diff --git a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
index 9dc5580..4a9b409 100644
--- a/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
+++ b/workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md
@@ -163,10 +163,12 @@ access or secret.
 
 ```task
 id: RAIL-HO-WP-0011-T05
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "ba526585-6141-5df1-9094-a1322394d8b5"
 ```
+2026-09-29 (CUST-WP-0074-T05 backfill): this task was `wait` with no external dependency or human gate stated, which Task Wait Qualifiers v0.1 treats as unqualified; set to `todo`. Re-add `wait` with a qualifier if a real gate exists.
+
 
 Provide one operator-facing, non-ambiguous command that checks inventory and
 contract validity, runs the applicable profile for every selected host,
@@ -255,6 +257,8 @@ verification without host evidence, and a token-shaped field.
 ```task
 id: RAIL-HO-WP-0011-T08
 status: wait
+needs_human: true
+blocking_reason: "Live recipient removal or credential replacement requires explicit operator approval after the dry run."
 priority: medium
 state_hub_task_id: "920f869a-2554-58a9-b0da-8a0bbd7c5ef1"
 ```
diff --git a/workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md b/workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md
index 4967e13..ab55c5f 100644
--- a/workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md
+++ b/workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md
@@ -133,6 +133,9 @@ no timer is installed merely by running a verification command.
 ```task
 id: RAIL-HO-WP-0012-T05
 status: wait
+blocked_on: message-from:railiance-platform
+decision_id: CCR-2026-0004
+blocking_reason: "Offsite upload goes through railiance-platform's railiance-backup-offsite-lane (CCR-2026-0004); credentials must be provisioned there."
 priority: high
 state_hub_task_id: "783dff8b-849e-5ed9-a668-af1184be7bdd"
 ```
@@ -173,6 +176,8 @@ scheduled.
 ```task
 id: RAIL-HO-WP-0012-T06
 status: wait
+depends_on: [RAIL-HO-WP-0012-T05]
+blocking_reason: "Restore drill needs a fresh off-host artifact from T05."
 priority: high
 state_hub_task_id: "2ae6feab-3aa3-58e8-a4a9-1bd70a5e30ca"
 ```
diff --git a/workplans/RAIL-HO-WP-0013-host-time-baseline.md b/workplans/RAIL-HO-WP-0013-host-time-baseline.md
index ade0c4e..977295d 100644
--- a/workplans/RAIL-HO-WP-0013-host-time-baseline.md
+++ b/workplans/RAIL-HO-WP-0013-host-time-baseline.md
@@ -34,6 +34,8 @@ and tools/observe_host_clock.py. No configuration or clock change was made.
 ```task
 id: RAIL-HO-WP-0013-T01
 status: wait
+depends_on: [RCLK-WP-0002]
+blocking_reason: "Joins RCLK-WP-0002's upstream independence, leap and health review."
 priority: high
 state_hub_task_id: "9e5db140-0642-58de-8a9c-1c5a3cfd7b6e"
 ```
@@ -50,6 +52,8 @@ Define what source health can honestly claim before exposing it to the clock app
 ```task
 id: RAIL-HO-WP-0013-T02
 status: wait
+depends_on: [RAIL-HO-WP-0013-T01]
+blocking_reason: "Depends on the T01 policy review."
 priority: high
 state_hub_task_id: "75f17ffa-b781-549d-82ce-d19d431c2618"
 ```
@@ -67,6 +71,8 @@ capability belongs only to the admitted host daemon. No public UDP/123 ingress.
 ```task
 id: RAIL-HO-WP-0013-T03
 status: wait
+depends_on: [RAIL-HO-WP-0013-T02]
+blocking_reason: "Depends on T02."
 priority: high
 state_hub_task_id: "c9d142b0-9c8d-5abf-82d9-099a772da5ec"
 ```
@@ -82,6 +88,9 @@ A mocked systemctl result or container-only check is not host synchronization pr
 ```task
 id: RAIL-HO-WP-0013-T04
 status: wait
+needs_human: true
+depends_on: [RAIL-HO-WP-0013-T03]
+blocking_reason: "Depends on T03 and reviewed live-host authorization."
 priority: high
 state_hub_task_id: "9adae3a6-8ee6-538b-9bb3-1ee32ed185e1"
 ```