diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index 01042bac..f75f9851 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -327,10 +327,14 @@ is what the autopilot needs in order to CHOOSE a target. One run in:
   🔴 **Reading the wait target from the log is blocked by cost**:
   `KeWaitForSingleObject` is `kHighFrequency` and silent without
   `--log_high_frequency_kernel_calls=true`, and *with* it the emulator is 17
-  minutes into a boot with a **black screen** and 175 MB of log. **Next, cheapest
-  first:** a targeted Canary log line that fires only after a wait has timed out
-  N times on the same thread — self-selecting, free on a healthy run, one small
-  patch plus a build that is already configured. `frozen.py` detects the state in one call; `ob_hunt.py` /
+  minutes into a boot with a **black screen** and 175 MB of log. ✅ **Built** (canary `auto/re-wait-timeout-probe` `820696c11`,
+  `--log_stuck_waits=true`, binary at `/sylph-home/re/bin/waitprobe/`): counts
+  consecutive timeouts on the same object per thread and logs at 100 then every
+  500. **Healthy-run control measured** — 27 lines over 25 minutes, all one
+  thread polling one Event at guest VA `BE56BB5C` with a ~30 ms timeout, so the
+  freeze signal is a **new (thread, object) pair**, not the presence of output.
+  🟡 **Next:** catch a freeze with it — the run that measured the control never
+  froze. `frozen.py` detects the state in one call; `ob_hunt.py` /
   `ob_flag.py` abort on it. **Roughly two runs in three.**
   See [`mission-freeze-resume-spin.md`](mission-freeze-resume-spin.md).