docs: decision 68 correction, Jason creates the svc account (sage)

Mos: the svc-mosaic-stack password is a credential Jason keeps (R5), and
T236 creates no users. The runbook's Path A now has Jason create it with
the command from the instance's ops doc. Records the R20 confirmation.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/guides/slice-1-identities.md

@@ -176,8 +176,9 @@ On Path B, create it the same way as the owner:
 docker exec -it mosaic-vikunja /app/vikunja/vikunja user create -u "svc-$BIZ" -e "[email protected]"
 ```
 
-On Path A, the instance's operator creates it with the same command on
+On Path A, you create it yourself, because its password is yours to
-the instance's container, unless the instance allows registration.
+keep. The instance's ops doc gives the exact `vikunja user create`
+command for its container, with the password entered at a prompt.
 
 ### Logins for this guide
 

docs/plans/2026-09-26_lead-decisions.md

@@ -1230,3 +1230,12 @@ which stay with him. Each item names who decided it and what happened.
     - T236 has to provide `svc-mosaic-stack` on the estate instance.
       Its operator creates it with `vikunja user create`, unless the
       instance allows registration. Sent to Mos.
+    - Correction (Mos, 2026-10-08, after this entry): Jason creates
+      `svc-mosaic-stack`, not T236's operator. Its password is a
+      credential Jason keeps, so it's gated under R5, and T236's brief
+      creates no users. T236's ops doc gives the exact
+      `vikunja user create` command, and the runbook's Path A now says
+      so. Mos records "one `svc-<business>` per business with bots" as
+      an estate rule. Jason is away 10-10, so the runbook's Vikunja
+      sections run on 10-11 at the earliest, depending on T236. R20 is
+      confirmed to Mos: Sage is the stack's PM and Darkwing its Lead.