diff --git a/.custodian-brief.md b/.custodian-brief.md
index e42f3c1..7de901c 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,18 @@
 # Custodian Brief — key-cape
 
 **Domain:** infotech  
-**Last synced:** 2026-10-11 18:48 UTC  
+**Last synced:** 2026-10-11 21:03 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)
+Progress: 0/2 done  |  workplan_id: `a67f9d60-9b8f-5111-9fe5-9f64e631b1c3`
+
+**Open tasks:**
+- · Recovery preview rejects valid input (F6)  `b385602d`
+- · Link the OTP prompt to lost-authenticator help (F3)  `3ad155dd`
+
 ### Negative-check tokens for the secrets-engine OpenBao JWT role
 Progress: 2/3 done  |  workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
 
@@ -18,7 +25,9 @@ Progress: 2/4 done  |  workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
 
 **Open tasks:**
 - ! T01 — Define what Forgejo receives  `ddcfb482`
+  *(wait: Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout.)*
 - ! T02 — Register the client and hand over its secret  `40ddaa29`
+  *(wait: Claims are verified against the registered client.)*
 
 ## Inbox Hygiene