diff --git a/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md b/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md
new file mode 100644
index 0000000000..28d12d4eb0
--- /dev/null
+++ b/changelog.d/3116-auth-patterns-format-check-and-hasstrategy.fixed.md
@@ -0,0 +1 @@
+- Fix authentication-patterns guide: parenthesize the combined-strategy format check so `(request.format ?: "html") == "json"` evaluates correctly; the unparenthesized form crashed at runtime when `request.format` was set. Also corrects the `hasStrategy` rationale — `registerStrategy()` replaces in place so duplicates cannot stack; the guard skips rebuilding the strategy object on warm reloads (#3116).
diff --git a/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx b/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
index ac070fe0c0..03099baee7 100644
--- a/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
+++ b/web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx
@@ -61,7 +61,7 @@ local.di.map("sessionStrategy").to("wheels.auth.SessionStrategy").asSingleton();
 
 Both are singletons — one instance per app lifetime. The authenticator holds its strategy registry in instance state, so a singleton is the correct scope.
 
-Wire the session strategy into the authenticator on app init. A cold reload registers it once; the `hasStrategy` check keeps a second reload from stacking duplicates:
+Wire the session strategy into the authenticator on app init. `registerStrategy()` replaces any existing entry with the same name in place, so duplicate registrations cannot stack. The `hasStrategy` guard simply skips rebuilding the strategy object on warm reloads:
 
 ```cfm {test:compile} title="config/app.cfm or equivalent init hook"
 if (StructKeyExists(application, "wheelsdi") && application.wheelsdi.containsInstance("authenticator")) {
@@ -340,7 +340,7 @@ component extends="wheels.Controller" {
     private function authenticate() {
         var result = service("authenticator").authenticate(request);
         if (!result.success) {
-            if (request.format ?: "html" == "json") {
+            if ((request.format ?: "html") == "json") {
                 renderWith(data={error: result.error}, status=result.statusCode);
             } else {
                 flashInsert(error="Please log in first");