diff --git a/docs/remediation/TASKS.md b/docs/remediation/TASKS.md
index 439bc92c..fc1506bd 100644
--- a/docs/remediation/TASKS.md
+++ b/docs/remediation/TASKS.md
@@ -2025,6 +2025,37 @@ governs the raw-API path, the tea login governs the tea path, and the two can di
 > **Belongs in the seat-provisioning checklist, not only in this ledger.** `read:user` is an
 > **enhancement for mechanical self-checking, not a repair.**
 
+> **★★ RESOLUTION — RULED (a), FLEET-WIDE PATTERN CHANGE (Mos, 2026-08-05). AND THE BLAST RADIUS WAS
+> FOUR SEATS, NOT ONE.** The same misreading had classified **all four** seats in the credential
+> reconciliation as **REJECTED**. All four tokens were **VALID**: the server _itemises the token's
+> scopes_ in the 403 body — which is itself proof the request **authenticated** — and `repos`/`search`
+> returned 200 under all four. A genuinely dead token returns **401**, control-proved. Retractions
+> delivered; all four resumed authoring.
+>
+> **What made it rulable before an incident rather than after one:** the near-escalation on `f10-coder`
+> was caught and **banked** rather than shrugged off, and `coder-mos1`'s 401/403 control completed it.
+> A finding recorded from a near-miss is what turned four wrongly-held seats into a same-day fix.
+>
+> **Standard seat token pattern is now `write:issue, write:repository, read:user`** — new mints
+> immediately; existing seats re-mint at their next natural seam, `coder-mos1` first. Rationale:
+> `read:user` is **read-only and about the actor itself** — the marginal privilege is precisely the
+> identity the read-back doctrine already requires every authoring seat to verify. **Least-privilege
+> that blinds identity self-verification fights the mission's own controls.**
+>
+> **★ (a) AND (b) ANSWER DIFFERENT QUESTIONS — KEEP BOTH.** `read:user` proves **who you are**;
+> **authored-artifact READ-BACK proves the write LANDED UNDER THAT IDENTITY**, which `read:user` alone
+> cannot. Read-back therefore remains **MANDATORY on authoring operations** and is not superseded.
+>
+> **D-45 discipline preserved and recorded:** the seat was told **not** to widen its own scope to make
+> its check pass; **the widening was the coordinator's decision, made and recorded at the coordinator
+> level.** An audited party must never relax its own audit — the fix is that someone else relaxes it,
+> deliberately, on the record.
+>
+> **Adopted into doctrine on `main`:** `/user` is a **bad capability probe** for least-privilege token
+> classes; the **capability differential** (authenticated vs unauthenticated on an **in-scope**
+> operation) enters the seat-provisioning checklist; and **verdict classification happens on the ERROR
+> BODY, never the status code alone.**
+
 ### D-12 — a requested SAFETY flag was silently degraded, and I did not check
 
 I created PR #1027 with `pr-create.sh ... -d` (draft) because it carries **partial, unproven work**.