diff --git a/.custodian-brief.md b/.custodian-brief.md
index 76834a4..2b93fdd 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-09-28 21:40 UTC  
+**Last synced:** 2026-09-28 22:31 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -31,6 +31,12 @@ Progress: 2/3 done  |  workplan_id: `21528e8d-a049-523d-9ae1-da7a27cb8bbf`
 - ! Task: Graded lockdown / break-glass with explicit trust-root  `cae498ee`
   *(wait: Trust-root design is a founder decision: who holds unseal shares and recovery keys, quorum, break-glass invocation; executable seal steps are attended.)*
 
+### Repoint the whynot-design npm lane to Forgejo
+Progress: 2/3 done  |  workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e`
+
+**Open tasks:**
+- ! Prove routing and publication  `a8b1b855`
+
 ### Preserve explicit policy caller refusals before credential and CA effects
 Progress: 2/3 done  |  workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8`
 
@@ -38,12 +44,6 @@ Progress: 2/3 done  |  workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8`
 - ! Resolve the credential proxy's admitted policy binding  `8ca28b63`
   *(wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)*
 
-### Repoint the whynot-design npm lane to Forgejo
-Progress: 2/3 done  |  workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e`
-
-**Open tasks:**
-- ! Prove routing and publication  `a8b1b855`
-
 ---
 ## MCP Orientation (when available)