diff --git a/docs/architecture.md b/docs/architecture.md
index 06e493f3..8c6e19e1 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -29,8 +29,8 @@
                        │ Podman REST API socket + systemd Quadlet units
 ┌──────────────────────┴───────────────────────────────┐
 │           ROOTLESS PODMAN CONTAINERS                 │
-│  50+ manifest-driven apps as user.slice Quadlet      │
-│  units — survive backend restarts, self-heal         │
+│  50+ manifest-driven apps the orchestrator owns and  │
+│  self-heals; companion UIs run as systemd Quadlet    │
 └──────────────────────────────────────────────────────┘
 
 ┌──────────────────────────────────────────────────────┐
@@ -104,9 +104,11 @@ never appear in `podman inspect` or unit files), `generated_secrets` /
 `generated_certs` (self-healing), `network_aliases`, `data_uid`, and
 allow-listed `post_install` hooks that run inside the app's own sandbox.
 
-**Install** compiles the manifest to a rootless **Quadlet unit under
-`user.slice`** — containers survive backend restarts and reboots.
-Multi-container apps (BTCPay, Mempool, Immich, NetBird, IndeeHub) are sets of
+**Install** creates a rootless container the orchestrator owns; the companion
+UI containers run as systemd **Quadlet units under `user.slice`** (the
+validated path being flipped to default for all apps), so those survive backend
+restarts and reboots outright, and the reconciler rebuilds any container that
+vanishes. Multi-container apps (BTCPay, Mempool, Immich, NetBird, IndeeHub) are sets of
 per-member manifests installed via the stack orchestrator on an app-local
 network with readiness gates and generated cross-service secrets. A
 level-triggered **boot reconciler** converges actual state to desired state