diff --git a/workplans/RMGR-WP-0021-secret-detection-controls.md b/workplans/RMGR-WP-0021-secret-detection-controls.md
index 04dad76..abbbb9c 100644
--- a/workplans/RMGR-WP-0021-secret-detection-controls.md
+++ b/workplans/RMGR-WP-0021-secret-detection-controls.md
@@ -117,6 +117,22 @@ introduced. State Hub owner record: STATE-WP-ADHOC-2026-10-13-T01. Dedicated tim
 regressions and real delayed-hook acceptance are recorded in Custodian's
 `push-deadline.json`. This transport correction does not close T03.
 
+2026-10-13 expansion completed: FORGE6-EXPAND-001 revision 1 exited 0 after
+all 143 targets passed actual SSH clean/scanner-refusal probes under an exact-ref
+veto. The independent final read-only audit reconciles 167 repositories: 166
+admitted profiles, one builtin-only (numeric ID 55), zero unknown profiles. All
+23 baseline profiles remain exact; no probe refs, temporary vetoes or ownership
+markers remain. Each rejected synthetic commit was absent after its probe.
+Repository 55 has four external submodules and remains required compatibility
+work. Ordinary source acceptance is distinct from vetoed scanner checks.
+Production HTTP/API/frontend acceptance remains unverified: the protected API
+credential route failed before child handoff and the metadata-only capability
+check denied access. Prepare one complete acceptance command for the existing
+attended login window. CI, import/mirror, historical/LFS/log/artifact detection
+and private response gates remain open; this is no whole-estate closure.
+Evidence: Custodian `docs/evidence/2026-10-13-netkingdom-security/forge-expansion-final.json`
+and `forge-api-route-readiness.json`.
+
 ## Verify private finding-to-response handling
 
 ```task