diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 7dd707f..0ca879a 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -1,4 +1,5 @@
 name: Release
+# The Hub overview names a released tag, so it is published here only, never on a push to main.
 on:
   push:
     tags: ['v[0-9]+.[0-9]+.[0-9]+']
@@ -81,8 +82,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'push'
       # Publish the named release's own tree, so the page never pairs one Plainpages tag with another
-      # release's sidecar pins, which is also why it never syncs on a push to main. A version that
-      # was never released fails here.
+      # release's sidecar pins. A version that was never released fails here.
       - uses: actions/checkout@v7.0.1
         if: github.event_name == 'workflow_dispatch'
         with:
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index fffd8b7..d842fcf 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -38,8 +38,7 @@ jobs:
       - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
-          # A persisted token rides every request as an extraheader, outranking the PAT in the push
-          # URL: Gitea then sees the Actions bot push the tag and starts no workflow for it.
+          # A persisted token outranks the PAT in the push URL, and Gitea runs nothing for its pushes.
           persist-credentials: false
       - name: Tag a release for what Renovate merged
         env:
diff --git a/AGENTS.md b/AGENTS.md
index cd48e46..f5287df 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -340,11 +340,10 @@ Revisit only if the stated reason stops holding.
   *text* guard — the test image ships neither `git` nor `bash`. This is why the Docker Hub overview is
   `release-tooling/dockerhub-overview.md.tmpl` and not a `.md`: a release reads it and a unit test
   guards it, so giving it a `.md` name would let a broken `{{VERSION}}` merge with its own guard
-  skipped. `README.md` is the one markdown tests read — `release-tooling/contract-version.test.ts`
-  checks its `apiVersion` samples, `release-tooling/dockerhub-overview.test.ts` that the Hub page
-  says only what it says — and a README-only change skips both; accepted, because those samples are
-  illustrative, the copies that matter (`examples/`, `views/`, the template) are gated, and the next
-  gated change catches a README that dropped a Hub command. **Valid while no markdown file is rendered or executed.**
+  skipped. `README.md` is the one markdown tests read, and a README-only change skips them. Accepted:
+  the `apiVersion` samples `release-tooling/contract-version.test.ts` checks are illustrative, and
+  the copies that matter (`examples/`, `views/`, the template) are gated. A Hub page command the
+  README dropped (`release-tooling/dockerhub-overview.test.ts`) fails the next gated change. **Valid while no markdown file is rendered or executed.**
 - **CI docker logins share the runner host's Docker config.** The act_runner is host-mode, so
   `docker login`/`logout` in the workflows mutate one shared `~/.docker/config.json`: concurrent jobs
   can race (one job's logout can 401 another's push — recover by re-running), and tokens sit in that