diff --git a/docs/TASK-PERMISSION-AND-TAINT.md b/docs/TASK-PERMISSION-AND-TAINT.md
index 78e8d34..34ef6b6 100644
--- a/docs/TASK-PERMISSION-AND-TAINT.md
+++ b/docs/TASK-PERMISSION-AND-TAINT.md
@@ -138,6 +138,17 @@ intersection.
    cases, and the shell never refuses. Limits pinned by that table: a literal
    secret in a URL is not an expansion, and a subdomain of a tainted host
    (`www.iana.org` vs `iana.org`) is not matched.
+
+   **Live, mission 01a0cb8c.** The agent fetched `example.com`, then made six
+   literal requests to the IANA pages and four with `?t=$(date +%s)`. Shadow
+   recorded exactly the four expansion calls as `untrusted-target` and none of
+   the six. The first thing to watch: 5 of the 8 tainted hosts
+   (`www.google.com`, `www.googleapis.com`, …) came from `www.iana.org`'s
+   `Content-Security-Policy` **response header**, not its body. That is
+   correct by the letter (fetched output named them) and noisy in practice.
+   An agent later calling a Google API with `$KEY` in the URL would be
+   recorded. If shadow traffic shows that, the fix is to stop reading header
+   lines other than `Location`. Stage 3 waits on that evidence.
 3. Enforce on the **container tier**, where public egress is open. On the VM
    tier it is defence in depth behind an allow-list that already holds.