diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 224836b..2e13d4e 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -39,8 +39,8 @@
 | task | RAILIANCE-WP-0019-T10 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
-| task | RAILIANCE-WP-0020-T03 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
-| task | RAILIANCE-WP-0020-T04 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| task | RAILIANCE-WP-0020-T04 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T05 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
diff --git a/docs/evidence/openbao-isolated-restore-2026-08-03.json b/docs/evidence/openbao-isolated-restore-2026-08-03.json
new file mode 100644
index 0000000..0972bc4
--- /dev/null
+++ b/docs/evidence/openbao-isolated-restore-2026-08-03.json
@@ -0,0 +1,41 @@
+{
+  "audit": {
+    "declarative_file_device_loaded": true,
+    "file_nonempty": true,
+    "path": "/openbao/audit/openbao-audit.log"
+  },
+  "authorization_probe": {
+    "credential": "existing external-secrets-rapp-qonto AppRole passed by stdin/reference",
+    "exact_path": "tenants/data/binky/qonto-api",
+    "exact_path_capabilities": ["read"],
+    "sibling_capabilities": ["deny"],
+    "sibling_path": "tenants/data/binky/not-qonto-api"
+  },
+  "captured_at": "2026-08-03",
+  "cluster_id": "fd28df5d-98ec-57dd-42ec-9b3e4f4e53bf",
+  "inventory": {
+    "approle_count": 7,
+    "auth_method_count": 5,
+    "kubernetes_role_count": 3,
+    "mount_count": 8,
+    "policy_count": 26,
+    "ssh_role_count": 3
+  },
+  "restart_unseal_cycles": 2,
+  "restored_active": true,
+  "seal": {
+    "shares": 3,
+    "threshold": 2,
+    "type": "shamir"
+  },
+  "snapshot": {
+    "bytes": 106836,
+    "sha256": "8ba31731131539e8070f24de1a8c3677998b417dacd5c5a6bdb94e7b7d20125d"
+  },
+  "source_remained_authoritative": true,
+  "target_version": "2.5.4",
+  "temporary_credentials_removed": true,
+  "temporary_plaintext_snapshot_removed": true,
+  "unseal_ceremony": "attended; rotated source shares entered through hidden prompts",
+  "secret_values_recorded": false
+}
diff --git a/docs/openbao-coulombcore-to-railiance01-runbook.md b/docs/openbao-coulombcore-to-railiance01-runbook.md
index c5c97b6..f682e96 100644
--- a/docs/openbao-coulombcore-to-railiance01-runbook.md
+++ b/docs/openbao-coulombcore-to-railiance01-runbook.md
@@ -36,9 +36,14 @@ approved offsite backup lane. Its non-secret fingerprints are:
 
 A second fresh snapshot restored successfully into an isolated OpenBao 2.5.4
 pod on railiance01. OpenBao correctly resealed immediately after restore under
-the source Shamir barrier. Full semantic and restart validation therefore
-requires the source 2-of-3 unseal quorum; the temporary instance was not made
-serving. The empty target Helm release has been aligned from 2.5.3 to 2.5.4.
+the source Shamir barrier. On 2026-08-03 the operator supplied the rotated
+2-of-3 quorum through hidden prompts. Two restart/unseal cycles passed; the
+restored cluster became active with the source cluster ID, its inventory
+matched, a scoped AppRole proved exact-path read and sibling denial, and the
+declarative file audit device wrote successfully. Evidence is in
+`docs/evidence/openbao-isolated-restore-2026-08-03.json`. The disposable
+instance and plaintext staging were then removed. The empty target Helm release
+has been aligned from 2.5.3 to 2.5.4.
 
 ## Preconditions and abort points
 
diff --git a/tools/openbao-attended-unseal-drill.sh b/tools/openbao-attended-unseal-drill.sh
new file mode 100755
index 0000000..7f7de57
--- /dev/null
+++ b/tools/openbao-attended-unseal-drill.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+remote=(ssh -tt railiance01)
+unseal='kubectl -n openbao-restore-drill exec -it openbao -- env BAO_ADDR=http://127.0.0.1:8200 bao operator unseal'
+status='kubectl -n openbao-restore-drill exec openbao -- env BAO_ADDR=http://127.0.0.1:8200 bao status'
+
+echo "OpenBao isolated restore: enter source share 1 of 2 at the hidden prompt."
+"${remote[@]}" "$unseal"
+echo "OpenBao isolated restore: enter a different source share at the hidden prompt."
+"${remote[@]}" "$unseal"
+echo "OpenBao isolated restore status:"
+"${remote[@]}" "$status"