diff --git a/README.md b/README.md
index 57ee604..f64be36 100644
--- a/README.md
+++ b/README.md
@@ -856,8 +856,12 @@ JSON. Full behavior and safety gates are documented in
 
 Authenticated release producers use `POST /api/v1/human-gates/intake` with an
 `Idempotency-Key` and an immutable `"candidate_hash"`; durable account-bound
-SQLite storage is configured by `STACKCHAIN_HUMAN_GATE_DB`. Review decisions
-carry `expected_revision`, a new idempotency key, and return durable receipts.
+SQLite storage is configured by `STACKCHAIN_HUMAN_GATE_DB`. Account isolation
+binds each queue to the upstream principal ID and login, including its offline
+browser cache. Review decisions carry `expected_revision`, a stable idempotency
+key across network retries, and return durable receipts. If producer evidence
+changes after a release or hold, the update reopens the exact hash for a new
+revision-checked decision instead of silently retaining the old outcome.
 New hashes mark older pending candidates `superseded` without removing their audit
 history. See [`docs/human-gates.md`](docs/human-gates.md) for the complete
 producer body, decision API, and **Telegram coalescing contract**. Lock-screen
diff --git a/tests/test_human_gates_readme.py b/tests/test_human_gates_readme.py
index e3feaf4..71acac0 100644
--- a/tests/test_human_gates_readme.py
+++ b/tests/test_human_gates_readme.py
@@ -11,6 +11,8 @@ def test_readme_documents_hash_bound_producer_intake_and_revision_decisions():
     assert '"candidate_hash"' in text
     assert "expected_revision" in text
     assert "STACKCHAIN_HUMAN_GATE_DB" in text
+    assert "principal ID and login" in text
+    assert "reopens the exact hash" in text
 
 
 def test_readme_defines_privacy_safe_telegram_coalescing_contract():