docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2)

.claude/rules/workplan-convention.md

@@ -46,7 +46,7 @@ fix-consistency. Do not edit or rename it.
 
 **Workplan** is the fleet term — see
 `the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
-**Workstream** is legacy only: some API routes (`/workstreams/`), params
+**Workplan** is legacy only: some API routes (`/workstreams/`), params
 (`workstream_id`), MCP aliases (`create_workstream`), and the frontmatter field
 above remain until `STATE-WP-0069` retires them via legacy-meter. Treat those
 identifiers as workplan IDs. Prefer `GET /workplans/` and `workplan_id` in new

SCOPE.md

@@ -336,7 +336,7 @@ Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operato
 | `flex-auth` | Authorization; policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
 | `key-cape` | Identity / IAM Profile lightweight mode |
 | `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) |
-| `state-hub` | Workstream registry |
+| `state-hub` | Workplan registry |
 
 ---
 

wiki/WorkloadSecurityPosture.md

@@ -91,7 +91,7 @@ prod-posture, M3 workload.
 
 ## Using this to refine blockers
 
-When a workstream says "blocked on security", classify it before escalating. The
+When a workplan says "blocked on security", classify it before escalating. The
 classification decides whether the blocker is real, belongs to an owning subsystem, or
 can be removed by a dev/test double.