Write down that a typed value is a defect, not a documentation problem

The lesson from dejima-ci-hardener's per-pool migration, where every step that
asked an operator to type something was a step that went wrong on a real host,
and every fix was to stop asking rather than to ask more clearly.

Recorded here rather than only there because the failure shape is the same in
both: a note that names a path, a network or a count is a note somebody runs
twice, changing the obvious part and leaving the rest. This repository already
gets it right in one place - bootstrap records the guest version, so nothing
asks an operator to - which is the example worth reaching for before adding
another prompt.

.dejima.md

@@ -3,6 +3,31 @@
 Notes for an agent working **on this repo**. Not a description of what the tool
 does: `README.md` and `docs/threat-model.md` are that.
 
+## Remove the value an operator would type, rather than documenting it better
+
+When a step needs a path, a name or a number typed in, the fix is almost never a
+clearer instruction. It is to take the value from wherever it is already
+recorded, and to have the command name the thing rather than describe it.
+
+The evidence is next door. dejima-ci-hardener's per-pool migration asked an
+operator for a network and a project directory that had to agree with each
+other and with a third file, once per pool. Run twice, the path gets changed and
+the network does not, because the path is the part that obviously differs, and
+both pools end up sharing one allowlist while looking exactly like they worked.
+The instruction was accurate; the shape was wrong. It became `--pool <scope>`,
+reading both values from the file that already knew them, and the failure became
+impossible rather than documented.
+
+This repository already does it in one place, which is worth knowing before
+adding a second: nothing asks an operator to record the guest version, because
+bootstrap knows it. `mark-node` exists only for the half no guest can see. When
+a note starts to say "and then type", check whether something on the box already
+holds the answer.
+
+Where the value genuinely has to be given, make the wrong one refuse rather than
+proceed. A check that catches the mistake is worth more than a paragraph
+describing it, because the paragraph is read once and the check runs every time.
+
 ## An upgrade note is a procedure, not a description
 
 Somebody follows it verbatim, on a machine they are partway through changing,