diff --git a/.custodian-brief.md b/.custodian-brief.md
index 7c26345..94b37c9 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-10-10 18:13 UTC  
+**Last synced:** 2026-10-11 12:06 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -77,7 +77,7 @@ Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
   *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
 
 ### Implement reviewed credential lanes with separate owner gates
-Progress: 3/10 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
+Progress: 4/12 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
 
 **Open tasks:**
 - ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
@@ -93,6 +93,7 @@ Progress: 3/10 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
 - ! Founder approval of the CCR-2026-0033 custody child  `7c753be6`
   *(wait: Waits for founder approvals: A1 ops-mason design (keycape-secrets-engine-openbao-client-custody, MASON-WP-0009); A2 revised CCR-2026-0033 plus sibling operator reader CCR-2026-0034 (platform-owner, key-cape-owner, net-kingdom-owner reviews; bound claims confirmed for both readers incl. groups=net-kingdom-admins and /assurance/level=aal2); A3 the exact custody-child decision id recorded in the CCR-2026-0033 review (not boundary decision 632a8893). secrets-engine D1-D4 are superseded (no consumer copy).)*
 - ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018)  `af2d4dba`
+- … and 1 more open tasks
 
 ### Coordinate KeyCape live Secret exposure recovery
 Progress: 4/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`