diff --git a/workplans/FORGE-WP-0006-independent-secret-detection.md b/workplans/FORGE-WP-0006-independent-secret-detection.md
index 37fb060..4e2b26a 100644
--- a/workplans/FORGE-WP-0006-independent-secret-detection.md
+++ b/workplans/FORGE-WP-0006-independent-secret-detection.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: railiance
 created: "2026-10-12"
-updated: "2026-10-13"
+updated: "2026-10-18"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "69458fdc-d727-5391-b88b-d03da0afe24e"
@@ -186,6 +186,25 @@ and session-revocation receipts remain required. Packet: Custodian
 `docs/attended-window/2026-10-13-forge-route-acceptance.md`; evidence:
 `docs/evidence/2026-10-13-netkingdom-security/forge-routes-preparation.json`.
 
+2026-10-18 attended live run of FORGE6-ROUTES-001 (founder OIDC/MFA, contained
+lane) is a failed trial: result `unverified`, failure phase `merge-api`, child
+exit 1, no credential returned to the agent. 24 of 25 checks passed on owned
+private repository 173: authenticated caller, private creation, anonymous
+denial, exact inherited hook, HTTPS clean push, HTTPS secret refusal with refs
+and quarantine objects absent, content API acceptance/refusal with detector
+evidence, and secret-bearing merge-message refusal with the merge not applied.
+The subsequent clean merge was not accepted (`clean_merge_accepted: false`), so
+merge-path acceptance and `clean_merge_applied` remain unproven; raw diagnostics
+were deliberately not retained, so the cause is not known. The isolated suite
+passed the same step, so suspect a production-specific merge setting or a
+post-refusal merge state, not the scanner. Cleanup verified identity, deleted
+the repository and confirmed absence. An earlier garbled invocation that same
+day never started the runner (no receipt, no transport file). The receipt is
+consumed: a retry needs a new trial revision (fresh name/receipt) and another
+attended login, never a replay. Custodian evidence:
+`docs/evidence/2026-10-13-netkingdom-security/forge-routes-live.json` and
+`forge-routes-live.transport.json`.
+
 ## Verify CI independence, detection response and complete coverage
 
 ```task