diff --git a/.custodian-brief.md b/.custodian-brief.md
index 3e26d00..b480010 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-06 11:46 UTC  
+**Last synced:** 2026-10-06 12:27 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -16,15 +16,6 @@ Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
 - ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
   *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
 
-### Onboard rapp-policy-nexus to the ArgoCD production lane
-Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
-
-**Open tasks:**
-- ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
-  *(wait: Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07.)*
-- ! Prepare the Application and the dry-run evidence  `2afb1aac`
-  *(wait: Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster.)*
-
 ### ArgoCD phase B: adopt the four existing Applications on railiance01
 Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 
@@ -42,6 +33,13 @@ Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 - ! Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
   *(wait: Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope.)*
 
+### Close Forgejo primary backup coverage on Scaleway
+Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
+
+**Open tasks:**
+- ! Establish primary full-archive delivery and application recovery  `a4807df0`
+  *(wait: Operator chooses the independent archive prefix and confirms retention/caller contract and bounded worker credential delivery before the primary archive retrieval.)*
+
 ### Coordinate KeyCape live Secret exposure recovery
 Progress: 4/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
 
@@ -92,12 +90,14 @@ Progress: 3/9 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
   *(wait: Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens.)*
 - ! Founder approval of the CCR-2026-0033 custody child  `7c753be6`
 
-### Close Forgejo primary backup coverage on Scaleway
-Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
+### Onboard rapp-policy-nexus to the ArgoCD production lane
+Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
 
 **Open tasks:**
-- ! Establish primary full-archive delivery and application recovery  `a4807df0`
-  *(wait: Operator chooses the independent archive prefix and confirms retention/caller contract and bounded worker credential delivery before the primary archive retrieval.)*
+- ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
+  *(wait: Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07.)*
+- ! Prepare the Application and the dry-run evidence  `2afb1aac`
+  *(wait: Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster.)*
 
 ### Coordinate KeyCape live Secret exposure recovery
 Progress: 4/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`