diff --git a/docs/devops/GITEA_NPM_REGISTRY_MIGRATION.md b/docs/devops/GITEA_NPM_REGISTRY_MIGRATION.md
index f2e825b8..3f3a7726 100644
--- a/docs/devops/GITEA_NPM_REGISTRY_MIGRATION.md
+++ b/docs/devops/GITEA_NPM_REGISTRY_MIGRATION.md
@@ -170,7 +170,7 @@ The remaining blocker is not host-side package publishing or host-side package c
 The blocker is specifically:
 
 - Docker / BuildKit installs against the local Homebrew Gitea instance on this Mac
-- registry metadata and tarball fetch behavior across the Mac host ↔ Docker build boundary
+- the Docker-side auth path, where `host.docker.internal` reaches the registry but placeholder-token package fetches still fail with `401 Unauthorized`
 
 At the time of writing:
 
@@ -190,6 +190,7 @@ The local rehearsal on this Mac has proven enough to validate the **host-side**
 
 - Docker / BuildKit package installs from the local Homebrew Gitea instance are still not green
 - the Homebrew Gitea `ROOT_URL` / package tarball URL behavior is still fragile across host and Docker boundaries
+- Docker-side package installs currently need a real Gitea package token even though host-side installs only need non-empty `GITEA_NPM_TOKEN` env resolution for `.npmrc`
 - local Gitea Actions has not yet been validated end-to-end for the package build → publish → consumer flow
 - the FlowMonk pilot is currently validated only for backend/web host-side consumption; Docker is still blocked and mobile remains outside the registry-backed pilot slice
 - not all `@bytelyst/*` packages have been revalidated under the local Gitea registry with a fresh consumer install after the `pnpm pack` publish flow changes