diff --git a/README.md b/README.md
index 2c05e89..d0f05fc 100644
--- a/README.md
+++ b/README.md
@@ -177,9 +177,16 @@ something", and no waterfall that can rewrite a loop-built request
 
 ## Install
 
+The plugin brings no dependency of its own: everything it imports at runtime is a
+`@deepseek-ai/*` **peer** that ships with the dsh install on the machine.
+`npm install` does **not** deliver those peers (three of the four are declared
+optional), so on its own it leaves a tree that cannot even load the plugin — link
+them first, per
+[Prerequisite: link the harness packages first](#prerequisite-link-the-harness-packages-first).
+
 ```bash
 # from this repo
-npm install                    # nothing to install; dsh packages are peers
+npm install
 ```
 
 The plugin needs `node:sqlite` (built into Node ≥ 22.5). On Node 22.23 it works
@@ -646,22 +653,26 @@ because they will bite anyone writing a second dsh service plugin.
 
 ### Prerequisite: link the harness packages first
 
-This repository has **no runtime dependencies** — `lib/` uses only `node:`
-built-ins. Everything it imports from `@deepseek-ai/*` is a **peer** that must
-come from the dsh install already on the machine, which is why none of it is
-bundled here (vendoring a copy would let it drift from the harness it is supposed
-to run inside).
+Nothing here is fetched as this plugin's own dependency. The `@deepseek-ai/*`
+packages that `lib/` imports at runtime are **peers**: they belong to the dsh
+install already on the machine, and they are not vendored here on purpose
+(a copy would drift from the harness this plugin is supposed to run inside).
+`npm install` does not resolve them either — `cordis` is the only one of the four
+that is non-optional, so npm fetches that one (plus its own transitive deps) and
+leaves the other three missing.
 
-So a fresh clone needs one setup step before the suite can run:
+A fresh clone therefore needs one setup step before the suite can run:
 
 ```bash
 bash scripts/link-dsh.sh          # symlinks the installed dsh packages into node_modules
 ```
 
-**If you skip it, `npm test` fails with four files reporting
-`ERR_MODULE_NOT_FOUND: Cannot find package '@deepseek-ai/cordis'`** (loader,
-plugin, guard and http suites). That is the expected symptom of a missing setup
-step, not a broken tree — run the script and it goes green.
+**Skip it and `npm test` and `npm run check` both fail with four files
+reporting `ERR_MODULE_NOT_FOUND: Cannot find package '@deepseek-ai/…'`** —
+`loader`, `plugin`, `phase-b-g` and `phase-b-h` (the suites that mount a real
+dsh app). Those four die at import, so the run reports a handful of tests rather
+than the full suite. That is the expected symptom of a missing setup step, not a
+broken tree; run the script and both commands go green.
 
 The script takes an optional argument for a non-default install root:
 
diff --git a/scripts/link-dsh.sh b/scripts/link-dsh.sh
index 104fccd..4d09f88 100755
--- a/scripts/link-dsh.sh
+++ b/scripts/link-dsh.sh
@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 # Link the globally-installed dsh packages into node_modules.
 #
-# The plugin itself has zero runtime dependencies (it uses only `node:` built-ins),
-# so nothing is installed from a registry. The dsh packages are *peers*: they must
-# come from the running harness. During development they live in
+# The plugin declares no dependency of its own, so nothing here is fetched from a
+# registry. The dsh packages it *imports* at runtime are **peers**: they must come
+# from the running harness, and npm will not install them for us. During
+# development they live in
 # /usr/lib/node_modules/@deepseek-ai (a global install), so this script wires them
 # up by symlink instead of vendoring a copy that could drift from the harness.
 #