diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index f55da31f0b31ec02c1fb75aabd6ae7d159e0129d..12232faae5fd4f8fa13c19883501a805dbbd49ca 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -571,7 +571,17 @@ |---|---|---|
 | `../warren` | `vault/`, `render/`, `index/`, `search/`, `mcpsrv/`, `linkcheck/` | Most of the read plane, already written. Absorbed — but see the two gaps below; this is not free. |
 | `../sourcehut-compare` | chrome/templates, cookie→identity, GraphQL authorizer + TTL cache, SCSS pipeline, `contrib/` nginx+systemd shape | Closest sibling; copy the integration scaffolding wholesale. |
 | `../sourcehut-dolt` | bare-store lifecycle under `<repos>/~user/<name>`, brant migration wrapper, config validation | Same storage-root and migration patterns. |
-| `sr-ht-core` (fork) | config, crypto, auth, database, server, **gqlgen scaffolding + `webhooks`** | Pinned to `git.srht.bigb.es/~bigbes/core-go` via `replace`, as in both siblings. Never `go get -u`. The gqlgen path is the blessed one and is what Phase 2's `/query` is built on. |
+| `sr-ht-core` (fork) | config, crypto, auth, database, server, **gqlgen scaffolding + `webhooks`** | Pinned to `sourcecraft.dev/bigbes/sr-ht-core v0.0.0-20260718185800-dd418a200152`, byte-identical to both siblings. **No `replace` directive** — see the note below. Never `go get -u`. The gqlgen path is the blessed one and is what Phase 2's `/query` is built on. |
+
+> **Note on the core-go pin.** dolt.sr.ht's README describes this dependency as
+> "replaced by the instance fork via a `replace` directive". That is **stale** —
+> neither sibling's `go.mod` contains such a directive, and this service has none
+> either. The fork *declares* the module path `sourcecraft.dev/bigbes/sr-ht-core`
+> as of commit `dd418a20`, so it is required directly under that path; a
+> `replace` pointing at `git.srht.bigb.es/~bigbes/core-go` is rejected by the Go
+> toolchain for any commit at or before `c2c2f38`, where the fork's `go.mod`
+> still said `git.sr.ht/~sircmpwn/core-go`. Fetching still needs
+> `GOPRIVATE=git.srht.bigb.es`.
 
 **Two absorption gaps, both understated in earlier drafts:**