diff --git a/AGENTS.md b/AGENTS.md
index 91e6629..41b685d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,7 +32,8 @@ There is no in-cluster ingress controller and no public IP. Every external entry
 - `argocd` — ArgoCD, KSOPS plugin, `sops-age-keys` Secret
 - `cert-manager` — cert-manager controllers + Cloudflare API token
 - `cloudflare-operator-system` — cloudflare-operator, tunnel deployment, Cloudflare API secret
-- `arc-system` — ARC controller (Actions Runner Controller)
+- `arc-systems` — ARC controller (Actions Runner Controller)
+- `arc-runners` — ARC scale sets, listeners, and ephemeral runner pods
 
 ## Certificate Management
 
@@ -179,6 +180,7 @@ pre-commit run --all-files
 4. **Tor secret format** — Use `data` with raw binary base64; `stringData` double-encodes.
 5. **KSOPS needs the age key in the repo-server pod** — Without `sops-age-keys` mounted, manifest generation fails before any sync.
 6. **DNS-01 requires external resolvers** — cluster DNS cannot validate Let's Encrypt challenges; the cert-manager controller args above are required.
+7. **ARC upgrades can leave a stale listener** — because pruning is disabled for controller-generated listener resources, a chart upgrade can leave a listener referencing a deleted `EphemeralRunnerSet`. The listener then restarts with `ephemeralrunnersets.actions.github.com "<name>" not found`, and `arc-tf` jobs remain queued. Inspect the listener pod's owner and current ARC custom resources before deleting the stale `AutoscalingListener`; deleting only its pod recreates the same broken listener.
 
 ## Useful Commands
 
diff --git a/README.md b/README.md
index 0d5b0d6..201092e 100644
--- a/README.md
+++ b/README.md
@@ -163,12 +163,12 @@ The age public key is committed in `.sops.yaml`. The matching private key is loa
 
 ## CI/CD
 
-`.github/workflows/ci.yml`:
+The repository uses `.github/workflows/test.yml` and `.github/workflows/sync.yml`:
 
 1. **test** (`ubuntu-latest`) — runs pre-commit (yamllint, kube-linter, conventional-commit, etc.)
-2. **sync** (`arc` runner, `main` only) — `kubectl patch` each App-of-Apps root (`bootstrap-secrets`, `gitops-operators`, `gitops-workloads`) to trigger an ArgoCD sync at the new SHA
+2. **sync** (`arc-tf` runner, `main` only) — after tests pass, patches each App-of-Apps root (`bootstrap-secrets`, `gitops-operators`, `gitops-workloads`) to initiate an ArgoCD sync at the tested SHA
 
-The in-cluster ARC runner uses its ServiceAccount token to talk to the API directly.
+The in-cluster ARC runner uses its ServiceAccount token to talk to the API directly. The sync workflow initiates reconciliation but does not wait for it to finish. Afterward, confirm each affected Application reports the target revision, `Synced`, and `Healthy`. Use `workflow_dispatch` on `sync.yml` to retry the selected ref when necessary.
 
 ## Resource Sizing