diff --git a/SCANNER_BUGS.md b/SCANNER_BUGS.md
index 716d4d3..582e3f6 100644
--- a/SCANNER_BUGS.md
+++ b/SCANNER_BUGS.md
@@ -81,14 +81,21 @@ worth flagging in most cases. The four boxes are a deliberate summary of what
 merits attention, not an exhaustive partition of the total, and the detail table
 already lists every finding including the unbucketed ones.
 
-Two narrow consequences remain visible and are recorded so the next reader does
-not mistake them for oversights: the headline "N vulnerabilities" beside the
-four boxes is a larger number than they sum to on multi-severity distros, and an
-image whose findings are *entirely* Negligible or Unknown has `Total > 0`, so it
-skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`. If
-either is ever worth addressing, the cheap route is to derive the headline from
-the four counts rather than adding a fifth bucket, which needs no lexicon or
-protocol change.
+Two consequences follow, and both are intended. Recorded here because each
+looks like a rendering bug from the code alone, and the next reader should not
+"correct" them.
+
+The headline "N vulnerabilities" beside the four boxes is a larger number than
+they sum to on multi-severity distros. That is the point: the total is the
+finding count, the boxes are the ones worth acting on.
+
+An image whose findings are *entirely* Negligible or Unknown has `Total > 0`,
+so it skips the "Clean" branch and renders a coloured strip reading `0 0 0 0`.
+This is correct, because **"clean" is not the same as "nothing worth
+reporting"**. A clean image has no findings at all; this one has findings, none
+of which rise to a flagged severity. Rendering it as Clean would assert
+something untrue, and the vulnerabilities tab lists exactly what the strip does
+not.
 
 **The 512 MiB `GOMEMLIMIT` does not scale with `scanner.workers`.** Process-wide
 rather than per-worker, so it is divided among concurrent scans: +1.7% for a