diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 205c79f..8e62eff 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -18,7 +18,7 @@
 | workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
 | workplan | KEY-WP-0007 | finished | — | workplans/KEY-WP-0007-user-engine-portal-oidc-client.md |
 | workplan | KEY-WP-0008 | finished | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
-| workplan | KEY-WP-0009 | blocked | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| workplan | KEY-WP-0009 | finished | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | workplan | KEY-WP-0010 | finished | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
 | workplan | KEY-WP-0011 | finished | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
 | workplan | KEY-WP-0012 | finished | — | workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md |
@@ -36,6 +36,7 @@
 | workplan | KEY-WP-0024 | finished | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
 | workplan | KEY-WP-0025 | finished | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
 | workplan | KEY-WP-0026 | finished | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| workplan | KEY-WP-0027 | finished | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -97,7 +98,7 @@
 | task | KEY-WP-0009-T01 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | task | KEY-WP-0009-T02 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | task | KEY-WP-0009-T03 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
-| task | KEY-WP-0009-T04 | wait | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
+| task | KEY-WP-0009-T04 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | task | KEY-WP-0010-T01 | done | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
 | task | KEY-WP-0011-T01 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
 | task | KEY-WP-0011-T02 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
@@ -158,4 +159,8 @@
 | task | KEY-WP-0026-T04 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
 | task | KEY-WP-0026-T05 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
 | task | KEY-WP-0026-T06 | done | — | workplans/KEY-WP-0026-packaging-bootstrap-and-credential-handling.md |
+| task | KEY-WP-0027-T01 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T02 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T03 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
+| task | KEY-WP-0027-T04 | done | — | workplans/KEY-WP-0027-rollout-readiness-and-live-state.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md b/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md
index 16ff584..32a658d 100644
--- a/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md
+++ b/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: rollout-readiness-and-live-state
 created: "2026-09-08"
 updated: "2026-09-08"
+state_hub_workstream_id: "2ab60558-ee14-542c-9f19-bb487de8e668"
 ---
 
 G10 cannot be closed from this repository: it waits on named custody and platform
@@ -22,6 +23,7 @@ last question turned up a defect in this repository's own recent work.
 id: KEY-WP-0027-T01
 status: done
 priority: medium
+state_hub_task_id: "00de2bad-04da-5b58-8cde-aaa144272541"
 ```
 
 KEY-WP-0009 was reopened once because delivery was claimed without receipts, so
@@ -39,6 +41,7 @@ after sending and is not itself a blocker to record.
 id: KEY-WP-0027-T02
 status: done
 priority: medium
+state_hub_task_id: "2d513229-1dbd-500e-9100-c0173be7b4de"
 ```
 
 Read-only cluster inspection, `sso` namespace, 2026-09-08:
@@ -65,6 +68,7 @@ scripts, a fresh deployment — not for this one.
 id: KEY-WP-0027-T03
 status: done
 priority: high
+state_hub_task_id: "23c8d04b-c2b7-5347-80a0-6388c1c41c53"
 ```
 
 **Defect found in KEY-WP-0019, before it shipped.** Upstream verification
@@ -104,6 +108,7 @@ Two mitigations, both in this repository:
 id: KEY-WP-0027-T04
 status: done
 priority: medium
+state_hub_task_id: "7ba84b61-0458-5820-8ded-c6f59d820303"
 ```
 
 G10's status now names the live state, the outstanding requests with their