diff --git a/bin/__pycache__/cd-targetcpython-312.pyc b/bin/__pycache__/cd-targetcpython-312.pyc
new file mode 100644
index 0000000..bef1e65
Binary files /dev/null and b/bin/__pycache__/cd-targetcpython-312.pyc differ
diff --git a/bin/cd-deploy b/bin/cd-deploy
index cfdd226..dcde5b9 100755
--- a/bin/cd-deploy
+++ b/bin/cd-deploy
@@ -134,7 +134,7 @@ notify() {
         -H "Title: ${CD_NAME} deploy" \
         -d "${icon} ${CD_NAME} (${CD_ENV}): ${message}" \
         "${CD_NTFY_BASE_URL}/${topic}" >/dev/null 2>&1 \
-        || warn "ntfy notification failed (deploy outcome itself is unaffected)"
+        || warn "ntfy notification failed (the deploy itself is unaffected)"
 }
 
 # ------------------------------------------------------------------- lock ---
diff --git a/bin/cd-status b/bin/cd-status
index aeed84a..4ea600f 100755
--- a/bin/cd-status
+++ b/bin/cd-status
@@ -4,7 +4,7 @@
 #
 # Written because "the timer is active" was never proof of anything in this
 # fleet -- the same lesson the uas-ng updater documents. This shows the daemon,
-# the socket, and the outcome of the last deploy for each target.
+# the socket, and how the last deploy for each target ended.
 
 set -Eeuo pipefail
 
diff --git a/bin/cd-target b/bin/cd-target
index c710b37..07947a6 100755
--- a/bin/cd-target
+++ b/bin/cd-target
@@ -9,7 +9,7 @@ itself, so there is exactly one implementation of the matching rules.
 Subcommands:
     resolve --repo OWNER/NAME --branch BRANCH [--host HOST]
         Print shell-quoted KEY=VALUE lines for the matching target.
-        Exit 3 when nothing matches (a normal, non-error outcome: it just
+        Exit 3 when nothing matches (a normal, non-error result: it just
         means this push is not ours to act on).
 
     list [--host HOST]
diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
index 40fc6b8..a98aaac 100644
--- a/docs/OPERATIONS.md
+++ b/docs/OPERATIONS.md
@@ -11,8 +11,8 @@ design.
 
 An active service is not proof of anything on its own — the same lesson the
 `uas-ng` updater documents. `cd-status` shows the daemon state, whether the port
-is genuinely listening, the hook endpoints, and the outcome of the last deploy
-per target.
+is genuinely listening, the hook endpoints, and how each target's last
+deploy ended.
 
 ## Where things are
 
diff --git a/docs/hints.md b/docs/hints.md
new file mode 100644
index 0000000..16ac692
--- /dev/null
+++ b/docs/hints.md
@@ -0,0 +1,32 @@
+# Hints
+
+Short notes on things that were not obvious. Prune stale ones.
+
+- **`bin/cd-target` cannot be imported normally.** The hyphen in the filename is
+  not a valid Python identifier, so `bin/cd-render-hooks` loads it through
+  `importlib.machinery.SourceFileLoader`. Importing `importlib.util` alone is
+  not enough — `importlib.machinery` needs its own import.
+
+- **`docker/metadata-action`'s `type=sha,format=short` produces 7 characters.**
+  That is why `image_tag_template` uses `{short7}`. domaindingo's `build.yml`
+  prefixes it with the branch, giving `test-sha-abc1234` / `prod-sha-abc1234`.
+
+- **domaindingo's compose stacks are not in the domaindingo repo.** Test and
+  prod both live in `sysadmin/uas-ng` at
+  `docker/domaindingo/s5.fisher.hu/` (`docker-compose.yml` and
+  `docker-compose-prod.yml`). The `scripts/deploy-*.sh` files still in the
+  application repo point at compose files that do not exist on s5 — they are
+  dead code for both environments that matter.
+
+- **domaindingo test and prod both run on s5, not s2.** Only dev is still on s2.
+  The `hostname != s2` guard in the old scripts therefore matched nothing and
+  `exit 0`d, which reads as success.
+
+- **Registry tags in this fleet have drifted before.** `domaindingo:0.1.149`
+  once resolved to a different image than the one running, with a broken
+  `/login`. This is why `cd-deploy` checks
+  `org.opencontainers.image.revision` and deploys by digest.
+
+- **`docker compose down -v` destroys the data volumes** for these stacks. The
+  retired paradicsomleves test script used it. `cd-deploy` only ever runs
+  `up -d`.