diff --git a/.github/workflows/live-e2e.yml b/.github/workflows/live-e2e.yml
index 204be323f..f45afdc2c 100644
--- a/.github/workflows/live-e2e.yml
+++ b/.github/workflows/live-e2e.yml
@@ -1,12 +1,14 @@
 # Live E2E — the console driven against a REAL ObjectStack backend (#2835).
 #
-# What runs: an allowlist of e2e/live specs (screen-flow, action-modal,
-# master-detail — `pnpm test:e2e:live:ci`) against `objectstack dev` booted
-# from PUBLISHED @objectstack/* packages serving the showcase app. Every PR
-# therefore smoke-tests "this console x the released backend" — the class of
-# bug only a real browser against a real backend can catch (framework#3528:
-# a lazily-loaded widget's suspension unwound to the host's route boundary
-# and tore down the flow dialog; zero unit test could see it).
+# What runs: an allowlist of e2e/live specs (the list is whatever the
+# `test:e2e:live:ci` script in package.json names — that script is the single
+# source of truth; do not re-enumerate the specs here, a hand-copied list
+# drifts on every promotion) against `objectstack dev` booted from PUBLISHED
+# @objectstack/* packages serving the showcase app. Every PR therefore
+# smoke-tests "this console x the released backend" — the class of bug only
+# a real browser against a real backend can catch (framework#3528: a
+# lazily-loaded widget's suspension unwound to the host's route boundary and
+# tore down the flow dialog; zero unit test could see it).
 #
 # ⚠️ INFORMATIONAL, NON-REQUIRED lane — `continue-on-error: true` keeps a
 # failure here from failing the workflow run, so it never blocks a merge and
diff --git a/content/docs/guide/ci-cd-pipeline.md b/content/docs/guide/ci-cd-pipeline.md
index 939637764..75a0cd6f4 100644
--- a/content/docs/guide/ci-cd-pipeline.md
+++ b/content/docs/guide/ci-cd-pipeline.md
@@ -230,11 +230,16 @@ is informational and never ejects a PR from the merge queue. Do not add it to re
 (and do not remove `continue-on-error`) until the nightly record proves the lane stable; see the
 header comment in the workflow file (#2835).
 
-What it does: runs the allowlisted live specs (`pnpm test:e2e:live:ci` — screen-flow,
-action-modal, master-detail) against a real `objectstack dev` backend booted from **published**
-`@objectstack/*` packages serving the showcase app, catching the class of bug only a real
-browser against a real backend can see. Failures still surface as a red step plus an uploaded
-Playwright report and job summary.
+What it does: runs an allowlist of the live specs (`pnpm test:e2e:live:ci`) against a real
+`objectstack dev` backend booted from **published** `@objectstack/*` packages serving the
+showcase app, catching the class of bug only a real browser against a real backend can see.
+Failures still surface as a red step plus an uploaded Playwright report and job summary.
+
+**Which specs are in the allowlist:** whatever the `test:e2e:live:ci` script in `package.json`
+names — that script is the single source of truth, and this page deliberately does not repeat
+the list. The lane grows the allowlist a few proven specs at a time (see the workflow's header
+comment), so every promotion would stale a hand-copied enumeration here; it already did
+(objectui#3488).
 
 Backend pins live in `e2e/live/ci/backend.env` and must match the `@objectstack/spec` version in
 `pnpm-lock.yaml` — bump both in the same PR, or the run proves nothing.