diff --git a/custom-skills/35-seo-signal-validation/SKILL.md b/custom-skills/35-seo-signal-validation/SKILL.md
index 000af74..f6ca3cd 100644
--- a/custom-skills/35-seo-signal-validation/SKILL.md
+++ b/custom-skills/35-seo-signal-validation/SKILL.md
@@ -78,3 +78,64 @@ Run cheapest-first; stop early when a layer is already decisive.
 - **Cheap rank spot-check**: `mcp__ourseo__check_serp(keyword, domain)`.
 - **[KR market]** Naver SERP composition: `our research naver serp` (blog / cafe /
   지식iN / Smart Store / brand zone) — Semrush/Ahrefs don't model Naver.
+
+### L3 — Entity / Knowledge Graph → via `28-seo-knowledge-graph`
+
+A real impact event should leave corroborating traces in the entity layer, not
+just a rank number. Five checks:
+
+1. **Google KG API** entity match + `resultScore` —
+   `mcp__ourseo__search_knowledge_graph(query)` (uses `GOOGLE_KG_API_KEY`).
+2. **Wikidata** QID presence + key claims — **verify the QID against
+   `Special:EntityData/{Q}.json` labels before trusting it** (false-match guard:
+   Q109455878 = office tower ≠ hotel; Q490787 = Shinsegae Inc. ≠ Group).
+3. **Knowledge Panel** presence/attributes on the live entity-name SERP (Chrome).
+4. **sameAs** consistency on the entity's `Organization`/`Person` JSON-LD.
+5. **[KR]** Naver 백과사전 / 지식iN presence.
+
+`mcp__ourseo__monitor_brand` supplements with brand-mention / brand-SERP ownership.
+
+### L4 — Attribution synthesis
+
+Cross-check: does the **measured delta (L1)** corroborate the **live reality
+(L2)**, and does the **entity layer (L3)** move consistently? The query-clicks
+delta names the true drivers (brand/seasonal vs the claimed term).
+
+## Verdict
+
+| Verdict | Condition |
+|---|---|
+| **CONFIRMED** | Measured + live + (where relevant) entity all corroborate movement attributable to the term/intent |
+| **PARTIAL** | Real movement, but misattributed, or only some layers agree |
+| **ARTIFACT** | Modeling/snapshot artifact — measured + live reality don't support it |
+| **INCONCLUSIVE** | Insufficient data (query anonymized, GSC lag, no entity baseline, third-party entity with no measured access) — name what's missing + how to resolve |
+
+**Confidence cap:** third-party entities (no L1) cannot reach CONFIRMED on traffic
+claims — at most PARTIAL; ARTIFACT only when live+entity clearly contradict.
+
+Every verdict ships an **evidence ledger** (per layer: finding + data-trust tier +
+corroborates/contradicts) and a **client-safe narrative** (the defensible story).
+
+## Standing skepticism rules
+
+- Estimated organic traffic = **smoke-detector, not scale** (Σ est-volume × position-CTR curve).
+- **Head-term over-fire**: one high-volume keyword at an estimated high rank inflates the whole modeled number.
+- **KR Naver blind spot**: Semrush models Google only; misses much of Korean organic.
+- **Single-geo/device snapshot** diverges from GSC's national average.
+- **Trust hierarchy**: 1st-party measured > 3rd-party measured > 3rd-party modeled.
+
+## Output
+
+- **Always**: inline report — verdict + evidence ledger + client-safe narrative +
+  "what would raise confidence."
+- **Optional**: archive to Notion *Working with AI DB* (`data_source_id
+  f8f19ede-32bd-43ac-9f60-0651f6f40afe`) via the **notion-writer script** (never
+  Notion MCP write). Type=Memo/Research, Topic=SEO, Account Code as relevant.
+- **Optional**: if a new generalizable gotcha emerges, append a memory entry to
+  the active workspace's memory dir.
+
+## Non-goals
+
+No cron/scheduler, no snapshot DB, no new directories. Does not replace the three
+instrument skills. Returns INCONCLUSIVE rather than fabricating when data is thin.
+**Never crawls/audits Marriott for JHR** (sameAs only).