diff --git a/docs/occupymedia-storage.md b/docs/occupymedia-storage.md
index 9955e90..351ac77 100644
--- a/docs/occupymedia-storage.md
+++ b/docs/occupymedia-storage.md
@@ -11,11 +11,17 @@ are the next operator runbook. Design input: `runs/wp4/fileshare-research.md`.
 | Payload bucket | Exclusive owner | Status |
 |---|---|---|
 | `occupymedia-matrix-media` | Future Tuwunel native S3 media | Existing bucket; live conduwuit still local |
-| `occupymedia-files-blobs` | oCIS S3NG, working files/docs and pad exports | Proposed new bucket; inventory/provision first |
+| `hub-files-blobs` | oCIS S3NG, working files/docs and pad exports | Existing bucket (provisioned 2026-10-08); oCIS deployed 2026-10-10 on occ-files CT 320. S3 key scoped to this bucket only |
+| `hub-pads` | Future compliant pad persistence | Existing bucket; unused until a compliant pad adapter exists |
+| `hub-media-library` | Reserved — library copies requiring separate attribution | Existing bucket; unused |
 | `occupymedia-media-encrypted` | Tactical Media Broadcast Hub media/library, existing envelope format | Existing configuration; preserve KEK |
 | `occupymedia-peertube-videos` | PeerTube video objects | Existing dedicated bucket |
 | `occupymedia-peertube-playlists` | PeerTube playlists | Existing dedicated bucket |
 
+Reality note (2026-10-10): the provisioned buckets use the `hub-` prefix, not
+the `occupymedia-files-blobs` name first written here. The `hub-` names are the
+contract now; do not create duplicates.
+
 Verify actual inventory; names here are ownership contracts, not proof of
 provisioning. Do not let the bot write directly into oCIS's opaque bucket. It must
 upload via authorized WebDAV/CS3 so metadata and ACLs remain coherent. Each