
+can report grouping `large`. Verified that user-engine performs no identifier
+parsing; every `split` in the portal is URL routing. `TenantRecord` had been
+dropping the field, so the read now carries it, the operator screen shows it
+with the identifier caveat, and OpenAPI documents where to read it. The
+reclassification control itself is deliberately not built: the route is not
+deployed and wants its own permission.
+
 ## T05 - Trigger enterprise federation planning only on demand
 
 ```task