diff --git a/scripts/NodeVersion.ps1 b/scripts/NodeVersion.ps1
index 1b72782..eb0a686 100644
--- a/scripts/NodeVersion.ps1
+++ b/scripts/NodeVersion.ps1
@@ -135,8 +135,12 @@ $script:DEFAULT_NODE_VERSION = '18.16.1'
 # not free: post-20 syntax and node: APIs pass here and fail in the pipeline, and
 # Node 26 ships an npm that can touch the lockfile in ways CI's npm reads
 # differently. The `engines` field in both package.json files records the floor
-# machine-readably; nothing yet catches "too new for where this ships". See #208
-# part 4, which is an open decision rather than an oversight.
+# machine-readably.
+#
+# Settled in #208 part 4: the pin stays at 26.7.0 and CI on 20 is the backstop.
+# The cost is knowing that "it passed locally" does not mean it ships — a post-20
+# API is caught after a push rather than before one. That is accepted rather than
+# unnoticed, which is the only reason this paragraph is here.
 
 <#
     Switches to the pinned version and insists it clears the floor.