diff --git a/.gitignore b/.gitignore
index 5a3161f..7b9bd8d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -87,9 +87,16 @@ Releases/
 *.pfx
 *.p12
 *.snk
+# Signing keystores, with one exception that is tracked deliberately. build/nightly.keystore is
+# committed in the open on purpose — see ADR 0014 for why a key everybody holds is what makes the
+# nightly channel safe to run in CI — and a file already tracked is unaffected by an ignore rule
+# anyway. The negation is here so that reading this list does not suggest the tracked one is an
+# oversight. The *release* keystore is a real secret under ADR 0011 rule 1 and must never land here.
+*.keystore
+*.jks
+!build/nightly.keystore
 appsettings.Local.json
 appsettings.*.Local.json
 .env
 .env.*
-!deploy/.env.example
 secrets/
diff --git a/deploy/docker-compose.dev.yml b/deploy/docker-compose.dev.yml
index d799eed..73910f3 100644
--- a/deploy/docker-compose.dev.yml
+++ b/deploy/docker-compose.dev.yml
@@ -1,7 +1,12 @@
 # Development dependencies only: PostgreSQL and Keycloak.
 #
 # The API itself runs from the IDE or `dotnet run`, so the inner loop stays fast while the
-# schema is still churning. The production stack is deploy/docker-compose.yml.
+# schema is still churning.
+#
+# There is no production compose file in this repository. This one said there was, naming a
+# deploy/docker-compose.yml that has never existed in any commit. What ships instead is the
+# container image the CI image job builds and pushes; a compose file to run it belongs to the
+# self-hosting guide in M4, and until that exists the honest thing to say is that it does not.
 #
 #   docker compose -f deploy/docker-compose.dev.yml up -d
 #   dotnet run --project src/DodoSSH.Api
diff --git a/src/DodoSSH.Api/Setup/DodoOptions.cs b/src/DodoSSH.Api/Setup/DodoOptions.cs
index 6fb14e4..100326a 100644
--- a/src/DodoSSH.Api/Setup/DodoOptions.cs
+++ b/src/DodoSSH.Api/Setup/DodoOptions.cs
@@ -115,10 +115,20 @@ public sealed class RelayOptions
     /// Whether RFC1918 and other private ranges may be dialled.
     /// </summary>
     /// <remarks>
+    /// <para>
     /// Defaults to true, unlike a typical SSRF allow-list, because reaching private
     /// infrastructure is the entire purpose of a self-hosted SSH tool. The control that matters is
-    /// the ACL: only hosts in a vault the caller holds Connect on can be dialled at all. Loopback,
-    /// link-local and cloud metadata ranges are denied unconditionally and are not configurable.
+    /// the ACL: only hosts in a vault the caller holds Connect on can be dialled at all.
+    /// </para>
+    /// <para>
+    /// <b>Nothing reads this setting yet, and that is the point of saying so here.</b> The relay is
+    /// an ADR and a contract; there is no endpoint and no dialler. This option exists so the shape
+    /// is settled before the code is, which makes it exactly the kind of comment that gets read as a
+    /// description of an implemented control. It is not one. Whoever builds the dialler owes ADR 0004
+    /// §3 in full — loopback, link-local, <c>0.0.0.0/8</c>, multicast and the cloud metadata addresses
+    /// denied with no configuration escape, and IPv4-mapped IPv6 normalised and re-checked — and this
+    /// flag governs RFC1918 only, never that list.
+    /// </para>
     /// </remarks>
     public bool AllowPrivateNetworks { get; set; } = true;