diff --git a/scripts/tests/test_ci_toolchain_image_resolves.py b/scripts/tests/test_ci_toolchain_image_resolves.py
index b974186c0..181eab4ff 100644
--- a/scripts/tests/test_ci_toolchain_image_resolves.py
+++ b/scripts/tests/test_ci_toolchain_image_resolves.py
@@ -299,7 +299,7 @@ def test_a_refusal_with_NO_CHALLENGE_never_claims_a_token_was_obtained(preflight
 
     `probe` enters the token leg on a `401` only, so a registry answering `403` on the first read —
     or a `401` carrying no `Www-Authenticate` — leaves the script with no token having asked for
-    nothing. Measured 2026-09-05 on the predecessor at 59003d5a3, the `403` shape reported "even
+    nothing. Measured 2026-09-05 on the predecessor of this commit, the `403` shape reported "even
     after a Bearer token was obtained", which sends an operator to package visibility on evidence
     that does not exist (`dont-narrate-mechanisms-you-didnt-measure`). The two codes are BOTH driven
     because they take different paths: the challenge-less `401` still enters and abandons the token
diff --git a/scripts/tests/test_workflow_persist_credentials.py b/scripts/tests/test_workflow_persist_credentials.py
index cfad85b07..11c09b7a8 100644
--- a/scripts/tests/test_workflow_persist_credentials.py
+++ b/scripts/tests/test_workflow_persist_credentials.py
@@ -523,7 +523,8 @@ def test_the_DOCUMENT_walk_finds_every_secret_reference_the_TEXT_does() -> None:
     loader drops) is then a disagreement, and the guard says so instead of reporting clean.
 
     IT COUNTS OCCURRENCES, IT DOES NOT COMPARE NAME SETS, and that is the load-bearing part rather
-    than a refinement. Measured 2026-09-05 on the shipped tree at 59003d5a3: hoisting
+    than a refinement. Measured 2026-09-05 against the predecessor of this commit — the guard as it
+    walked `jobs.<id>` only and compared per-file NAME SETS — hoisting
     `ETV_REGISTRY_AUTH: ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}` into
     `docker-build.yml`'s root `env:` left a set-comparison cross-check GREEN (`14 passed`), because
     `build` legitimately keeps naming both names — the two halves cancelled and the check could only
@@ -711,9 +712,9 @@ def test_the_collector_reports_a_WORKFLOW_SCOPE_reference_no_job_if_can_reach()
 def test_MUTATION_a_WORKFLOW_LEVEL_env_in_the_SHIPPED_workflow_is_DETECTED() -> None:
     """Drives the SHIPPED `docker-build.yml`, hoisting the credential to workflow scope.
 
-    This is the mutation that a name-set cross-check could not see (measured 2026-09-05 at
-    59003d5a3: `14 passed`, rc=0) — `build` already names both halves, so a second copy at root
-    changed no NAME. It is exercised on the real file rather than a synthetic document for the same
+    This is the mutation that a name-set cross-check could not see (measured 2026-09-05 against the
+    predecessor of this commit: `14 passed`, rc=0) — `build` already names both halves, so a second
+    copy at root changed no NAME. It is exercised on the real file rather than a synthetic document for the same
     reason `test_MUTATION_the_BUILD_job_losing_its_route_EXCLUSION_is_DETECTED` is: `docker-build.yml`
     is the file the invariant is about, and a fixture would only prove the collector works on a
     document this repo does not ship.