diff --git a/docs/titan_20_21_22_capacity_optimization.md b/docs/titan_20_21_22_capacity_optimization.md
index 524a6a24..7330f49f 100644
--- a/docs/titan_20_21_22_capacity_optimization.md
+++ b/docs/titan_20_21_22_capacity_optimization.md
@@ -430,7 +430,19 @@ scraped in this cluster (`node_exporter`, `DCGM`, cAdvisor `container_cpu_cfs_*`
 
 This session cannot apply the alert/dashboard PR, cannot trigger a synthetic
 transcode, and cannot restart or exec into `jellyfin` (RBAC is `get/list/
-watch` only, confirmed). As of this revision, Jenkins/VictoriaMetrics/Wger
+watch` only, confirmed). Checked three independent avenues before concluding
+this, not just RBAC: (1) `kubectl auth can-i create jobs/pods -n jellyfin`
+and `create pods -n jenkins` both `no`, `get/list secrets` cluster-wide and
+in `jellyfin` both `no` — no path to launch a load-gen Job or read a
+Jellyfin API key from its Vault-injected secret; (2) VictoriaMetrics has no
+`jellyfin_*`/session/transcode-named series at all (`/api/v1/label/__name__/values`
+checked directly) — only DCGM/cAdvisor/node_exporter give any Jellyfin-load
+signal; (3) `jellyfin.jellyfin.svc.cluster.local`'s public, unauthenticated
+`/System/Info/Public` responds `200` (reachable in-cluster) but `/Sessions`
+correctly requires an API key (`401`) — there is no read-only way to see
+active playback/transcode sessions without credentials this session does
+not have and should not attempt to obtain. As of this revision,
+Jenkins/VictoriaMetrics/Wger
 have been co-resident on titan-22 for ~1-3h (§4a) with zero Jellyfin impact,
 but zero GPU activity in that window either — so the one validation that
 actually matters (an active hardware transcode overlapping with real