diff --git a/doc/migration-todo.md b/doc/migration-todo.md
index 42f863c..6188e8f 100644
--- a/doc/migration-todo.md
+++ b/doc/migration-todo.md
@@ -72,6 +72,8 @@ Date: `2026-04-12`
 - We have not yet reconstructed the current live `trade-staging` manifests and host drift into `trade-gitops` and `trade-host-iac`.
 - The first canonical bootstrap module now exists in `trade-next/trade-gitops`: `bootstrap/gitea-actions`.
 - An organization-scoped Gitea Actions runner for `trade-next` is now online on `sol` and can reach the target `k3s` cluster using the `K3S_KUBECONFIG_B64` org secret.
+- The first canary environment now exists in `trade-next/trade-gitops` under `environments/sol/trade-r001-canary`.
+- Namespace `trade-r001-canary` is live on `sol` with initial quota and limit guardrails, and can reach the shared `Postgres` and `Redis` services in `trade-infra`.
 
 ## Migration Risks
 
@@ -310,7 +312,17 @@ Date: `2026-04-12`
 
 ### 20. Prepare a minimal canary namespace for trade on `mevnode`
 
-- Pending.
+- Done on `2026-04-12`.
+- Use a dedicated canary namespace for `R001`, not the default namespace and not the infra namespace.
+- Put namespace-level CPU, memory, object-count, and storage caps in place before the first application manifests are applied.
+- Keep the first canary envelope conservative until the validator protection budget is finalized.
+- Validate that the canary namespace can resolve and reach `postgres-host.trade-infra.svc.cluster.local:5432` and `redis-host.trade-infra.svc.cluster.local:6379`.
+- Done on `2026-04-12`: created `trade-next/trade-gitops` environment module at `environments/sol/trade-r001-canary`.
+- Done on `2026-04-12`: applied namespace `trade-r001-canary` on `sol` with revision label `R001` and canary environment labels.
+- Done on `2026-04-12`: applied `ResourceQuota` in `trade-r001-canary` with caps `requests.cpu=2`, `limits.cpu=6`, `requests.memory=4Gi`, `limits.memory=12Gi`, `pods=20`, `services=10`, `configmaps=20`, `secrets=30`, `persistentvolumeclaims=4`, `requests.storage=100Gi`.
+- Done on `2026-04-12`: applied `LimitRange` in `trade-r001-canary` with default request `100m/128Mi`, default limit `1 CPU/1Gi`, and per-container max `2 CPU/4Gi`.
+- Done on `2026-04-12`: verified deployment through Gitea Actions; commit `060dcc3` completed with status `success` for `deploy-trade-r001-canary / apply (push)`.
+- Done on `2026-04-12`: verified an in-cluster connectivity smoke test from `trade-r001-canary` to host-backed `Postgres` and `Redis` services.
 
 ### 21. Bring up `Hasura`, API, and frontend on `mevnode`
 
@@ -351,7 +363,7 @@ Date: `2026-04-12`
 - [x] 17. Install and bootstrap `k3s` on `mevnode`.
 - [x] 18. Install `Postgres` and `Redis` on `mevnode`.
 - [x] 19. Bootstrap an organization-scoped Gitea Actions runner on `mevnode`.
-- [ ] 20. Prepare a minimal canary namespace for trade on `mevnode`.
+- [x] 20. Prepare a minimal canary namespace for trade on `mevnode`.
 - [ ] 21. Bring up `Hasura`, API, and frontend on `mevnode`.
 - [ ] 22. Migrate publishers and ingest only after storage and Redis validation pass.
 - [ ] 23. Validate host health, agave health, trade health, and end-to-end flow after rollout.