- store client_secret after trusted RP update responses - add regression test for secret recovery on later detail fetch