diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md
index 9ab4cc341..d714c4827 100644
--- a/docs/plans/2026-09-26_lead-decisions.md
+++ b/docs/plans/2026-09-26_lead-decisions.md
@@ -2388,3 +2388,28 @@ which stay with him. Each item names who decided it and what happened.
     - It reopens only as a new question to Jason, after the containers
       run and the actions that need it are known. Nobody adds it to a
       brief before then.
+108. **Q105 A: the subscription token as a read-only file secret, I1-4
+    (2026-10-12).** Jason, relayed by Mos (sage-0078, recorded in
+    jason-master-restart DECISIONS.md): "Q105: A". Q105 offered (A) the
+    subscription token as a read-only file secret, or (B) an API key
+    behind a key-holding gateway. Before he answered, Mos corrected the
+    question: egress goes through the one proxy to the approved provider
+    hosts, not only Anthropic's.
+    - Containerized managed sessions get `CLAUDE_CODE_OAUTH_TOKEN` from
+      a file secret mounted read-only into each session container. It
+      never goes in the container config, compose environment or image.
+      There is no API key, no gateway and no new spend.
+    - Jason accepts that an agent in the container can read the token
+      and copy it out. The egress allowlist is what limits where it can
+      go. The instance workspace is mounted read-write, so a copy can
+      also land on the host disk. The brief says so.
+    - Design items for the brief, Sage's to settle: how the token
+      reaches the Claude CLI from the file without going into the
+      container config (the runner reads it and passes it to the
+      adapter's process only), and file ownership under the rootless
+      subuid mapping (decision 106).
+    - Moving to B later costs money, so it goes back to Jason.
+    - With decisions 105 to 108, all four I1 items are answered. The I1
+      brief is Sage's to write. M1 is decision 104. Under decision 96,
+      when T3 Mos retires is still Jason's call after the M3 trial, and
+      nobody puts it to him before then.