diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md
index 281dd14..1b5fa48 100644
--- a/workplans/USER-WP-0026-account-recovery.md
+++ b/workplans/USER-WP-0026-account-recovery.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: user-engine
 created: "2026-09-12"
 updated: "2026-09-12"
+state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
 ---
 
 The operator reports a dead-end authentication error after using an account
@@ -21,6 +22,7 @@ failure; tenant rejection and provider failure must not be conflated.
 id: USER-WP-0026-T01
 status: done
 priority: high
+state_hub_task_id: "86324ec8-cf2f-5e9e-bb60-670c4d792828"
 ```
 
 Route failed browser login to the public account recovery surface without codes,
@@ -36,6 +38,7 @@ MFA downgrade, global JWT revocation claim or inferred workload entitlements.
 id: USER-WP-0026-T02
 status: progress
 priority: high
+state_hub_task_id: "ad5b0a77-d8ec-5e07-9a9e-2fa231a6f792"
 ```
 
 Publish immutable images, update canonical runtime pins, verify anonymous
@@ -51,6 +54,7 @@ Source verification: 182 tests passed with three optional integration skips; lay
 id: USER-WP-0026-T03
 status: todo
 priority: high
+state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
 ```
 
 The requested cross-application allow list is not represented by the current