diff --git a/scripts/check-core-boundary.sh b/scripts/check-core-boundary.sh
index 3f290ce77b..54d300eec2 100644
--- a/scripts/check-core-boundary.sh
+++ b/scripts/check-core-boundary.sh
@@ -135,7 +135,17 @@ COMMERCIAL_SURFACE="internal/cliauth internal/serviceproto cmd/gc/cmd_login.go"
 COMMERCIAL_FIELD_RE='json:"[^"]*(trial|billing|credit|plan|invoice|subscription|quota|coupon|entitlement)'
 commercial_fields=""
 for p in $COMMERCIAL_SURFACE; do
-	[ -e "$p" ] || continue
+	# A surface member that has not landed yet is skipped, but never SILENTLY:
+	# this file's contract is fail-closed (see header), and an unannounced skip
+	# is how a guard stays switched off after the package it guards arrives.
+	# internal/serviceproto is the current expected absence — it is planned for
+	# this module, not the hosted one (engdocs/plans/hosted-onboarding/DESIGN.md).
+	# If a name here is still reported once its package exists, the path is wrong
+	# and check (f) is scanning nothing.
+	if [ ! -e "$p" ]; then
+		note "(f) surface member not present, not scanned: $p"
+		continue
+	fi
 	hits=$(grep -rnE --include='*.go' "$COMMERCIAL_FIELD_RE" "$p" 2>/dev/null \
 		| grep -v '_test\.go:' | grep -v 'boundary:allow commercial')
 	if [ -n "$hits" ]; then
diff --git a/scripts/gc-session-docker b/scripts/gc-session-docker
index 9c62a4ed8d..db901b940b 100755
--- a/scripts/gc-session-docker
+++ b/scripts/gc-session-docker
@@ -5,7 +5,7 @@
 #   GC_SESSION=exec:scripts/gc-session-docker gc start
 #
 # Implements the Gas City exec session provider protocol (see
-# internal/session/exec/exec.go). Each agent runs in its own Docker
+# docs/reference/exec-session-provider.md). Each agent runs in its own Docker
 # container with tmux providing session management inside the container.
 #
 # Architecture:
@@ -41,8 +41,10 @@ TMUX_SOCK_DIR="/run/gc-tmux"
 
 # Controller-only env vars stripped from containers. These reference
 # controller-side resources (Unix sockets, localhost ports) that aren't
-# reachable from inside a container. Matches the K8s provider's skip list
-# in internal/session/k8s/pod.go buildPodEnv().
+# reachable from inside a container. This list is maintained here and is not
+# derived from any other provider — contrib/session-scripts/gc-session-k8s
+# carries no equivalent list, so add a var here when it names a
+# controller-local coordinate, without expecting a canonical copy elsewhere.
 # Strip controller-only connection coordinates; auth credentials
 # (GC_DOLT_USER, GC_DOLT_PASSWORD, BEADS_DOLT_SERVER_USER, BEADS_DOLT_PASSWORD)
 # pass through — agents need them to authenticate against Dolt.