diff --git a/.custodian-brief.md b/.custodian-brief.md
index d915a13..454c169 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-10-03 17:56 UTC  
+**Last synced:** 2026-10-03 18:39 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -40,11 +40,9 @@ Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`
   *(wait: Needs the operator-owned governed transactional mail lane (email-connect plus the OpenBao delivery token).)*
 
 ### Read-only account authority for Hub integration
-Progress: 1/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
+Progress: 2/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
 
 **Open tasks:**
-- ! Root entitlement and mapping disposition  `23a5c211`
-  *(wait: Consumer transport, durable baseline, pinned canon and optional mapping implemented (0d0751d); awaits NK-WP-0045-T05 reviewed publisher provenance/admission plus owner image promotion, receipt-bound baseline initialization and live integration evidence. Approved empty no-grant source is acceptable.)*
 - ! Authenticated workload transport and private acceptance  `c5d67725`
   *(wait: Real Hub workload credential admission requested from state-hub (message f3bcc516, unanswered); private acceptance also needs the T02 contract.)*