diff --git a/docs/ci-cd.md b/docs/ci-cd.md
index 3e7fd56b9..e73683619 100644
--- a/docs/ci-cd.md
+++ b/docs/ci-cd.md
@@ -2452,9 +2452,9 @@ because they send you to different places:
 | HTTP 200 with a manifest body | green | resolves |
 | HTTP 404 | **red** | `IS GONE` — rebuild the tag (recovery above) |
 | HTTP 200, body is not a manifest | **red** | something is answering for the registry (proxy, login page) |
-| 401 / 403 after a token was obtained | **red** | the registry `refused an ANONYMOUS read` — check that `timothy/ersatztv` and its `ersatztv-ci` package are still PUBLIC |
-| the challenge names no realm, or the token endpoint answers with no token | **red** | `could NOT OBTAIN an anonymous pull token` — worded apart on purpose: this is about the registry's token endpoint, not the package's visibility. Not retried |
-| 401 / 403 carrying NO `Www-Authenticate` challenge at all | **red** | `refused an ANONYMOUS read ... WITHOUT issuing a Bearer challenge` — no token was ever requested, because `probe` enters the token leg on a `401` only. An answer about ACCESS to the registry (visibility, or something answering for it) |
+| 401 / 403 that survives a bearer the run actually obtained | **red** | the registry `refused an ANONYMOUS read ... even after a Bearer token was obtained` — about the PACKAGE: check that `timothy/ersatztv` and its `ersatztv-ci` package are still PUBLIC |
+| 401 whose token leg yielded no bearer — no `Www-Authenticate` at all, a challenge naming no realm, or a token endpoint answering with no token | **red** | `could NOT OBTAIN an anonymous pull token` — about the registry's TOKEN ENDPOINT, not the package's visibility. Not retried |
+| 403 on the FIRST read, before any token leg — `probe` enters it on a `401` only, so nothing was ever asked for | **red** | `refused an ANONYMOUS read ... WITHOUT issuing a Bearer challenge` — about ACCESS to the registry: visibility, or something answering for it |
 | anything else (5xx, unreachable, no `curl`) | **red** after `ETV_CI_ATTEMPTS` tries | `could NOT VERIFY` — check the registry's health, NOT the pin |
 
 **The three refusal rows say only what actually ran**, and that is the point of wording them apart
diff --git a/scripts/ci-toolchain-image-resolves.sh b/scripts/ci-toolchain-image-resolves.sh
index 95abe988a..edf8265de 100755
--- a/scripts/ci-toolchain-image-resolves.sh
+++ b/scripts/ci-toolchain-image-resolves.sh
@@ -202,10 +202,10 @@ for pin in $pins; do
       #     contexts;
       #   * a challenge that yielded no usable token is an infrastructure answer about the TOKEN
       #     ENDPOINT;
-      #   * a refusal carrying NO Bearer challenge at all never reached the token leg — `probe`
-      #     enters it on a 401 only, so a first-read 403 (or a 401 with no `Www-Authenticate`, which
-      #     the token leg then abandons) leaves `token` empty having asked for nothing. This is an
-      #     answer about ACCESS to the registry, and the branch order below is `token` first
+      #   * a FIRST-READ 403 never reached the token leg at all — `probe` enters it on a 401 only —
+      #     so nothing was ever asked for. This is an answer about ACCESS to the registry. Note the
+      #     boundary: a 401 carrying no `Www-Authenticate` DOES enter the token leg and abandon it,
+      #     so it lands in the row above, not this one. The branch order below is `token` first
       #     precisely so this case cannot borrow either of the other two mechanisms.
       #
       # A failed token leg is NOT retried, deliberately: `token_leg_done` is set before the attempt