diff --git a/.custodian-brief.md b/.custodian-brief.md
index 37026d5..05a2ec8 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — net-kingdom
 
 **Domain:** infotech  
-**Last synced:** 2026-10-03 16:41 UTC  
+**Last synced:** 2026-10-03 17:01 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -45,19 +45,6 @@ Progress: 4/5 done  |  workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
 - ! Obtain audit-core freshness adoption  `7d2029d2`
   *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)*
 
-### Make the platform-root custody record readable as a non-secret root-grant fact
-Progress: 2/6 done  |  workplan_id: `43fbb1aa-b711-5792-b72b-07cd93ca8f45`
-
-**Open tasks:**
-- ! Accept ADR-0017  `25489680`
-  *(wait: Bernd accepts or amends NK-ADR-0017 (proposed) after user-engine confirms the AccountAuthority mapping.)*
-- ! Decide the read surface  `472e191f`
-  *(wait: Needs a decision on where a workload reads the record (OpenBao-held, platform service, or repository artifact) and which owner delivers it.)*
-- ! Deliver the read path with the owner  `628e8a3b`
-  *(wait: Depends on the read-surface decision and on the delivering owner.)*
-- ! Close the loop with user-engine  `eb71faf7`
-  *(wait: Needs the delivered read path.)*
-
 ### Define an execution-attribution receipt for Railiance runs
 Progress: 1/2 done  |  workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
 
@@ -79,6 +66,15 @@ Progress: 7/8 done  |  workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
 - ! T08 - Final deletion and closure  `42a3b4c0`
   *(wait: Explicit approval, rollback retention window expiry and one successful railiance01 restore/restart drill before destructive CoulombCore cleanup.)*
 
+### Make the platform-root custody record readable as a non-secret root-grant fact
+Progress: 4/6 done  |  workplan_id: `43fbb1aa-b711-5792-b72b-07cd93ca8f45`
+
+**Open tasks:**
+- ! Deliver the read path with the owner  `628e8a3b`
+  *(wait: Approved OpenBao design; RPF-WP-0049-T05 must provide the real authenticated read path, custody provenance and producer receipts. Reader identity, executor/recovery and separate live provisioning approval remain pending.)*
+- ! Close the loop with user-engine  `eb71faf7`
+  *(wait: Needs T05 delivery and user-engine USER-WP-0037-T02 adapter/mapping acceptance against the delivered source, including revocation, freshness and rollback evidence.)*
+
 ---
 ## MCP Orientation (when available)