diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md
index 6ba5352..8e1783a 100644
--- a/workplans/FORGE-WP-0006-independent-secret-detection.md
+++ b/workplans/FORGE-WP-0006-independent-secret-detection.md
@@ -171,6 +171,21 @@ and private response gates remain open; this is no whole-estate closure.
 Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
 and `forge-api-route-readiness.json`.
 
+2026-10-13 authenticated-route preparation: FORGE6-ROUTES-001 revision 2
+binds a silent contained operation to one newly created private disposable
+repository. The exact shared suite passes 27 isolated pinned-image checks:
+creation/inherited hook, anonymous denial, HTTPS clean/secret pushes, API content
+acceptance/refusal, merge-message refusal/clean merge, unchanged refs, quarantine
+and owned cleanup. Five boundary tests cover changed ownership, ambiguous-create
+cleanup refusal, generic-error non-acceptance, redirect credential protection,
+and silent digest-bound credential handoff. Read-only live preflight passes
+under a private HOME. The failed first rehearsal and source-binding limitation
+remain recorded. No production API mutation or credential fetch was performed.
+The existing attended-window command is ready for caller OIDC/MFA; live route
+and session-revocation receipts remain required. Packet: Custodian
+`docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence:
+`docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`.
+
 ## Verify CI independence, detection response and complete coverage
 
 ```task