diff --git a/CI-CD.md b/CI-CD.md
index 7fdf843..27fb502 100644
--- a/CI-CD.md
+++ b/CI-CD.md
@@ -170,7 +170,11 @@ Group 3 took it to `56` assertions over `21` charts. Its 19 come from six charts
 
 The fail path was exercised rather than assumed: a Service renamed in the route, a port the Service does not expose, a port left out entirely, an emptied `parentRefs` with the chart's own guard disabled, an overlay that renders no route, a run with zero assertions, and — for the pairing — both the redirect rule deleted outright and the redirect pointed at a path other than the one stripped; each produced a `FAIL` naming both sides and a non-zero exit.
 
-**Gitea #123 takes it to `58` over `21`.** `stalwart` grows a second route — the MTA-STS policy hosts — so that chart goes from **2** assertions to **4** while the chart count does not move. That is the ordinary way this figure grows now the sweep is done: a **converted chart gaining an object**, not a new chart. And it only counts because the overlay was extended to enter the new shape (`ci/httproute/stalwart.yaml` now carries an entry with a `clusterIssuer`, one without, and one host on a subdomain) — an overlay left alone would have added a route this test never rendered, which is the anti-vacuum rule biting on a *second* object inside a chart that already passes.
+**The MTA-STS routes of Gitea #123 add `2`**, the third of the three parallel rounds and the one that shows what this figure means from now on: `stalwart` goes from **2** assertions to **4** — one `parentRefs` and one `backendRefs` assertion for its new MTA-STS route — and **the chart count does not move at all.** Every earlier entry in this history grew because a chart *joined* the list; this is the first that grew because a chart already in it gained an **object**. That is the ordinary shape of the next one too, now the sweep is done.
+
+Measured under the same delta rule, and worth stating precisely because three branches were in flight at once: **`60` assertions over `22` charts**, read on a branch that **did** contain `rss-bridge` (it had merged by then) and did **not** contain the realm hostnames of #122. So `58 + 2`. Against the `62/22` above — which is `rss-bridge` plus #122 and not this round — the three deltas are `+2`, `+4` and `+2`, and the total once all three have landed is to be **read off the first run on `main` that holds all of them**, not added up here.
+
+And it only counts because the overlay was extended to enter the new shape (`ci/httproute/stalwart.yaml` carries an entry with a `clusterIssuer`, one without, and one host on a subdomain). An overlay left alone would have added a route this test never rendered — the anti-vacuum rule biting on a **second** object inside a chart that already passes, which is a gap no per-chart "has an overlay" check can see.
 
 Note which half that leaves uncovered: an overlay switches a chart into Gateway mode, so **the Ingress half of a both-modes feature is never rendered here.** For `stalwart`'s MTA-STS objects that half sits in `ci/stalwart/test-values.yaml` instead, where the install-test has a real API server accept them.