diff --git a/build/README.md b/build/README.md
index c43bedd0..4759b93a 100644
--- a/build/README.md
+++ b/build/README.md
@@ -55,12 +55,15 @@ Three things worth knowing about how this is put together:
 source, not a dependency, not a directory that 'looked convenient'."* Both
 are closed. `runtime_prod` from this Dockerfile — tagged
 `ghcr.io/nestrilabs/nestri/base:latest` — is a complete, bootable, Steam-less guest image,
-and also the shared foundation other builds start from: nesbox's jailer
-image (see `nesbox/build/`) extracts Mesa and virglrenderer from it so the
-guest and host sides of the virtio-gpu native-context protocol never drift
-apart. Whatever layers Proton and the Steam client on top of it is a closed
-build outside this repo, by design — not something this repo names, links
-to, or depends on.
+and also the shared foundation other builds start from: nesbox's jail image
+(see `nesbox/build/`) extracts **Mesa** from it so the guest and host sides of
+the virtio-gpu native-context protocol never drift apart. Only Mesa —
+`virglrenderer` is the host half of that protocol and nesbox builds its own,
+patched, from `nesbox/patches/`; nothing in this image carries it.
+
+Whatever layers Proton and the Steam client on top of it is a closed build
+outside this repo, by design — not something this repo names, links to, or
+depends on.
 
 ## The nesinit gap
 
diff --git a/build/etc/conf.d/nestri-user-env b/build/etc/conf.d/nestri-user-env
index 13973ba3..ccde8729 100644
--- a/build/etc/conf.d/nestri-user-env
+++ b/build/etc/conf.d/nestri-user-env
@@ -11,12 +11,16 @@ XDG_SESSION_TYPE="wayland"
 XDG_SESSION_DESKTOP="nestri"
 DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/1000/bus"
 
-# Driver forcing, mirrored from /etc/profile.d/nestri-env.sh. That file only
-# runs for login shells, and nothing here is a login shell — every service
-# below runs from OpenRC. Capture happens through a Vulkan layer, so a
-# process that reached the GPU via native OpenGL would render fine and
-# capture nothing; zink is what makes such a process capturable at all.
-# These are load-bearing. Keep them in step with the profile.d copy.
+# Driver forcing — currently off, in both copies. Kept, commented, because
+# the reasoning still applies if it is ever needed again: capture happens
+# through a Vulkan layer, so a process reaching the GPU via native OpenGL
+# would render fine and capture nothing, and zink is what makes such a
+# process capturable at all. Nothing has needed it so far.
+#
+# /etc/profile.d/nestri-env.sh carries the same block, also commented, and
+# only runs for login shells — nothing here is one, every service below runs
+# from OpenRC. If these are ever re-enabled, re-enable both: one copy on and
+# one off means services and shells reach the GPU by different paths.
 #__GLX_VENDOR_LIBRARY_NAME="mesa"
 #MESA_LOADER_DRIVER_OVERRIDE="zink"
 #GALLIUM_DRIVER="zink"
diff --git a/build/etc/fstab b/build/etc/fstab
index 92284f56..b183fda8 100644
--- a/build/etc/fstab
+++ b/build/etc/fstab
@@ -1,4 +1,10 @@
-/dev/vda    /          ext4     rw,relatime              0 1
+# `ro`, matching how a box is actually started: nesbox passes `ro` on the
+# kernel command line and marks the root device `is_read_only: true` (see
+# nesbox's examples/vm.json), so the virtio-blk device refuses writes at the
+# device level. Saying `rw` here does not make it writable — it only asks
+# OpenRC's `root` service to attempt a remount that the device must reject.
+# Everything a running box writes to is a tmpfs or a share below.
+/dev/vda    /          ext4     ro,relatime              0 1
 devtmpfs    /dev       devtmpfs rw,nosuid                0 0
 proc        /proc      proc     rw,nosuid,nodev,noexec   0 0
 sysfs       /sys       sysfs    rw,nosuid,nodev,noexec   0 0