diff --git a/.custodian-brief.md b/.custodian-brief.md
index 1fc4943..f36b9a9 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — prj-forgejo-org-refactor
 
 **Domain:** infotech  
-**Last synced:** 2026-10-08 22:38 UTC  
+**Last synced:** 2026-10-08 22:46 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -11,23 +11,33 @@
 Progress: 0/5 done  |  workplan_id: `c1dcd349-1a7a-51ae-8827-4ce96cfe0008`
 
 **Open tasks:**
-- ! Tasks  `4964bf8f`
-- ! Tasks  `00d150ed`
-  *(wait: Taxonomy draws on the G1 inventory (T01).)*
-- ! Tasks  `4b57ef3f`
-- ! Tasks  `a55d95e2`
-- ! Tasks  `3ad6090f`
+- ! T01 — Build the repeatable reference inventory  `4964bf8f`
+  *(wait: The September 28 collector is not G1 acceptance. Authenticated metadata still waits on decision 5f3680fc, and an unchanged-fleet pair is still missing.)*
+- ! T02 — Agree stewardship criteria and taxonomy  `00d150ed`
+  *(wait: The taxonomy draft waits on the G1 inventory (T01) and on stewardship review 60c5767c. The September 28 matrix is not acceptance.)*
+- ! T03 — Verify Git and package transfer behavior  `4b57ef3f`
+  *(wait: The August 11 production deferral remains in force. Throwaway forge behavior does not start while G1 and G2 are unaccepted and the rollback-gate decision is open.)*
+- ! T04 — Prove transfer rollback  `a55d95e2`
+  *(wait: Rollback proof cannot bootstrap its own prerequisite. Decision e9aca79b is still open, and the August 11 production deferral remains in force.)*
+- ! T05 — Write the staged cutover plan  `3ad6090f`
+  *(wait: The cutover plan is written from T01–T04 evidence. Those tasks are still open.)*
 
 ### Close the forge: NetKingdom access control first, then private by default
 Progress: 3/9 done  |  workplan_id: `f873c10f-1408-5bf2-a834-fed88387804b`
 
 **Open tasks:**
-- ! T03 — Review what has already been public  `112617e1`
-- ! T04 — NetKingdom: Forgejo as an OIDC client (child workplan in key-cape)  `6c635b25`
-- ! T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-forge)  `1285f94d`
-- ! T06 — Give every consumer its own read identity  `0dcf25e2`
-- ! T07 — Rehearse the flip and the rollback  `42724077`
-- ! T08 — Close the forge in waves  `82f53328`
+- ! T04 — NetKingdom: Forgejo as an OIDC client (child workplan in key-cape)  `112617e1`
+  *(wait: KEY-WP-0038-T03 must deliver claims evidence; registration T02 waits on NK-WP-0048-T06 (KnownSecurityCase), not an ad-hoc helper.)*
+- ! T05 — Forgejo: NetKingdom login and team mapping (child workplan in railiance-apps)  `6c635b25`
+  *(wait: RAPPS-WP-0016-T03 must prove account linking and team grants after KEY-WP-0038 delivers the client and claims.)*
+- ! T06 — Give every consumer its own read identity  `1285f94d`
+  *(wait: T05 identity/team proof and owner private-canary receipts remain missing. The local collector token option and FT-WP-0001-T14 upload delivery are implemented; authorized private forge access is not yet proven for every consumer.)*
+- ! T07 — Rehearse the flip and the rollback  `0dcf25e2`
+  *(wait: Rehearsal needs every consumer class migrated onto the canary.)*
+- ! T08 — Close the forge in waves  `42724077`
+  *(wait: Each production visibility wave needs founder approval after a green rehearsal.)*
+- ! T09 — Verify, hand back and record  `82f53328`
+  *(wait: Verification and handback follow the final wave.)*
 
 ## Inbox Hygiene