diff --git a/.custodian-brief.md b/.custodian-brief.md
index a386d1f..1d4fcea 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — hub-core
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 01:29 UTC  
+**Last synced:** 2026-10-04 10:13 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,30 +12,33 @@ Progress: 0/3 done  |  workplan_id: `3c8034fc-fd90-58f5-99bc-99b4f93e5ee1`
 
 **Open tasks:**
 - ! Admit the actual reader identity and full scope semantics  `35c5ae8b`
+  *(wait: Selected reader owner must specify principal, recipient/broadcast/alias scope; identity/platform owners must deliver a dedicated workload grant and credential under the shared access contract.)*
 - ! Execute one reviewed client switch  `61c727a5`
-- · Establish ongoing inbox freshness  `588e4b58`
+  *(wait: Needs fresh parity and caller-admission receipts plus a State Hub/client-owner authorized reversible reader switch.)*
+- ! Establish ongoing inbox freshness  `588e4b58`
+  *(wait: State Hub must define a consistent source revision/cursor, read/archive changes, explicit deletions/retention and recovery semantics for the derived inbox; packaging owner must admit refresh/staleness operation.)*
 
 ### Repository classification aggregation and navigation
 Progress: 5/6 done  |  workplan_id: `05ebd06e-4af8-5f6c-918c-c143c1520e00`
 
 **Open tasks:**
 - ! Hand A5/A4 navigation to State Hub retirement  `7c8225f7`
-  *(wait: Waits on T02-T05 and the State Hub cutover window under STATE-WP-0079.)*
+  *(wait: Publisher admission is complete; State Hub and selected A5/A4 consumer owners must supply parity cases, caller/alias mapping, a bounded switch window and rollback/traffic receipts.)*
 
 ### NetKingdom identity and tenant integration: platform-root first
 Progress: 0/8 done  |  workplan_id: `e61ce290-c5ec-516c-8589-ef9a55cf3aa3`
 
 **Open tasks:**
 - ! T01 — Freeze the integration contract and platform coverage matrix  `204f4fb0`
-  *(wait: Contract reviewers' (NetKingdom, user-engine, tenant-engine, flex-auth) sign-off on the inventory and disputed rows)*
+  *(wait: NetKingdom, User/Tenant Engine, access-engine and platform owners must review current per-surface action/audience/tenant mappings and return explicit dispositions for unresolved inventory rows.)*
 - ! T02 — Bind platform-root identity, login, tenant and revocation  `9a955fbf`
-  *(wait: NetKingdom/KeyCape live root login, AAL2 enrollment acceptance, and User/Tenant Engine authenticated HTTP readers (contract published in docs/owner-facts-contract.md, no owner endpoint admitted yet))*
+  *(wait: Account HTTP source and custody mapping now exist; needs admitted Hub workload transport, Tenant Engine authenticated lifecycle contract, real immutable root/custody grant and attended issuer/AAL2/private-journey receipts.)*
 - ! T03 — Deliver root policy and authenticated decision evaluation  `feea8f20`
-  *(wait: flex-auth production PDP deployment and signing-key delivery from platform owners (audit-core-senders routing entry to ops-mason/OpenBao is unresolved; no Hub sender credential minted))*
+  *(wait: access-engine must admit Hub protected-system policy/caller and signed-decision trust; platform and audit-core must deliver separate Hub PDP/audit credentials, keys and durable receiver admission with failure/rotation receipts.)*
 - ! T04 — Enforce the boundary across Hub Core and its clients  `15bc3cae`
-  *(wait: T02/T03 live admission; private full-root browser/API/MCP journeys need a real root login and PDP, which do not exist yet)*
+  *(wait: Local boundary/client source is implemented; T02/T03 admission plus rapp-core-hub private pinned composition are required for real browser/API/MCP, bypass, revocation and rollback acceptance.)*
 - ! T05 — Admit extensions and State Hub migration callers  `6d29854e`
-  *(wait: T04 live admission)*
+  *(wait: T04 admission and ops-hub/other extension owners must supply authenticated host composition, per-audience caller grants and root/non-root/wrong-tenant acceptance receipts.)*
 - ! T06 — Prove full platform-root coverage, including Railiance (M1)  `97b0b242`
   *(wait: T04/T05 live admission and Railiance/platform owners' attended receipts)*
 - ! T07 — Package and gate public exposure  `0c15cb82`
@@ -45,7 +48,7 @@ Progress: 0/8 done  |  workplan_id: `e61ce290-c5ec-516c-8589-ef9a55cf3aa3`
 ## Inbox Hygiene
 
 **Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 1 unread message(s) lack supersession chains.
+**Missing thread_id:** 2 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)