diff --git a/.custodian-brief.md b/.custodian-brief.md
index ef62de3..e401b22 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,27 +2,24 @@
 # Custodian Brief — sand-boxer
 
 **Domain:** infotech  
-**Last synced:** 2026-09-27 21:22 UTC  
+**Last synced:** 2026-09-28 21:35 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Owner-mediated governed bwrap execution
-Progress: 4/5 done  |  workplan_id: `b616d1cd-208f-5ecf-a4a0-a028396422c4`
-
-**Open tasks:**
-- ! Prove one governed rein and coordinate consumers  `c6812fd4`
-
 ### Provide a pinned bwrap rein runtime and private state
 Progress: 5/6 done  |  workplan_id: `d3f12387-fd23-58f0-b979-9c811507614d`
 
 **Open tasks:**
 - ! Resolve Claude credentials, enforced egress, and production acceptance  `58817ef6`
+  *(wait: Credential owner railiance-platform/OpenBao with rein-aharness must establish a Claude-compatible route and delivery/revocation contract.)*
 
-## Inbox Hygiene
+### Owner-mediated governed bwrap execution
+Progress: 4/5 done  |  workplan_id: `b616d1cd-208f-5ecf-a4a0-a028396422c4`
 
-**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 1 unread message(s) lack supersession chains.
+**Open tasks:**
+- ! Prove one governed rein and coordinate consumers  `c6812fd4`
+  *(wait: Needs a concrete Claude-compatible credential route (SAND-WP-0015-T04) before one real rein command can run through the owner API.)*
 
 ---
 ## MCP Orientation (when available)