diff --git a/.custodian-brief.md b/.custodian-brief.md
index 9852ca0..b0181ce 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-11 18:05 UTC  
+**Last synced:** 2026-10-11 18:33 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -29,18 +29,14 @@ Progress: 3/5 done  |  workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
 Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 
 **Open tasks:**
-- ! Adopt openbao-secretstore (lowest risk)  `6d5fc801`
-  *(wait: Adopted 2026-09-21; the follow-on step (issue-core adoption, then automation) waits on the founder's go-ahead.)*
-- ! Adopt issue-core (from rapp-issue-core)  `0e619658`
-  *(wait: Founder go-ahead plus rapp-issue-core's agreement (hub message) that ArgoCD owns production and make deploy stops being a production path.)*
-- ! Adopt target-revenue  `d418068a`
-  *(wait: Adopted 2026-09-21; remaining preconditions and the next step wait on the founder's go-ahead.)*
-- ! Adopt external-secrets (highest risk)  `4ca54868`
-  *(wait: Founder go-ahead for the ESO adoption after adding CRD Prune=false,Delete=false and re-running the diff.)*
 - ! Turn the root back to the production lane  `844ff115`
   *(wait: Founder go-ahead to restore automated prune/selfHeal on railiance-apps-root once T03-T06 are proven.)*
 - ! Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
   *(wait: Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope.)*
+- · Adopt openbao-secretstore (lowest risk)  `6d5fc801`
+- · Adopt issue-core (from rapp-issue-core)  `0e619658`
+- · Adopt target-revenue  `d418068a`
+- · Adopt external-secrets (highest risk)  `4ca54868`
 
 ### Close Forgejo primary backup coverage on Scaleway
 Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
@@ -53,19 +49,17 @@ Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
 Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
 
 **Open tasks:**
-- ! Make backup freshness and recurring recovery evidence checkable  `d64446fb`
-  *(wait: activity-core replied (not accepted yet): role acceptance is the founder decision ACTIVITY-WP-0042-T01 (D2); then ACTIVITY-WP-0042 bounded operation, S3 OpenBao credential route, repaired openbao-activity-core store and per-run approval-engine approval.)*
 - ! Produce S3 signals and prove their delivery to the evidence owner  `5351e0e4`
   *(wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)*
 - ! Obtain acceptance for compatibility assets and derived-record cleanup  `3b74f79c`
   *(wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)*
+- · Make backup freshness and recurring recovery evidence checkable  `d64446fb`
 
 ### Adopt activity-core application runtime into railiance01 GitOps
 Progress: 2/3 done  |  workplan_id: `b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54`
 
 **Open tasks:**
-- ! Observe adoption and enforce bounded promotion readiness  `63b44949`
-  *(wait: 24h soak after adoption, then founder confirmation of the scoped identity and checks before automated sync; ACTIVITY-WP-0041 owns publication and the promotion guard.)*
+- · Observe adoption and enforce bounded promotion readiness  `63b44949`
 
 ### Coordinate audit-core temporary custody and recovery exercises
 Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
@@ -77,15 +71,13 @@ Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
   *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
 
 ### Implement reviewed credential lanes with separate owner gates
-Progress: 6/13 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
+Progress: 7/13 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
 
 **Open tasks:**
 - ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
   *(wait: Source ready (CCR-2026-0038, service-jwt-login applier type). Waits on founder approval + binding confirmation + delegated apply (one command, see 2026-10-09 note), then the login proof via a real KeyCape service JWT (SECRETS-WP-0012-T03 probe-openbao).)*
 - ! Implement the platform operator-write CCR contract and Fluid lane  `f47e5bc5`
   *(wait: MASON-WP-0005-T02 source contract is done (ops-mason message 79570eb8). The attended policy/schema apply remains with the open provisioning decision.)*
-- ! Admit the separate approval client-side readers  `68bff751`
-  *(wait: INFD-WP-0001-T07/T08 terminal; remaining gate is human approval of the scoped delivery proof; front door stays non-resolvable.)*
 - ! Dispose of the ungoverned whynot-design npm duplicate  `0dd7c9a5`
   *(wait: Founder HOLD (2026-09-21) on the legacy whynot-design npm pointer; custody disposition is an attended decision.)*
 - ! Admit the two factory audit-sender custody lanes  `0ef52c26`