diff --git a/changelog.d/2026-07-30-codeql-both-placements.md b/changelog.d/2026-07-30-codeql-both-placements.md
new file mode 100644
index 0000000..ce3b869
--- /dev/null
+++ b/changelog.d/2026-07-30-codeql-both-placements.md
@@ -0,0 +1,3 @@
+### Changed
+
+- Record that both inline CodeQL suppression placements were tested and neither is honoured in this setup: a trailing same-line comment and the documented standalone comment line immediately before the call. The earlier note cited only the first, which left the conclusion resting on a single placement and invited a repeat attempt. Both the commits and their CodeQL check-run ids are named at the call site, so the next reader lands on the evidence rather than on a commit, and can stop rather than re-derive.
diff --git a/tests/test_claude_transcript_model.py b/tests/test_claude_transcript_model.py
index 9e2801a..50d5235 100644
--- a/tests/test_claude_transcript_model.py
+++ b/tests/test_claude_transcript_model.py
@@ -175,10 +175,15 @@ def test_group_writable_transcript_is_rejected(self):
         # mechanisms were tried and do not work here --
         #   * inline codeql suppression comments for rule id
         #     py/overly-permissive-file are NOT honoured by GitHub code scanning
-        #     in this setup (verified empirically in PR #80: the alerts re-fired
-        #     on the annotated lines). The suppression grammar is deliberately
-        #     paraphrased here so this comment is not itself a suppression-shaped
-        #     token that a future parser could match or an audit could miscount;
+        #     in this setup. BOTH placements were tested and both re-fired the
+        #     alerts on the annotated lines: a trailing same-line comment (PR
+        #     #80, commit 0017b3f, CodeQL check run 90773472337) and the
+        #     documented standalone comment line immediately before the call
+        #     (PR #82, commit 27b697a, CodeQL check run 90784725147). Do not
+        #     spend a third cycle on a placement variant. The suppression grammar is
+        #     deliberately paraphrased here so this comment is not itself a
+        #     suppression-shaped token that a future parser could match or an
+        #     audit could miscount;
         #   * stock CodeQL config cannot scope a filter to a path --
         #     `query-filters` match query metadata repository-wide, so excluding
         #     the query would unscan production, and `paths-ignore` drops EVERY