diff --git a/doc/multitenant-porting-guide.md b/doc/multitenant-porting-guide.md
index b814f42c..673dde00 100644
--- a/doc/multitenant-porting-guide.md
+++ b/doc/multitenant-porting-guide.md
@@ -52,6 +52,42 @@ wired by default (see §8).
 
 ---
 
+## 2a. How the Console (`../fission`) Integrates
+
+The Fission Console (`github.com/naeel/fission`, package `console`) creates tenant
+namespaces via `SetupFissionNamespace()` in
+`console/internal/fission/namespace.go`.
+
+That function does three things:
+1. Creates the Namespace with two labels:
+   - `managed-by=fission-console` — console's own filter
+   - **`fission.io/managed=true`** — this is the NSWatcher trigger
+2. Creates `fission-fetcher` and `fission-builder` ServiceAccounts in the new NS
+3. Creates RoleBindings for all Fission system SAs (`fission-executor`,
+   `fission-router`, `fission-buildermgr`, etc.) using `cluster-admin` scoped to
+   the namespace
+
+**The coupling is exactly one label.** The console does not call any Fission
+internal API to register the namespace — it just sets `fission.io/managed=true`
+and the NSWatcher in executor/router/buildermgr picks it up automatically within
+~50ms.
+
+**Before `v1.22.0-mt1` (today's deploy):** the console set the label but the
+executor was running the official `ghcr.io/fission/fission-bundle:v1.22.0` image
+which has no NSWatcher — so the label was silently ignored. Tenant namespaces
+still worked because the console also created the SA/RoleBindings manually (step 2
+and 3 above), so pool pods could start. But executor/router/buildermgr were not
+dynamically aware of new namespaces — they relied on whatever was in
+`FISSION_RESOURCE_NAMESPACES` at startup.
+
+**After `v1.22.0-mt1`:** executor/router/buildermgr detect the label
+automatically. The SA creation in `EnsureNamespaceSA` (our code in
+`pkg/utils/serviceaccount.go`) now runs from the executor side as well — but since
+the console already created the SA, `EnsureNamespaceSA` is a no-op (idempotent).
+No conflict, no double work.
+
+---
+
 ## 3. Backward Compatibility
 
 `FISSION_RESOURCE_NAMESPACES` continues to work exactly as before. Namespaces