diff --git a/.custodian-brief.md b/.custodian-brief.md
index 57b2962..7e265b3 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,22 +2,35 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-09-24 08:10 UTC  
+**Last synced:** 2026-09-28 07:45 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Adopt unknown -> fail_closed behind signing-target classification coverage
+Progress: 1/4 done  |  workplan_id: `c8ee441e-1be1-5219-910c-e79ff23cc9ec`
+
+**Open tasks:**
+- ! Tasks  `611f0901`
+  *(wait: Await authoritative owner declaration of the actual continuity actor/target and z2-continuity resolution. adm-example is not an admitted repair actor.)*
+- ! Tasks  `54ad4864`
+  *(wait: Coverage refreshed: 0 resolved, 3 unknown, 1 not-applicable signing targets. Owner routing/declaration follow-up remains for ops-bridge-tunnel, codex-interhub-bootstrap and backup-daily.)*
+- ! Tasks  `93eaf1f2`
+  *(wait: Await classified continuity path (T01) and acceptance of security-layer-model v0.8 or successor; local authoritative v0.8 remains proposed.)*
+
 ### Layer model v0.7 conformance — state the deadline, bind the agent boundary, steward the estate's newest rule
 Progress: 5/6 done  |  workplan_id: `ae3ff76f-883d-5e2f-b6aa-144d61e8fdef`
 
 **Open tasks:**
 - ! Tasks  `7d1b3c82`
+  *(wait: Await ops-mason stance-map answer and railiance-infra KRL-versus-TTL answer. Flex-auth decision-lifetime answer already recorded.)*
 
 ### Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
 Progress: 2/3 done  |  workplan_id: `21528e8d-a049-523d-9ae1-da7a27cb8bbf`
 
 **Open tasks:**
-- ► Task: Graded lockdown / break-glass with explicit trust-root  `cae498ee`
+- ! Task: Graded lockdown / break-glass with explicit trust-root  `cae498ee`
+  *(wait: Await fresh platform-owned attended emergency seal/unseal scenario, current platform/infra/master receipts and new founder GO. Prior NO-GO consumed the August scenario.)*
 
 ### Repoint the whynot-design npm lane to Forgejo
 Progress: 2/3 done  |  workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e`
@@ -32,12 +45,6 @@ Progress: 2/3 done  |  workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8`
 - ! Resolve the credential proxy's admitted policy binding  `8ca28b63`
   *(wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)*
 
-## Inbox Hygiene
-
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 3 unread message(s) lack supersession chains.
-- ! flex-auth: Re: WARDEN-IN-0003 — the record id, and one finding: owner_repo is not only a coordinate  `025c6243`
-
 ---
 ## MCP Orientation (when available)