diff --git a/.custodian-brief.md b/.custodian-brief.md
index d84ed77..330eba3 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-11 19:07 UTC  
+**Last synced:** 2026-10-11 19:09 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -32,7 +32,7 @@ Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
 - ! Adopt policy-nexus (live, founder go-ahead)  `8638fa73`
   *(wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)*
 - ! Prepare the Application and the dry-run evidence  `2afb1aac`
-  *(wait: Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster.)*
+  *(wait: Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.)*
 
 ### ArgoCD phase B: adopt the four existing Applications on railiance01
 Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
@@ -41,7 +41,7 @@ Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 - ! Turn the root back to the production lane  `844ff115`
   *(wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)*
 - ! Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
-  *(wait: Operator read-only check of coulombcore ArgoCD; item on the attended-window checklist (D1 standing rule), not a decision.)*
+  *(wait: Founder runs read-only: ssh coulombcore 'sudo k3s kubectl get applications -n argocd' (agent identity has no kube rights on coulombcore).)*
 - · Adopt openbao-secretstore (lowest risk)  `6d5fc801`
 - · Adopt issue-core (from rapp-issue-core)  `0e619658`
 - · Adopt target-revenue  `d418068a`