diff --git a/context/build-and-run.md b/context/build-and-run.md
index e7bb6e8..94727ea 100644
--- a/context/build-and-run.md
+++ b/context/build-and-run.md
@@ -200,8 +200,13 @@ default (`-DBT_STEAM=ON` is the documented dev-checkout state). `BT_EXPIRE=ON` (
 zip somewhere clean and booting it with no repo present — that is what catches a missing runtime DLL.
 
 ⚠ **ANTIVIRUS SMOKE TEST — do this before handing a zip to anyone (#190, 2026-08-15).** Windows
-Defender's ML classifier flagged `btl4.exe` as `Trojan:Win32/Bearfoos.A!ml` and DELETED it. This is
-a false positive, and it is **per-binary, not per-project**: of 17 archived builds extracted side by
+Defender's ML classifier flagged `btl4.exe` as `Trojan:Win32/Bearfoos.A!ml` and DELETED it. False
+positive, and **it corrected itself within hours** — the verdict lived in definition set
+1.457.172.0 (8/14 19:34) and was gone by 1.457.177.0 (8/15 03:41), same binary passing cleanly;
+a second tester on midnight-updated definitions never saw it at all. **The lesson is the response,
+not the incident: an ML verdict is a time-varying opinion about a file, not a fact about it — update
+definitions and retest BEFORE warning testers, resigning, or rebuilding.** It is also
+**per-binary, not per-project**: of 17 archived builds extracted side by
 side, only **4.11.957** was condemned — 622 through 913 all survived — plus that evening's fresh
 build. Our exe fits the profile that trips these classifiers (unsigned, rebuilt every session so it
 never accrues reputation, opens raw sockets, enumerates processes, writes beside itself), so any