diff --git a/docs/reuse-surface-on-railiance01.md b/docs/reuse-surface-on-railiance01.md
new file mode 100644
index 0000000..1bb35ab
--- /dev/null
+++ b/docs/reuse-surface-on-railiance01.md
@@ -0,0 +1,68 @@
+# reuse-surface on railiance01
+
+Federation service deployment for **`https://reuse.coulomb.social`**.
+
+Companion workplans: **RAILIANCE-WP-0007** (Helm release), **REUSE-WP-0011**
+(service + CLI).
+
+## DNS
+
+| Record | Value | Status |
+|---|---|---|
+| `reuse.coulomb.social` A | `92.205.62.239` | Operator confirmed 2026-06-15 |
+
+Verify before deploy (propagation may lag):
+
+```bash
+dig +short reuse.coulomb.social A
+```
+
+Ingress host in chart: `charts/reuse-surface/values.yaml` → `ingress.host`.
+
+## Release surface
+
+| Item | Value |
+|---|---|
+| Namespace | `reuse` |
+| Helm release | `reuse` |
+| Chart | `charts/reuse-surface` |
+| Values | `helm/reuse-surface-values.yaml` |
+| Image | `gitea.coulomb.social/coulomb/reuse-surface:<tag>` |
+| Secret | `reuse-surface-env` (`REUSE_SURFACE_TOKEN`) |
+
+## Deploy
+
+```bash
+# 1. Pin image tag in helm/reuse-surface-values.yaml
+# 2. Create secret (example — use SOPS handoff in production)
+kubectl create namespace reuse --dry-run=client -o yaml | kubectl apply -f -
+kubectl create secret generic reuse-surface-env \
+  --namespace reuse \
+  --from-literal=REUSE_SURFACE_TOKEN='<token>' \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+make reuse-dry-run
+make reuse-deploy
+make reuse-status
+```
+
+## Smoke checks
+
+```bash
+curl -fsS https://reuse.coulomb.social/health
+
+export REUSE_SURFACE_URL=https://reuse.coulomb.social
+export REUSE_SURFACE_TOKEN=<token>
+reuse-surface hub status
+reuse-surface hub list
+```
+
+## Operations
+
+```bash
+make reuse-logs
+make reuse-status
+```
+
+Image promotion: build from `coulomb/reuse-surface`, push to Gitea OCI, update
+`helm/reuse-surface-values.yaml` `image.tag`, `make reuse-deploy`.
\ No newline at end of file
diff --git a/workplans/RAILIANCE-WP-0007-reuse-surface-hub-on-railiance01.md b/workplans/RAILIANCE-WP-0007-reuse-surface-hub-on-railiance01.md
index 26c31e8..9414a88 100644
--- a/workplans/RAILIANCE-WP-0007-reuse-surface-hub-on-railiance01.md
+++ b/workplans/RAILIANCE-WP-0007-reuse-surface-hub-on-railiance01.md
@@ -26,6 +26,11 @@ per-machine `sources.yaml` maintenance.
 Gitea repo: `coulomb/reuse-surface`  
 OCI image: `gitea.coulomb.social/coulomb/reuse-surface:<tag>`
 
+## DNS evidence
+
+`reuse.coulomb.social` A → **`92.205.62.239`** (operator confirmed 2026-06-15).
+Ingress host configured in `charts/reuse-surface/values.yaml`.
+
 ## Upstream dependency
 
 | Upstream | Workplan | Required artifact |
@@ -80,7 +85,7 @@ Makefile `reuse-*` targets.
 
 ```task
 id: RAILIANCE-WP-0007-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "80dc308a-3c0f-4027-9b40-67df5f17aca7"
 ```
@@ -91,7 +96,7 @@ Ingress enabled in chart values:
 - `cert-manager.io/cluster-issuer: letsencrypt-prod`
 - Traefik annotations matching `inter-hub`
 
-Confirm DNS A record in `coulomb.social` zone.
+DNS A record live: `reuse.coulomb.social → 92.205.62.239`.
 
 ## Deploy Release To railiance01
 
@@ -113,12 +118,13 @@ When image is available:
 
 ```task
 id: RAILIANCE-WP-0007-T05
-status: todo
+status: progress
 priority: low
 state_hub_task_id: "30b08789-38bb-409a-b5b1-b3c73ff31a96"
 ```
 
-Add `docs/reuse-surface-on-railiance01.md` with smoke checks:
+Added `docs/reuse-surface-on-railiance01.md`. Complete after first deploy with
+live smoke checks:
 
 ```bash
 export REUSE_SURFACE_URL=https://reuse.coulomb.social