diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 77a630e..8ceda06 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -31,6 +31,6 @@
 | task | RAILIANCE-WP-0019-T05 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T06 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T07 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
-| task | RAILIANCE-WP-0019-T08 | progress | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
+| task | RAILIANCE-WP-0019-T08 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T09 | progress | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0019-T10 | progress | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
diff --git a/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md b/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
index d3280dd..499efaf 100644
--- a/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
+++ b/workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md
@@ -340,7 +340,7 @@ and an offline validator. `rail-knative` and `rapp-qonto` pass that validator.
 
 ```task
 id: RAILIANCE-WP-0019-T08
-status: progress
+status: done
 priority: high
 state_hub_task_id: "663a319e-2a05-4a35-90a2-4f6b7b5afa22"
 ```
@@ -360,6 +360,11 @@ Acceptance:
 `railiance-cluster` and recorded the failed API reachability result as reef
 evidence with `block_installation`. Declared topology was not promoted.
 
+2026-07-26: After the server upgrade, the server-side preflight and complete
+Knative lifecycle verification passed. Reef evidence now distinguishes the
+verified rail from blocked production approval and retains capacity and
+single-node split triggers.
+
 ## T09 - Establish Qonto SLO, threat, rollback, and fallback evidence
 
 ```task
@@ -415,6 +420,10 @@ cluster preflight is idempotent and read-only. Credential routing was attempted
 first; its unrelated Forgejo match is tracked as a catalog-quality gap rather
 than used for Kubernetes access.
 
+2026-07-26: The cluster now has checksum-locked, idempotent Serving/Kourier
+installation and live verification automation. The configured SSH lane
+provides agent execution while direct public API access remains unnecessary.
+
 ## Exit Criteria
 
 - [x] `rail-knative` has a written boundary against `rail-kubernetes`