Finish KEY-WP-0040: OTP help link and recovery preview accepted live.

Founder-attended 2026-10-17: the OTP challenge shows the lost-authenticator
link (T02), and the platform-root factor-recovery preview of tegwick lists the
TOTP without invalid_request (T01, F6 fixed). No factor was changed. U08 is
handed back to user-engine (USER-WP-0028-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — key-cape
 
 **Domain:** infotech  
-**Last synced:** 2026-10-14 22:10 UTC  
+**Last synced:** 2026-10-14 22:34 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -30,12 +30,6 @@ Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
 - ! T02 — Register the client and hand over its secret  `40ddaa29`
   *(wait: Claims are verified against the registered client.)*
 
-### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)
-Progress: 1/2 done  |  workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b`
-
-**Open tasks:**
-- ► Deploy the image and record its digest  `bd5db26c`
-
 ## Inbox Hygiene
 
 **Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.

WORK-RECORDS.md

@@ -50,8 +50,8 @@
 | workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md |
 | workplan | KEY-WP-0038 | active | — | workplans/KEY-WP-0038-forgejo-oidc-client.md |
 | workplan | KEY-WP-0039 | active | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
-| workplan | KEY-WP-0040 | active | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| workplan | KEY-WP-0040 | finished | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
-| workplan | KEY-WP-0041 | active | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| workplan | KEY-WP-0041 | finished | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md |
@@ -217,8 +217,8 @@
 | task | KEY-WP-0039-T01 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
 | task | KEY-WP-0039-T02 | wait | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
 | task | KEY-WP-0039-T03 | done | — | workplans/KEY-WP-0039-openbao-negative-probe-tokens.md |
-| task | KEY-WP-0040-T01 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0040-T01 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
-| task | KEY-WP-0040-T02 | progress | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
+| task | KEY-WP-0040-T02 | done | — | workplans/KEY-WP-0040-mfa-attended-run-findings.md |
 | task | KEY-WP-0041-T01 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
-| task | KEY-WP-0041-T02 | todo | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
+| task | KEY-WP-0041-T02 | done | — | workplans/KEY-WP-0041-sign-in-diagnosis-page.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

workplans/KEY-WP-0040-mfa-attended-run-findings.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-10-11"
-updated: "2026-10-16"
+updated: "2026-10-17"
 flavor: implementation
 depends_on: []
 state_hub_workstream_id: "a67f9d60-9b8f-5111-9fe5-9f64e631b1c3"
@@ -21,7 +21,7 @@ U05–U07 passed. U08 is blocked by T01.
 
 ```task
 id: KEY-WP-0040-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "b385602d-714a-5fdb-b40b-bd870420f28e"
 ```
@@ -60,7 +60,7 @@ the deployed authenticated preview succeeds and user-engine can rerun U08.
 
 ```task
 id: KEY-WP-0040-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "3ad155dd-15ef-5522-bdf9-c78832728553"
 ```
@@ -132,3 +132,30 @@ OTP-page observation. Both remain progress. Resume the existing owner procedure
 No authenticated preview, real-factor mutation or attended page observation was
 performed during this source reconciliation. No passwords, codes, token values,
 provider keys or production Secret objects were requested or read.
+
+## T02 attended acceptance — 2026-10-17
+
+The founder reported in session that the real user-engine-portal OTP challenge
+shows **Code rejected or lost your authenticator?**, that it leads to
+`https://users.coulomb.social/security`, and that the lost-device guidance is
+reachable there ("T02 is fine"). This is the founder's own observation, on the
+deployed image `cdec9dd7` from source `8c6c071`. No exact time or client was
+recorded, and no challenge URL, request state, cookie or OTP value was preserved.
+T02 is done. T01 still waits for the authenticated preview (step 2 above).
+
+## T01 attended preview acceptance — 2026-10-17
+
+The founder, signed in as platform-root with its own fresh OTP (AAL2), opened
+`/platform/factor-recovery` and previewed login `tegwick` with the existing
+reference `U08-2026-10-11`. The founder reported that the preview listed
+tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur.
+No confirm or disable action was taken, and no factor was changed. The serial
+suffix and exact time were not reported, so this record does not claim that the
+listed factor is still …E1D. The U08 operator must reconcile the current factor
+metadata in the preview before any disable.
+
+All Done-when conditions hold: the DN-shaped actor defect was fixed with regression
+tests (2026-10-12), the sidecar logs only closed field names and error codes, and
+the deployed preview succeeds. T01 and the workplan are done. U08 itself, meaning
+the attended disable, re-enrolment and fresh login, belongs to user-engine
+(USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.