diff --git a/.custodian-brief.md b/.custodian-brief.md
index bfc4336..a04a79a 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,16 +2,51 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-09-28 21:19 UTC  
+**Last synced:** 2026-09-28 21:47 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### User account journeys and recovery
+Progress: 1/3 done  |  workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b`
+
+**Open tasks:**
+- ! Connect authoritative application access  `5d1bf977`
+  *(wait: Blocked on the provider-owned catalogue/admission and scoped grant/revocation contract from USER-WP-0026-T03.)*
+- ! Complete optional OTP onboarding with provider evidence  `40e46e52`
+  *(wait: U05-U08 depend on KEY-WP-0035 and NK-WP-0033 credential custody before live handoff.)*
+
+### Clear account state and complete user, tenant-admin and platform-admin journeys
+Progress: 4/6 done  |  workplan_id: `455300ca-ec1e-569e-a584-a8dcda2595cf`
+
+**Open tasks:**
+- ! Complete provider OTP activation and recovery path  `9657abcb`
+  *(wait: KEY-WP-0035-T02/T03 and the NK-WP-0033 custody handoff; net-kingdom-privacyidea-admin-token route still non-resolvable.)*
+- ! Validate all journeys across roles and applications  `550886ca`
+  *(wait: Full journey matrix needs authoritative application access (USER-WP-0026-T03), factor recovery (T04) and preserves VERGABE-WP-0019 real-user acceptance.)*
+
+### Account recovery and visible identity and access
+Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`
+
+**Open tasks:**
+- ! Discover workload access from authoritative application records  `95e9a6d4`
+  *(wait: Needs a provider-owned workload catalogue and application access decisions for the signed-in identity; the membership store cannot represent the allow list.)*
+
 ### Onboarding handoff findings from the 2026-09-23 operator run
 Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`
 
 **Open tasks:**
 - ! Deliver the setup link to the recipient  `fae614ba`
+  *(wait: Needs the operator-owned governed transactional mail lane (email-connect plus the OpenBao delivery token).)*
+
+### Read-only account authority for Hub integration
+Progress: 1/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
+
+**Open tasks:**
+- ! Root entitlement and mapping disposition  `23a5c211`
+  *(wait: Specify with NetKingdom the root-grant custody/revocation and platform:root to tenant:platform mapping.)*
+- ! Authenticated workload transport and private acceptance  `c5d67725`
+  *(wait: Real caller credentials are admitted through their owner after the T02 contract.)*
 
 ### Follow the flex-auth to access-engine repository rename (FLEX-WP-0020 handoff)
 Progress: 1/2 done  |  workplan_id: `0b948be1-ad75-5548-b4eb-aabc8e3ae6cc`
@@ -20,33 +55,6 @@ Progress: 1/2 done  |  workplan_id: `0b948be1-ad75-5548-b4eb-aabc8e3ae6cc`
 - ! Re-point the absolute source path after the rename lands  `e945b036`
   *(wait: FLEX-WP-0020 §8: the canonical access-engine clone must be registered before the blueprint pointer changes.)*
 
-### User account journeys and recovery
-Progress: 1/3 done  |  workplan_id: `145df9d5-a7e9-5d20-8280-9d3ea069838b`
-
-**Open tasks:**
-- ! Connect authoritative application access  `5d1bf977`
-- ! Complete optional OTP onboarding with provider evidence  `40e46e52`
-
-### Clear account state and complete user, tenant-admin and platform-admin journeys
-Progress: 4/6 done  |  workplan_id: `455300ca-ec1e-569e-a584-a8dcda2595cf`
-
-**Open tasks:**
-- ! Complete provider OTP activation and recovery path  `9657abcb`
-- ! Validate all journeys across roles and applications  `550886ca`
-
-### Account recovery and visible identity and access
-Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`
-
-**Open tasks:**
-- ! Discover workload access from authoritative application records  `95e9a6d4`
-
-### Read-only account authority for Hub integration
-Progress: 1/3 done  |  workplan_id: `54d99faf-4c53-5927-a82c-feca41de2cf3`
-
-**Open tasks:**
-- ! Root entitlement and mapping disposition  `23a5c211`
-- ! Authenticated workload transport and private acceptance  `c5d67725`
-
 ---
 ## MCP Orientation (when available)