v5 and v6 both end by telling the operator to run `dejima-guard accept` on the machine running the guard. That is the host form. dejima-guard is usually a container, and on that host there is no dejima-guard at all - or worse, one from a second deployment with its own baseline and its own idea of what normal looks like. Either way the note ends in command-not-found on the step meant to confirm the upgrade landed. Both notes name the container form and point at the guard's own README for the rest, rather than growing a copy of another project's interface that would go stale here without anything noticing. A test holds it for any future note that runs the guard.