diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md
index fc1506bd..0e31c560 100644
--- a/docs/remediation/TASKS.md
+++ b/docs/remediation/TASKS.md
@@ -2056,6 +2056,63 @@ governs the raw-API path, the tea login governs the tea path, and the two can di
 > operation) enters the seat-provisioning checklist; and **verdict classification happens on the ERROR
 > BODY, never the status code alone.**
 
+> **★★★ AMENDED — THE FLEET-WIDE WIDENING IS WITHDRAWN (Mos, 2026-08-05, on `tl-mosaic`'s split).
+> AND THE ORCHESTRATOR LEANED THE WRONG WAY FOR THE SAME REASON THE COORDINATOR DID.**
+>
+> Two of the three reasons for (a) did not survive inspection:
+>
+> | reason                                                   | verdict                                                                                                                                                                                                        |
+> | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+> | "read-back doctrine requires identity self-verification" | **WRONG BY MECHANISM** — the mandated read-back is of the **AUTHORED ARTIFACT**, whose author field is readable under the seat's **existing repo scopes**. **Identity-on-authoring never needed `read:user`.** |
+> | "read-only, about the actor, marginal privilege"         | **TRUE BUT NOT A JUSTIFICATION — cheap is not the same as needed.**                                                                                                                                            |
+>
+> > **★ THE NAMED TRAP: A FLEET-WIDE SCOPE WIDENING PERFORMED TO MAKE AN INSTRUMENT GREEN.** The tail
+> > wagging the dog — same family as buying admin read to answer the wrong question more
+> > authoritatively. Mos wrote that rule into doctrine hours earlier and walked into its sibling within
+> > the hour.
+>
+> **MY OWN ERROR, AND IT IS THE SHARPER ONE: I recommended (a).** I wrote _"I lean (a): the scope
+> widening is read-only on the actor's own identity, and it converts an unverifiable property into a
+> one-command self-check."_ That is **exactly** the discredited reason 1. Worse — **I had already
+> written the correct answer as my own option (b)**, the authored-artifact read-back, and preferred the
+> widening **because it made the check mechanical.** Having the right answer in hand and reaching past
+> it for the one that services the instrument is the whole failure. `tl-mosaic` caught what neither the
+> coordinator nor I did.
+>
+> **THE AMENDED SPLIT — two questions, different instruments:**
+>
+> | question                                    | instrument                                                                        | on absence                                                                                                   |
+> | ------------------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
+> | **CAPABILITY** "does this credential work?" | in-scope probe + differential (**this seat's D-11b check, CANONICAL, unchanged**) | fail-closed — this is the real question                                                                      |
+> | **IDENTITY** "who does it authenticate as?" | `/user` **where the token holds `read:user`**                                     | **NOT-MEASURED — neither pass NOR fail; a seat lacking `read:user` is CORRECTLY PROVISIONED, not defective** |
+>
+> **`NOT-MEASURED` is the resolution of this entire class** — it is P-WRAPPER-001's tri-state applied to
+> measurement itself. The false negative existed because a missing measurement was being scored as a
+> failure. The residual is stated in every report: **MISMATCH coverage extends only to
+> `read:user`-holding tokens.**
+>
+> **The MISMATCH class closes at MINT TIME instead, at zero runtime scope cost:** the minting authority
+> already holds admin scopes and can **read back the principal at mint**, asserting filename-vs-principal
+> **once, at the only moment a mismatch can be created.**
+>
+> **`coder-mos1`: criterion REPLACED, not repaired** — capability differential + artifact read-back on
+> its next natural authored write. **No re-mint. It was correctly provisioned the entire time.**
+
+> **★ PRE-REGISTRATION DOCTRINE — WHAT TO DO WHEN A CHECK'S PREMISE DIES (ratified from `tl-mosaic` §2).**
+> The original post-condition arm **would have been satisfied by seats that were never broken** — so it
+> was amended before running, and **a false red was traded for a real test**.
+>
+> > **A pre-registered check whose PREMISE has died is an ACTIVE PRESSURE TOWARD BREAKING WORKING CODE.**
+> > Amending it **BEFORE it runs, in writing, with the premise-change NAMED**, is the only honest
+> > handling. Leaving it to fail and then "fixing" reality to satisfy it is the corruption.
+>
+> This completes the pre-registration principle: pre-registration prevents **retrofitting**, and this
+> names the one legitimate amendment — premise falsified, amended before execution, change recorded.
+>
+> **Control-property note:** `tl-mosaic` was itself the **unrepresentative control** (its token holds
+> `read:user`; the fleet's correctly do not) — **and it caught that in its own evidence before anyone
+> else read it.**
+
 ### D-12 — a requested SAFETY flag was silently degraded, and I did not check
 
 I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.