diff --git a/.custodian-brief.md b/.custodian-brief.md
index ce26687..52ceec7 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,17 +2,17 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-14 17:49 UTC  
+**Last synced:** 2026-10-16 05:54 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Name a dedicated caller for the reuse-surface hub writer token
-Progress: 3/4 done  |  workplan_id: `08e52353-b6e5-5742-b7b4-080d51a0cf57`
+### Check the target's readiness tier before a direct Kubernetes apply
+Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
 
 **Open tasks:**
-- ! Record the sanitized receipt  `9e12db29`
-  *(wait: After T03. Founder runs scripts/verify-reuse-surface-hub-writer.py member and non-member. A live receipt does not exist yet.)*
+- ! Review on 2026-12-21  `49dd5f9a`
+  *(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
 
 ### Describe every stored credential so the store is navigable
 Progress: 2/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
@@ -23,13 +23,6 @@ Progress: 2/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
 - ! Make an undescribed path visible before it accumulates  `9a0cea06`
   *(wait: After T03. A scheduled --undescribed report needs an unattended metadata-read credential and a named reader; survey grants are human-minted and expire within an hour.)*
 
-### Check the target's readiness tier before a direct Kubernetes apply
-Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
-
-**Open tasks:**
-- ! Review on 2026-12-21  `49dd5f9a`
-  *(wait: Plan-approval exception accepted under D2; closes when policy-nexus ArgoCD onboarding is confirmed.)*
-
 ### Materialize SecurityCases from their type, with acceptance as the only gate
 Progress: 2/4 done  |  workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583`
 
@@ -55,7 +48,7 @@ Progress: 4/5 done  |  workplan_id: `d9be08f5-a0f5-5cd1-8f87-0a6868661d77`
 ## Inbox Hygiene
 
 **Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
+**Missing thread_id:** 7 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)
diff --git a/workplans/MASON-WP-0010-security-case-materialization.md b/workplans/MASON-WP-0010-security-case-materialization.md
index 4b1a1fd..1a9880c 100644
--- a/workplans/MASON-WP-0010-security-case-materialization.md
+++ b/workplans/MASON-WP-0010-security-case-materialization.md
@@ -258,3 +258,27 @@ namespace/SA, ordinary unimplemented refusal, proposed build refusal, historical
 structure tests pass. No live survey, execution, case/type status, acceptance,
 native owner evidence or CCR was changed. T03 remains progress; actual accepted
 1.2 case/reviewed source and authenticated native owner evidence remain required.
+
+2026-10-17 (T03 source review): ops-mason source is complete for T03.
+`structure-request` prepares the typed request; `case_structure.verify` and
+`bind_status_transition` take an owner-supplied authenticating verifier by
+design, so no CLI that trusts observation JSON is added. Every remaining step
+is an owner observation or an attended native run.
+
+Attended checklist (in order; none may be simulated):
+1. net-kingdom: accept the Forgejo case at type 1.2 (acceptance record in the
+   case); ops-mason then re-renders `plan --case ... --types-root <1.2>` to
+   `reviewed` and rebuilds the bundle (source-only, worker may run).
+2. railiance-platform: supply independently authenticated metadata-only
+   observations for ESO policy, `external-secrets-keycape-forgejo` role and
+   KV layout, each marked created (with change receipt) or preexisting-matched,
+   against the `structure-request` digest. No values.
+3. railiance-apps + railiance-platform: bind CCR-2026-0042 consumer
+   `openbao.auth` (namespace/SA), reconcile it from @1.0 to the current type,
+   review and apply; supply its receipt.
+4. ops-warden: authenticate the pointer-only catalog entry observation.
+5. Owner (railiance-platform) supplies the authenticating verifier seam and,
+   with founder go, runs `bind_status_transition` to preview
+   accepted -> materialized; Warden accepts the new raw case digest.
+6. Follow-through after materialization, not prerequisites: mint in custody,
+   ESO delivery, first live verification (NK-WP-0048-T06).