diff --git a/docs/release/service-provenance-reconciliation-2026-10-30.md b/docs/release/service-provenance-reconciliation-2026-10-30.md
index 756bc40..0fadadf 100644
--- a/docs/release/service-provenance-reconciliation-2026-10-30.md
+++ b/docs/release/service-provenance-reconciliation-2026-10-30.md
@@ -85,3 +85,26 @@ counts. It contains no application bodies, credentials, provider costs or
 fabricated identity mapping. Ruff and whitespace checks pass; application
 behavior/tests are unchanged, so the existing 383-case full gate is not claimed
 as a newly executed acceptance result for this metadata correction.
+
+## Owner-surface follow-through, 2026-10-31
+
+Read-only requests to the documented operations owner surface,
+`https://hub.coulomb.social/api/v2/openapi.json` and `/api/v2/hubs`, both failed
+certificate verification with `CERTIFICATE_VERIFY_FAILED: self-signed certificate`.
+No authenticated service-record response was obtained. Verification was not
+disabled and no bootstrap mutation was attempted. This is an access/evidence
+blocker, not proof that the service record is absent.
+
+The finance source's default ledger is `.fin-hub/ledger.db`. Opened directly with
+SQLite `mode=ro`, the existing local file contains seven ledger entries and only
+the legacy entry/import/meta tables. Its `ledger_entries` schema has no
+`client_id`, `application_id`, `app_instance_id` or `cost_attribution_key`; there
+is no engagement-price table. The ledger path is also documented in the owner's
+2026-07-08 dogfood evidence. No schema migration, write, invoice-body disclosure
+or inferred zero cost was performed. This legacy local file cannot establish
+current client attribution or production finance ingestion; it does not prove
+that a newer owner-held ledger is absent.
+
+Required returns remain the authoritative current operations record and finance
+mapping/report described above. These observations do not satisfy service
+contract §§4–5 or authorize inventing the missing client/instance identities.
diff --git a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md
index 9afd360..ff0c0a2 100644
--- a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md
+++ b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: coulomb-social
 created: "2026-10-08"
-updated: "2026-10-30"
+updated: "2026-10-31"
 origin: residual
 origin_ref: CSOC-WP-0008
 state_hub_workstream_id: "0cd1f513-f26e-5707-b646-8b4bbe6369fc"
@@ -281,6 +281,15 @@ No identity rekey, cost, finance ingestion or ops bootstrap is inferred.
 Local service-catalog slug404/repo0rows does not establish owner-surface absence.
 Proof/next returns: docs/release/service-provenance-reconciliation-2026-10-30.{md,json}.
 
+2026-10-31 owner-surface follow-through: the documented operations public API
+fails certificate verification, so no service record was verified there. The
+finance default local ledger was inspected with SQLite mode=ro: seven legacy
+entries, no client/application/instance attribution columns. It cannot prove
+current finance ingestion or costs, nor does it establish absence of another
+owner-held ledger. No TLS bypass, external write, schema migration or fabricated
+mapping was used. Bounded observations and required owner returns are appended
+to docs/release/service-provenance-reconciliation-2026-10-30.md; §§4–5 remain open.
+
 ## Completion
 
 Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.