diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 7ad8037..471a244 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -73,4 +73,4 @@
 | task | RCLUSTER-WP-0018-T05 | todo | — | workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md |
 | task | RCLUSTER-WP-0019-T01 | done | — | workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md |
 | task | RCLUSTER-WP-0019-T02 | done | — | workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md |
-| task | RCLUSTER-WP-0019-T03 | wait | — | workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md |
+| task | RCLUSTER-WP-0019-T03 | done | — | workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md |
diff --git a/workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md b/workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md
index efd4693..2796904 100644
--- a/workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md
+++ b/workplans/RCLUSTER-WP-0019-k3s-admin-kubeconfig-mode.md
@@ -64,13 +64,13 @@ transform test on a synthetic unit). No host connection.
 
 ```task
 id: RCLUSTER-WP-0019-T03
-status: wait
+status: done
 priority: high
-needs_human: true
-blocking_reason: "Attended privileged run on railiance01 (k3s restart, ~30-90s API outage); supervisor runs check mode first, then apply."
 state_hub_task_id: "012fb36b-2b19-51ef-ac0a-22a9ffd3e6a8"
 ```
 
+**Done 2026-10-20 (attended, founder present).** Applied on railiance01: admin kubeconfig root:root 0600, API ready, node Ready; unit backup retained root-only. Also found registries.yaml 0644 with a registry login; restricted to 0600 and persisted (`36f733c`). Evidence: the-custodian `docs/evidence/2026-10-20-railiance01-cutover-steps-2-4.md`.
+
 ```
 ansible-playbook ansible/k3s-kubeconfig-mode.yml -e target=<railiance01 inventory host> --check --diff
 ansible-playbook ansible/k3s-kubeconfig-mode.yml -e target=<railiance01 inventory host> --diff