diff --git a/officer.dev/CLAUDE.md b/officer.dev/CLAUDE.md
index a5296e5..8007bac 100644
--- a/officer.dev/CLAUDE.md
+++ b/officer.dev/CLAUDE.md
@@ -175,10 +175,17 @@ keyed on **role**, never on a user, and live in `role_capabilities`; absence den
 capabilities (terminal, chat, files, tasks, items, desktop, browser) run as the owner's OS user in the
 owner's home and are **never grantable at any level** — that is structural, not a policy default.
 
-What is NOT built: **there is no way to create a second account.** `createUser` has one call site,
-`api/auth/bootstrap.ts`, gated on an empty `users` table. No signup route, no invites, no admin
-create-user handler — the six accounts in Postgres were inserted by hand. Details and the open defect
-list are in `platform/TODO.md` → "Multi-user"; the design write-up is `COMMS/capability-permissions-2026-08-07.md`.
+**Account creation now exists** — `POST /api/users`, owner-gated, with a form under Settings → User
+Management, plus role change, password reset, Linux provisioning and delete. It landed in `69a31051`; this
+file claimed the opposite for days afterwards, and so did `platform/CLAUDE.md` and
+`docs/roles-and-teams.md`, which sequenced a phase around building the thing that already existed.
+
+Roles are a table as of 2026-08-23, with `users.role` and `role_permissions.role` as foreign keys onto
+`roles.name` with `ON UPDATE CASCADE`. `USER_ROLES` is gone and `UserRole` is `string`, so the guard the
+compiler used to provide is now a runtime check at every write path that takes a role from outside.
+
+The design write-up is `COMMS/capability-permissions-2026-08-07.md`; the roles plan and what is still open
+is `docs/roles-and-teams.md`.
 
 The single-user claims that used to be all over this repo's docs were corrected on 2026-08-07. If you
 find another one, it is stale — `platform/src/servers/capabilities/registry.ts` is the authority.