docs(remediation): bank the credential resolution — four seats were misclassified, not one

Mos ruled (a): re-mint with read:user, fleet-wide pattern change. The finding was bigger than I framed
it. The same misreading had classified all FOUR seats in the credential reconciliation as REJECTED, and
all four tokens were valid — the server itemises the token's scopes in the 403 body, which is itself
proof the request authenticated, and repos/search returned 200 under all four. A genuinely dead token
returns 401, control-proved. Retractions delivered; all four resumed authoring.

What made this rulable before an incident rather than after one: the near-escalation on f10-coder was
caught and BANKED rather than shrugged off, and coder-mos1's 401/403 control completed it. A finding
recorded from a near-miss is what turned four wrongly-held seats into a same-day fix.

Standard seat token pattern becomes write:issue, write:repository, read:user. read:user is read-only
and about the actor itself — the marginal privilege is exactly the identity the read-back doctrine
already requires every authoring seat to verify, and least-privilege that blinds identity
self-verification fights the mission's own controls.

(a) and (b) answer different questions and both stay: read:user proves who you are, authored-artifact
read-back proves the write landed under that identity, which read:user alone cannot. Read-back remains
mandatory on authoring operations.

D-45 discipline preserved and recorded: the seat was told not to widen its own scope to make its check
pass, and the widening was the coordinator's decision made at the coordinator level. An audited party
must never relax its own audit — the fix is that someone else relaxes it, deliberately, on the record.

Adopted into doctrine on main: /user is a bad capability probe for least-privilege token classes, the
capability differential on an in-scope operation enters the seat-provisioning checklist, and verdict
classification happens on the error body, never the status code alone.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/TASKS.md

@@ -2025,6 +2025,37 @@ governs the raw-API path, the tea login governs the tea path, and the two can di
 > **Belongs in the seat-provisioning checklist, not only in this ledger.** `read:user` is an
 > **enhancement for mechanical self-checking, not a repair.**
 
+> **★★ RESOLUTION — RULED (a), FLEET-WIDE PATTERN CHANGE (Mos, 2026-08-05). AND THE BLAST RADIUS WAS
+> FOUR SEATS, NOT ONE.** The same misreading had classified **all four** seats in the credential
+> reconciliation as **REJECTED**. All four tokens were **VALID**: the server _itemises the token's
+> scopes_ in the 403 body — which is itself proof the request **authenticated** — and `repos`/`search`
+> returned 200 under all four. A genuinely dead token returns **401**, control-proved. Retractions
+> delivered; all four resumed authoring.
+>
+> **What made it rulable before an incident rather than after one:** the near-escalation on `f10-coder`
+> was caught and **banked** rather than shrugged off, and `coder-mos1`'s 401/403 control completed it.
+> A finding recorded from a near-miss is what turned four wrongly-held seats into a same-day fix.
+>
+> **Standard seat token pattern is now `write:issue, write:repository, read:user`** — new mints
+> immediately; existing seats re-mint at their next natural seam, `coder-mos1` first. Rationale:
+> `read:user` is **read-only and about the actor itself** — the marginal privilege is precisely the
+> identity the read-back doctrine already requires every authoring seat to verify. **Least-privilege
+> that blinds identity self-verification fights the mission's own controls.**
+>
+> **★ (a) AND (b) ANSWER DIFFERENT QUESTIONS — KEEP BOTH.** `read:user` proves **who you are**;
+> **authored-artifact READ-BACK proves the write LANDED UNDER THAT IDENTITY**, which `read:user` alone
+> cannot. Read-back therefore remains **MANDATORY on authoring operations** and is not superseded.
+>
+> **D-45 discipline preserved and recorded:** the seat was told **not** to widen its own scope to make
+> its check pass; **the widening was the coordinator's decision, made and recorded at the coordinator
+> level.** An audited party must never relax its own audit — the fix is that someone else relaxes it,
+> deliberately, on the record.
+>
+> **Adopted into doctrine on `main`:** `/user` is a **bad capability probe** for least-privilege token
+> classes; the **capability differential** (authenticated vs unauthenticated on an **in-scope**
+> operation) enters the seat-provisioning checklist; and **verdict classification happens on the ERROR
+> BODY, never the status code alone.**
+
 ### D-12 — a requested SAFETY flag was silently degraded, and I did not check
 
 I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.