diff --git a/strix/report/dep_verify.py b/strix/report/dep_verify.py
index 48c207fc7..8d5b8b504 100644
--- a/strix/report/dep_verify.py
+++ b/strix/report/dep_verify.py
@@ -157,6 +157,8 @@ def verify_dependency(  # noqa: PLR0911 — the returns are deliberate fail-open
     if affecting is None:
         return None  # provider couldn't answer → fail open, emit
     if ident in affecting:
+        logger.info("dep-verify: %s confirmed in range for %s@%s; emitting (real)",
+                    ident, pkg, version)
         return None  # confirmed: installed version IS in the CVE's range → emit (real)
     if not affecting:
         # definitive "no advisories affect this version" is still a coverage-gap