diff --git a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
index 9c2cfcf..b540b18 100644
--- a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
+++ b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
@@ -240,7 +240,7 @@ this host. Enable/apply gated on **T07** (extend protection to live deployed tag
 
 ```task
 id: ACTIVITY-WP-0020-T07
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "59cd05b3-1a26-4935-9131-0e4d746cb984"
 ```
@@ -257,6 +257,17 @@ Acceptance: a dry-run shows all live tags for activity-core, state-hub, and othe
 production workloads present in `skipped_protected` (or absent from `would_delete`),
 verified against the cluster. Only then are T05 enable and T06 apply unblocked.
 
+**Progress 2026-07-16:** live-tag protection implemented in the prune tool
+(`railiance-platform@`, `collect_live_cluster_versions()` — enumerates pod images
+via kubectl, protects `forgejo…/coulomb/<name>:<tag>`; on by default; unit-tested).
+Verified against the reachable production cluster (92.205.130.254): it protects
+**state-hub f2e042a**, vergabe-teilnahme, issue-core live tags — closing the
+state-hub gap. **Multi-cluster caveat:** `activity-core` (the largest delete set,
+16) does **not** run on that cluster, so its live tag is not yet covered — the
+prune must aggregate live tags across **all** production clusters/contexts (or run
+where it sees them) before enable/apply. Enable/apply remains gated until every
+production cluster's live tags are protected in one dry-run.
+
 ---
 
 ### T06 — First apply run and backup impact evidence