diff --git a/.custodian-brief.md b/.custodian-brief.md
index c72a5d1..366baf2 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,20 +2,11 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-09-23 17:53 UTC  
+**Last synced:** 2026-09-23 18:18 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Keep the dynamic-database ESO parent tokens alive: periodic tokens and a renewer
-Progress: 2/6 done  |  workplan_id: `cdb309e0-adb4-58aa-9c98-5ea270780e8d`
-
-**Open tasks:**
-- ! T03 Re-mint the five tokens as periodic (live, founder)  `211bc548`
-- ! T04 Adopt the renewer through ArgoCD (live, founder)  `28726b1b`
-- ! T05 Move consumers off leases from the old tokens before 2026-10-25  `acf49bee`
-- · T06 Hand-offs and assurance  `2f528e56`
-
 ### Close Forgejo primary backup coverage on Scaleway
 Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
 
@@ -30,6 +21,15 @@ Progress: 2/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
 - ! Prepare the Application and the dry-run evidence  `2afb1aac`
 - ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
 
+### Keep the dynamic-database ESO parent tokens alive: periodic tokens and a renewer
+Progress: 2/6 done  |  workplan_id: `cdb309e0-adb4-58aa-9c98-5ea270780e8d`
+
+**Open tasks:**
+- ! T03 Re-mint the five tokens as periodic (live, founder)  `211bc548`
+- ! T04 Adopt the renewer through ArgoCD (live, founder)  `28726b1b`
+- ! T05 Move consumers off leases from the old tokens before 2026-10-25  `acf49bee`
+- · T06 Hand-offs and assurance  `2f528e56`
+
 ### ArgoCD phase B: adopt the four existing Applications on railiance01
 Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 
@@ -41,11 +41,12 @@ Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 - ► Adopt target-revenue  `d418068a`
 - · Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
 
-### Move openbao-activity-core and openbao-email-connect off expired static tokens to Kubernetes auth
-Progress: 5/6 done  |  workplan_id: `0edc6426-9cc8-5bbe-88ea-c27d9862d96e`
+### Coordinate audit-core temporary custody and recovery exercises
+Progress: 2/4 done  |  workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
 
 **Open tasks:**
-- ! T06 Retire the two static-token Secrets  `f56d7096`
+- ► T02 — Define the runtime database lease recovery exercise  `caba7fcd`
+- ► T03 — Define the coordinated railiance01 reboot exercise  `09cf4065`
 
 ### Coordinate KeyCape live Secret exposure recovery
 Progress: 2/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
@@ -56,13 +57,6 @@ Progress: 2/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
 - ► T03 — Collect exact owner acknowledgements  `e019c166`
 - ► T06 — Publish the Railiance/OpenBao custody handoff  `69326850`
 
-### Coordinate audit-core temporary custody and recovery exercises
-Progress: 2/4 done  |  workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
-
-**Open tasks:**
-- ► T02 — Define the runtime database lease recovery exercise  `caba7fcd`
-- ► T03 — Define the coordinated railiance01 reboot exercise  `09cf4065`
-
 ### Close S3 service assurance and ownership gaps
 Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`