Over-broad OAuth scopes issued

Audit logs reveal that 3 weeks ago a bug in your OAuth consent flow let a partner app whose tokens you issue request and receive broader scopes than approved (it asked for read:tickets, was granted read:tickets admin:org due to a scope-merge bug). ~2,000 access/refresh tokens with the over-broad scope are now live across many customer orgs; some were minted to a partner that has since had a security incident. You must claw back the excess scope without breaking the partner's legitimate read:tickets use, and without forcing every customer to re-consent if you can avoid it. How do you triage and remediate?