diff --git a/.custodian-brief.md b/.custodian-brief.md
index 4bdef98..a7289b8 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,25 +2,11 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-10 18:30 UTC  
+**Last synced:** 2026-10-11 18:36 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Establish SecurityCaseTypes so that known security cases are light
-Progress: 7/9 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
-
-**Open tasks:**
-- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
-- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
-
-### Implement deterministic posture and evidence feedback
-Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
-
-**Open tasks:**
-- ! Obtain audit-core freshness adoption  `7d2029d2`
-  *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
-
 ### Publish the NetKingdom emission-cadence security profile
 Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
 
@@ -28,6 +14,13 @@ Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
 - ! Bind and hand off the published contract  `e3fbc8b8`
   *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
 
+### Implement deterministic posture and evidence feedback
+Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
+
+**Open tasks:**
+- ! Obtain audit-core freshness adoption  `7d2029d2`
+  *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
+
 ### Reconcile reef placement and security-zone canon dependencies
 Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
 
@@ -39,12 +32,12 @@ Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
 - ! T06 — Resolve the `DataClassification` mismatch  `bf8b3e1d`
   *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)*
 
-### Cut over NetKingdom identity to railiance01 and retire CoulombCore
-Progress: 7/8 done  |  workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
 
 **Open tasks:**
-- ! T08 - Final deletion and closure  `42a3b4c0`
-  *(wait: Explicit approval, rollback retention window expiry and one successful railiance01 restore/restart drill before destructive CoulombCore cleanup.)*
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence.)*
 
 ### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
 Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
@@ -66,12 +59,19 @@ Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
   *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
 - … and 1 more open tasks
 
-### Define an execution-attribution receipt for Railiance runs
-Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+### Establish SecurityCaseTypes so that known security cases are light
+Progress: 7/9 done  |  workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
 
 **Open tasks:**
-- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
-  *(wait: Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence.)*
+- ! T05 — Acknowledge the type through informed-decision  `d9b26bcf`
+- ! T06 — First KnownSecurityCase: Forgejo  `c3c9c3ae`
+
+### Cut over NetKingdom identity to railiance01 and retire CoulombCore
+Progress: 7/8 done  |  workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
+
+**Open tasks:**
+- ! T08 - Final deletion and closure  `42a3b4c0`
+  *(wait: Explicit approval, rollback retention window expiry and one successful railiance01 restore/restart drill before destructive CoulombCore cleanup.)*
 
 ---
 ## MCP Orientation (when available)