diff --git a/docs/gotchas.md b/docs/gotchas.md
index b730963..9e566b3 100644
--- a/docs/gotchas.md
+++ b/docs/gotchas.md
@@ -66,8 +66,15 @@ are correct and both exit non-zero. Pin the invariant — a fatal cause reaches
 experiment and the next one can be handed an address a previous run used —
 `65.109.0.222` came back as a build host having been experiment 3's watchdog,
 and SSH refused with REMOTE HOST IDENTIFICATION HAS CHANGED. It is ordinary
-address reuse, not an interception: `ssh-keygen -R <ip>` clears it. Worth
-knowing before the warning arrives mid-provision and reads as something worse.
+address reuse, not an interception.
+
+This is not just a manual-SSH nuisance: it broke a real provision. The watchdog
+landed on a build host's recycled address, `arm_watchdog.sh` could not connect,
+and the failed-apply trap tore the run down. `StrictHostKeyChecking=accept-new`
+admits an *unknown* host but hard-fails a *changed* one, so it does not help
+here. `provision.sh` and `arm_watchdog.sh` now scrub the host keys of the
+servers they just created, which is safe precisely because those servers are
+seconds old.
 
 **Build the deploy artifact natively.** Emulating linux/amd64 on an arm64
 workstation turns an 8-minute compile into 40-plus and yields a cross-emulated