diff --git a/.custodian-brief.md b/.custodian-brief.md
index 4fc2416..b5b91e4 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — whitehat-security
 
 **Domain:** infotech  
-**Last synced:** 2026-10-04 00:41 UTC  
+**Last synced:** 2026-10-04 01:10 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,14 +12,18 @@ Progress: 0/1 done  |  workplan_id: `94b71ba3-998d-5166-9730-6beb5f595923`
 
 **Open tasks:**
 - ! T01 — Live ASM under a new engagement  `1faabcb7`
+  *(wait: A surface owner must name, for one Canon test_id, the component revision, identities, window, and technique. T-06 still needs approval-engine and a consuming PEP. secrets-engine 4b4d556 is not that surface. One owner return admits only that test_id, and only after a complete engagement and plane admission.)*
 
 ### Authorized live residuals after WHITEHAT-WP-0001
 Progress: 0/3 done  |  workplan_id: `fe26f070-70ca-55ba-92b3-3378929ba90f`
 
 **Open tasks:**
 - ! T01 — Live E3 against a runtime-safe surface  `ed82ecb5`
+  *(wait: rapp-postgres must name a database whose ordinary runtime identity can read the conformance view without BYPASSRLS, superuser, or owner privilege, and a complete engagement must name that database, window, rate ceiling, abort contact, and finding destination.)*
 - ! T02 — Live P1/P2 against a bounded substrate window  `f226b8e1`
+  *(wait: An operator must approve a substrate window naming the aggressor consumer, allowance, concurrency and resource ceilings, service classes, headroom threshold, and abort thresholds. No repository has published that window.)*
 - ! T03 — Remaining E2 under new engagement IDs  `414a7f68`
+  *(wait: access-engine must confirm a tenant-A identity with no tenant-B authority for the flex-auth target, or audit-core must approve a later run under a new engagement ID. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal.)*
 
 ## Inbox Hygiene