diff --git a/.custodian-brief.md b/.custodian-brief.md
index 83e92ec..b6bf084 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-08 21:50 UTC  
+**Last synced:** 2026-10-08 22:29 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -29,11 +29,9 @@ Progress: 0/4 done  |  workplan_id: `e5656747-a974-581a-a3d4-4e6bb7262f4c`
   *(wait: Blocked on T03.)*
 
 ### Project the tenant-engine audit-core sender token into its namespace
-Progress: 4/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
+Progress: 5/6 done  |  workplan_id: `60acab5e-8ee3-5449-bc1e-91b203e92262`
 
 **Open tasks:**
-- ! Manifests in the tenant-engine rApp repository  `e56f0374`
-  *(wait: tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD.)*
 - ! Verify and hand off  `84576093`
   *(wait: Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine.)*