diff --git a/.custodian-brief.md b/.custodian-brief.md
index 6929b05..4d6bd6f 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,25 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-14 21:52 UTC  
+**Last synced:** 2026-10-18 10:41 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Implement Platform bindings for the browser SecurityCase successor
+Progress: 1/4 done  |  workplan_id: `43110f82-ef9f-5a46-a305-f0e287b7b226`
+
+**Open tasks:**
+- ► T01 — Bind the broker to reviewed acknowledged type sources  `afec2053`
+- · T03 — Implement mint, guarded destruction and authenticated evidence  `b5d73ec6`
+- · T04 — Implement and admit the delivery lane and capability  `84f8b0a4`
+
+### Prepare the exact seven private-source reader for reuse-surface
+Progress: 4/5 done  |  workplan_id: `b55a8aec-7457-563b-990b-4a55ca04d2f6`
+
+**Open tasks:**
+- ! Rotate or revoke dedicated seven-source reader within 90 days  `f0780e75`
+
 ### Coordinate audit-core temporary custody and recovery exercises
 Progress: 3/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
 
@@ -14,12 +28,25 @@ Progress: 3/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
 - ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
   *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
 
-### Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI
-Progress: 2/4 done  |  workplan_id: `04f7c4aa-0a24-5d61-994d-2487ca6bfb91`
+### Self-service CCR intake: clients file and progress CCRs without a platform worker
+Progress: 2/5 done  |  workplan_id: `bad0cc9b-e8ad-572b-8d0d-fb3adb208b4a`
 
 **Open tasks:**
-- ! Apply CCR-2026-0045  `d3236de5`
-- ! Deploy the overlay  `94cdfd1c`
+- ► T03 — CI gate on `ccr/*` branches  `0fd97924`
+- ► T04 — Hub decision on submit and client-run `sync-decision`  `15ac9eae`
+- · T05 — Client documentation and first self-service CCR  `27797fa5`
+
+### Admit hourly receiver cadence and exact Qonto collector custody
+Progress: 3/4 done  |  workplan_id: `d57eeafb-c406-5e1e-841c-5d1288aacabf`
+
+**Open tasks:**
+- ► Collect actual producer and independent observer acceptance  `7d8e5315`
+
+### Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI
+Progress: 3/4 done  |  workplan_id: `04f7c4aa-0a24-5d61-994d-2487ca6bfb91`
+
+**Open tasks:**
+- ► Deploy the overlay  `94cdfd1c`
 
 ### Coordinate KeyCape live Secret exposure recovery
 Progress: 4/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
@@ -120,6 +147,11 @@ Progress: 2/3 done  |  workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
 **Open tasks:**
 - ! T03 — Complete the attended operator cutover  `99f8b41f`
 
+## Inbox Hygiene
+
+**Stale unread:** 14 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 15 unread message(s) lack supersession chains.
+
 ---
 ## MCP Orientation (when available)
 
diff --git a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml
index e25a49f..0b5cf21 100644
--- a/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml
+++ b/credential-change-requests/CCR-2026-0051-mas-tem-relay-smtp.yaml
@@ -3,7 +3,7 @@ kind: credential-change-request
 schema_version: 1
 request_type: workload-kv-read
 title: Temporary MAS Scaleway TEM relay SMTP ESO read lane
-status: proposed
+status: approved
 created: '2026-10-18'
 updated: '2026-10-18'
 requester:
@@ -24,6 +24,12 @@ review:
     comment: 'Standard lane: passes ccr-standard-lane v1 sha256:5481be201456739b9e01b14b0b11211923d7d838a2e71e2e417af038a05aec95.
       Platform-owner source review only; founder approval and confirm-binding still
       required.'
+  - at: '2026-10-18T10:42:00+00:00'
+    reviewer: founder (Bernd Worsch)
+    decision: approved
+    comment: 'Approved 2026-10-18 for ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014):
+      build policy workload-kv-read-mas-tem-relay and kubernetes role external-secrets-mas-tem-relay
+      under ops-mason-construct. Temporary; teardown with namespace mas.'
 target:
   domain: infotech
   tenant: platform