diff --git a/findings/subsystems/spy-detection-roll.md b/findings/subsystems/spy-detection-roll.md
index e4aa8e2..7189cbe 100644
--- a/findings/subsystems/spy-detection-roll.md
+++ b/findings/subsystems/spy-detection-roll.md
@@ -646,6 +646,18 @@ touched** — this lane needed no new verbs, which is the first VM lane in a whi
 * **Ghidra's size for `0x008877b0` is 1,869 bytes; the next function starts at `0x00887f30`, i.e.
   1,920.** The detection roll at `0x00887c8a` is inside both, but the 51-byte shortfall is rule 17
   again, on the very function this lane exists to read.
+* **This lane's own pre-registered §1.1, corrected here rather than edited there (rule 12).**
+  `docs/AS-predictions.md` calls `0x0083ce50` "the deploy validator" and says its `0x1000000`
+  refusal bit *is* the `Can't deploy spy: Spy requires an asteroid belt to hide.` message. Read
+  properly afterwards, `0x0083ce50` is a **shared placement validator** with ~21 refusal bits
+  (colonise, mine, dump ore, too many things present, …), reached from `0x00760ce0` and the order
+  path `0x00849460`, and it is **not on `ServerSpyManager::DeploySpy`'s call chain at all** — that
+  chain is `SHIPACTION_DEPLOYSPY 0x0078c930` → vtable slot 7 `0x00887410` → `AddSpy`, and it never
+  calls `0x00743f80`. What survives, and is all §1.2 needs, is that **`0x00743f80` bit 0 gates a
+  belt-shaped refusal there and the detection roll here**; *which* action that refusal belongs to
+  was over-claimed and is not established. The empirical half is unaffected: `Deploy Spy` was
+  offered and accepted at a belt system, and the corpus agreement of `ARes2 > 0` with `TerrFl & 1`
+  is 616 of 616.
 
 ---