plans: #436b draft r1, 3b's open item closed on a scratch 1.27.1: GET /api/v1/token needs the token header (Basic 404s) and reports normalized scopes; no code change

agents/megavolt/work/436b/DESIGN.md

@@ -45,7 +45,7 @@ accepted them in mos-1136.
 - F6. The cap is Gitea #38406, backported in #38426 (de4b8277e9 on release/v1.27, 2026-07-12). It first ships
   in v1.27.0. v1.27.0-rc0 lacks it, and so does every 1.24.x, 1.25.x and 1.26.x through 1.26.4.
 - F7. `GET /api/v1/token` and `DELETE /api/v1/token` exist in 1.27.1 (introspection and self-delete, api.go
-  :1050-1053).
+  :1050-1053). `GET` needs the `token` header and reports normalized scopes (3b).
 
 ## 2. The binding
 
@@ -121,10 +121,17 @@ The admin token holds exactly `write:admin`, `write:user` and `write:repository`
 - `read:user` is covered by `write:user` (F5), so it is dropped.
 
 The executor checks the token's scopes at `set` and at each start with `GET /api/v1/token`, and refuses
-`grant-admin-scope` unless they are exactly those three. A broader token (`all`, or a fourth scope) refuses
-too, so the slot can't silently hold more than the design says. **To verify on a scratch 1.27.1 before
-build:** that `GET /api/v1/token` returns the scopes field for a Basic or token caller. If it doesn't, the check
-moves to the scope probe in section 9's test X-G3, and the row's BUILD.md records it as a deviation.
+`grant-admin-scope` unless they are exactly those three. A broader token (`all`, or another category) refuses
+too, so the slot can't silently hold more than the design says.
+
+Checked on a scratch 1.27.1 (`token_introspect.py`, `introspect.log`, 2026-10-20T22:40Z):
+
+- With the `token` header, `GET /api/v1/token` gives 200 with `id`, `name`, `scopes`, `user`, `created_at` and
+  `last_used_at`, and no token value. With Basic it gives 404 (`invalid access token`). So this check sends
+  the `token` header, unlike the mint route (F1).
+- Gitea reports normalized scopes. A token made with the three scopes plus `read:user` reports the same three,
+  so the check can't tell them apart. That is harmless, because `read:user` adds nothing to `write:user` (F5).
+  A token made with `all` reports `["all"]` and refuses.
 
 ### 3c. Where it lives, who can read it