diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 14f1065..d570135 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -15,8 +15,8 @@
 | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md |
 | task | REEF-RAILIANCE-WP-0002-T01 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
-| task | REEF-RAILIANCE-WP-0002-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
-| task | REEF-RAILIANCE-WP-0002-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
+| task | REEF-RAILIANCE-WP-0002-T02 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
+| task | REEF-RAILIANCE-WP-0002-T03 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0002-T04 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0002-T05 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0002-T06 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
diff --git a/evidence/preflight/knative-2026-07-26-success.json b/evidence/preflight/knative-2026-07-26-success.json
new file mode 100644
index 0000000..e89cdc7
--- /dev/null
+++ b/evidence/preflight/knative-2026-07-26-success.json
@@ -0,0 +1,14 @@
+{
+  "schema_version": "railiance.knative-preflight/v1",
+  "collected_at": "2026-07-26T16:30:00Z",
+  "status": "passed_with_risk",
+  "kubernetes_server_version": "v1.35.1+k3s1",
+  "nodes": {"total": 1, "ready": 1, "allocatable_cpu": "4", "allocatable_memory": "16377056Ki", "observed_cpu": "452m", "observed_memory": "4619Mi"},
+  "disk": {"size": "193G", "available": "147G", "used_percent": 25},
+  "ingress_classes": ["traefik"],
+  "storage_classes": ["local-path"],
+  "knative_crd_count_before_install": 0,
+  "secret_values_collected": false,
+  "risks": ["single node and shared control plane", "4 CPU is below the upstream generic one-node 6 CPU recommendation"],
+  "admission_effect": "allow_installation_block_production_approval"
+}
diff --git a/evidence/verification/rail-knative-v1.22.0-2026-07-26.json b/evidence/verification/rail-knative-v1.22.0-2026-07-26.json
new file mode 100644
index 0000000..b08ca82
--- /dev/null
+++ b/evidence/verification/rail-knative-v1.22.0-2026-07-26.json
@@ -0,0 +1,21 @@
+{
+  "schema_version": "railiance.rail-verification/v1",
+  "collected_at": "2026-07-26T17:42:50Z",
+  "rail_id": "rail-knative",
+  "state": "verified",
+  "serving_version": "1.22.0",
+  "networking": {"implementation": "net-kourier", "version": "1.22.0", "gateway_service_type": "ClusterIP", "public_exposure": false},
+  "compatibility": {"kubernetes": "v1.35.1+k3s1", "knative_minimum_kubernetes": "1.34", "result": "passed"},
+  "checks": {
+    "control_plane_available": "passed",
+    "private_service_ready": "passed",
+    "scale_to_zero": {"result": "passed", "observed_seconds": 50},
+    "cold_activation": {"result": "passed", "observed_milliseconds": 6276},
+    "second_revision_ready": "passed",
+    "previous_revision_rollback": "passed",
+    "smoke_namespace_cleanup": "passed"
+  },
+  "production_approval": "blocked",
+  "remaining_gates": ["single-node residual-risk decision", "public ingress DNS and TLS if requested", "restricted Qonto FQDN egress", "workload identity and OpenBao delivery", "Qonto-specific failure and audit probes"],
+  "secret_values_collected": false
+}
diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md
index 6778314..9d94913 100644
--- a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md
+++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md
@@ -39,7 +39,7 @@ recovery, and failure-domain evidence rather than inferring it from topology.
 
 ```task
 id: REEF-RAILIANCE-WP-0002-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "833f6246-23bc-43ac-802d-7595b18f77a2"
 ```
@@ -53,11 +53,15 @@ API endpoint timed out. Recorded machine-readable failure evidence and kept
 installation blocked. `railiance-cluster` now owns a reusable preflight probe
 and the access/install workplan.
 
+2026-07-26: Server-side preflight passed after the upgrade. Kubernetes is
+v1.35.1 and the Ready node has 4 CPU/16 GiB. The below-recommendation CPU count
+and single-node topology remain explicit production risks.
+
 ## T03 - Install and verify the derived rail
 
 ```task
 id: REEF-RAILIANCE-WP-0002-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2"
 ```
@@ -67,6 +71,10 @@ versioned smoke and rollback evidence.
 
 Blocked by failed API reachability preflight; no install was attempted.
 
+2026-07-26: Installed and verified checksum-locked Serving and Kourier
+v1.22.0. Scale-to-zero, cold activation, revision creation, private routing,
+and previous-revision rollback passed. Public exposure remains disabled.
+
 ## T04 - Bind and verify rapp-qonto
 
 ```task