diff --git a/registry/capabilities/capability.infotech.isolated-login-browser.md b/registry/capabilities/capability.infotech.isolated-login-browser.md
index e76ad23..9fce5e7 100644
--- a/registry/capabilities/capability.infotech.isolated-login-browser.md
+++ b/registry/capabilities/capability.infotech.isolated-login-browser.md
@@ -73,6 +73,7 @@ availability:
   current_level: A2
   target_level: A3
   current_artifacts:
+    - ../railiance-platform/scripts/operator-browser/cmd.exe
     - ../railiance-platform/scripts/operator-browser/xdg-open
     - ../railiance-platform/scripts/openbao-attended-exec.py
     - ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
@@ -94,9 +95,10 @@ evidence:
     - ../railiance-platform/tests/test_operator_browser.py
   consumer_feedback:
     - >-
-      2026-11-02: the attended OpenBao window was Firefox, the Windows default,
-      after a launcher intended to open Edge. The signed-in session could not
-      be used for platform-root.
+      2026-11-02: the attended OpenBao window was Firefox, the Windows default.
+      A later login also opened a Firefox tab because OpenBao calls
+      `cmd.exe /c start` on WSL and never reaches xdg-open. The empty profile
+      was not used. The login still completed after the old session expired.
   bug_reports: []
   incidents: []
 consumer_guidance:
@@ -134,8 +136,9 @@ and headless trials are outside it.
 ### Availability
 
 Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
-wrapper places `scripts/operator-browser` first on `PATH`, so OpenBao's
-`xdg-open` reaches this launcher.
+wrapper places `scripts/operator-browser` first on `PATH`. On WSL, OpenBao
+runs `cmd.exe /c start`, so that directory provides `cmd.exe` for the
+allowlisted login URL.
 
 ### Completeness
 
@@ -144,6 +147,6 @@ in that window is still outstanding, so the core use case is not complete.
 
 ### Reliability
 
-The previous Windows opener disappointed the operator by presenting the
-default Firefox session. This entry stays fragile until one real login
-completes in the pinned Chromium.
+The attended login still opened a Firefox tab on 2026-11-02 because the
+WSL opener never called xdg-open. This entry stays fragile until one real
+login completes in the pinned Chromium.