diff --git a/docs/user-guide.md b/docs/user-guide.md
index 1f1bc002..66ab0f9a 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -311,9 +311,12 @@ The next boot runs the new slot; `boot-success` judges it (state partition
 usable, services up, the zone supervisor healthy) and only then makes it the
 committed boot file. An unhealthy trial reboots into the previous slot by
 itself. Persistent zone data on `kryptik-state` is never written by any of
-this. `apply` refuses while another trial is armed (reboot first) and while
-the state partition is degraded; after a trial that failed to boot it
-refuses that slot again until you pass `--retry`.
+this. `apply` refuses while another trial is armed (reboot first), while the
+state partition is degraded, and on any slot but the committed one, such as
+one picked in the firmware's boot menu: the refusal says how to boot the
+committed slot, or to make the running one committed from the medium. After
+a trial that failed to boot it refuses that slot again until you pass
+`--retry`.
 
 ```sh
 kryptik-update rollback                       # back to the other slot, if it is intact
@@ -341,10 +344,11 @@ state partition.
 slot, as the installer does, then commits it. Every byte comes from the
 medium, and the slot is committed only once it verifies against the root
 hash the medium's signed kernel carries. A medium whose root or slot kernel
-is not that release's is refused with the reason, and nothing is committed. The state partition is not touched, so users
-and zone volumes survive. The result is the medium's version, which may be
-older than what was installed: the tool names the version it writes but does
-not compare it, so read `--status` first.
+is not that release's is refused with the reason, and nothing is committed.
+The state partition is not touched, so users and zone volumes survive. The
+result is the medium's version, which may be older than what was installed:
+the tool names the version it writes but does not compare it, so read
+`--status` first.
 
 A machine that stops responding resets itself after about a minute (the
 software watchdog's timeout; a hardware watchdog keeps its own): a service