diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 3fd589c..5ec7346 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -47,8 +47,8 @@
 | task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
-| task | NK-WP-0022-T06 | progress | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
-| task | NK-WP-0022-T07 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
+| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0022-T08 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
 | task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
 | task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
diff --git a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
index 94bed16..eaec60c 100644
--- a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
+++ b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
@@ -219,7 +219,7 @@ client tests and TLS/discovery evidence, pre-cutover conformance passes.
 
 ```task
 id: NK-WP-0022-T06
-status: progress
+status: done
 priority: high
 state_hub_task_id: "00bfa48b-28de-4b8e-b3da-715c797beae5"
 ```
@@ -249,11 +249,20 @@ returned generic OpenBao/login/SSH routes, not provider DNS authority.
 Consequently T06 remains in progress on one explicit operator DNS change and
 its observation window, rather than being closed cosmetically.
 
+2026-07-30 completion: the operator moved `lldap.coulomb.social` to
+railiance01. Normal resolution now sends `auth`, `login`, `lldap`, `pink`,
+`pink-account`, and `kc` to `92.205.62.239`; only the explicitly retained
+`bao`, retired `gitea`, and `hub` names resolve to CoulombCore. HTTPS probes
+for Authelia, LLDAP, both privacyIDEA surfaces, and KeyCape discovery pass on
+the public path. Direct TLS-preserving requests to the old IP return 404 for
+each identity hostname, proving the stale ingress has no functioning backend.
+The observation gate therefore passes without fallback traffic.
+
 ## T07 - Retire CoulombCore identity workloads reversibly
 
 ```task
 id: NK-WP-0022-T07
-status: wait
+status: done
 priority: high
 state_hub_task_id: "75d160e6-ed58-4b89-b870-4a755e1ca5ce"
 ```
@@ -277,6 +286,14 @@ one replica. It must not be scaled down until the final LLDAP DNS record and
 T06 observation gate pass. The reversible retirement is therefore reduced to
 one remaining workload plus stale ingress/backup checks.
 
+2026-07-30 completion: after T06 passed, CoulombCore Authelia was scaled to
+zero. KeyCape, LLDAP, privacyIDEA, and Authelia are now all zero replicas.
+No legacy identity backup CronJobs remain present. Services, Ingresses,
+ConfigMaps, Secrets, PVCs, TLS material, and source manifests were deliberately
+retained. Public identity probes still reach healthy railiance01 endpoints,
+while direct old-IP identity requests return 404. The reversible rollback
+window begins 2026-07-30; no retained state may be deleted under this task.
+
 ## T08 - Final deletion and closure
 
 ```task
@@ -295,6 +312,11 @@ runbooks. Run `statehub fix-consistency`.
 Done when railiance01 is the sole authoritative identity stack, all evidence
 is reconciled, and the workplan is marked finished.
 
+Retention gate: keep the reversible CoulombCore identity resources through at
+least 2026-08-29. T08 then requires a successful railiance01 restore/restart
+drill and a new explicit approval for destructive deletion. Until both occur,
+the workplan remains active with only T08 waiting.
+
 ## Safety gates
 
 - No retirement before a tested backup and restore path exists.