diff --git a/SCOPE.md b/SCOPE.md
index 5f042ea..da5ac8b 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -104,9 +104,21 @@ Keycloak interchangeability are not established.
   this was a real fix), and both approval service clients were verified live in an
   attended owner process, showing JWKS signature verification, exact claims,
   excess-scope and wrong-secret denial at a 900s lifetime
-  (`2026-09-09-keycape-verifier-admission.json`). Those receipts also decline what
-  they did not test: no real predecessor rotation and no observed wall-clock
-  expiry. The deployed image is older than this revision, so the
+  (`2026-09-09-keycape-verifier-admission.json`), independently confirmed by the
+  custody owner. That is live evidence for those two clients specifically —
+  more than a source claim, less than a general one. On the custody boundary:
+  client-side retrieval of those secrets is unadmitted and stays so, but the
+  attended operator path is not a client-side read and never required one;
+  conflating the two is what left this work recorded as waiting on a run that had
+  already happened. Those receipts also decline what they did not test: no real
+  predecessor rotation and no observed wall-clock expiry. Those name a **third
+  state** this document otherwise has no words for — *implemented and unproven*,
+  distinct from both missing and done. `verify-client`'s predecessor rejection is
+  written and unit-tested but has never run against a genuinely distinct
+  predecessor, so this repository holds a receipt that reads like rotation
+  evidence and is not. Both owners state that limit independently. Read "there is
+  a test" and "it has been exercised against the real thing" as separate claims
+  wherever this document makes one. The deployed image is older than this revision, so the
   authorization-code bindings, upstream verification, readiness, graceful
   shutdown and the two tenant-related changes are **not yet running anywhere** —
   see [operations](docs/operations.md), "Unreleased fail-closed startup changes".
diff --git a/history/2026-09-09-scope-reassessment.md b/history/2026-09-09-scope-reassessment.md
index 269b7bc..c833340 100644
--- a/history/2026-09-09-scope-reassessment.md
+++ b/history/2026-09-09-scope-reassessment.md
@@ -72,7 +72,18 @@ stating exactly:
   900s lifetime, no credential values emitted.
 
 Those receipts also decline what they did not test — no real predecessor rotation,
-no observed wall-clock expiry — and this document declines it with them.
+no observed wall-clock expiry — and this document declines it with them. They also
+force a distinction SCOPE had no vocabulary for: *implemented and unproven*, a
+third state between missing and done. `verify-client`'s predecessor rejection is
+written and unit-tested and has never run against a genuinely distinct
+predecessor, so the repository holds a receipt that reads like rotation evidence
+and is not. Both owners state that limit independently, which is why it belongs
+in SCOPE rather than only in a workplan.
+
+One framing correction worth propagating, from the custody owner: client-side
+retrieval of those secrets is unadmitted and remains so, but the attended
+operator path is not a client-side read and never required one. Conflating the
+two is what left T02 recorded here as waiting on a run that had already happened.
 
 The deployed image predates this revision, so the authorization-code bindings,
 upstream verification, readiness, graceful shutdown and both tenant-related