sage: row 178 brief, the turn-on doesn't wait for Jason (mos-0881), with roll-back-at-once on a failed signed-in check; bc310ee pod-label part recorded

docs/plans/2026-10-19_console-proxy-proof.md

@@ -76,9 +76,17 @@ can read. This row neither reuses it nor retires it, and the uid switch stays a
 3. The unit. After a store backup, add `--proof-header NAME --proof-file <slot path>` to the Console unit with
    `webui-service.sh install` and a restart, in a window Mos plan-checks. The order is middleware first, then the
    unit flags, then a signed-in check through the public name and a forged loopback request that has to get 401.
-   Rollback drops the unit flags first, then the middleware. A STATE report follows. This step narrows who can reach
-   the Console from outside, and Q173 keeps any change to that for Jason. Mos rules at the plan check whether
-   narrowing counts. Until then it waits for Jason.
+   Rollback drops the unit flags first, then the middleware. A STATE report follows. If the signed-in check through
+   the public name fails, roll back at once, flags first and then the middleware, and record it in STATE.
+
+The turn-on doesn't wait for Jason (mos-0881). Outside traffic arrives only through Traefik with Authentik, and
+Traefik adds the proof, so whoever gets in from outside today still gets in. The callers it cuts off are local
+processes on dragon-lin and hostNetwork pods on k8s-woltje, which are inside callers. Step 2 is k3s under ops-01's R27
+standing authority, as infrastructure bc310ee was. Mos confirms this again at the 178 plan check.
+
+#385's Traefik pod-label part is already live as infrastructure bc310ee (PR #352, Argo sync 2026-10-19T22:45:04Z,
+Traefik FORWARDED and falco DROPPED on Hubble, #385 comment 290). #385 stays open for this row and Jason's uid
+question.
 
 ## Tests