diff --git a/docs/kubernetes-change-gate-decision.md b/docs/kubernetes-change-gate-decision.md
index 1395ba8..51108c6 100644
--- a/docs/kubernetes-change-gate-decision.md
+++ b/docs/kubernetes-change-gate-decision.md
@@ -175,3 +175,25 @@ State Hub's CPU request was **100m → 250m**, the chart's own default. The mode
 4. Ran `helm upgrade --atomic` with the pinned image `main-0747b4d`, giving **revision 64**, 1/1 ready.
 
 Hub health afterwards: `ok`, db connected, schema `b5e6f7a8c9d0` as expected. There was no downtime (maxUnavailable=0).
+
+## Phase B begun, and external-secrets repaired, 2026-09-21
+
+All of the following were done with the founder's go-ahead, in `ADMINISTER @ realm:kubernetes/railiance01` with `activation=APPROVED`, by the custodian session.
+
+**1. ArgoCD resources** (railiance-enablement RAIL-EN-WP-0002-T02). Requests and limits were applied from the declared kustomization. All four pods are now Burstable, Ready, with 0 restarts. Free capacity was checked first, with 680m free, so the rollouts did not deadlock.
+
+**2. Phase B layout** (RPF-WP-0044-T01). The founder chose option A: a railiance01-only path, `argocd/railiance01/`. Nothing under `argocd/applications/` or `argocd/bootstrap/`, which coulombcore's ArgoCD reads, was changed. **Hazard:** `make argocd-bootstrap-deploy` still renders the old root with automated sync and must not be run on railiance01.
+
+**3. T02 and T03.**
+- **T02:** 3 AppProjects and a root app with automated sync off were applied at `c3ebd6d`. The root is Synced/Healthy with zero children, which shows the repo-server reaches Forgejo.
+- **T03:** openbao-secretstore was adopted:
+  - the diff was rc=0;
+  - the child was merged in `182e788`;
+  - a manual sync at `d2dbc19`, with the apply strategy and prune off, succeeded;
+  - `ClusterSecretStore/openbao` is Valid and tracked, and issue-core-runtime is SecretSynced.
+
+  **It is the first workload under GitOps on railiance01.** It is now in its 24-hour proving period. `selfHeal` needs a second go-ahead, and `prune` a third.
+
+**4. external-secrets Helm release.** It had been stuck in `pending-upgrade` (rev 7) since 2026-07-07. Rev 6 and rev 7 were identical in values and manifests, and live matched both exactly, so the upgrade had fully applied and only the status was stuck. It was fixed with `helm rollback external-secrets 6`: dry run first, the chart has no hooks, and the result is rev 8, deployed. All three pods kept their names and their 36-day age, so nothing restarted.
+
+**Found and routed, not fixed:** two ClusterSecretStores have been failing since 2026-09-13 (`openbao-email-connect`) and 2026-09-19 (`openbao-activity-core`). Their static OpenBao tokens are rejected with 403 on `lookup-self`, so 5 of 37 ExternalSecrets are not syncing, including activity-core's offsite-backup credential. This is credential custody, so it was routed to railiance-platform, activity-core and email-connect. No token was read or minted.