diff --git a/INTENT.md b/INTENT.md
index e1b93f9..04a631e 100644
--- a/INTENT.md
+++ b/INTENT.md
@@ -100,10 +100,22 @@ directly. Like that repo, it is downstream by construction and must not become
 a second source of truth — a finding is a claim about a system, and the system
 remains authoritative about itself.
 
-The first content is already waiting: the unverified tenant boundary, the
-absent noisy-neighbour characterisation, the missing quality-of-service
-vocabulary, and the erasure-versus-audit tension — all currently open questions
-in NetKingdom's *Tenancy Posture* standard, which is a draft and not a register.
+The register is no longer empty. `RISK-F-0001` arrived on 2026-08-17: a live
+authorization bypass in `flex-auth`, self-reported during a framework review.
+Three more defects surfaced in the same round and are recorded inside it as
+visible-but-unfiled, pending this repo setting the precedent for what warrants
+a record of its own.
+
+**The first finding already tested the deferral.** Controlled disclosure is
+recorded above as deferred to production, on the reasoning that build mode has
+no users to expose. `RISK-F-0001` is a live authorization bypass in the service
+every other service trusts, and today the choice is publish or hold with
+nothing in between. That may still be the right deferral — but it is now a
+decision taken with a real case in hand rather than a hypothetical one.
+
+Also waiting: the unverified tenant boundary, the absent noisy-neighbour
+characterisation, and the erasure-versus-audit tension — open questions in
+NetKingdom's *Tenancy Posture*, which is a draft and not a register.
 
 ## What good looks like