diff --git a/geode/plans/2026-05-07-event-ingestion-batching.md b/geode/plans/2026-05-07-event-ingestion-batching.md
index 08a8d88f7a..eb7d8d9d1b 100644
--- a/geode/plans/2026-05-07-event-ingestion-batching.md
+++ b/geode/plans/2026-05-07-event-ingestion-batching.md
@@ -95,13 +95,24 @@ verifies pre-mark `Rejected` and skip the insert.
 Wired through `NostrServer(parallelVerify = ...)` and
 `geode.Relay(parallelVerify = ...)`, controlled by
 `[options].parallel_verify` in the relay config (default `true`)
-and `--no-parallel-verify` on the CLI. Operators that flip it on
-must omit `VerifyPolicy` from their policy chain — `Main.kt` does
-this automatically; `composePolicy` is told to skip the
-`VerifyPolicy` piece when `parallelVerify` is true. Internal
-direct callers of `NostrServer` (tests, library users) are
-opt-in: the flag defaults to `false` to keep existing
-`VerifyPolicy`-in-chain semantics unchanged.
+and `--no-parallel-verify` on the CLI. Internal direct callers of
+`NostrServer` (tests, library users) are opt-in: the flag defaults
+to `false` to keep existing `VerifyPolicy`-in-chain semantics
+unchanged.
+
+`VerifyPolicy` was split into a parameterised
+`VerifyEventsAndAuthPolicy(verifyEvents)` with two singletons:
+
+- `VerifyPolicy` (default): verifies both `EVENT` and `AUTH`.
+- `VerifyAuthOnlyPolicy`: verifies `AUTH` only, used when the
+  `IngestQueue` is doing the EVENT verify.
+
+When `parallelVerify` is on, `composePolicy` swaps `VerifyPolicy`
+for `VerifyAuthOnlyPolicy` so EVENTs aren't verified twice while
+AUTH commands — which bypass the queue entirely — keep their
+signature check. Without this split, removing `VerifyPolicy` from
+the chain would let a forged AUTH event mark a pubkey as
+authenticated.
 
 Expected: ≈CPU_COUNT× verify-step speed-up on burst publishes
 from a single connection, where verify was previously serial on