diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 8c04441..6abbc51 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -1178,6 +1178,7 @@ needs_human: true
 decision_id: "9f9d0d88-837a-433c-8a11-d30b633b0073"
 depends_on: [NK-WP-0049-T35]
 blocking_reason: "Founder decides: accept ACME letsencrypt-prod reissue as the kc.coulomb.social TLS disposition, or require original key custody via RCLUSTER-WP-0018."
+state_hub_task_id: "90f473db-bda6-5fe2-a2e1-7ddfaca815b7"
 ```
 
 Founder gate for T35. Approves no mutation and no attempt.
@@ -1193,6 +1194,7 @@ needs_human: true
 decision_id: "d1ab097d-cc79-4612-9c17-bb9b364081ac"
 depends_on: [NK-WP-0049-T33]
 blocking_reason: "Approved in principle (d1ab097d); founder signs the <=24h secrets-engine-recovery-attempt admission only once T33's packet is ready."
+state_hub_task_id: "90865f76-0573-5840-b1b5-937f0820ea82"
 ```
 
 The signed document is T33's required `--admission` input and T18's surviving