diff --git a/docs/guard-inventory.md b/docs/guard-inventory.md
index 448e636fd..443b2dc8c 100644
--- a/docs/guard-inventory.md
+++ b/docs/guard-inventory.md
@@ -64,7 +64,7 @@ with have sat in these gaps. Treat anything not named here as unassessed, not as
    the check proves each job was classified, never that the classification is CORRECT; and an
    `inline` assertion cannot be proven to work without running the job, so those rows carry
    `Proof: NONE` honestly instead of borrowing a neighbouring file's proof.
-2. **C# and TypeScript guards** — four files, none with a row:
+2. **C# and TypeScript guards** — five files, none with a row:
    `ErsatzTV.Mcp.Tests/ToolCatalogTests.cs`, `web/src/api/pageSizeCallSites.guard.test.ts`,
    `web/src/api/completeRequest.guard.test.ts`, and the pair
    `web/vite-plugins/trackedSourceFiles.test.ts` + its `.realgit.test.ts` sibling, which together
diff --git a/web/vite-plugins/trackedSourceFiles.realgit.test.ts b/web/vite-plugins/trackedSourceFiles.realgit.test.ts
index 9abef2bd9..f911f11f9 100644
--- a/web/vite-plugins/trackedSourceFiles.realgit.test.ts
+++ b/web/vite-plugins/trackedSourceFiles.realgit.test.ts
@@ -6,11 +6,15 @@ import { afterAll, describe, expect, it } from 'vitest';
 import { type GitRunner, resolveTrackedSourceFiles } from './trackedSourceFiles';
 
 /**
- * SEPARATE FILE because these are the only tests in the SPA suite that need the `git` BINARY, not
- * merely a checkout (ersatztv#819).
+ * SEPARATE FILE because these are the only tests in the SPA suite that need the `git` BINARY but NO
+ * CHECKOUT — they build their own repository (ersatztv#819). That is not the same as saying the
+ * guard needs only a checkout: it needs a checkout AND, through it, the binary. Measured — with
+ * `.git` present and git off `PATH`, `pageSizeCallSites.guard.test.ts` still fails with the
+ * plugin's refusal. Reading the two exclusions as checkout-versus-binary is what broke the Docker
+ * stage once already; see `docker/Dockerfile`, which retracts that framing.
  *
  * `docker/Dockerfile`'s web-build stage runs on `node:22-bookworm-slim`, which ships no git at all,
- * so this file is excluded there alongside the guard that needs an index. Keeping them apart means
+ * so this file is excluded there alongside the guard. Keeping them apart means
  * that exclusion costs two files rather than the thirteen injected-runner tests in
  * `trackedSourceFiles.test.ts`, which run fine with no git and no repository.
  *