diff --git a/VALIDATION.md b/VALIDATION.md
index 013e77f..ef58cd2 100644
--- a/VALIDATION.md
+++ b/VALIDATION.md
@@ -1,30 +1,10 @@
 # Verification report
 
-## Artifact-level evidence
+## Artifact evidence
+The repository contains the complete service contract, implementation, tests, dependency metadata, container packaging, and operator documentation for steps 0–6. Tests specifically cover CRUD, current status, liveness/readiness, environment validation, successful/error checks, DNS private-address rejection, redirect revalidation, and query-log redaction.
 
-The repository contains inspectable source, tests, configuration, documentation, and deterministic validation commands. Tests use `httpx.MockTransport` and injected DNS resolvers, so they require no external network. The test assertions cover CRUD, atomic duplicate creation, capacity, status persistence, operational routes, public/non-public DNS answers, mixed DNS answers, redirect revalidation, status/latency, and URL/log redaction.
+## Executed-check status
+Generation in this environment did **not** provide a shell/container executor. Therefore `ruff format --check .`, `ruff check .`, `mypy app`, `pytest -q`, `docker build`, container startup, and HTTP smoke tests were **not executed**, and no passing result is claimed. The exact validator commands are documented in README and should be run by the downstream validator.
 
-## Execution status
-
-The generation interface available for this delivery can create and commit files but exposes no shell, Docker daemon, or command-execution facility. Consequently, it would be misleading to claim that formatting, static checks, tests, image build, startup, or smoke tests were executed here. They are **not executed in this environment**.
-
-A validator with Python and Docker can execute the exact sequence below:
-
-```bash
-python -m pip install -e '.[dev]'
-ruff format --check .
-ruff check .
-mypy src
-pytest -q
-docker build -t endpoint-monitor .
-docker run --rm -d --name endpoint-monitor-smoke -p 8000:8000 endpoint-monitor
-python -c "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8000/healthz').status == 200"
-python -c "import urllib.request; assert urllib.request.urlopen('http://127.0.0.1:8000/readyz').status == 200"
-docker rm -f endpoint-monitor-smoke
-```
-
-`make verify` runs format checking, lint, strict typing, and tests. `make image` builds the image.
-
-## Operational limitations
-
-Data disappears on restart. Multiple workers/containers have independent stores and inconsistent monitor views. Use one worker only. Durable or horizontally scaled deployment requires shared storage, coordination, and a production egress control. Application DNS validation has a documented DNS-rebinding TOCTOU window; an egress proxy/firewall is required as the authoritative SSRF boundary.
+## Known limitations
+Storage is process-local and volatile. Use one worker only; restart loses state and replicas do not coordinate. DNS policy validation and the HTTP connection use separate resolutions, leaving a DNS-rebinding TOCTOU gap; production should additionally enforce an egress firewall/proxy. No external readiness dependency exists, so readiness indicates successful application initialization only.