diff --git a/workplans/SECRETS-WP-0003-pilot-closeout.md b/workplans/SECRETS-WP-0003-pilot-closeout.md
index 03dd574..5d06625 100644
--- a/workplans/SECRETS-WP-0003-pilot-closeout.md
+++ b/workplans/SECRETS-WP-0003-pilot-closeout.md
@@ -140,6 +140,15 @@ whynot-design Gitea bot package token. Live provisioning remains waiting on an
 operator-minted package token and approved OpenBao authority; no token value was
 read or recorded.
 
+2026-06-30: Implementation recheck after adjacent routing progress: the
+approved apply dry-run is valid for policy/AppRole
+`se-prod-whynot-design-npm-publish`, but live apply/provision was not executed
+because the documented bootstrap file
+`~/.secrets-engine/bootstrap/prod-whynot-design.token` and package-token handoff
+file `~/.secrets-engine/handoff/whynot-design-npm.token` are both absent. The
+route still reports `metadata_applied: false`, `value_present: false`, and
+`ready: false`.
+
 Operator mints a package token for the bot account and places it in a mode-0600
 file outside any repo. Provision it with
 `secrets-engine provision whynot-design-npm-publish --stage prod --field npm_token
@@ -167,6 +176,16 @@ A real publish is still waiting on T02/T03 plus a coordinated version bump in th
 external `whynot-design` repo and operator confirmation of the published package
 version.
 
+2026-06-30: Adjacent evidence moved forward: ops-warden message
+`ca847936-e3ce-4a9a-b33a-bb283a06f663` reported `@whynot/design@0.4.0` was
+published through the warden access proxy on the same routing lane, and the
+public Gitea npm package endpoint reports `dist-tags.latest: 0.4.0`. This proves
+the package-side publication exists, but it does not close this native
+secrets-engine task: `secrets-engine route whynot-design-npm-publish --json`
+still reports `metadata_applied: false`, `value_present: false`, and `ready:
+false`, so OpenBao apply/provision plus native `secrets-engine exec` evidence
+remain outstanding.
+
 Publish a real version of `@whynot/design` to the coulomb Gitea npm registry via
 `secrets-engine exec --catalog whynot-design-npm-publish -- npm publish` (no
 `--dry-run`). Coordinate the version bump with the whynot-design repo.
@@ -183,7 +202,7 @@ Acceptance:
 
 ```task
 id: SECRETS-WP-0003-T05
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "461a7854-6229-4bc1-8d94-f6e2c4e5fa79"
 ```
@@ -194,6 +213,15 @@ whynot-design pointer payload and sent State Hub message
 waiting on ops-warden updating/confirming its own routing catalog so
 `warden route find "npm publish whynot-design"` resolves here.
 
+2026-06-30: Confirmed the adjacent ops-warden routing update is live. `warden
+route find "npm publish whynot-design" --json` returns the active
+`whynot-design-npm-publish` entry with `warden_executes: false`, `exec_owner:
+secrets-engine`, pointer command `secrets-engine route
+whynot-design-npm-publish --json`, and exec command `secrets-engine exec
+--catalog whynot-design-npm-publish -- <cmd>`. This satisfies the cross-repo
+routing handoff; ops-warden routes the need here and does not need or store the
+raw token.
+
 Coordinate with the ops-warden repo so `warden route find` points npm publish
 credential needs at secrets-engine, returning the `secrets-engine route` pointer
 rather than a value. This is a handoff/coordination task; the route catalog entry