diff --git a/.claude/rules/workplan-convention.md b/.claude/rules/workplan-convention.md
index 398d817..9b6adcc 100644
--- a/.claude/rules/workplan-convention.md
+++ b/.claude/rules/workplan-convention.md
@@ -46,7 +46,7 @@ fix-consistency. Do not edit or rename it.
 
 **Workplan** is the fleet term — see
 `the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
-**Workstream** is legacy only: some API routes (`/workstreams/`), params
+**Workplan** is legacy only: some API routes (`/workstreams/`), params
 (`workstream_id`), MCP aliases (`create_workstream`), and the frontmatter field
 above remain until `STATE-WP-0069` retires them via legacy-meter. Treat those
 identifiers as workplan IDs. Prefer `GET /workplans/` and `workplan_id` in new
diff --git a/SCOPE.md b/SCOPE.md
index 4d93a6b..35d698c 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -336,7 +336,7 @@ Downstream: `ops-bridge` (primary), kaizen agents, CI automations, human operato
 | `flex-auth` | Authorization; policy package shipped (FLEX-WP-0006); runtime deploy FLEX-WP-0007 |
 | `key-cape` | Identity / IAM Profile lightweight mode |
 | `secrets-engine` | Owner-native secret-exec front door (`secrets-engine exec/route`); ops-warden routes provisioned secret lanes to it (WP-0019) |
-| `state-hub` | Workstream registry |
+| `state-hub` | Workplan registry |
 
 ---
 
diff --git a/wiki/WorkloadSecurityPosture.md b/wiki/WorkloadSecurityPosture.md
index efeff7f..3278a8f 100644
--- a/wiki/WorkloadSecurityPosture.md
+++ b/wiki/WorkloadSecurityPosture.md
@@ -91,7 +91,7 @@ prod-posture, M3 workload.
 
 ## Using this to refine blockers
 
-When a workstream says "blocked on security", classify it before escalating. The
+When a workplan says "blocked on security", classify it before escalating. The
 classification decides whether the blocker is real, belongs to an owning subsystem, or
 can be removed by a dev/test double.