diff --git a/README.md b/README.md
index 1b0b5137..f0d4f80e 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@
 
 ## Architecture
 
-On the default macOS Apple Container backend, a bottle is an agent container on a host-only internal network plus a gateway attached to both that internal network and a NAT egress network. The agent gets HTTP(S)_PROXY and CA bundle env vars pointing at the gateway's internal-network IP, so HTTP/HTTPS traffic flows through the gateway instead of direct egress. `bottle.git` / git-gate is intentionally deferred on this backend until a safe Apple Container key-delivery path exists.
+On the default macOS Apple Container backend, a bottle is an agent container on a host-only internal network plus a gateway attached to both that internal network and a NAT egress network. The agent gets HTTP(S)_PROXY and CA bundle env vars pointing at the gateway's internal-network IP, so HTTP/HTTPS traffic flows through the gateway instead of direct egress. git-gate runs over the gateway's consolidated `git-http` daemon (the legacy per-bottle `git://` daemon is not used on this backend); keys are provisioned dynamically at launch and revoked on teardown.
 
 On the Firecracker backend, a bottle is an agent microVM plus a Docker gateway for egress, git-gate, and supervise. The VM reaches the gateway over a per-bottle point-to-point TAP link; a dedicated fail-closed `nftables` table (`inet bot_bottle_fc`) confines the guest to that link, so nothing leaves the box except through the gateway. The TAP pool and nft table are provisioned once (root); per-launch needs no privilege.
 
diff --git a/docs/prds/prd-new-macos-container-ci-runner.md b/docs/prds/prd-new-macos-container-ci-runner.md
index 4b04714d..cc03a3bc 100644
--- a/docs/prds/prd-new-macos-container-ci-runner.md
+++ b/docs/prds/prd-new-macos-container-ci-runner.md
@@ -131,10 +131,10 @@ the backend launches — the very false-green this issue is about.
 
 ## Open questions
 
-- Some sandbox-escape attacks depend on `bottle.git` / git-gate, which is
-  intentionally deferred on the macOS backend until a safe Apple Container
-  key-delivery path exists. First runner bring-up may reveal individual attacks
-  that need a `skipUnless` guard for `macos-container`. This does not affect the
-  infra-regression signal (that fails at `setUpClass`/launch, before any
-  attack), but it is expected first-run shakeout and is left to the bring-up
-  PR that actually has the runner in hand.
+- None known that block the job. git-gate is fully implemented on the macOS
+  backend (the gateway's consolidated `git-http` daemon plus dynamic key
+  provisioning/revocation), so `TestSandboxEscape` attack 5 — secret exfil
+  pushed through git-gate, rejected by the gitleaks hook before the upstream
+  push — runs the same as on the other backends. Any genuinely
+  macOS-specific test adjustment would surface at first runner bring-up, but
+  none is anticipated from the current backend implementation.