diff --git a/.custodian-brief.md b/.custodian-brief.md
index cfa9d48..e2e9f67 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-09 09:03 UTC  
+**Last synced:** 2026-10-09 10:10 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -15,13 +15,6 @@ Progress: 1/4 done  |  workplan_id: `eabf2c39-94bd-5a11-8f2e-76d7a95d1583`
 - ! T02 — Render a construction plan from a case  `56cea6be`
 - ! T03 — Build from an accepted case  `f6ad0d3c`
 
-### Check the target's readiness tier before a direct Kubernetes apply
-Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
-
-**Open tasks:**
-- ! Review on 2026-12-21  `49dd5f9a`
-  *(wait: Dated review 2026-12-21: platform confirms policy-nexus ArgoCD onboarding; founder reviews the plan-approval exception.)*
-
 ### Describe every stored credential so the store is navigable
 Progress: 1/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
 
@@ -40,6 +33,13 @@ Progress: 5/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
 - ! Verify and hand off  `84576093`
   *(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)*
 
+### Check the target's readiness tier before a direct Kubernetes apply
+Progress: 5/6 done  |  workplan_id: `1b900161-51ff-544f-8412-ba7fcab64bb5`
+
+**Open tasks:**
+- ! Review on 2026-12-21  `49dd5f9a`
+  *(wait: Dated review 2026-12-21: platform confirms policy-nexus ArgoCD onboarding; founder reviews the plan-approval exception.)*
+
 ### Construct the fluid-telegram operator credential lane
 Progress: 3/6 done  |  workplan_id: `483e56d6-6601-5377-9066-66225214c046`