diff --git a/.custodian-brief.md b/.custodian-brief.md
index 44b26f2..9cf9b4e 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,19 +2,11 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 17:28 UTC  
+**Last synced:** 2026-10-03 17:54 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Make the platform-root custody record readable as a non-secret root-grant fact
-Progress: 4/6 done  |  workplan_id: `43fbb1aa-b711-5792-b72b-07cd93ca8f45`
-
-**Open tasks:**
-- ! Close the loop with user-engine  `eb71faf7`
-  *(wait: Needs T05 delivery and user-engine USER-WP-0037-T02 adapter/mapping acceptance against the delivered source, including revocation, freshness and rollback evidence.)*
-- ► Deliver the read path with the owner  `628e8a3b`
-
 ### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
 Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
 
@@ -28,20 +20,6 @@ Progress: 1/9 done  |  workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
 - · Prove recovery and audit delivery  `e5f44ddc`
 - … and 1 more open tasks
 
-### Implement deterministic posture and evidence feedback
-Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
-
-**Open tasks:**
-- ! Obtain audit-core freshness adoption  `7d2029d2`
-  *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)*
-
-### Publish the NetKingdom emission-cadence security profile
-Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
-
-**Open tasks:**
-- ! Bind and hand off the published contract  `e3fbc8b8`
-  *(wait: Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft.)*
-
 ### Reconcile reef placement and security-zone canon dependencies
 Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
 
@@ -53,6 +31,36 @@ Progress: 3/6 done  |  workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
 - ! T06 — Resolve the `DataClassification` mismatch  `bf8b3e1d`
   *(wait: DataClassification vocabulary mismatch between rapp-policy-nexus (public) and ops-warden dataclass_floor must be resolved with those owners.)*
 
+### Publish the NetKingdom emission-cadence security profile
+Progress: 4/5 done  |  workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
+
+**Open tasks:**
+- ! Bind and hand off the published contract  `e3fbc8b8`
+  *(wait: Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft.)*
+
+### Implement deterministic posture and evidence feedback
+Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
+
+**Open tasks:**
+- ! Obtain audit-core freshness adoption  `7d2029d2`
+  *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)*
+
+### Make the platform-root custody record readable as a non-secret root-grant fact
+Progress: 4/6 done  |  workplan_id: `43fbb1aa-b711-5792-b72b-07cd93ca8f45`
+
+**Open tasks:**
+- ! Deliver the read path with the owner  `628e8a3b`
+  *(wait: Source implementation and go-forward approval complete; attended OpenBao admission/empty publication and RPF-WP-0049-T05 live producer/recovery receipts remain. No new generic approval or actual custodian identity is needed for the empty baseline.)*
+- ! Close the loop with user-engine  `eb71faf7`
+  *(wait: Needs T05 delivery, custody-capable image promotion and authenticated empty-source/baseline read-deny-outage-restart acceptance from USER-WP-0037-T02 and RAPP-USER-ENGINE-WP-0003-T03. Real grant exercises remain ceremony-dependent; empty source creates no grants.)*
+
+### Define an execution-attribution receipt for Railiance runs
+Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
+
+**Open tasks:**
+- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
+  *(wait: Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated.)*
+
 ### Let workloads require MFA for all or part of their features
 Progress: 1/2 done  |  workplan_id: `3f702215-704b-5788-8ca0-b8b9ba2dd3f8`
 
@@ -67,13 +75,6 @@ Progress: 7/8 done  |  workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
 - ! T08 - Final deletion and closure  `42a3b4c0`
   *(wait: Explicit approval, rollback retention window expiry and one successful railiance01 restore/restart drill before destructive CoulombCore cleanup.)*
 
-### Define an execution-attribution receipt for Railiance runs
-Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
-
-**Open tasks:**
-- ! Agree the evidence holder and schema with audit-core and Railiance  `963120c1`
-  *(wait: Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated.)*
-
 ---
 ## MCP Orientation (when available)