diff --git a/.custodian-brief.md b/.custodian-brief.md
index 9733d39..53572a7 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-11 18:36 UTC  
+**Last synced:** 2026-10-11 19:06 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -30,7 +30,7 @@ Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
 
 **Open tasks:**
 - ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
-  *(wait: Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07.)*
+  *(wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)*
 - ! Prepare the Application and the dry-run evidence  `2afb1aac`
   *(wait: Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster.)*
 
@@ -39,9 +39,9 @@ Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 
 **Open tasks:**
 - ! Turn the root back to the production lane  `844ff115`
-  *(wait: Founder go-ahead to restore automated prune/selfHeal on railiance-apps-root once T03-T06 are proven.)*
+  *(wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)*
 - ! Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
-  *(wait: Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope.)*
+  *(wait: Operator read-only check of coulombcore ArgoCD; item on the attended-window checklist (D1 standing rule), not a decision.)*
 - · Adopt openbao-secretstore (lowest risk)  `6d5fc801`
 - · Adopt issue-core (from rapp-issue-core)  `0e619658`
 - · Adopt target-revenue  `d418068a`
@@ -75,13 +75,13 @@ Progress: 7/13 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
 
 **Open tasks:**
 - ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
-  *(wait: Source ready (CCR-2026-0038, service-jwt-login applier type). Waits on founder approval + binding confirmation + delegated apply (one command, see 2026-10-09 note), then the login proof via a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao).)*
+  *(wait: Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.)*
 - ! Implement the platform operator-write CCR contract and Fluid lane  `f47e5bc5`
-  *(wait: MASON-WP-0005-T02 source contract is done (ops-mason message 79570eb8). The attended policy/schema apply remains with the open provisioning decision.)*
+  *(wait: Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.)*
 - ! Dispose of the ungoverned whynot-design npm duplicate  `0dd7c9a5`
-  *(wait: Founder HOLD (2026-09-21) on the legacy whynot-design npm pointer; custody disposition is an attended decision.)*
+  *(wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)*
 - ! Admit the two factory audit-sender custody lanes  `0ef52c26`
-  *(wait: Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens.)*
+  *(wait: Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.)*
 - ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018)  `af2d4dba`
 - ► Implement and prove the separately approved task execution entitlement  `914bf383`