diff --git a/docs/MDTODO/github-gitea-durable-source-authority.md b/docs/MDTODO/github-gitea-durable-source-authority.md
index 1e63233d..a2236b36 100644
--- a/docs/MDTODO/github-gitea-durable-source-authority.md
+++ b/docs/MDTODO/github-gitea-durable-source-authority.md
@@ -49,3 +49,7 @@
 ### R3.3
 
 依赖 R3.2，覆盖仓库缺失、ref 缺失、重复 delivery、controller 重启、retry exhaustion 与恢复测试；只用修复 PR merge 产生的新自动事件验收 resource bundle 获取成功，禁止人工 mirror、sync、flush、trigger 或 direct GitHub 补洞，完成任务后将详细报告写入[任务报告](./details/github-gitea-durable-source-authority/R3.3_Task_Report.md)。
+
+## R4 [in_progress]
+
+修复 [UniDesk #1933](https://github.com/pikasTech/unidesk/issues/1933) 暴露的 Gitea mirror 默认只读 plan 回归：恢复 repository-scoped targetRepos 计算，保持 mutation authority 不变，补充最小回归验证并由独立 Artificer PR 交付，完成任务后将详细报告写入[任务报告](./details/github-gitea-durable-source-authority/R4_Task_Report.md)。
diff --git a/scripts/src/cicd-delivery-authority.test.ts b/scripts/src/cicd-delivery-authority.test.ts
index a74b5c7d..e872342c 100644
--- a/scripts/src/cicd-delivery-authority.test.ts
+++ b/scripts/src/cicd-delivery-authority.test.ts
@@ -499,9 +499,13 @@ describe("migrated CLI 执行 guard 与提示清理", () => {
   });
 
   test("Gitea 与 mirror 默认 plan 只返回只读 Next", async () => {
+    const giteaPlan = await runPlatformInfraGiteaCommand({} as never, ["plan", "--target", "NC01", "--raw"]) as Record<string, unknown>;
+    const nc01MirrorPlan = await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "NC01", "--raw"]) as Record<string, unknown>;
+    const jd01MirrorPlan = await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "JD01", "--raw"]) as Record<string, unknown>;
     const plans = [
-      await runPlatformInfraGiteaCommand({} as never, ["plan", "--target", "NC01", "--raw"]),
-      await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "NC01", "--raw"]),
+      giteaPlan,
+      nc01MirrorPlan,
+      jd01MirrorPlan,
     ] as Record<string, unknown>[];
     for (const plan of plans) {
       expect(plan.mutation).toBe(false);
@@ -509,6 +513,8 @@ describe("migrated CLI 执行 guard 与提示清理", () => {
       expect(JSON.stringify(plan.next)).toContain("status");
       expect(JSON.stringify(plan.next)).toContain(PAC_AUTOMATIC_DELIVERY_REFERENCE);
     }
+    expect(JSON.stringify(nc01MirrorPlan.credentials)).toContain("github-upstream:selfmedia-nc01");
+    expect(JSON.stringify(jd01MirrorPlan.credentials)).not.toContain("github-upstream:selfmedia-nc01");
   });
 
   test("PaC history detail 只按唯一 consumer 生成 Next，四类前缀无默认 consumer 回退", () => {
diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts
index 0f01c99b..5cfb4e25 100644
--- a/scripts/src/platform-infra-gitea.ts
+++ b/scripts/src/platform-infra-gitea.ts
@@ -314,6 +314,7 @@ async function mirrorWebhookCommand(config: UniDeskConfig, args: string[]): Prom
 function mirrorPlan(options: CommonOptions): Record<string, unknown> {
   const gitea = readGiteaConfig();
   const target = resolveCommandTarget(gitea, options.targetId);
+  const targetRepos = repositoriesForTarget(gitea, target);
   return {
     ok: true,
     action: "platform-infra-gitea-mirror-plan",
@@ -321,7 +322,7 @@ function mirrorPlan(options: CommonOptions): Record<string, unknown> {
     target: targetSummary(target),
     sourceAuthority: sourceAuthoritySummary(gitea, target),
     responsibilities: gitea.sourceAuthority.responsibilities.map(responsibilitySummary),
-    repositories: repositoriesForTarget(gitea, target).map((repo) => repositorySummary(gitea, repo)),
+    repositories: targetRepos.map((repo) => repositorySummary(gitea, repo)),
     credentials: credentialSummaries(gitea, targetRepos),
     next: mirrorReadOnlyNextCommands(target.id),
   };