diff --git a/README.md b/README.md
index 80d4062..b5ee5cb 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 # Relicario
 
-> **Audience:** users + evaluators. This doc owns the pitch, security-model summary, quick-start commands, reference-image explanation, recovery-QR overview, and roadmap teaser. Goes no deeper — for the system tour see [DESIGN.md](DESIGN.md), for crypto see [docs/CRYPTO.md](docs/CRYPTO.md).
+> **Audience:** users + evaluators. This doc owns the pitch, security-model summary, quick-start commands, second-factor explanation (reference image / key file), recovery-QR overview, and roadmap teaser. Goes no deeper — for the system tour see [DESIGN.md](DESIGN.md), for crypto see [docs/CRYPTO.md](docs/CRYPTO.md).
 
 A git-backed, self-hostable password manager. The security thesis: two independent secrets feed the Argon2id KDF, the vault server holds only opaque ciphertext, and every mutation is a git commit — a built-in audit log. Compromise of either factor alone is insufficient to decrypt the vault.
 
diff --git a/docs/FORMATS.md b/docs/FORMATS.md
index f7e43b3..06525a6 100644
--- a/docs/FORMATS.md
+++ b/docs/FORMATS.md
@@ -37,10 +37,11 @@ Every encrypted file — `manifest.enc`, `settings.enc`, `items/<id>.enc`, `atta
 }
 ```
 
-Parsed via `ParamsFile { kdf: KdfParams }` in `crates/relicario-core/src/crypto.rs`
-(`ParamsFile` struct; `second_factor` field added by
-<!-- TODO(dev-e): pin exact line once Dev-D's keyfile.rs lands -->
-`crates/relicario-core/src/crypto.rs`). The `kdf` nesting is intentional — `format_version`, `aead`, and `salt_path` co-exist for forward-compat probing. Do not flatten. Production defaults: `m=65536` (64 MiB), `t=3`, `p=4`. Tests use `m=256, t=1, p=1`.
+Parsed via `ParamsFile { kdf: KdfParams }` in `crates/relicario-cli/src/session.rs:117`
+(`KdfParams` is defined in `crates/relicario-core/src/crypto.rs:157`). `second_factor` is a
+top-level sibling of `kdf` on `ParamsFile`, added by Dev-D's key-file work.
+<!-- TODO(dev-e): pin exact line of the second_factor field once Dev-D's params change lands -->
+The `kdf` nesting is intentional — `format_version`, `aead`, and `salt_path` co-exist for forward-compat probing. Do not flatten. Production defaults: `m=65536` (64 MiB), `t=3`, `p=4`. Tests use `m=256, t=1, p=1`.
 
 ### `second_factor` field