diff --git a/hive-c0re/src/forge/users.rs b/hive-c0re/src/forge/users.rs
index 5c83d49e..467c5dfe 100644
--- a/hive-c0re/src/forge/users.rs
+++ b/hive-c0re/src/forge/users.rs
@@ -29,12 +29,13 @@ use crate::paths::FORGE_CORE_TOKEN as CORE_TOKEN_PATH;
 // helpers in `hive_sh4re::assets`. The `agent-configs.png` is
 // rendered from its SVG during the `hyperhive-assets` derivation's
 // build.
-/// Per-agent token scopes (broad-but-not-admin). See
-/// `docs/forge.md::Token scopes` for the per-scope rationale.
-/// `pub(super)` — also reused by `extra.rs`'s external-forge
-/// provisioning so a granted agent gets the same scope set on an
-/// extra forge as on the internal one.
-pub(super) const TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
+/// Per-agent token scopes (broad-but-not-admin) for tokens hive-c0re
+/// mints itself on the **internal** forge. See `docs/forge.md::Token
+/// scopes` for the per-scope rationale. Not `pub(super)` — external
+/// forges (`dashboard/extra_forges.rs`) take an operator-pasted token
+/// verbatim, so their scope is whatever the operator's remote account
+/// happened to grant; we never mint there and don't need to know it.
+const TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
 
 /// Bootstrap `core` token scopes — adds `read:admin,write:admin` on
 /// top of `TOKEN_SCOPES` so the host daemon can drive