diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md
index 389d28d..1c0d676 100644
--- a/workplans/FORGE-WP-0006-independent-secret-detection.md
+++ b/workplans/FORGE-WP-0006-independent-secret-detection.md
@@ -133,8 +133,27 @@ and `activate_forge_template.py`. Rollback retains the ConfigMap inert and uses
 an explicit default template selection because merely removing the environment
 variable would leave the saved setting behind. Original immutable October 12
 activation remains bound to its old pod and must not be rewritten or replayed.
-Authenticated production HTTP/SSO/frontend creation, the other 143 existing
-repositories, import/mirror and wider detection/response coverage remain open.
+Authenticated production HTTP/SSO/frontend creation, the other 144 existing
+repositories (fresh 166-repository inventory), import/mirror and wider detection/response coverage remain open.
+
+2026-10-13 custody recovery: the generation-12 health/hash/malformed-input
+acceptance above missed a restart regression. The next normal source push refused
+with `scanner-file-refused`: both binaries were 0775 after Kubernetes volume
+processing. FORGE6-TEMPLATE-LIFECYCLE-001 remains a failed original trial.
+Recovery revision 2 verified the exact binary hashes/owners and restored 0755;
+this repository's queued `ec1d7c5` push then succeeded. Revision 3 persists an
+unprivileged hash/owner-checking init guard in railiance-apps `50b66c4`, mounting
+only the existing security subtree. Generations 13 and 14 completed that guard
+and passed inherited installed-hook clean acceptance, intermediate-secret refusal,
+quarantine removal and clean recovery. Six isolated custody cases pass. Native
+temporary probes exclude builtin authorization; ordinary SSH pushes are checked
+separately. Initial rejected dry-run preparations remain recorded. Rollback must
+explicitly restore modes after removing the guard. Custodian evidence:
+`docs/evidence/2026-10-13-netkingdom-security/forge-custody-recovery-summary.json`.
+Fresh inventory is 166 repositories: 22 admitted profiles and 144 builtin-only;
+one default tree has gitlinks, needing compatibility treatment before expansion.
+Production HTTP/SSO/frontend, import/mirror, CI and response acceptance remain
+open. T02/T03 are not complete from this repaired lifecycle slice.
 
 ## Verify CI independence, detection response and complete coverage