diff --git a/docs/remote-mcp/threat-model-anchors.json b/docs/remote-mcp/threat-model-anchors.json
index 3aa0eb6..eaefd35 100644
--- a/docs/remote-mcp/threat-model-anchors.json
+++ b/docs/remote-mcp/threat-model-anchors.json
@@ -8,7 +8,7 @@
     "document. #930's inventory had no such guard and its gitea_mcp_server.py",
     "anchors drifted between 7bf4f125 and aad5c8b4."
   ],
-  "generated_against_commit": "ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0",
+  "generated_against_commit": "1dd30ecb1508b559868c2d5d94367bc055d5138e",
   "anchors": [
     {
       "anchor": "gitea_mcp_server.py:25087",
diff --git a/docs/remote-mcp/threat-model.md b/docs/remote-mcp/threat-model.md
index 3d67961..4f2c2f5 100644
--- a/docs/remote-mcp/threat-model.md
+++ b/docs/remote-mcp/threat-model.md
@@ -5,7 +5,7 @@ What the adversary is, what each boundary protects, and which services may share
 - **Issue:** #956 (Remote-MCP threat model), child of epic #929, cross-linked to #955.
 - **Depends on:** #930 (closed) — `docs/remote-mcp/coupling-inventory.md`.
 - **Blocks:** #932, #933, #934, #938.
-- **Generated against commit:** `ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0` (#708's
+- **Generated against commit:** `1dd30ecb1508b559868c2d5d94367bc055d5138e` (#708's
   namespace-attachment gate). Originally generated against
   `aad5c8b42361d380a8eeb07b94b90815e594c2c5` (`master`), re-anchored at
   `a143cd065ba06e1a2bdc5143a19ec156e53650ef` when #931's transport bind seam shifted the
@@ -75,7 +75,7 @@ authenticate the *caller*, not the *intent*.
 ## 3. Trust boundaries
 
 "Crossing requires today" is what the code actually enforces at
-`ca5f078d8a575ea3e2991771f8b4ea85e3dcaaa0`, not what the design intends.
+`1dd30ecb1508b559868c2d5d94367bc055d5138e`, not what the design intends.
 
 | ID | Boundary | Protects | Crossing requires today | Crossing must require remotely |
 | -- | -------- | -------- | ----------------------- | ------------------------------ |