diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md
index f12190f7e..6fabbdc4c 100644
--- a/docs/plans/2026-09-26_lead-decisions.md
+++ b/docs/plans/2026-09-26_lead-decisions.md
@@ -2044,3 +2044,32 @@ which stay with him. Each item names who decided it and what happened.
       unit's `Restart=on-failure` brings it back; after a reboot, or a
       logout without linger, it waits for Jason. Deferring nine rows
       pushes the skills, routing and hygiene work back by about two days.
+
+95. **Q95 yes: a human message to a role from the Console, for the
+    PoC on dragon-lin (2026-10-11).** Jason, relayed by Mos (sage-0056):
+    "Q95: If this is the way for us to get the deployment up, validate
+    the PoC, then yes. We are working toward the containerization of
+    Mosaic Stack to mitigate security concerns like this."
+    - Row 76 (#1570) is unblocked with the scope Sage proposed: a human
+      `message.send` to a role, behind Authentik and the header check,
+      Origin required on the POST, decisions resolved only in the CLI
+      (REQ-DEC-3). Dewey builds it after row 74 lands, since both edit
+      the same files.
+    - The local-forgery limit of decision 62 is accepted for this PoC on
+      dragon-lin under Jason's user: any same-UID process that reaches the
+      Console's port and sets the header can send a human instruction.
+      The containerized install is meant to close it; this decision
+      doesn't carry the limit there.
+    - No broker row. Mos's reading started rows A and B; decision 94
+      already found A unneeded, because the Console reaches the bus
+      through the human transport. Sage keeps it dropped. A label telling
+      web sends from CLI sends in the trail (`via`) is a possible
+      follow-up after cutover, not a cutover row. Until then the
+      Console's per-send log line on stdout is the only place they
+      differ.
+    - Cutover target: about 2026-10-12T21:30Z, Jason's live approval at
+      the time.
+    - The tradeoff: dropping A saves a security review round, which was
+      the likeliest way the date slips. The cost is that the bus trail
+      records a web send exactly as a CLI send, `human-cli`, until the
+      label row.