diff --git a/.2119/verdicts/REQ-008.2.1--ec3576645763.json b/.2119/verdicts/REQ-008.2.1--ec3576645763.json
deleted file mode 100644
index 8dd3b17..0000000
--- a/.2119/verdicts/REQ-008.2.1--ec3576645763.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "reviewId": "REQ-008.2.1--ec3576645763",
-  "requirementId": "REQ-008.2.1",
-  "hash": "ec3576645763",
-  "verdict": "pass",
-  "summary": "docs/scaling.md covers all seven required topics: exact-version pinning, test suite as a separate CI gate, CODEOWNERS for specs and verdicts, independent-runner recipe, explicit evidence globs over bare [review], shared_evidence for fixtures, and a --no-verify [verify] policy for untrusted PRs.",
-  "timestamp": "2026-07-10T22:57:27.221Z"
-}
diff --git a/.2119/verdicts/REQ-008.2.1.json b/.2119/verdicts/REQ-008.2.1.json
new file mode 100644
index 0000000..649bc3f
--- /dev/null
+++ b/.2119/verdicts/REQ-008.2.1.json
@@ -0,0 +1,8 @@
+{
+  "reviewId": "REQ-008.2.1--2cd0a760d9fd",
+  "requirementId": "REQ-008.2.1",
+  "hash": "2cd0a760d9fd",
+  "verdict": "pass",
+  "summary": "scaling.md covers all seven mandated topics with concrete recipes: pinning, separate CI gates, CODEOWNERS, independent-runner, explicit evidence globs, shared_evidence, and no-verify policy",
+  "timestamp": "2026-08-08T07:57:34.368Z"
+}
diff --git a/.2119/verdicts/REQ-008.2.2.json b/.2119/verdicts/REQ-008.2.2.json
index 98993dc..1874a93 100644
--- a/.2119/verdicts/REQ-008.2.2.json
+++ b/.2119/verdicts/REQ-008.2.2.json
@@ -1,8 +1,8 @@
 {
-  "reviewId": "REQ-008.2.2--cfb51e2cfabb",
+  "reviewId": "REQ-008.2.2--456734b19776",
   "requirementId": "REQ-008.2.2",
-  "hash": "cfb51e2cfabb",
+  "hash": "456734b19776",
   "verdict": "pass",
   "summary": "README's Diversify-then-audit bullet and scaling.md's cross-provider audit section both advise periodic sweeps plus targeted audits of challenging or high-consequence requirements",
-  "timestamp": "2026-08-08T07:28:19.232Z"
+  "timestamp": "2026-08-08T07:57:56.365Z"
 }
diff --git a/docs/scaling.md b/docs/scaling.md
index 190c0a6..ff55379 100644
--- a/docs/scaling.md
+++ b/docs/scaling.md
@@ -116,3 +116,27 @@ npx --yes rfc2119@<pinned> check --no-verify
 `[verify]` requirements are then surfaced alongside `[manual]` exemptions instead of executed;
 run the full `check` (with verify) only on trusted branches, or in a job gated on maintainer
 approval.
+
+## Measured baselines
+
+Wall-clock for the full deterministic gate (`time npx -y rfc2119 check`, Apple
+M-series, rfc2119 0.7.0, measured 2026-08; "cold" includes npx package
+resolution):
+
+| Corpus | Scale | `check` wall time |
+|---|---|---|
+| Production application (private) | ~5,400 tracked files, ~600k lines incl. subprojects; sparse specs, 110 committed verdicts (hash verification in path) | ~1.4s steady, ~2.7s cold |
+| Subproject of the same application (private) | 84 files, ~40k lines | ~1.0s |
+| Synthetic dense corpus (reproducible) | 100 spec files · 3,000 MUST requirements · 2,000 annotated test files, ~300k lines; judgment layer disabled | ~1.7–2.0s steady |
+
+The spread is the point: a sparse-specced production codebase and a corpus
+with 3,000 requirements land within a second of each other, because the walk
+and parse are the cost and both are bounded — spec/annotation volume, not
+repository size, is what you are budgeting. All three sit well inside the
+enforced sub-5-second perf requirement.
+
+To regenerate the synthetic corpus: 100 spec files of 5 sections × 6
+single-keyword MUST items each; 2,000 test files of ~150 lines, each opening
+with one section-level annotation (`// 2119: REQ-0NN.M`); `reviews: false` in
+`.2119.yml`. Numbers rot with hardware and versions — re-measure on yours
+before relying on them.