diff --git a/.agents/brain.md b/.agents/brain.md
index 5ae699f..ae5d3dd 100644
--- a/.agents/brain.md
+++ b/.agents/brain.md
@@ -33,5 +33,20 @@ This document summarizes the architectural knowledge, conventions, and learnings
 - **Phase 3 (Nutrition):** Implemented. Recipes now store `calories`, `protein`, `carbs`, and `fat`. Admin panel handles inputs, and the UI displays them beautifully.
 - **Phase 4 (Interactive Cooking Mode):** Implemented. Recipes now support step-by-step looping background videos and interactive timers (`step_videos`, `step_timers`). The UI utilizes a fullscreen overlay slider with Vanilla JS logic.
 
-## 6. Next Steps
-According to `TODO.md`, the next major feature block is **Phase 5 (PWA & Offline Support)**, which involves service workers, manifest files, and enabling the app to be installable on mobile devices.
+## 6. Git Workflow Violations & Recovery
+
+- **Phase 2 (commit `21833fa`) and Phase 4 (commit `a4a2d83`) were committed directly to `main`**, bypassing the required feature branch → PR flow. This is the correct diagnosis when someone says "Phase X wasn't saved properly" — the code exists, but the audit trail does not.
+- **Recovery strategy (retroactive feature branch):** Branch from current `main`, clean up / improve the work on that branch, then open a PR. This produces the audit trail without rewriting history. Do not force-push or attempt to amend merged commits in `main`.
+
+## 7. Phase 2 Architecture Details
+
+- **Auth CSS location:** All auth/profile/favorites styles live in `assets/style.css` under the `PHASE 2` section header. `login.php` should have **no inline `<style>` block**.
+- **Firebase SDK version:** Using the **v10 compat SDK** (loaded via `gstatic.com`). The compat layer allows legacy v8-style API calls (`window.auth.signInWithEmailAndPassword`). This is intentional.
+- **Firebase v10 error code change:** `auth/wrong-password` and `auth/user-not-found` were consolidated into `auth/invalid-credential` in Firebase v10. All three must be handled for backwards compatibility.
+- **Session sync flow:** `head.php` → `onAuthStateChanged` fires → XHR POST to `api/session.php` with uid/email/token → PHP sets `$_SESSION['fc_user']` → page reloads to show auth state.
+- **Token is NOT verified server-side:** `api/session.php` trusts the client-sent UID and email. The ID Token is stored but not validated cryptographically. Acceptable for a food blog; would need Firebase Admin SDK for sensitive apps.
+- **Dark mode is forced:** The site is dark-only by design. `head.php` sets `data-theme="dark"` unconditionally to prevent FOUC. There is no light mode toggle and this is intentional.
+
+## 8. Next Steps
+
+According to `TODO.md`, all 5 phases are complete. The next work will be new features or bug fixes as directed by the user.