diff --git a/.custodian-brief.md b/.custodian-brief.md
index f6a724b..428115a 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,17 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-10-11 21:14 UTC  
+**Last synced:** 2026-10-14 07:30 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Runtime image OS-package hardening for RISK-F-0016
+Progress: 0/1 done  |  workplan_id: `5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0`
+
+**Open tasks:**
+- · Remove or replace unfixed-HIGH OS packages in the runtime image  `59584b44`
+
 ### User account journeys and recovery
 Progress: 1/3 done  |  workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b`
 
@@ -36,7 +42,8 @@ Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`
 Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`
 
 **Open tasks:**
-- · Deliver the setup link to the recipient  `fae614ba`
+- ! Deliver the setup link to the recipient  `fae614ba`
+  *(wait: Existing mail service lacks an admitted provider password-setup template and recipient-bound opaque issuer handoff. EMAIL-IN-0001 and NET-IN-0005 request exact owner implementation records; no new founder choice or credential request.)*
 
 ### Read-only account authority for Hub integration
 Progress: 2/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
@@ -45,6 +52,10 @@ Progress: 2/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
 - ! Authenticated workload transport and private acceptance  `c5d67725`
   *(wait: T02 delivered empty no-grant custody integration; real independently authenticated Hub caller credential admission and withdrawal/outage/private integration acceptance remain with state-hub (original f3bcc516; renewed request 350c3e12-284c-43a7-9ab1-116df8bcc007). Hub repository registration is not caller admission.)*
 
+## Inbox Hygiene
+
+**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
+
 ---
 ## MCP Orientation (when available)
 
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index c330590..6addaac 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -48,6 +48,7 @@
 | workplan | USER-WP-0035 | blocked | — | workplans/USER-WP-0035-onboarding-handoff-findings.md |
 | workplan | USER-WP-0036 | finished | — | workplans/USER-WP-0036-account-situational-awareness.md |
 | workplan | USER-WP-0037 | blocked | — | workplans/USER-WP-0037-hub-authority-lookup.md |
+| workplan | USER-WP-0038 | ready | — | workplans/USER-WP-0038-runtime-image-os-package-hardening.md |
 | task | USER-WP-ADHOC-2026-09-06-T01 | done | — | workplans/ADHOC-2026-09-06.md |
 | task | USER-WP-ADHOC-2026-10-09-T01 | done | — | workplans/ADHOC-2026-10-09.md |
 | task | USER-WP-ADHOC-2026-10-09-T02 | done | — | workplans/ADHOC-2026-10-09.md |
@@ -238,6 +239,7 @@
 | task | USER-WP-0036-T03 | done | — | workplans/USER-WP-0036-account-situational-awareness.md |
 | task | USER-WP-0037-T01 | done | — | workplans/USER-WP-0037-hub-authority-lookup.md |
 | task | USER-WP-0037-T02 | done | — | workplans/USER-WP-0037-hub-authority-lookup.md |
+| task | USER-WP-0038-T01 | todo | — | workplans/USER-WP-0038-runtime-image-os-package-hardening.md |
 | task | USER-WP-0037-T03 | wait | — | workplans/USER-WP-0037-hub-authority-lookup.md |
 | intake | USER-IN-0001 | answered | — | intakes/intakes.md |
 | intake | USER-IN-0002 | open | — | intakes/intakes.md |
diff --git a/workplans/USER-WP-0038-runtime-image-os-package-hardening.md b/workplans/USER-WP-0038-runtime-image-os-package-hardening.md
index e8485ff..516eabc 100644
--- a/workplans/USER-WP-0038-runtime-image-os-package-hardening.md
+++ b/workplans/USER-WP-0038-runtime-image-os-package-hardening.md
@@ -13,6 +13,7 @@ related:
   - RISK-F-0016
   - RAPP-USER-ENGINE-WP-0004
   - USER-WP-ADHOC-2026-10-11
+state_hub_workstream_id: "5ce5f3eb-e1dd-59bc-9cce-b0172431b9f0"
 ---
 
 # Runtime image OS-package hardening
@@ -35,6 +36,7 @@ on Python 3.12 slim-trixie base `a6e34c59`
 id: USER-WP-0038-T01
 status: todo
 priority: high
+state_hub_task_id: "59584b44-a7b7-5637-98fb-a746b5bc6c00"
 ```
 
 Target the 2026-10-14 HIGH set: util-linux family (bsdutils, mount, libblkid,