diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 309d49b..a8976a7 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -19,6 +19,7 @@
 | workplan | SECRETS-WP-0008 | active | — | workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md |
 | workplan | SECRETS-WP-0009 | blocked | — | workplans/SECRETS-WP-0009-glas-claude-native-delivery.md |
 | workplan | SECRETS-WP-0010 | finished | — | workplans/SECRETS-WP-0010-openrouter-native-access.md |
+| workplan | SECRETS-WP-0011 | active | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
 | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
 | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
 | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
@@ -71,6 +72,10 @@
 | task | SECRETS-WP-0010-T01 | done | — | workplans/SECRETS-WP-0010-openrouter-native-access.md |
 | task | SECRETS-WP-0010-T02 | done | — | workplans/SECRETS-WP-0010-openrouter-native-access.md |
 | task | SECRETS-WP-0010-T03 | done | — | workplans/SECRETS-WP-0010-openrouter-native-access.md |
+| task | SECRETS-WP-0011-T01 | done | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+| task | SECRETS-WP-0011-T02 | done | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+| task | SECRETS-WP-0011-T03 | done | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+| task | SECRETS-WP-0011-T04 | wait | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
 | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
 | intake | SECRETS-IN-0002 | open | — | intakes/intakes.md |
 | intake | SECRETS-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
index 59239e5..64bb306 100644
--- a/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
+++ b/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
@@ -445,3 +445,25 @@ A provisioning script (SpendPolicy, `spend init`, request tables, mode-0600
 owner config under `~/hfact/owner`) validates in memory. Staging it on
 railiance01 was blocked by the harness classifier as a real-world transaction.
 It has not been run. No policy, ledger or owner config exists yet.
+
+### 2026-09-23 metered identity and host placement
+
+activity-core accepted a dedicated worker identity (ACTIVITY-WP-0039):
+`rein-aharness-metered@railiance01`. Its token is delivered by the companion
+lane `activity-core-metered-worker-token` (SECRETS-WP-0011). The operator chose
+to re-provision under that identity. The `~/hfact/owner` set (policy
+`f1e06b0b…`, owner config `5fa8ea21…`) is **superseded and unused**. Its ledger
+has no reservations, and no `exec_owner` pin will name it. The new set goes in
+`~/hfact/owner-metered` (same envelope, runtime, profile, grant, definition and
+target), provisioned by the operator. The owner must be launched with
+`AGENT_HARNESS_WORKER_ID=rein-aharness-metered@railiance01`.
+
+Placement: the operator chose to run `secrets-engine exec` on railiance01, next
+to the pinned owner. The host checkout is at `f7c12be` (origin/forgejo) with a
+Python 3.12 venv. Preflights pass there: both lanes load, and a pending-owner
+exec refuses before approval or backend. From the host, OpenBao-active,
+approval-engine, `flex-auth-secrets-engine` and KeyCape answer. The PDP and
+approval URLs must be literal loopback or HTTPS (`decision_check.py:73`,
+`approval_auth.py:90`), so the attended session needs host-side
+`kubectl port-forward` to 127.0.0.1 for both. That is a session step, not a
+standing change.