diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
index 0245e0e..de32a27 100644
--- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
+++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
@@ -42,7 +42,7 @@ remains the migration target.
 
 ```task
 id: REEF-RAILIANCE-WP-0003-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
 ```
@@ -61,11 +61,22 @@ included by the runtime Kustomization. T02 remains `progress` until
 railiance01 NetworkPolicy enforcement is repaired and the three-way probe
 proves allowlisted success, other-host denial, and direct-bypass denial.
 
+2026-07-27 follow-up: Host firewall-chain tracing showed NetworkPolicy does
+enforce after kube-router creates the per-pod chain; the failed immediate
+probe exposed an asynchronous startup window rather than a disabled
+controller. The runtime now uses an immutable curl init container as a
+fail-closed startup gate. It retries until its own pod proves Qonto proxy
+access (`CONNECT 200`), other-host proxy denial (`CONNECT 403`), and direct
+Qonto denial. Knative init-container support is enabled and source-controlled
+in `railiance-cluster`. Live disposable-pod evidence reported `gate=passed`
+before `application=admitted`. The proxy bundle is now part of the active
+runtime Kustomization and T02 is complete.
+
 ## T03 - Deploy and verify rapp-qonto
 
 ```task
 id: REEF-RAILIANCE-WP-0003-T03
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad"
 ```