diff --git a/openspec/changes/cropper-token-auth/tasks.md b/openspec/changes/cropper-token-auth/tasks.md
index fb55bdd..717e042 100644
--- a/openspec/changes/cropper-token-auth/tasks.md
+++ b/openspec/changes/cropper-token-auth/tasks.md
@@ -11,5 +11,8 @@
 - [x] 4. Tests: save carries the bearer token and no query auth; the resolved
   domain wins over the body; unsafe values are refused; no OTP field in the
   served page; queue load exposes `domainCode` (46 tests pass).
-- [ ] 5. Deploy a2loft and this app, then a field pass: load a queued picture →
+- [x] 5. Deploy a2loft and this app, then a field pass: load a queued picture →
   save with no OTP → confirm the picture lands attributed to the token's phone.
+  Verified: loaded upload 0b90075b-… (panel showed "Domain ucth · picture target
+  core"), no OTP field, save POSTed with the session token and no query auth,
+  answered "Saved — Picture saved for +2348068287222" and reset the panel.