diff --git a/REPORT.md b/REPORT.md
index 2737b7e..a673ed8 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -92,14 +92,25 @@ resolve either base image; DooPlex holds no Docker Hub login. Both were pulled f
 official Docker Hub mirror** and retagged locally, after which `build.sh` ran unmodified:
 
 ```
-mirror.gcr.io/library/debian:bookworm-slim      sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
-mirror.gcr.io/library/golang:1.24-bookworm      sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac
+debian:bookworm-slim      image id  sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
+golang:1.24-bookworm      image id  sha256:1a6d4452c65dea36aac2e2d606b01b4a029ec90cc1ae53890540ce6173ea77ac
 ```
 
-**GRADED HONESTLY: that these are byte-identical to Docker Hub's is KNOWN, not MEASURED here** — the
-throttle was still in force at the end of the session, so `docker manifest inspect` could not be run
-against Hub for the comparison. The digests are recorded above precisely so the check is one command
-whenever the window clears. No host configuration was changed and no daemon was restarted.
+**MEASURED — the identity claim is no longer taken on trust.** The throttle cleared 40 minutes later
+and the check was run rather than left for someone else:
+
+- `docker pull docker.io/library/debian:bookworm-slim` and `…/golang:1.24-bookworm` both answered
+  **`Status: Image is up to date`**, i.e. **Docker Hub's own manifest resolved to the images already
+  local — the ones the mirror supplied and the ones 0.233.0 was built from.** The image ids above are
+  unchanged after the Hub pull. That is the decisive test: same bytes, by Docker's own resolution.
+- Independently, the two manifest indexes are identical between the registries: `sha256` of the
+  `docker manifest inspect` body is `959bc47a76ff713a…` (debian) and `de3a17b36657e232…` (golang) on
+  **both** `docker.io/library/…` and `mirror.gcr.io/library/…`.
+
+**So the shipped 0.233.0 image is byte-for-byte what a Docker-Hub build would have produced.** No host
+configuration was changed and no daemon was restarted. (Note for the next reader: the two `sha256`
+values above are local IMAGE IDs, not manifest-list digests — the two are easy to confuse and were
+confused once during this check.)
 
 ## 6. Live validation — what was proven, and by which method