diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 69dfc53..9578af9 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -21,7 +21,7 @@
 | task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
-| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
-| task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
+| task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
+| task | REEF-RAILIANCE-WP-0003-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
index 456f09e..0245e0e 100644
--- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
+++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
@@ -50,6 +50,17 @@ state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
 Implement and verify FQDN-aware policy or a controlled egress proxy. Do not
 substitute unrestricted HTTPS.
 
+2026-07-27: Implemented a pinned Canonical Squid controlled-proxy candidate
+that permits `CONNECT` only to exact host `thirdparty.qonto.com:443`, with
+private-address exclusions and namespace/pod isolation policies. Repository
+tests and Kubernetes server-side validation passed. Live probes did not:
+allowlisted proxy access returned `000`, non-allowlisted access returned
+`000`, and direct Qonto HTTPS unexpectedly succeeded despite namespace
+default-deny. The candidate was removed from the live cluster and is not
+included by the runtime Kustomization. T02 remains `progress` until
+railiance01 NetworkPolicy enforcement is repaired and the three-way probe
+proves allowlisted success, other-host denial, and direct-bypass denial.
+
 ## T03 - Deploy and verify rapp-qonto
 
 ```task