diff --git a/CHANGELOG.md b/CHANGELOG.md
index b93463506..9da7ab543 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,8 @@ Main run 37345275258 of `cso-runtime-images.yml` staged every image, but eight `
 - **Dependency installs get a bounded longer ceiling.** The Rails fixture's lockfile lists only the `ruby` platform, so `bundle install --local` compiles nokogiri, sqlite3 and pg. At the app container's 0.85 CPU share that takes about 385 seconds, past the 300-second limit on one command. Dependency fetch and install commands in the preparation phases now get `PREPARATION_COMMAND_TIMEOUT_MS` (900 seconds). Every other command keeps 300 seconds, both stay inside the journey deadline, and a free test pins which calls can ask for the longer ceiling. The CPU share and `ISOLATION_POLICY_HASH` are unchanged.
 - **Export refusals name their reason.** A prepared-tree export the helper refuses now fails with `PREPARED_EXPORT_REJECTED`, the helper's exit status and its fixed reason or filesystem errno. Target paths are never included, and nothing retries. One unexplained refusal was seen locally in 20 exports, so a recurrence on CI will now say why.
 
+- **The `/cso --diff` eval accepts every correct name for the webhook bug.** `cso-diff-mode` matched only `signature|authenticat|forg` in the root cause and impact, so a correct finding titled "no authenticity verification" failed it. It now also matches `authentic`, `spoof` and `hmac`, and checks the finding title. A solo panel on main measured the case at 10/10 with and without the qualified scanner images available.
+
 The images change (`/opt/cso/preparation` and the Node recipe), so qualification needs a fresh staging run on main.
 
 ## [1.91.27.0] - 2026-10-05
diff --git a/test/skill-e2e-cso.test.ts b/test/skill-e2e-cso.test.ts
index ad702779f..e01473e50 100644
--- a/test/skill-e2e-cso.test.ts
+++ b/test/skill-e2e-cso.test.ts
@@ -178,7 +178,7 @@ http.createServer((req, res) => {
         expect(report.policy.diff).toBe(true);
         expect(report.policy.base).toBe('main');
         expect(report.source.baseCommit).toBe(git(f.repo, 'rev-parse', 'main').trim());
-        expect(report.findings.some(item => item.location.path === 'webhook.js' && /signature|authenticat|forg/i.test(`${item.rootCause} ${item.impact}`))).toBe(true);
+        expect(report.findings.some(item => item.location.path === 'webhook.js' && /signature|authentic|forg|spoof|hmac/i.test(`${item.title} ${item.rootCause} ${item.impact}`))).toBe(true);
         expect(report.findings.every(item => item.location.path === 'webhook.js')).toBe(true);
         passed = result.browseErrors.length === 0;
       } finally {