diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 938dd0c..5524edb 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `d22a2d0b7c74731c858ab01f9e5bf8742a289c03`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `2ecbac0dd74ebab613af57640f2d1ac5245ced6d`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index e2b50cb..ac8da85 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "d22a2d0b7c74731c858ab01f9e5bf8742a289c03",
+  "sourceRevision": "2ecbac0dd74ebab613af57640f2d1ac5245ced6d",
   "files": [
     {
       "path": ".dockerignore",
@@ -19,8 +19,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "a8b5176abcf5ddc844768c2116807a86d540ebaeab928f37ab059d7ed2630fcc",
-      "bytes": 6764
+      "sha256": "312ac5975e10bd53d320fbbe1fe4228812ebe7e34d5bea0c4f18576de97d2cf4",
+      "bytes": 7382
     },
     {
       "path": "SECURITY.md",
diff --git a/README.md b/README.md
index 17f5b4b..bf791ea 100644
--- a/README.md
+++ b/README.md
@@ -63,6 +63,15 @@ npm run sbom
 
 `npm run sbom` writes an ignored production CycloneDX file named `certscope-sbom.cdx.json`.
 
+## Your first inspection
+
+1. Enter one public hostname, without a URL scheme, path or IP literal.
+2. Read the collection status for DNS, TLS and HTTP before interpreting the score.
+3. Open a finding to inspect the observed evidence and recommended change.
+4. Export the report when you need a reproducible handoff; rerun the inspection after changing the target.
+
+A blocked target is a safety decision, and an unavailable collector is incomplete evidence. Neither should be interpreted as a successful check. The screenshots above are offline fixtures; they do not imply that the demonstration hostname is reachable.
+
 ## Docker deployment
 
 ```bash