diff --git a/.custodian-brief.md b/.custodian-brief.md
index 5699e22..22b13e3 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-08-22 10:42 UTC  
+**Last synced:** 2026-08-22 10:39 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -11,7 +11,7 @@
 Progress: 0/4 done  |  workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
 
 **Open tasks:**
-- ! T01 — Define the Whitehat E2 temporary sender lane  `c4da371a`
+- · T01 — Define the Whitehat E2 temporary sender lane  `c4da371a`
 - · T02 — Define the runtime database lease recovery exercise  `caba7fcd`
 - · T03 — Define the coordinated railiance01 reboot exercise  `09cf4065`
 - · T04 — Route the contracts and approval gates  `22f5011f`
diff --git a/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
index 9a52991..2064a0f 100644
--- a/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
+++ b/workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Coordinate audit-core temporary custody and recovery exercises"
 domain: financials
 repo: railiance-platform
-status: active
+status: ready
 owner: codex
 topic_slug: railiance
 created: "2026-08-22"
@@ -33,12 +33,10 @@ lease revocation, firewall change, or host reboot.
   response bodies in Git, State Hub, command output, evidence, or chat.
 - Use exact paths and non-secret handles only. Temporary files, if later
   approved, must be outside Git, mode `0600`, and securely removed.
-- A sender token stored in the audit-core registry has no intrinsic OpenBao
-  lease. Audit-core deployed boundary enforcement for timezone-aware
-  `expires_at` at commit `abd22fa` / image digest
-  `sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6`.
-  Reverify that exact prerequisite before projection; projection-credential
-  expiry alone is still not sufficient.
+- A sender token stored in the current audit-core registry has no intrinsic
+  OpenBao lease. Expiring its projection credential does not expire the copy
+  accepted by audit-core. E2 live execution therefore remains blocked until
+  audit-core enforces an `expires_at` value for each temporary identity.
 - All live exercises require a separate engagement acknowledgement, attended
   operators, a named window, and explicit abort authority.
 
@@ -46,7 +44,7 @@ lease revocation, firewall change, or host reboot.
 
 ```task
 id: RAILIANCE-WP-0024-T01
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "c4da371a-f35d-5377-9f6a-d34e274c98d0"
 ```
@@ -65,13 +63,6 @@ and value-safe positive/negative evidence.
 Done when audit-core and the engagement owner can review a complete path whose
 failure mode is expiry or denial, not a long-lived accepted bearer.
 
-**Window update (2026-08-22):** engagement `WH-ENG-20260822-AUDIT-E2-01` is
-operator-approved and target-owner-acknowledged for 18:00Z–18:15Z. The task is
-waiting for that attended window. Do not mint before approximately 17:59Z;
-both identities must expire no later than 18:15Z and cleanup/reload must be
-attended. No unattended scheduler or background credential job is authorized
-by this record.
-
 ## T02 — Define the runtime database lease recovery exercise
 
 ```task