diff --git a/.custodian-brief.md b/.custodian-brief.md
index 203dfc1..e225359 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,20 +2,38 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-11 18:31 UTC  
+**Last synced:** 2026-10-14 16:21 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Name a dedicated caller for the reuse-surface hub writer token
+Progress: 1/4 done  |  workplan_id: `08e52353-b6e5-5742-b7b4-080d51a0cf57`
+
+**Open tasks:**
+- ! Confirm the group and the member entity  `9863b4b8`
+  *(wait: key-cape confirms group reuse-surface-hub-writers and a member entity that is not 4a1f663c-0621-0483-edd0-f852274f4b6b and has no platform-admin or operator-custody identity policy.)*
+- ! Apply the role without a KV write  `7c32e273`
+  *(wait: After T02. Founder applies the CCR through the delegated applier. No bao kv put. Do not attach the policy to the admin entity.)*
+- ! Record the sanitized receipt  `9e12db29`
+  *(wait: After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet.)*
+
 ### Describe every stored credential so the store is navigable
 Progress: 2/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
 
 **Open tasks:**
 - ! Resolve the rest with their owners  `fff26914`
-  *(wait: Owners fill the gaps in manifests/custody-descriptions.yaml for the 9 draft entries (asked 2026-10-09).)*
+  *(wait: operators/nextcloud base entry removed 2026-10-14 after the founder retired it. Remaining draft gaps still need their owners.)*
 - ! Make an undescribed path visible before it accumulates  `9a0cea06`
   *(wait: After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.)*
 
+### Check the target's readiness tier before a direct Kubernetes apply
+Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
+
+**Open tasks:**
+- ! Review on 2026-12-21  `49dd5f9a`
+  *(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
+
 ### Materialize SecurityCases from their type, with acceptance as the only gate
 Progress: 2/4 done  |  workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583`
 
@@ -32,13 +50,6 @@ Progress: 4/6 done  |  workplan_id: `483e56d6-6601-5377-9066-66225214c046`
   *(wait: After T05 verification; only ops-warden activates the entry.)*
 - ► Verify capabilities and record metadata-only evidence  `4c205be7`
 
-### Check the target's readiness tier before a direct Kubernetes apply
-Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
-
-**Open tasks:**
-- ! Review on 2026-12-21  `49dd5f9a`
-  *(wait: Dated review 2026-12-21: platform confirms policy-nexus ArgoCD onboarding; founder reviews the plan-approval exception.)*
-
 ### Place the KeyCape secrets-engine-openbao client secret in OpenBao
 Progress: 4/5 done  |  workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77`
 
@@ -47,8 +58,8 @@ Progress: 4/5 done  |  workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77`
 
 ## Inbox Hygiene
 
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 3 unread message(s) lack supersession chains.
+**Stale unread:** 6 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 4 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 692ea44..25a1853 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -20,6 +20,7 @@
 | workplan | MASON-WP-0008 | finished | — | workplans/MASON-WP-0008-plan-survey.md |
 | workplan | MASON-WP-0009 | blocked | — | workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md |
 | workplan | MASON-WP-0010 | blocked | — | workplans/MASON-WP-0010-security-case-materialization.md |
+| workplan | MASON-WP-0011 | active | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
 | task | ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
 | task | ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
 | task | ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
@@ -74,6 +75,10 @@
 | task | MASON-WP-0010-T02 | done | — | workplans/MASON-WP-0010-security-case-materialization.md |
 | task | MASON-WP-0010-T03 | progress | — | workplans/MASON-WP-0010-security-case-materialization.md |
 | task | MASON-WP-0010-T04 | wait | — | workplans/MASON-WP-0010-security-case-materialization.md |
+| task | MASON-WP-0011-T01 | done | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
+| task | MASON-WP-0011-T02 | wait | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
+| task | MASON-WP-0011-T03 | wait | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
+| task | MASON-WP-0011-T04 | wait | — | workplans/MASON-WP-0011-reuse-surface-hub-writer.md |
 | intake | MASON-IN-0001 | closed | green | intakes/intakes.md |
 | intake | MASON-IN-0002 | closed | — | intakes/intakes.md |
 | intake | MASON-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md
index d18b489..7065457 100644
--- a/workplans/MASON-WP-0011-reuse-surface-hub-writer.md
+++ b/workplans/MASON-WP-0011-reuse-surface-hub-writer.md
@@ -10,6 +10,7 @@ owner: codex
 topic_slug: custodian
 created: "2026-10-14"
 updated: "2026-10-14"
+state_hub_workstream_id: "08e52353-b6e5-5742-b7b4-080d51a0cf57"
 ---
 
 # Name a dedicated caller for the reuse-surface hub writer token
@@ -42,6 +43,7 @@ the-custodian, workplan CUST-WP-0081.
 id: MASON-WP-0011-T01
 status: done
 priority: high
+state_hub_task_id: "d847ded9-d189-578a-a59f-9c12c205fcf9"
 ```
 
 Record why the admin entity cannot carry the workload policy, reuse the
@@ -60,6 +62,7 @@ depends_on: [MASON-WP-0011-T01]
 blocked_on: message-from:key-cape
 blocking_reason: "key-cape confirms group reuse-surface-hub-writers and a member entity that is not 4a1f663c-0621-0483-edd0-f852274f4b6b and has no platform-admin or operator-custody identity policy."
 priority: high
+state_hub_task_id: "9863b4b8-fcff-5eec-86f9-7249b66c4700"
 ```
 
 Ask key-cape to create or confirm the group and to name the member entity
@@ -75,6 +78,7 @@ depends_on: [MASON-WP-0011-T02]
 blocked_on: human
 blocking_reason: "After T02. Founder applies the CCR through the delegated applier. No bao kv put. Do not attach the policy to the admin entity."
 priority: high
+state_hub_task_id: "7c32e273-e7a0-5626-96cd-ecf4bc326df2"
 ```
 
 railiance-platform assigns the real CCR id, copies the policy file over the
@@ -90,6 +94,7 @@ depends_on: [MASON-WP-0011-T03]
 blocked_on: human
 blocking_reason: "After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet."
 priority: high
+state_hub_task_id: "9e12db29-532d-5d90-8519-227799018ab0"
 ```
 
 Both modes must pass. Copy the mode-0600 receipts into `docs/evidence/`