diff --git a/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md b/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md
index 987c8cf..a82a052 100644
--- a/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md
+++ b/docs/evidence/gen2-secrets-001-local-provisioning-2026-08-31.md
@@ -33,3 +33,21 @@ The following checks completed successfully before production execution:
 
 No credential value, fingerprint, length, header, or plaintext environment
 value was read, printed, copied, committed, or included in this evidence.
+
+## Production control-plane evidence
+
+The one-shot provisioner was run from a detached `gen2-integration` worktree
+on `docker.cin.su`. It created the dedicated external volume and provisioned
+the credential once. A repeat `ensure` reported that the already active
+artifact was reused. A bounded owner-requested rotation then completed.
+
+For creation, idempotent ensure, and rotation, the stable Core, Commit,
+Creator Web, Cognitive Worker, and Research Runtime container identities were
+recorded before and after the one-shot operation and were unchanged. The
+verification checked only artifact and separate metadata/audit file presence;
+it did not read their content.
+
+At this point the credential is provisioned but not yet used by the stable
+runtime. Consumer mount and service-authentication acceptance are completed
+only when `GEN2-AUTHORITY-001` is merged and deployed as its own controlled
+candidate ReleaseSet.