diff --git a/conformance/tests/l0-static/flux-postbuild-substitution/check.sh b/conformance/tests/l0-static/flux-postbuild-substitution/check.sh
index b75754a..84f2e10 100755
--- a/conformance/tests/l0-static/flux-postbuild-substitution/check.sh
+++ b/conformance/tests/l0-static/flux-postbuild-substitution/check.sh
@@ -62,10 +62,14 @@
 #
 # DOLLAR-RUN ARITHMETIC — the exact rule, MEASURED, not inferred (see assertion (7))
 # ---------------------------------------------------------------------------------
-# envsubst here is `github.com/drone/envsubst`, vendored by fluxcd/pkg/kustomize and exposed
-# by the `flux envsubst` CLI ("replicate the behavior of the Flux Kustomization post-build
-# substitutions" — its own --help). Its scanner walks the input left to right; on a `$` it
-# looks at the NEXT byte:
+# envsubst here is `github.com/fluxcd/pkg/envsubst` v1.1.0 — Flux's own maintained FORK of
+# `github.com/drone/envsubst` ("This package is a fork of drone/envsubst", its README) — and it
+# is exposed by the `flux envsubst` CLI ("replicate the behavior of the Flux Kustomization
+# post-build substitutions", its own --help). Named from the binary, not from memory: the
+# pinned flux 2.4.0 in the dev image embeds the Go module path
+# `/home/runner/go/pkg/mod/github.com/fluxcd/pkg/envsubst@v1.1.0/parse`
+# (`grep -ao 'github.com/fluxcd/pkg/envsubst[^ ]*' "$(command -v flux)"`). Its scanner walks
+# the input left to right; on a `$` it looks at the NEXT byte:
 #   * another `$`   -> BOTH are consumed and ONE `$` is emitted. This is UNCONDITIONAL. What
 #                      follows the pair is irrelevant — `{`, a letter, a digit, a semicolon,
 #                      a newline, end of input. `$$` is not "the escape for `${`"; it is the
@@ -98,8 +102,23 @@
 #       cannot parse, fails the ENTIRE Kustomization (proven above with $$${ARR[0]}, which
 #       aborted the whole stream while $${ARR[0]} on the line before it was fine).
 # `--strict` reports NONE of this: every row of that table except the parse error was
-# accepted SILENTLY by `flux envsubst --strict`, exit 0. Strict mode cannot see this class,
-# so a source-level assertion is the only available guard.
+# accepted SILENTLY by `flux envsubst --strict`, exit 0, and its output was BYTE-IDENTICAL to
+# non-strict (`cmp`). Strict mode cannot see this class, so a source-level assertion is the
+# only available guard.
+#
+# TO REPRODUCE THE TABLE (30 seconds, no cluster) — it is a measurement, so re-measure it
+# after any FLUX_VERSION bump in infra/devcontainer/versions.env. Open the toolbox with
+# `./infra/devcontainer/dev.sh` and run these INSIDE it (do NOT pipe into `dev.sh run` from
+# the host: it starts the container with `-it`, so a piped stdin hangs):
+#   printf '[$$] [$$$] [$${D}] [$$${D}] [DO $$ x $$;]\n' | D=VALUE flux envsubst
+#   -> [$] [$$] [${D}] [$VALUE] [DO $ x $;]
+# And end-to-end, on the actual delivery path, with the pre-16b7fcd manifest checked out
+# (`git show 16b7fcd^:apps/wave-0/nextcloud-db.yaml > apps/wave-0/nextcloud-db.yaml`):
+#   kubectl kustomize apps/wave-0 | grep 'DO \$'            -> "DO $$"  (the kubectl path)
+#   kubectl kustomize apps/wave-0 | flux envsubst --strict | grep 'DO \$'
+#                                                           -> "DO $"   (the FLUX path), exit 0
+# (`kubectl kustomize` IS the kustomize build here; the image ships no standalone binary.)
+# That two-command contrast IS the 2026-09-13 incident, and is why review missed it.
 #   ${...}, ${a b}, ${ARR[0]}  (UNESCAPED) -> HARD PARSE ERROR ("unable to parse
 #                        variable name" / "missing closing brace") which fails the
 #                        WHOLE Kustomization — every resource in the path, not just
diff --git a/conformance/tests/l0-static/flux-postbuild-substitution/dollar-collapse.allow b/conformance/tests/l0-static/flux-postbuild-substitution/dollar-collapse.allow
index c2905af..28bcf02 100644
--- a/conformance/tests/l0-static/flux-postbuild-substitution/dollar-collapse.allow
+++ b/conformance/tests/l0-static/flux-postbuild-substitution/dollar-collapse.allow
@@ -4,7 +4,9 @@
 #
 # WHY THIS FILE EXISTS
 # --------------------
-# Flux's postBuild substitution runs github.com/drone/envsubst over everything a
+# Flux's postBuild substitution runs github.com/fluxcd/pkg/envsubst (Flux's fork of
+# github.com/drone/envsubst; the module path is embedded in the pinned flux 2.4.0
+# binary, and check.sh's header says how to read it back out) over everything a
 # substituted Kustomization renders, and that scanner consumes dollars in PAIRS,
 # emitting ONE dollar per pair — unconditionally, wherever they appear, not only in
 # front of a brace. A run of N dollars becomes floor(N/2) dollars, and an ODD run