diff --git a/docs/ops/HYPERTWIST_REMOTE_DEVELOPMENT_REGISTRATION_PLAN_JETBRAINS_GATEWAY_2026_1_2_AND_VISUAL_STUDIO_2022_2026-05-30.md b/docs/ops/HYPERTWIST_REMOTE_DEVELOPMENT_REGISTRATION_PLAN_JETBRAINS_GATEWAY_2026_1_2_AND_VISUAL_STUDIO_2022_2026-05-30.md
index acac606..df8b06e 100644
--- a/docs/ops/HYPERTWIST_REMOTE_DEVELOPMENT_REGISTRATION_PLAN_JETBRAINS_GATEWAY_2026_1_2_AND_VISUAL_STUDIO_2022_2026-05-30.md
+++ b/docs/ops/HYPERTWIST_REMOTE_DEVELOPMENT_REGISTRATION_PLAN_JETBRAINS_GATEWAY_2026_1_2_AND_VISUAL_STUDIO_2022_2026-05-30.md
@@ -25,6 +25,11 @@ The following is already true:
   `root`
 - `dev` is in `sudo` and `docker`, so normal development and container
   operations do not require a root IDE session
+- `dev` and `deploy` password logins remain locked; SSH key auth is the live
+  login path
+- `dev` now has a narrow `NOPASSWD` sudoers rule for package-management
+  commands (`apt`, `apt-get`, `apt-cache`, `apt-mark`), so future package
+  installs do not require abandoning the remote-development session
 - local SSH alias exists:
   - `scriptoriumai-new-dev`
 - local JetBrains/Gateway-compatible key path:
@@ -95,8 +100,10 @@ Operational boundary:
 - use `dev` for JetBrains Gateway, Rider, terminal development, and Visual
   Studio remote registration
 - use `dev` for `VS Code Remote-SSH` sessions as well
-- use `root` only for system administration, package installation, certbot,
-  service repair, and recovery work
+- use `dev` for routine `sudo apt ...` package management now that the narrow
+  `NOPASSWD` rule exists
+- use `root` for broader system administration, certbot, service repair,
+  account recovery, and privileged tasks outside that package-management lane
 
 ## Canonical remote folder roots
 
diff --git a/docs/ops/HYPERTWIST_VPS_POST_CUTOVER_OPERATIONAL_INVARIANTS_2026-05-30.md b/docs/ops/HYPERTWIST_VPS_POST_CUTOVER_OPERATIONAL_INVARIANTS_2026-05-30.md
index dcdb8f9..42df675 100644
--- a/docs/ops/HYPERTWIST_VPS_POST_CUTOVER_OPERATIONAL_INVARIANTS_2026-05-30.md
+++ b/docs/ops/HYPERTWIST_VPS_POST_CUTOVER_OPERATIONAL_INVARIANTS_2026-05-30.md
@@ -61,12 +61,26 @@ Current privilege state:
 - `dev` is in `docker`
 - `deploy` is in `sudo`
 - `deploy` is in `docker`
+- `dev` password login is locked
+- `deploy` password login is locked
+- both additive users currently authenticate by SSH key, not by a usable Unix
+  password
+- `dev` now has a narrow `NOPASSWD` sudoers rule for package-management
+  commands:
+  - `/usr/bin/apt`
+  - `/usr/bin/apt-get`
+  - `/usr/bin/apt-cache`
+  - `/usr/bin/apt-mark`
 
 Operational rule:
 
 - IDE sessions, terminal development, and remote Git work should use `dev`
-- `root` stays reserved for admin, certbot, package-management, and recovery
-  work
+- `dev` may perform routine package-management operations with `sudo apt ...`
+  and related read-only `apt-cache` / `apt-mark` commands without an
+  interactive password prompt
+- `root` remains the required lane for broader system administration, certbot,
+  service repair, account recovery, and any privileged task outside the narrow
+  package-management sudoers rule
 - the current practical default remote-development lane is now `VS Code
   Remote-SSH` for agent-first work