fix: fourth-wall disclosure names the exact HF platform injection (no false distrust trigger)

index.html

@@ -240,7 +240,7 @@ load();
     <div style="margin-top:6px">canonical source: <a href="https://huggingface.co/spaces/SZLHOLDINGS/lambda-gate-holo/tree/main" style="color:#C9B787">SZLHOLDINGS/lambda-gate-holo</a><span id="fw-rev"></span> · verify from outside:
       <code style="color:#E8D9AE;background:#0B1F3A;padding:1px 6px;border-radius:3px">curl -sL https://huggingface.co/spaces/SZLHOLDINGS/lambda-gate-holo/resolve/main/index.html | sha256sum</code>
     </div>
-    <div style="margin-top:4px;color:#5c6f8a">Integrity &amp; origin of this page only — never the accuracy of anything on it. Static Space: served bytes should equal source bytes; if your two hashes differ, distrust the page and read the source. Doctrine v11.</div>
+    <div style="margin-top:4px;color:#5c6f8a">Integrity &amp; origin of this page only — never the accuracy of anything on it. Known platform delta: Hugging Face may inject one <code>window.huggingface</code> variables <code>&lt;script&gt;</code> into <code>&lt;head&gt;</code> of the served page, so the in-browser hash can differ from the source hash by exactly that banner — diff the two documents to see it. Distrust only differences beyond that. Doctrine v11.</div>
   </div>
 </section>
 <script>