diff --git a/docs/ADR-004-mcp-application-oauth.md b/docs/ADR-004-mcp-application-oauth.md
index 5af62305..74183ea2 100644
--- a/docs/ADR-004-mcp-application-oauth.md
+++ b/docs/ADR-004-mcp-application-oauth.md
@@ -1539,11 +1539,16 @@ The **Progressive Consent architecture** solves the critical challenges of token
 
 This architecture follows industry best practices for federated systems and positions the MCP server as a secure token broker in an enterprise identity ecosystem.
 
-## Implementation Status
+## Historical Implementation Notes
 
-**Current Status**: Partially Implemented (Refactoring Required)
+> These were the planned refactoring steps at the time this ADR was written.
+> They were **never completed** — the design was superseded by ADR-022 (Login
+> Flow v2) and ADR-023 (OAuth AS proxy) before this progressive-consent /
+> token-exchange architecture was adopted. The `ENABLE_TOKEN_EXCHANGE` /
+> `settings.enable_token_exchange` symbols referenced below no longer exist in
+> the codebase. Retained for historical context only.
 
-The current implementation (`nextcloud_mcp_server/auth/oauth_routes.py`) implements a **simplified hybrid flow** but needs refactoring to match the progressive consent architecture documented above:
+The implementation at the time (`nextcloud_mcp_server/auth/oauth_routes.py`) was a **simplified hybrid flow** that would have needed refactoring to match the progressive consent architecture documented above:
 
 ### What's Currently Implemented ✅
 
diff --git a/docs/login-flow-v2.md b/docs/login-flow-v2.md
index 4babbfa8..8eac8062 100644
--- a/docs/login-flow-v2.md
+++ b/docs/login-flow-v2.md
@@ -193,6 +193,11 @@ mcp-login-flow:
     - NEXTCLOUD_MCP_SERVER_URL=http://localhost:8004
     - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
     - MCP_DEPLOYMENT_MODE=login_flow
+    # Production: register a static OIDC client and set these — the DCR
+    # fallback used by this dev/test service expires after ~1h against the
+    # built-in `oidc` app (see "Default IdP setup" above and #907).
+    # - NEXTCLOUD_OIDC_CLIENT_ID=<your-client-id>
+    # - NEXTCLOUD_OIDC_CLIENT_SECRET=<your-client-secret>
     # Dev-only inline value. In production, mount via Docker secret and read
     # from a *_FILE env var or a secrets-management init step.
     - TOKEN_ENCRYPTION_KEY=<your-fernet-key>
diff --git a/env.sample.oauth-multi-user b/env.sample.oauth-multi-user
index 61bf205f..15a40f13 100644
--- a/env.sample.oauth-multi-user
+++ b/env.sample.oauth-multi-user
@@ -60,7 +60,7 @@ OLLAMA_EMBEDDING_MODEL=nomic-embed-text
 
 # Token Storage (required for background operations - auto-enabled by semantic search)
 # Generate encryption key: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-TOKEN_ENCRYPTION_KEY=your-encryption-key-here
+TOKEN_ENCRYPTION_KEY=<your-encryption-key>
 TOKEN_STORAGE_DB=/app/data/tokens.db
 
 # ===== OPTIONAL: DOCUMENT PROCESSING =====