diff --git a/.custodian-brief.md b/.custodian-brief.md
index 8a5b338..ea9ccd0 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-14 22:34 UTC  
+**Last synced:** 2026-10-15 17:24 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -69,17 +69,6 @@ Progress: 7/9 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
 - ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
   *(wait: The next types follow once the first one is proven end to end.)*
 
-### Show who a workload sign-in actually is
-Progress: 3/6 done  |  workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
-
-**Open tasks:**
-- ! Account site shows both sessions  `bdc8b414`
-  *(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)*
-- ! Enroll the negative-login factor  `afb5816f`
-  *(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)*
-- ! Hand the OpenBao proof back to its owners  `86fb4a6b`
-  *(wait: Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof.)*
-
 ### Register Playwright human and agent consumers through governed identity delivery
 Progress: 1/3 done  |  workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
 
diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
index 2d444ae..47a3bc0 100644
--- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
+++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
@@ -77,6 +77,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T01]
+state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462"
 ```
 
 Completed 2026-10-12–13. Public-recipient-only encryption, explicit temporary
@@ -98,6 +99,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T04]
+state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95"
 ```
 
 Completed 2026-10-13–14. Repaired KeyCape configuration and component Secret
@@ -122,6 +124,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T04, NK-WP-0049-T05]
+state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015"
 ```
 
 Completed 2026-10-15. Enumerated all 87 current non-test shell/Python callers
@@ -143,6 +146,7 @@ id: NK-WP-0049-T07
 status: done
 priority: high
 owner: codex
+state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6"
 ```
 
 Completed 2026-10-15–16. Bounded Storage Share/Scaleway inventories identified
@@ -163,6 +167,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T06, NK-WP-0049-T07]
+state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8"
 ```
 
 Completed 2026-10-16. Defined exact LLDAP/Authelia/KeyCape/privacyIDEA assets,
@@ -185,6 +190,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T08]
+state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1"
 ```
 
 Completed 2026-10-16. Platform CCR-2026-0048/0049 are verified. The operator
@@ -208,6 +214,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T08, NK-WP-0049-T09]
+state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0"
 ```
 
 Completed 2026-10-16. Applied exact UID/resource-version/spec-guarded DNS
@@ -229,6 +236,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T08]
+state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18"
 ```
 
 Completed 2026-10-16. Added the Railiance bootstrap `identity-recovery`
@@ -250,6 +258,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T09, NK-WP-0049-T10]
+state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb"
 ```
 
 Completed 2026-10-16. Captured original service keys/current data plus the
@@ -270,6 +279,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T11, NK-WP-0049-T12]
+state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d"
 ```
 
 Completed 2026-10-16. Independently downloaded the exact first generation
@@ -291,6 +301,7 @@ status: done
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T10, NK-WP-0049-T13]
+state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19"
 ```
 
 Completed 2026-10-16 after T13. Both daily backup/retention and hourly health
@@ -337,6 +348,7 @@ status: todo
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T08, NK-WP-0049-T13]
+state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae"
 ```
 
 **Next action:** turn the recovered manifest and current caller gaps into a
@@ -361,6 +373,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T15]
 blocking_reason: "Await the accepted isolated restore packet and independently supplied existing-user test credentials; no production restore is admitted by task refinement."
+state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0"
 ```
 
 Owner boundary: NetKingdom directory/User Engine owners. Restore the captured
@@ -381,6 +394,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T15, NK-WP-0049-T16]
 blocking_reason: "Await the accepted isolated packet and restored-directory authentication proof from T16."
+state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70"
 ```
 
 Owner boundary: SSO/Authelia and directory owners. Restore the original storage,
@@ -401,6 +415,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T15, NK-WP-0049-T16]
 blocking_reason: "Await the accepted isolated packet, restored directory and owner-selected retained-token/MFA test inputs."
+state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2"
 ```
 
 Owner boundary: MFA/privacyIDEA and directory owners. Use the exact linked dump
@@ -421,6 +436,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T15]
 blocking_reason: "Await the accepted isolated target/procedure and owner-admitted historical/new audit verification from T15."
+state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d"
 ```
 
 Owner boundary: MFA/privacyIDEA audit owner. Use the original recovered audit
@@ -441,6 +457,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T19]
 blocking_reason: "Await the accepted isolated packet, restored-directory proof and retained-token MFA proof for the selected authentication flow."
+state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125"
 ```
 
 Owner boundary: KeyCape and the selected current consumer owners. Restore the
@@ -461,6 +478,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T02]
 blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers."
+state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4"
 ```
 
 Owner boundary: each current caller's service/provider and credential owner.
@@ -483,6 +501,7 @@ priority: high
 owner: codex
 depends_on: [NK-WP-0049-T02, NK-WP-0049-T21]
 blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged."
+state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55"
 ```
 
 Owner boundary: Platform/custody and affected consumer owners. Review historical
@@ -505,6 +524,7 @@ status: todo
 priority: high
 owner: codex
 depends_on: [NK-WP-0049-T13]
+state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1"
 ```
 
 The existing independent retrieval succeeded through a healthy attended OpenBao
@@ -528,6 +548,7 @@ status: todo
 priority: medium
 owner: codex
 depends_on: [NK-WP-0049-T14]
+state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0"
 ```
 
 **Next action:** record the current single-provider and host-local-health limits,