diff --git a/docs/evidence/railiance01-console-access/RAIL01-CONSOLE-20261014T164803Z.yaml b/docs/evidence/railiance01-console-access/RAIL01-CONSOLE-20261014T164803Z.yaml
new file mode 100644
index 0000000..b825e75
--- /dev/null
+++ b/docs/evidence/railiance01-console-access/RAIL01-CONSOLE-20261014T164803Z.yaml
@@ -0,0 +1,20 @@
+receipt_id: RAIL01-CONSOLE-20261014T164803Z
+host: railiance01
+provider_resource_id: c0e697d1-4c71-40f5-9746-0b4c4b9e5c17
+attested_by_role: host-europe-account-holder
+attested_at: "2026-10-14T16:48:03Z"
+panel_login: ok
+mfa_used: false
+console_mechanism: "Wiederherstellungskonsole" (provider web terminal); panel also offers "Server stoppen", "Server neu starten", "Notfallmodus"
+console_shows_host: true
+independent_of_guest_network: true
+rescue_mode_offered: true
+hard_reboot_offered: true
+reboot_window_id: none (T09 capability check, not a window receipt)
+note: >-
+  Founder-attested in session 2026-10-14: the Wiederherstellungskonsole opened
+  railiance01's own terminal from the provider interface (hypervisor-side, so
+  independent of guest networking); provider stop/restart and emergency/rescue
+  mode are also offered. Panel login used no second factor - finding: enable MFA
+  on the Host Europe account. This is the T09 capability receipt; the T03 window
+  still needs a same-day receipt naming its window id.
diff --git a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
index 75cd38a..51ea0aa 100644
--- a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
+++ b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
@@ -295,9 +295,7 @@ decryption receipt or recipient change was attempted.
 
 ```task
 id: RAIL-HO-WP-0011-T09
-status: wait
-needs_human: true
-blocking_reason: "Only the Host Europe account holder (founder) can confirm the panel console mechanism and test it."
+status: done
 priority: high
 state_hub_task_id: "f404b272-a73b-529c-9527-3bbd076db92d"
 ```
@@ -321,6 +319,13 @@ and the hub.
 a first value-safe receipt `RAIL01-CONSOLE-<timestamp>` exists under
 `docs/evidence/railiance01-console-access/`.
 
+2026-10-14 done: founder confirmed in the panel that railiance01 has a provider-side
+"Wiederherstellungskonsole" (web terminal showing the host's own console, independent of
+guest networking), provider stop/restart, and "Notfallmodus" (rescue). Receipt:
+docs/evidence/railiance01-console-access/RAIL01-CONSOLE-20261014T164803Z.yaml.
+Finding: the panel login has no second factor; enabling MFA on the Host Europe account
+is recommended (founder). Each reboot window still needs its own same-day receipt.
+
 ## Acceptance
 
 - [x] Adopted Host Europe records and provider-managed Hetzner records cannot