# Platform administrator support release — 2026-09-13

Source b8506ef2e336f15eb85b3fd66072ddc7ade341c4.
Image `forgejo.coulomb.social/coulomb/user-engine@sha256:6c20229d5bc7bf7c89c10c0c3e8db66fbb76a71b3beec3adeed6b73ef140fb01`.
CI smoke run 147, image run 148 and journey run 149 passed.

Implemented operator-only platform activity search by exact support reference
and optional tenant, filtering before the 100-record display limit. Correlates
safe audit metadata and current delivery state, with links to delivery readback.
Missing evidence stays explicit. Raw payloads, free-text summaries and provider
error contents are excluded. Service recovery distinguishes configured adapters
from verified live health and provides assisted setup guidance.

Tenant restoration checks platform permission before confirmation, labels its
scope clearly and explains that it cannot prove ownership or bypass/reset factors.
No real user recovery, directory mutation or policy change was used in release
verification.

Validation:
- Full regression: 216 tests passed, seven opt-in PostgreSQL tests skipped;
  layer conformance passed. This change does not alter database behavior.
- Platform role selection: 19 tests passed; JSON report retained alongside this file.
- Isolated Chromium: 16 checks passed, including investigation form submission,
  no-match recovery, permission separation and factor-boundary confirmation.
- Packaging: four checks passed; source diff check passed.
- Platform completeness gate intentionally fails for P04/P05/P06; no complete
  provider acceptance is claimed.

Image-only rollout tests cluster UID, deployment UID/resourceVersion and predecessor
image; canonical package pins retain unrelated hostname work. Rollback predecessor:
`sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
Recreate replaces the single portal pod and resets in-memory sessions.

Live result: portal Ready 1/1; eight existing public HTTP checks and the new
anonymous platform-activity denial/recovery check passed after readiness.

P04 factor recovery, P05 credential renewal/provider health and P06 effective policy
remain USER-WP-0030-T03, dependent on KEY-WP-0035/NK-WP-0033. The owner route was
rechecked and remains non-resolvable. See docs/platform-admin-acceptance.md for
operator steps and exact remaining custody/renewal contract. Workplan remains active.