diff --git a/.claude/skills/local-dev/SKILL.md b/.claude/skills/local-dev/SKILL.md
index 947211e7..5236cb2a 100644
--- a/.claude/skills/local-dev/SKILL.md
+++ b/.claude/skills/local-dev/SKILL.md
@@ -147,7 +147,7 @@ supposed to rule out.
 **`react` and `react-dom` are the exception, and stay pinned per client.** They
 are a matched pair — `react-dom` reaches into React internals — and `react-dom`
 is still web-declared, so npm resolves it and its React peer together inside
-`clients/web/node_modules` (19.2.8 today, against the root's 19.2.7). Pointing
+`clients/web/node_modules`. Pointing
 `react` at the root while `react-dom` resolves from the client would pair a
 renderer with a React it was not installed against, which is the same split the
 pin exists to prevent, arrived at from the other side. `dedupe` still collapses
diff --git a/scripts/verify-dep-lockstep.mjs b/scripts/verify-dep-lockstep.mjs
index 03c54991..9d898027 100644
--- a/scripts/verify-dep-lockstep.mjs
+++ b/scripts/verify-dep-lockstep.mjs
@@ -283,9 +283,11 @@ export function toleratesSkew(name, holders, tolerated) {
  * boundary this tier polices is "does the repo name a package npm will install
  * for us", not "does it ship":
  *
- *   • `devDependencies` — the `@types/*` and toolchain case #2226 is about; every
- *     one of the four skews this tier first surfaced was a devDependency
- *     somewhere.
+ *   • `devDependencies` — the `@types/*` and toolchain case #2226 is about, and
+ *     three of the four skews this tier first surfaced (`@types/node`,
+ *     `@types/react`, `@vitejs/plugin-react`) were a devDependency somewhere.
+ *     The fourth, `react`, is a root runtime dependency whose client copies are
+ *     peer-installed — which is why the union spans fields as well as installs.
  *   • `optionalDependencies` — a direct declaration npm attempts to install like
  *     any other. Omitting it would leave an optional-only package free to hold
  *     conflicting top-level copies in two installs while this tier reported