diff --git a/.custodian-brief.md b/.custodian-brief.md
index 5d843c2..64536ab 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,26 +2,16 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-08-26 17:45 UTC  
+**Last synced:** 2026-09-08 12:53 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Coordinate KeyCape live Secret exposure recovery
-Progress: 2/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
+### Close Forgejo primary backup coverage on Scaleway
+Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
 
 **Open tasks:**
-- ! T04 — Execute the attended rotation  `28b31e57`
-- ! T05 — Prove predecessor denial and close  `9cb5fa67`
-- ► T03 — Collect exact owner acknowledgements  `714ae011`
-- ► T06 — Publish the Railiance/OpenBao custody handoff  `3b9748c4`
-
-### Coordinate audit-core temporary custody and recovery exercises
-Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
-
-**Open tasks:**
-- ► T02 — Define the runtime database lease recovery exercise  `fda4262a`
-- ► T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
+- ► Establish primary full-archive delivery and application recovery  `a4807df0`
 
 ### Coordinate audit-core temporary custody and recovery exercises
 Progress: 2/4 done  |  workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
@@ -39,18 +29,59 @@ Progress: 2/6 done  |  workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
 - ► T03 — Collect exact owner acknowledgements  `e019c166`
 - ► T06 — Publish the Railiance/OpenBao custody handoff  `69326850`
 
+### Coordinate KeyCape live Secret exposure recovery
+Progress: 3/6 done  |  workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
+
+**Open tasks:**
+- ! T03 — Collect exact owner acknowledgements  `714ae011`
+- ! T05 — Prove predecessor denial and close  `9cb5fa67`
+- ! T06 — Publish the Railiance/OpenBao custody handoff  `3b9748c4`
+
+### Close S3 service assurance and ownership gaps
+Progress: 4/7 done  |  workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
+
+**Open tasks:**
+- ! Produce S3 signals and prove their delivery to the evidence owner  `5351e0e4`
+- ! Obtain acceptance for compatibility assets and derived-record cleanup  `3b74f79c`
+- ! Make backup freshness and recurring recovery evidence checkable  `d64446fb`
+
 ### Retract public OpenBao listener behind operator-only access
 Progress: 2/3 done  |  workplan_id: `6dda6039-295e-5cac-aef6-3183c3218649`
 
 **Open tasks:**
 - ! T03 — Complete the attended operator cutover  `8850d742`
 
+### Coordinate audit-core temporary custody and recovery exercises
+Progress: 2/4 done  |  workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
+
+**Open tasks:**
+- ! T02 — Define the runtime database lease recovery exercise  `fda4262a`
+- ! T03 — Define the coordinated railiance01 reboot exercise  `ba729d18`
+
+### Remove backup credential default and verify governed replacement
+Progress: 2/3 done  |  workplan_id: `bb326ebb-a313-549e-b35f-1bf17e1c58fd`
+
+**Open tasks:**
+- ! Invalidate predecessor and prove replacement recovery  `b3f3402f`
+
+### Implement reviewed credential lanes with separate owner gates
+Progress: 2/5 done  |  workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
+
+**Open tasks:**
+- ! Accept and provision secrets-engine service JWT login  `e0c82ea9`
+- ! Implement the platform operator-write CCR contract and Fluid lane  `f47e5bc5`
+- ! Admit KeyCape approval-engine client custody and delivery  `e15d62c9`
+
 ### Retract public OpenBao listener behind operator-only access
 Progress: 2/3 done  |  workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
 
 **Open tasks:**
 - ! T03 — Complete the attended operator cutover  `99f8b41f`
 
+## Inbox Hygiene
+
+**Missing thread_id:** 1 unread message(s) lack supersession chains.
+
 ---
 ## MCP Orientation (when available)