diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0ba1f3f..57507a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,17 @@ and could stop an installed copy from updating.
 
 ## [Unreleased]
 
+### Changed
+
+- **keel's "What keel does not do" section now names the heredoc evasion
+  explicitly.** The list of un-inspected shell constructs already covered
+  `$()` command substitution, but not the specific `gh pr create` wrapped in
+  a heredoc'd `$(cat <<'EOF' … EOF)` — the exact form that opened keel's own
+  first PR past the advisory guard. Naming it makes the deliberate boundary
+  legible to a reader debugging why a heredoc'd command wasn't classified.
+  Documentation only; no behavior change (the guard is advisory by design, and
+  the real gates are server-side).
+
 ## [0.8.1] - 2026-07-23
 
 ### Fixed
diff --git a/README.md b/README.md
index 383de90..d9a1d91 100644
--- a/README.md
+++ b/README.md
@@ -215,11 +215,14 @@ than block on ignorance.
   Claude Code session.
 - **It does not parse shell constructs adversarially.** `bash -c`, `eval`,
   subshells, backticks/`$()`, and other command substitution are not
-  inspected — deliberately. keel's predecessor tried, and a review of that
-  code found roughly 20 verified ways to evade its checks while also
-  producing false positives (e.g. splitting a quoted commit message and
-  classifying a phantom push). Escalating that arms race isn't worth it: it
-  buys false confidence without buying real coverage.
+  inspected — deliberately. A `gh pr create` wrapped in a heredoc'd
+  `$(cat <<'EOF' … EOF)` slips straight past the guard, and keel's own first
+  PR was opened exactly that way. That is the design working, not failing:
+  keel's predecessor tried to close such holes, and a review of that code
+  found roughly 20 verified ways to evade its checks while also producing
+  false positives (e.g. splitting a quoted commit message and classifying a
+  phantom push). Escalating that arms race isn't worth it: it buys false
+  confidence without buying real coverage.
 - **It is not a security control.** It cannot stop someone determined to
   evade it, and it is not meant to. Its job is to catch honest mistakes
   early, not to gate access.