diff --git a/.custodian-brief.md b/.custodian-brief.md
index d466205..f6a724b 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — user-engine
 
 **Domain:** communication  
-**Last synced:** 2026-10-11 21:02 UTC  
+**Last synced:** 2026-10-11 21:14 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -30,7 +30,7 @@ Progress: 2/3 done  |  workplan_id: `0aea0a52-13f9-515b-bda8-665f8a4f2d5e`
 
 **Open tasks:**
 - ! Discover workload access from authoritative application records  `95e9a6d4`
-  *(wait: Actual one-app catalogue/readback is verified. Initial discovery acceptance needs real signed-in account projection, not a generic Access grant API. Separate ordinary catalogue-management restoration remains on this task before customers, supported by bounded Access policy/claims proposal FLEX-IN-0003; do not reopen finished FLEX-WP-0035.)*
+  *(wait: Signed-in readback live and correct for the deny path (tegwick: Informed Decision - Not available, founder-confirmed correct; docs/evidence/2026-10-11-signed-in-application-readback.md). Remaining: attended positive check with a net-kingdom-admins account (expect Available), then catalogue-management restoration before customers (FLEX-IN-0003).)*
 
 ### Onboarding handoff findings from the 2026-09-23 operator run
 Progress: 1/2 done  |  workplan_id: `35aa6adf-255a-5705-9294-a50d98e45f00`