diff --git a/test/e2e/README.md b/test/e2e/README.md
index 3fde46b..4134a37 100644
--- a/test/e2e/README.md
+++ b/test/e2e/README.md
@@ -64,6 +64,36 @@ for crew on a tier absent from quota config (`handleCrewList`), so it is invisib
 on a healthy hold. Crew add/update do not validate the tier against config,
 which is how these tests manufacture the condition without restarting the hold.
 
+**The repo page is `/r/{handle}/*`.** Not `/{handle}/{repo}` — that is a 404
+"Lost at Sea" page, which reads exactly like an access denial if you are
+checking whether a logged-out visitor gets denied. Verify the route before
+concluding anything from a 404.
+
+**Tags are `<option>`s in a `<select>`.** Scraping `a`, `td` or `span` for tag
+text finds nothing and reports "no tags render" against a page that is
+rendering them correctly.
+
+**A headed browser will not launch from an agent shell here.** Both
+`chromium.launch()` and `launchPersistentContext()` time out on the handshake
+despite `DISPLAY=:0` being set; headless works. Interactive flows (the admin
+login, `docker-credential-atcr login`) still need a human at a real browser —
+but non-interactive page checks can run headless, and `batch10-anonpull.mjs`
+does.
+
+**Logged-out checks need their own profile.** `lib.mjs`'s `PROFILE` is signed
+in, and clearing its cookies costs an interactive re-login for everything else.
+Use a throwaway `launchPersistentContext` dir instead of a fresh
+`chromium.launch()`.
+
+**The dev hold is `public: false` by default,** so anything testing the
+*allowed* half of anonymous pull is unreachable until you flip it. Do not edit
+the captain record: `hold_pds.go:335` reconciles `captain.Public` from config
+on every boot, so an untracked `docker-compose.override.yml` setting
+`HOLD_SERVER_PUBLIC: "true"` flips it, and deleting the file flips it back.
+Never commit that file. Allow ~15s after the container comes up for the appview
+to see the new value — a token minted too early is still judged against the old
+one, which looks exactly like a failing test.
+
 ## Per-batch stack switching
 
 Use `val-switch.sh`. The appview DB migrates **forward only**, so older batch