diff --git a/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md b/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md
index 5bdbdfa7..105707e4 100644
--- a/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md
+++ b/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md
@@ -88,7 +88,10 @@ mesh-catalog pull request 143, in the `postgres` module:
 4. **Reconciled every minute, on every database.** Each grant the reader holds that is not declared is
    revoked as the role that granted it, because a superuser's revoke acts as the table's owner and
    leaves a grant made by another role holding grant option. The grants are then read back, and anything
-   the reader still holds that is not declared is reported as a failure, never as revoked. Declared
+   the reader still holds that is not declared is reported as a failure with its reason, and only what
+   the read-back shows gone is reported as revoked. If the reader was given a privilege with grant
+   option and passed it on, a plain revoke fails, and the pass revokes with `CASCADE`, which reaches only
+   the grants that came from the reader. Declared
    columns that are missing are granted. The reader's role is altered only when an attribute, a setting
    or its password has drifted, so its password is not sent every minute. `postgres_reader_grants`
    answers the last pass, by name only.