diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md
index 460faf7..68de8f4 100644
--- a/workplans/USER-WP-0026-account-recovery.md
+++ b/workplans/USER-WP-0026-account-recovery.md
@@ -62,6 +62,8 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
 ```task
 id: USER-WP-0026-T03
 status: wait
+blocked_on: message-from:net-kingdom
+blocking_reason: "Needs a provider-owned workload catalogue and application access decisions for the signed-in identity; the membership store cannot represent the allow list."
 priority: high
 state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
 ```
diff --git a/workplans/USER-WP-0027-account-journey-clarity.md b/workplans/USER-WP-0027-account-journey-clarity.md
index 1651f92..872fb9a 100644
--- a/workplans/USER-WP-0027-account-journey-clarity.md
+++ b/workplans/USER-WP-0027-account-journey-clarity.md
@@ -65,6 +65,8 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9
 ```task
 id: USER-WP-0027-T04
 status: wait
+depends_on: [KEY-WP-0035-T02, KEY-WP-0035-T03, NK-WP-0033]
+blocking_reason: "KEY-WP-0035-T02/T03 and the NK-WP-0033 custody handoff; net-kingdom-privacyidea-admin-token route still non-resolvable."
 priority: high
 state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b"
 ```
@@ -116,6 +118,8 @@ It does not accept those journeys.
 ```task
 id: USER-WP-0027-T06
 status: wait
+depends_on: [USER-WP-0026-T03, USER-WP-0027-T04, VERGABE-WP-0019]
+blocking_reason: "Full journey matrix needs authoritative application access (USER-WP-0026-T03), factor recovery (T04) and preserves VERGABE-WP-0019 real-user acceptance."
 priority: high
 state_hub_task_id: "550886ca-f916-5637-9639-b4134b0da939"
 ```
diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md
index db92c07..285cc5c 100644
--- a/workplans/USER-WP-0028-user-journey-acceptance.md
+++ b/workplans/USER-WP-0028-user-journey-acceptance.md
@@ -32,6 +32,8 @@ U01–U04/U10–U13: preserve safe profile input on validation failure; confirm
 ```task
 id: USER-WP-0028-T02
 status: wait
+depends_on: [USER-WP-0026-T03]
+blocking_reason: "Blocked on the provider-owned catalogue/admission and scoped grant/revocation contract from USER-WP-0026-T03."
 priority: high
 state_hub_task_id: "5d1bf977-034d-5448-b4fb-5a8b630af6ba"
 ```
@@ -49,6 +51,8 @@ source, entry-point registry, identity/action mapping and mutation contract.
 ```task
 id: USER-WP-0028-T03
 status: wait
+depends_on: [KEY-WP-0035, NK-WP-0033]
+blocking_reason: "U05-U08 depend on KEY-WP-0035 and NK-WP-0033 credential custody before live handoff."
 priority: high
 state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3"
 ```
diff --git a/workplans/USER-WP-0035-onboarding-handoff-findings.md b/workplans/USER-WP-0035-onboarding-handoff-findings.md
index 66a17eb..4e1a974 100644
--- a/workplans/USER-WP-0035-onboarding-handoff-findings.md
+++ b/workplans/USER-WP-0035-onboarding-handoff-findings.md
@@ -50,6 +50,8 @@ No claim about password or factor state is added, and no delivery is claimed.
 ```task
 id: USER-WP-0035-T02
 status: wait
+needs_human: true
+blocking_reason: "Needs the operator-owned governed transactional mail lane (email-connect plus the OpenBao delivery token)."
 priority: high
 state_hub_task_id: "fae614ba-ffc0-511d-9d22-2d91fbab057f"
 ```
diff --git a/workplans/USER-WP-0037-hub-authority-lookup.md b/workplans/USER-WP-0037-hub-authority-lookup.md
index c65cba4..5b16cfd 100644
--- a/workplans/USER-WP-0037-hub-authority-lookup.md
+++ b/workplans/USER-WP-0037-hub-authority-lookup.md
@@ -49,6 +49,8 @@ production deployment was added. T02/T03 retain those outstanding owner gates.
 ```task
 id: USER-WP-0037-T02
 status: wait
+blocked_on: message-from:net-kingdom
+blocking_reason: "Specify with NetKingdom the root-grant custody/revocation and platform:root to tenant:platform mapping."
 priority: high
 state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
 ```
@@ -71,6 +73,9 @@ deliberately still carries no root-grant field pending that decision.
 ```task
 id: USER-WP-0037-T03
 status: wait
+depends_on: [USER-WP-0037-T02]
+blocked_on: message-from:net-kingdom
+blocking_reason: "Real caller credentials are admitted through their owner after the T02 contract."
 priority: high
 state_hub_task_id: "c5d67725-c685-50f6-9db8-28114a34014b"
 ```