diff --git a/docs/plans/2026-08-19-frontend-simplification.md b/docs/plans/2026-08-19-frontend-simplification.md
index ffd4c163..a9290443 100644
--- a/docs/plans/2026-08-19-frontend-simplification.md
+++ b/docs/plans/2026-08-19-frontend-simplification.md
@@ -63,10 +63,19 @@ remaining gap for the flows named above.
 The e2e suite covers the rendering half through `TestCrossOrigin_WidgetRendersOnAnotherOrigin`, which
 proves the document loads on another origin and reports itself through postMessage across the
 boundary, and `ALLOWED_HOSTS` refusal through `TestCrossOrigin_DisallowedHostNeverReportsInited`.
-#2214 adds the authentication half over TLS, the reload included, and runs it once more against a
-browser configured to block third-party cookies. That last case needs `IgnoreDefaultArgs`, because
-Playwright's own `--disable-features` list switches partitioning off and beats the flags passed
-through `Args`, which would leave the case asserting nothing.
+The open #2214 adds the authentication half over TLS, the reload included, and runs it once more
+against a browser configured to block third-party cookies. That second case needs
+`IgnoreDefaultArgs`, because Playwright's own `--disable-features` list switches partitioning off and
+beats the flags passed through `Args`, which would leave the case asserting nothing.
+
+Both of its TLS cases sign in anonymously, so the anonymous flow is the only one of the three
+measured in a third-party frame. Email is exercised over http by `TestAuth_EmailSignsIn` and never
+embedded; Telegram is not exercised anywhere and cannot be until #2208 makes the Telegram API base
+URL configurable, since without that the widget cannot be pointed at a stub. The expectation that all
+three behave alike is an inference and should be read as one: the client-side writer keys off `X-JWT`
+on any auth response and not off the provider, so nothing in it distinguishes them. Worth stating
+plainly, because a criterion naming flows the suite cannot reach is a milder version of the defect
+this section was rewritten to remove.
 
 `ALLOWED_HOSTS` sets the CSP `frame-ancestors` and `AUTH_SAME_SITE=none` lets the server's auth
 cookies be set from any embedding domain. Those server-set cookies carry no `Partitioned`, so they