diff --git a/AGENTS.md b/AGENTS.md
index 3362077..bad976d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -226,8 +226,10 @@ Revisit only if the stated reason stops holding.
   files, `.dockerignore` the image).
 - **A container whose output a human then edits or deletes runs as `--user "$(id -u):$(id -g)"`** —
   the E2E runner (artifacts) and a lockfile edit, or the output is root-owned and needs `sudo`, which
-  a dev box may not have at all. Not universal: `bootstrap` writes `jwks.json` as root on a first
-  boot, and a generated signing key is the operator's to leave alone. Three consequences.
+  a dev box may not have at all. Not universal: `bootstrap` writes `jwks.json` as root when it is
+  absent on first boot — the committed dev key makes that rare, and when it happens the rotation
+  runbook's host-side `>` needs the file re-owned first. Valid while the dev key ships committed.
+  Three consequences.
   `e2e-tests/artifacts/` is *tracked* (`.gitkeep`), since an absent bind-mount source is
   daemon-created as root and that uid then cannot write it — which also makes a root-owned leftover
   an upgrade hazard (README → Breaking changes). The runner image sets `HOME=/tmp`, since an
diff --git a/README.md b/README.md
index 83648fc..df31551 100644
--- a/README.md
+++ b/README.md
@@ -1775,12 +1775,13 @@ so for now the error names the rule it tripped instead.
   silently shadows the image's deps.
 - **`e2e-tests/artifacts/` is tracked, and the E2E runner writes as you** (2026-08-05). A root-owned
   leftover from an earlier run blocks the checkout of its `.gitkeep` — git reports the failure but
-  still exits 0, leaving the file staged as deleted — and every E2E suite then fails `EACCES`. Clear
-  it before pulling; a root container does what `sudo` would, which this needs and a dev box may lack:
+  still exits 0, leaving the file deleted in your working tree, where a later `git commit -a` would
+  commit that deletion — and every E2E suite then fails `EACCES`. Clear it before pulling; a root
+  container does what `sudo` would, which this needs and a dev box may lack:
 
   ```bash
-  docker run --rm -v "$PWD/e2e-tests:/x" alpine:3.23 rm -rf /x/artifacts
-  git checkout -- e2e-tests/artifacts/.gitkeep
+  docker run --rm -v "$PWD/e2e-tests:/x" node:24.19.0-alpine3.24 rm -rf /x/artifacts
+  git checkout -- e2e-tests/artifacts/.gitkeep   # only if a pull already deleted it
   ```
 
 ## Observability