diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index f097acc..9cc9022 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -18,6 +18,7 @@
 | workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
 | workplan | FLEX-WP-0009 | active | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
+| workplan | FLEX-WP-0011 | proposed | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -70,3 +71,6 @@
 | task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T04 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
+| task | FLEX-WP-0011-T01 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
+| task | FLEX-WP-0011-T02 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
+| task | FLEX-WP-0011-T03 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
diff --git a/deploy/README.md b/deploy/README.md
index 3484ae6..3e3f50b 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -83,7 +83,8 @@ last-known-good digest below.
 
 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
+| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 |
+| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
 | `flex-auth-user-engine` | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |
 
 Rolling back the tenant-engine service to `c25fc34a…` restores fail-closed
diff --git a/deploy/flex-auth-tenant-engine.yaml b/deploy/flex-auth-tenant-engine.yaml
index e0a71ad..de25e54 100644
--- a/deploy/flex-auth-tenant-engine.yaml
+++ b/deploy/flex-auth-tenant-engine.yaml
@@ -23,7 +23,7 @@ spec:
         - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
         - --policy
         - /opt/flex-auth/examples/tenant-engine/policy_package.md
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
         livenessProbe:
           httpGet:
             path: /healthz
diff --git a/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md b/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
index 9424017..bfdb16e 100644
--- a/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
+++ b/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
@@ -15,6 +15,7 @@ related_workplans:
   - RAIL-BS-WP-0006
 created: "2026-08-11"
 updated: "2026-08-11"
+state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
 ---
 
 # FLEX-WP-0011 - Bring flex-auth under the railiance staged-promotion contract
@@ -62,6 +63,7 @@ policy rollouts.
 id: FLEX-WP-0011-T01
 status: todo
 priority: medium
+state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
 ```
 
 Write `railiance/app.toml` against schema `railiance.app.v1`, using
@@ -88,6 +90,7 @@ set is accepted.
 id: FLEX-WP-0011-T02
 status: todo
 priority: medium
+state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
 ```
 
 Prove `stage deploy`, `stage observe`, `stage promote`, and `stage rollback`
@@ -104,6 +107,7 @@ evidence ids are recorded here.
 id: FLEX-WP-0011-T03
 status: todo
 priority: low
+state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
 ```
 
 `the-custodian/docs/coulombcore-drain-placement-plan.md` row 23 lists