diff --git a/docs/netkingdom-sign-in.md b/docs/netkingdom-sign-in.md
index a0f4250..1e1b6ad 100644
--- a/docs/netkingdom-sign-in.md
+++ b/docs/netkingdom-sign-in.md
@@ -26,8 +26,9 @@ Passwords and bearer tokens are not persisted in the product.
 ## Exact demo binding
 
 Enable only with the registered client and the verified KeyCape fresh-login
-release. The currently deployed `dcebd46` issuer lacks `tenant_source` and does
-not propagate fresh-login requests to Authelia; this product fails closed on it.
+release. The initial `dcebd46` issuer lacked `tenant_source` and fresh-login propagation.
+The approved 2026-09-12 rollout replaced it with source 8d4336e; live forwarding
+and the company entry are verified. Native recipient/MFA acceptance remains open.
 
 ```
 NETKINGDOM_ENABLED=true
diff --git a/workplans/VERGABE-WP-0019-invited-company-pilot.md b/workplans/VERGABE-WP-0019-invited-company-pilot.md
index e7fa856..7c31c01 100644
--- a/workplans/VERGABE-WP-0019-invited-company-pilot.md
+++ b/workplans/VERGABE-WP-0019-invited-company-pilot.md
@@ -259,3 +259,18 @@ The exact release packet, rollback and server-dry-run manifests are in
 railiance-apps/docs/vergabe-demo-company-sso-rollout.md. Runtime remains on the
 interim gate pending the documented attended KeyCape upgrade and native user/MFA
 acceptance. KEY-WP-0033 and NK-WP-0037 remain live receiving records.
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.