diff --git a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
index 2bf8391..17e6c0f 100644
--- a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
+++ b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
@@ -9,7 +9,7 @@ flavor: planning
 owner: codex
 topic_slug: whynot-design-forgejo-npm-lane
 created: "2026-09-04"
-updated: "2026-09-28"
+updated: "2026-10-03"
 state_hub_workstream_id: "42a097db-1c24-558e-a724-030bb2b4443e"
 ---
 
@@ -61,6 +61,9 @@ id: WARDEN-WP-0037-T03
 status: wait
 priority: high
 needs_human: true
+decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
+depends_on: [SECRETS-WP-0006-T06]
+blocking_reason: "Founder HOLD 2026-09-21: no rotation until SECRETS-WP-0006-T06 moves the publish lane off the legacy whynot-design npm path; then rotate and prove a fresh publish."
 intervention_note: "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane."
 state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
 ```
@@ -183,3 +186,5 @@ founder's no-rotation hold remains binding until SECRETS-WP-0006-T06 supplies
 native governed-consumer migration evidence; a dedicated token rotation and a
 fresh package publish/exact-version lookup then remain. No credential fetch,
 rotation or publication was attempted.
+
+2026-10-03 (CUST-WP-0075): the gate was only in intervention_note. Encoded as blocking_reason, depends_on SECRETS-WP-0006-T06, and hub decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa (D3: trust root and secret custody), which also carries the matching RPF-WP-0035-T07 hold.