diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md
index d0173d352..e6bf3fc4e 100644
--- a/docs/plans/2026-09-26_lead-decisions.md
+++ b/docs/plans/2026-09-26_lead-decisions.md
@@ -1991,3 +1991,11 @@ which stay with him. Each item names who decided it and what happened.
     - The tradeoff: a transient unit doesn't survive a reboot and isn't
       reviewed as a file. It runs one reviewed command line, which the
       install record states, until the follow-up row ships the unit.
+    - Correction (2026-10-11, Mos, sage-0052): the identity provider is
+      Authentik at auth.diversecanvas.com, not Pocket ID. There is no
+      Pocket ID in the homelab; the Q91 relay named it in error, and 92
+      and 93 above repeat it. ops-01 builds Authentik forward auth for
+      mosaic-preview.woltje.com, limited to Jason's group; the header is
+      likely X-authentik-uid. The Console check stays generic (one header
+      name, one user id, from flags). Jason's Q93, on the Authentik token,
+      gates ops-01's application, not the Console's landing or install.
diff --git a/docs/plans/2026-10-11_webui-preview.md b/docs/plans/2026-10-11_webui-preview.md
index 7f2577b9b..928d9dbbf 100644
--- a/docs/plans/2026-10-11_webui-preview.md
+++ b/docs/plans/2026-10-11_webui-preview.md
@@ -2,8 +2,10 @@
 
 Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`.
 One row. Amended the same evening for Jason's Q91 answer "A" (lead
-decision 93): a read-only preview at its own hostname, behind Pocket ID
-forward auth limited to Jason's group, the old build left up. Target:
+decision 93): a read-only preview at its own hostname, behind forward
+auth limited to Jason's group, the old build left up. The identity
+provider is Authentik at auth.diversecanvas.com, not Pocket ID as first
+relayed; the Console names no provider. Target:
 Jason signs in on 2026-10-12, by 2026-10-13T05:00Z at the latest. The
 service script is cut from this row for that date; it is a follow-up.
 
@@ -28,9 +30,9 @@ design:
 - Nothing runs the Console as a service. It is a foreground `serve`.
 
 Mos approved these cuts for the preview (2026-10-11): sign-in at the edge
-through Pocket ID forward auth, not login code in the Console; a preview
+through forward auth, not login code in the Console; a preview
 hostname, so the old build at mosaic.woltje.com stays; read-only; not
-held for S7 (row 42) or Gate E (row 5). ops-01 owns the Pocket ID client
+held for S7 (row 42) or Gate E (row 5). ops-01 owns the Authentik application
 (limited to Jason's group), the DNS name, TLS, the proxy and the route
 from the edge to this host. The route opens once rev-sol-01 passes
 ops-01's proposal (Q91 A).
@@ -52,7 +54,8 @@ A preview mode, off by default. Without its flags the Console behaves
 exactly as today, and the existing tests show it.
 
 - `serve --public-host NAME --auth-header HEADER --allow-user ID`, all
-  three or none. NAME is a hostname, no port or scheme. The bind stays
+  three or none. The check is generic: one header name and one user id,
+  both from the flags, nothing provider-specific in code or tests. NAME is a hostname, no port or scheme. The bind stays
   loopback; nothing here listens beyond it.
 - In preview mode a request's Host must be NAME, or loopback on the
   Console's port as today. An Origin, when sent, must be `https://NAME`
@@ -72,7 +75,7 @@ exactly as today, and the existing tests show it.
 - The README replaces "Do not expose either unauthenticated server
   through a public proxy" with what the preview mode requires of the
   proxy: it strips HEADER from every client request and sets it only
-  after Pocket ID signs the user in, it preserves Host, it terminates TLS,
+  after the identity provider signs the user in, it preserves Host, it terminates TLS,
   and it is the only thing that reaches the port from off the host. It
   says plainly that any local process can still connect and send HEADER,
   the same exposure the README already describes for the port.
@@ -82,7 +85,7 @@ exactly as today, and the existing tests show it.
 
 ### Out of scope
 
-- OIDC or login code in the Console; Pocket ID config; DNS, TLS, the
+- OIDC or login code in the Console; Authentik config; DNS, TLS, the
   proxy and the route from the edge (ops-01).
 - Resolving decisions or replying from the browser. REQ-DEC-3 keeps
   resolution in the CLI; changing that is a ruling and its own row.
@@ -94,7 +97,7 @@ exactly as today, and the existing tests show it.
   as a transient user unit (`systemd-run --user`, loopback port 7332;
   7330 holds the operator's own Console). The edge reaches it once
   rev-sol-01 passes ops-01's route.
-- The group check. Pocket ID and the proxy limit sign-in to Jason's
+- The group check. Authentik and the proxy limit sign-in to Jason's
   group; the Console checks the header against the one user id.
 
 ### Gate