diff --git a/.custodian-brief.md b/.custodian-brief.md
index 679d1c5..d3b36c3 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — key-cape
 
 **Domain:** infotech  
-**Last synced:** 2026-10-14 22:34 UTC  
+**Last synced:** 2026-10-17 02:16 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -14,13 +14,6 @@ Progress: 2/3 done  |  workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
 - ! T01 — Define the probe registrations  `03da4c38`
   *(wait: Ordered identity gate: Forgejo first SecurityCase registration/claims proof, then NetKingdom registry session and attended human/coding-agent custody; registration authorization already resolved.)*
 
-### Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)
-Progress: 0/2 done  |  workplan_id: `a67f9d60-9b8f-5111-9fe5-9f64e631b1c3`
-
-**Open tasks:**
-- ► Recovery preview rejects valid input (F6)  `b385602d`
-- ► Link the OTP prompt to lost-authenticator help (F3)  `3ad155dd`
-
 ### Forgejo as a NetKingdom OIDC client, so the forge can close
 Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
 
diff --git a/workplans/KEY-WP-0040-mfa-attended-run-findings.md b/workplans/KEY-WP-0040-mfa-attended-run-findings.md
index 58a0b99..8e8730c 100644
--- a/workplans/KEY-WP-0040-mfa-attended-run-findings.md
+++ b/workplans/KEY-WP-0040-mfa-attended-run-findings.md
@@ -149,13 +149,14 @@ The founder, signed in as platform-root with its own fresh OTP (AAL2), opened
 `/platform/factor-recovery` and previewed login `tegwick` with the existing
 reference `U08-2026-10-11`. The founder reported that the preview listed
 tegwick's TOTP. The `invalid_request` failure from October 11 (F6) did not recur.
-No confirm or disable action was taken, and no factor was changed. The serial
-suffix and exact time were not reported, so this record does not claim that the
-listed factor is still …E1D. The U08 operator must reconcile the current factor
-metadata in the preview before any disable.
+No confirm or disable action was taken, and no factor was changed. When asked
+afterwards, the founder confirmed that the listed TOTP's serial suffix is …E1D,
+the same active factor as on October 11. The exact time was not recorded.
 
-All Done-when conditions hold: the DN-shaped actor defect was fixed with regression
-tests (2026-10-12), the sidecar logs only closed field names and error codes, and
-the deployed preview succeeds. T01 and the workplan are done. U08 itself, meaning
+All three Done-when conditions now hold: the DN-shaped actor defect was fixed
+with regression tests (2026-10-12); the sidecar logs only closed field names and
+error codes; and the deployed preview for tegwick lists the active TOTP …E1D
+without applying anything. That third condition was met only after the suffix
+was confirmed, not before. T01 and the workplan are done. U08 itself, meaning
 the attended disable, re-enrolment and fresh login, belongs to user-engine
 (USER-WP-0028-T03) and is handed back to it. This workplan does not close U08.