diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index e03df4e..6f78a70 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -34,6 +34,7 @@
 | workplan | KEY-WP-0022 | finished | — | workplans/KEY-WP-0022-replacement-harness-and-external-conformance.md |
 | workplan | KEY-WP-0023 | finished | — | workplans/KEY-WP-0023-live-migration-proof.md |
 | workplan | KEY-WP-0024 | finished | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| workplan | KEY-WP-0025 | finished | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -146,4 +147,8 @@
 | task | KEY-WP-0023-T05 | done | — | workplans/KEY-WP-0023-live-migration-proof.md |
 | task | KEY-WP-0024-T01 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
 | task | KEY-WP-0024-T02 | done | — | workplans/KEY-WP-0024-tenant-roles-opt-in-wiring.md |
+| task | KEY-WP-0025-T01 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T02 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T03 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
+| task | KEY-WP-0025-T04 | done | — | workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md b/workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md
index b9c4ebd..a53e646 100644
--- a/workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md
+++ b/workplans/KEY-WP-0025-runtime-lifecycle-and-readiness.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: runtime-lifecycle-and-readiness
 created: "2026-09-08"
 updated: "2026-09-08"
+state_hub_workstream_id: "70f74bbd-6748-5bbe-b261-a310b6f24e0c"
 ---
 
 Closes gap G08. `/healthz` returned a constant without probing anything, the
@@ -26,6 +27,7 @@ requests, and write the limits down honestly.
 id: KEY-WP-0025-T01
 status: done
 priority: medium
+state_hub_task_id: "0e0d3349-efaf-546c-a58d-2a9b736278a9"
 ```
 
 Added `internal/server/readiness` and a `/readyz` endpoint probing LLDAP,
@@ -56,6 +58,7 @@ Design decisions worth keeping:
 id: KEY-WP-0025-T02
 status: done
 priority: medium
+state_hub_task_id: "0bea0780-523a-587e-a157-d429df15307b"
 ```
 
 `SIGTERM`/`SIGINT` now drain in-flight requests for up to 15 seconds. The grace
@@ -72,6 +75,7 @@ documented rather than papered over.
 id: KEY-WP-0025-T03
 status: done
 priority: medium
+state_hub_task_id: "97eba4bb-f8a0-5941-bdc8-6d59b0fa2942"
 ```
 
 `docs/operations.md` states the supported topology — exactly one replica, because
@@ -97,6 +101,7 @@ any number would be invented.
 id: KEY-WP-0025-T04
 status: done
 priority: medium
+state_hub_task_id: "bc64fdc2-0a31-5dab-afd1-5e7b6d11d2b3"
 ```
 
 Checked against the built executable rather than the handlers, following the