diff --git a/ks4/README.md b/ks4/README.md
index e5169e6..8226aca 100644
--- a/ks4/README.md
+++ b/ks4/README.md
@@ -11,6 +11,10 @@ Incus host at OVH — public-facing self-hosted services.
 - Instances are on a NAT bridge `incusbr0` (192.168.1.0/24); public
   ingress via Incus proxy devices. `gateway` (nginx) is the sole HTTP/S
   entry point and fans out to the app containers.
+- OS inventory: `incus list -c n,config:user.os,config:user.os-checked`
+  — refreshed by `incus-container-upgrade.sh` (`-o` for metadata only).
+  `image.description` shows the *creation* image (2019 for most), not
+  what the container runs today.
 - Services: gateway, mail, nextcloud, seafile, git, freshrss, bitwarden,
   outline, login (SSO), wireguard, + more — full table in
   [install.md](install.md).