diff --git a/.custodian-brief.md b/.custodian-brief.md
index 2557f55..b48937f 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,19 +2,11 @@
 # Custodian Brief — whitehat-security
 
 **Domain:** infotech  
-**Last synced:** 2026-10-04 09:15 UTC  
+**Last synced:** 2026-10-04 09:18 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Classify I and A, calibrate V observations, and name the live E4, R4, and V requirements
-Progress: 2/5 done  |  workplan_id: `b37d8173-48da-5981-8d5c-63dc27e0223d`
-
-**Open tasks:**
-- ! T03 — Live E4 demonstration  `b8f4e3c4`
-- ! T04 — Live R4 exercise  `acc22db7`
-- ! T05 — Live V2, V3, or V4 exercise  `3893b7b1`
-
 ### Authorized live ASM residuals after WHITEHAT-WP-0007
 Progress: 0/1 done  |  workplan_id: `94b71ba3-998d-5166-9730-6beb5f595923`
 
@@ -33,6 +25,17 @@ Progress: 0/3 done  |  workplan_id: `fe26f070-70ca-55ba-92b3-3378929ba90f`
 - ! T03 — Remaining E2 under new engagement IDs  `414a7f68`
   *(wait: access-engine must confirm a tenant-A identity with no tenant-B authority for the flex-auth target, or audit-core must approve a later run under a new engagement ID. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal.)*
 
+### Classify I and A, calibrate V observations, and name the live E4, R4, and V requirements
+Progress: 2/5 done  |  workplan_id: `b37d8173-48da-5981-8d5c-63dc27e0223d`
+
+**Open tasks:**
+- ! T03 — Live E4 demonstration  `b8f4e3c4`
+  *(wait: No scanned service declares current E: 4, and apps-pg is recorded as E4 unreachable. An owner must name a service that has a per-tenant credential and a separate per-tenant substrate, the credential class (never the value), the other tenant's substrate, the window, the abort contact, and a complete engagement. Tenancy Posture §13 classifies that demonstration as Mechanical. This task authorizes no connection attempt.)*
+- ! T04 — Live R4 exercise  `acc22db7`
+  *(wait: R4 evidence is Adversarial. An owner must name the route (horizon-elapsed or key-destroyed), a complete copy inventory covering live data, backups, and derived copies, the erasure horizon, the window, the abort contact, and a complete engagement. audit-core targets R2 and is not this owner. This task authorizes no store access.)*
+- ! T05 — Live V2, V3, or V4 exercise  `3893b7b1`
+  *(wait: V2, V3, and V4 are Adversarial and failure-injected. An operator must name the delivering service, the operation the claim covers, the failure domain, the RTO and RPO, the window, the abort contact, and give the separate approval the rules of engagement §1 require for a recovery probe. V1 stays a mechanical exercise in the declaring service. This task authorizes no failure injection.)*
+
 ## Inbox Hygiene
 
 **Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.