diff --git a/PLAN_NEXT.md b/PLAN_NEXT.md
index c80d058..86024d1 100644
--- a/PLAN_NEXT.md
+++ b/PLAN_NEXT.md
@@ -114,7 +114,9 @@ localStorage manager + toggle + inline `ColorSchemeScript` equivalent.
 RJSF swap was import-only; SSR smoke test proved all 10 intake labels +
 textarea/password/checkbox/slider widgets render. `npm run build` green.
 
-## 1. Locked decisions (do not re-ask)* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`,
+## 1. Locked decisions (do not re-ask)
+
+* Auth: SMTP magic-link, 15-min single-use tokens (`secrets.token_urlsafe`,
   store `sha256`, `used_at` set before session creation), session = opaque id
   in **DB table**, cookie `HttpOnly; Secure; SameSite=Lax; Path=/`.
   SMTP creds already in `.env` (`SMTP_HOST/PORT/USERNAME/PASSWORD`,