diff --git a/docs/qa/platform-checklist/README.md b/docs/qa/platform-checklist/README.md
index aaa48a4682..f659761d85 100644
--- a/docs/qa/platform-checklist/README.md
+++ b/docs/qa/platform-checklist/README.md
@@ -280,11 +280,12 @@ over this ledger**: `since == vN` (the new capabilities) ∪ all `P0` (the stand
 smoke) ∪ any item whose `source` cites a PR in the release. The tracking issue for the
 sweep links here and hosts discussion; results stay OUT of the repo — every run files
 one `qa-run` GitHub issue as its record (text only: the verdict table + a reproduction
-rule per failure, never screenshots; `runs/` is git-ignored), and a run that finds a real
-regression extracts it into its own standalone card at close-out (RUNNER.md, extraction
-obligation — the run issue itself stays `qa-run`-only, excluded from triage). Item text,
-fixtures learned, and new traps discovered flow **back into the ledger** as revisions —
-that is the accumulation the one-off checklists never had.
+rule per failure — RUNNER.md rule 2's authentication/authorization carve-out excepted,
+and it binds the extracted card too — never screenshots; `runs/` is git-ignored), and a
+run that finds a real regression extracts it into its own standalone card at close-out
+(RUNNER.md, extraction obligation — the run issue itself stays `qa-run`-only, excluded
+from triage). Item text, fixtures learned, and new traps discovered flow **back into the
+ledger** as revisions — that is the accumulation the one-off checklists never had.
 
 ## Relationship to what already exists
 
diff --git a/docs/qa/platform-checklist/runs/README.md b/docs/qa/platform-checklist/runs/README.md
index 25ef38eb7f..b3dce864b9 100644
--- a/docs/qa/platform-checklist/runs/README.md
+++ b/docs/qa/platform-checklist/runs/README.md
@@ -13,11 +13,19 @@ durable, **text-only** report (pass or fail alike):
 
 - the issue **body** hosts the per-clause verdict table (pass / partial / fail / blocked)
   and the scope — the selector that chose the items + the `revision` each ran against;
+  [../RUNNER.md](../RUNNER.md) carries the body contract in full, and this line
+  summarises only part of it;
 - **every `fail` carries a reproduction rule** in that same issue — ordered steps / API
   calls (method · path · body) / the ref-targeted selector path + expected-vs-actual;
   the run issue itself stays `qa-run`-only (protocol carrier, excluded from the triage
   sweep) — at close-out each product defect is extracted into its own standalone card
   (RUNNER.md, extraction obligation), and that card is what triages;
+  - **one exception — authentication and authorization findings.** Their reproduction is
+    **never published on GitHub**: not in this record, not in the extracted card, not in
+    a comment. Such a `fail` is still a completed verdict, and what it carries instead is
+    [../RUNNER.md](../RUNNER.md) rule 2's carve-out — read it there before you write the
+    record. This line is the flag that you are in that case; the rule itself is stated in
+    one place only;
 - **screenshots are never part of the report** — they are live judgment aids that die
   with the run environment, described in one line of text, never attached or linked.