Qualify wait tasks per Task Wait Qualifiers v0.1 (CUST-WP-0074-T05, gate root FLEX-WP-0020)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 237582@bnt-lap001
Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826

workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md

@@ -4,7 +4,7 @@ type: workplan
 title: NetKingdom Security Pattern Tutorials
 domain: infotech
 repo: net-kingdom
-status: backlog
+status: active
 flavor: implementation
 owner: codex
 topic_slug: netkingdom

workplans/NK-WP-0011-enterprise-federation-saml.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
 domain: infotech
 repo: net-kingdom
-status: backlog
+status: active
 flavor: implementation
 owner: worsch
 topic_slug: netkingdom

workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md

@@ -94,6 +94,8 @@ pulls after the rename. The image pins do not change because of the rename.
 ```task
 id: NK-WP-0039-T03
 status: wait
+depends_on: [FLEX-WP-0020]
+blocking_reason: "Await the flex-auth announcement that coulomb/access-engine resolves (FLEX-WP-0020), then verify repository-coordinate references."
 priority: medium
 state_hub_task_id: "6e62919d-117d-57ab-b55b-1b437a105402"
 ```
@@ -114,6 +116,8 @@ runtime/package names. NK-WP-0026 remains a historical record.
 ```task
 id: NK-WP-0039-T04
 status: wait
+blocked_on: message-from:flex-auth
+blocking_reason: "Retire-vs-reconcile answer routed to flex-auth (2c637dc9) and tenant-engine (9fc740da); act on whichever returns, do not pre-empt."
 priority: high
 state_hub_task_id: "2541f523-e433-5900-b119-5825f0e71ef3"
 ```