model card: three findings, not two — the third is the binder artwork note

Re-counted on a fresh clone: 23 known, 1 not yet known, 3 findings. The third finding is the ledger-carried binder note that the artwork was supplied by sha256 and is not pinned; it prints from any clone, not only from this mirror.

README.md

@@ -45,12 +45,14 @@ sha256sum -c PROOF.sha256          # 51 files; PROOF.md explains what each one i
 python3 bind/savante_verify.py .   # needs pycryptodome; no network
 ```
 
-Expected **from this mirror**: `VERDICT: APPROVE_WITH_CONDITIONS`, **23 checks known, 1 not yet known, 2
+Expected **from this mirror**: `VERDICT: APPROVE_WITH_CONDITIONS`, **23 checks known, 1 not yet known, 3
 findings**, exit 1 (measured 2026-09-17 on a fresh `git clone` of this repository).
 
 - The **not yet known** is step 5, the md5 of `savante.persona` against its mindX mirror. No stranger can
   perform it; the mindX repository is private.
-- The **two findings** are the price of a mirror: this repository is one squashed commit, so it carries none of
+- One **finding** is the binder's own note, carried in the ledger and printed from any clone: the artwork was
+  supplied with `--image`, recorded by sha256, not pinned.
+- The **other two findings** are the price of a mirror: this repository is one squashed commit, so it carries none of
   the canon's git history. `savante_verify.py` therefore cannot resolve the manifest's locator commit
   (`30d1e8c`) or re-read generation 6's manifest to confirm the lineage, and says so instead of assuming.
   Clone the canon from GitHub, or pass `--parent-manifest`, and both become known.