diff --git a/docs/plans/ui-ota.md b/docs/plans/ui-ota.md
index eecea7bd7..c79ffe58b 100644
--- a/docs/plans/ui-ota.md
+++ b/docs/plans/ui-ota.md
@@ -83,6 +83,10 @@ node tools/ui-ota/publish.mjs --version 1.0.1 --min-engine 0.3.20 --notes "one l
 node tools/ui-ota/publish.mjs --verify
 ```
 
+Order rule (the shipper, 7 October 2026): the 0.3.19 app, live since 10:23Z, ignores the `ui` object, so 1.0.1
+publishes with min_engine 0.3.20 only after 0.3.20 is on the manifest; an earlier publish is harmless (every 0.3.19
+engine skips it) and pointless. The kill switch (`--no-ui`) sits in the shipper's runbook beside the manifest's own.
+
 What it does: writes ui/VERSION from --version, packs the fifteen served files in sorted order with one fixed mtime
 (the same tree gives the same bytes; the self-test checks it), hashes, signs the entry through
 `igneum-ota-sign sign-ui`, copies the tar into the folder's ui/, writes ui.json and calls