diff --git a/workplans/KEY-WP-0034-account-recovery.md b/workplans/KEY-WP-0034-account-recovery.md
index 1397a2f..3804850 100644
--- a/workplans/KEY-WP-0034-account-recovery.md
+++ b/workplans/KEY-WP-0034-account-recovery.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: key-cape
 created: "2026-09-12"
 updated: "2026-09-12"
+state_hub_workstream_id: "49b0cd1d-fb9d-5351-99eb-9be9143a092d"
 ---
 
 The operator reports a dead-end authentication error after using an account
@@ -21,6 +22,7 @@ failure; tenant rejection and provider failure must not be conflated.
 id: KEY-WP-0034-T01
 status: done
 priority: high
+state_hub_task_id: "ba285335-4ead-5478-8fb7-89a2ec1ba695"
 ```
 
 Route failed browser login to the public account recovery surface without codes,
@@ -36,6 +38,7 @@ MFA downgrade, global JWT revocation claim or inferred workload entitlements.
 id: KEY-WP-0034-T02
 status: progress
 priority: high
+state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2"
 ```
 
 Publish immutable images, update canonical runtime pins, verify anonymous