diff --git a/workplans/USER-WP-0027-account-journey-clarity.md b/workplans/USER-WP-0027-account-journey-clarity.md
index 010f069..a33c92f 100644
--- a/workplans/USER-WP-0027-account-journey-clarity.md
+++ b/workplans/USER-WP-0027-account-journey-clarity.md
@@ -66,6 +66,7 @@ Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b9
 id: USER-WP-0027-T04
 status: wait
 needs_human: true
+decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
 blocking_reason: "Attended live acceptance of U05-U08/P04-P06 against the real provider factor (enrollment, cancellation, replacement, recovery, fresh login, privileged portal policy); the net-kingdom-privacyidea-admin-token route is still resolvable:false because railiance-platform has not published its OpenBao path/field/expiry contract."
 priority: high
 state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b"
@@ -92,6 +93,8 @@ Remaining gate: attended U05–U08 enrollment/cancel/replacement/lost-factor and
 fresh-login acceptance, plus verified portal setup handoff configuration. No new
 credential request is required to resolve the historical blocker.
 
+2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.
+
 ## Close tenant and platform administrator usability gaps
 
 ```task
diff --git a/workplans/USER-WP-0028-user-journey-acceptance.md b/workplans/USER-WP-0028-user-journey-acceptance.md
index 6b109f8..6334a79 100644
--- a/workplans/USER-WP-0028-user-journey-acceptance.md
+++ b/workplans/USER-WP-0028-user-journey-acceptance.md
@@ -52,6 +52,7 @@ source, entry-point registry, identity/action mapping and mutation contract.
 id: USER-WP-0028-T03
 status: wait
 needs_human: true
+decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
 blocking_reason: "Attended live acceptance of U05-U08 (enrollment, cancel, replace, lost-factor recovery, old-AAL1-session behavior) against the real provider factor before enabling live handoff; no stub acceptance."
 priority: high
 state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3"
@@ -74,3 +75,5 @@ enrollment/cancellation, recovery/replacement and old-session enforcement.
 The remaining blocker is attended real-user U05–U08 acceptance and verified
 portal setup handoff, not another service token. See USER-WP-0027-T04 and
 `docs/evidence/2026-09-13-p06-authentication-policy.md`.
+
+2026-10-03: human gate routed to hub decision cef97ccd-4ee7-40fe-859e-1df9c9360ecb (D10: Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience) by CUST-WP-0075; resolving that decision raises C-40 here.
diff --git a/workplans/USER-WP-0035-onboarding-handoff-findings.md b/workplans/USER-WP-0035-onboarding-handoff-findings.md
index 4e1a974..2e65dc3 100644
--- a/workplans/USER-WP-0035-onboarding-handoff-findings.md
+++ b/workplans/USER-WP-0035-onboarding-handoff-findings.md
@@ -9,7 +9,7 @@ flavor: implementation
 owner: claude-code
 topic_slug: user-engine
 created: "2026-09-23"
-updated: "2026-09-27"
+updated: "2026-10-03"
 related: [USER-WP-0027, USER-WP-0028, NK-WP-0036, NK-WP-0041]
 state_hub_workstream_id: "35aa6adf-255a-5705-9294-a50d98e45f00"
 ---
@@ -51,6 +51,7 @@ No claim about password or factor state is added, and no delivery is claimed.
 id: USER-WP-0035-T02
 status: wait
 needs_human: true
+decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
 blocking_reason: "Needs the operator-owned governed transactional mail lane (email-connect plus the OpenBao delivery token)."
 priority: high
 state_hub_task_id: "fae614ba-ffc0-511d-9d22-2d91fbab057f"
@@ -71,3 +72,5 @@ task still needs an owner-supported setup-link delivery handoff and evidence of
 receipt by the intended person; a generic SMTP success is insufficient.
 The latest attended onboarding record still uses out-of-band handoff. No message
 was sent and no setup-link secret was copied into an event or work record.
+
+2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.