diff --git a/intakes/intakes.md b/intakes/intakes.md
index 6252ede..c9d2320 100644
--- a/intakes/intakes.md
+++ b/intakes/intakes.md
@@ -291,7 +291,7 @@ repo: informed-decision
 lane: blue
 tags: [cross-repo, authentication]
 created: '2026-09-16'
-updated: '2026-09-16'
+updated: '2026-09-27'
 description: >-
   Coordinate with key-cape and the Authelia deployment owner to validate an
   upgrade supporting prompt=login/max_age, including changed ID-token claims,
@@ -304,6 +304,18 @@ description: >-
   prove the full browser path, not just redirect parameter forwarding.
   T03's three human approvals and key check subsequently completed; this is
   ongoing authentication reliability work, not an outstanding T03 execution.
+
+  2026-09-27: reproduced live — platform-root's attempt to approve
+  infd-20260927-b01 got policy_denied from flex-auth's compact_sitting
+  policy despite a just-completed MFA sign-in, matching this intake's
+  predicted failure exactly. Root cause confirmed and fixed in key-cape
+  (`ADHOC-2026-09-27`, commit 911e9de): completeAuthorization was reusing an
+  existing kc_login cookie's IssuedAt even on the two call sites that had
+  just validated an MFA token in that same request, backdating freshness.
+  Regression test added; full key-cape suite green. The prompt=login/max_age
+  and actionable-freshness-error parts of this intake remain open — do not
+  close until platform-root confirms a live approval succeeds against the
+  fixed key-cape build.
 state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08"
 ```