diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1094fc9..a87dcfc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,13 @@
 > self-update and destroyed the control the proof rested on. **`release-complete` convicted on the
 > release heading and was right to** — the answer was to stop claiming a release, not to bypass the
 > gate. See R-347.
+>
+> **The fleet runs these exact bytes.** Both demo boxes were first given a hand build made during the
+> proof — same source, same version string, **different bytes** (`256e0829…`), because
+> `release-agent.sh` builds with `-trimpath -buildvcs=false` and a hand build does not. Nothing would
+> have corrected that: the boxes already reported `0.130.0`, so self-update saw the vouched version as
+> installed and would have done nothing, forever. Both were reinstalled from the **downloaded package**
+> and now report `a56a92a7…`. Filed as **R-349**, because every prove-then-publish train hits it.
 
 **What was measured, before anything was changed.** Between 2026-08-18 09:51:22Z and 2026-08-20
 08:02:13Z, ep0's PBS proxy accumulated **388 established connections** — 194 from each demo box, on a