diff --git a/REPORT-seo-felho-tarhely-2026-10-14.md b/REPORT-seo-felho-tarhely-2026-10-14.md
index f60cb91d..9cb540e6 100644
--- a/REPORT-seo-felho-tarhely-2026-10-14.md
+++ b/REPORT-seo-felho-tarhely-2026-10-14.md
@@ -157,6 +157,33 @@ pristine `git worktree` of `origin/main`:
 The last one is a real open problem, it is just not this session's. It is left for whoever baked that
 golden.
 
+**Re-run on DooPlex, at the exact pushed SHA** (`e62fc00e`, a fresh clone from Gitea, so the files are
+in their canonical LF form rather than this workstation's CRLF): **`site` OK**, `instructions` OK,
+`due-checks` / `one-register` / `closed-register` / `register-shape` / `observations` / `stands` /
+`poster-facts` OK. `script-tests` FAILED there too, on four tests: `test_gate_decoys`,
+`test_golden_currency_gate`, `test_guide_quote_gate`, `test_repo_gates`.
+
+**Control, because "not mine" is a claim that needs one:** the same gate at the **parent commit**
+`6e0643f6` fails **the same four tests, with the same return codes**. So `script-tests` is
+pre-existing and this change did not move it. (The remaining INCONCLUSIVE gates — `hub-copy`,
+`wire-contract`, `guide-quote`, `decoy-coverage`, `golden-currency` — read sibling repositories that a
+bare clone does not have.)
+
+### CI, and what I can and cannot claim
+
+**CI did fail on my first push, and the alarm was right.** `[felhom CI] gates FAILED`, 2026-10-14
+16:58:46Z, commit **`a2ca6eb4`**, run 1021, elapsed 394 s — that is the duplicate-R-1033 commit. I had
+already found and fixed the same failure locally before the mail arrived; the two agree on the cause.
+
+**No alarm arrived for `a98cddc4` (the fix) or `e62fc00e` (the audit evidence)** within the window a
+394-second run needs. Since CI alarms on failure and did alarm for `a2ca6eb4`, that silence is
+evidence — but **an absent alarm is not a confirmation**, and this project's rule is to say so:
+**CI is NOT confirmed by run id for the final commit.** No credential in the store opens Gitea's
+Actions API (measured 2026-10-11 by an earlier session; `GET …/actions/jobs` returns 401 for every key
+that exists, while the repo itself answers 200 unauthenticated). The documented substitutes are what I
+used: the same gate command, run on DooPlex at the pushed SHA, plus the mailbox as a different
+channel. **Asking for a Gitea API token would close this properly** and is worth doing.
+
 ## 6. Register
 
 | | |