diff --git a/DESIGN-root-tld-cert.md b/DESIGN-root-tld-cert.md
index 4ccdfde..cf661de 100644
--- a/DESIGN-root-tld-cert.md
+++ b/DESIGN-root-tld-cert.md
@@ -64,18 +64,26 @@ certificate is held by the operator wallet on chipnet — for a real deployment
 this needs to be a multisig, a covenant, or a governance body (Athenae council,
 see `ROADMAP-IDEAS.md §4`) so the root isn't controlled by a single key.
 
-## What this unlocks
+## What this unlocks — and what it does NOT
 
-1. **Multi-TLD resolution** (already live) — `bnsd` and Theseus accept any
-   `<label>.<tld>`. The root cert is the "which TLDs count as ours" answer.
-2. **Collision detection** for the soft "Open with…" prompt — a client can
-   preempt the prompt on `.com` (not BCNR-native, only ICANN could have it)
-   without hardcoding an ICANN-TLD allowlist.
-3. **Surgical-mode routing** (`install.ps1 -Mode nrpt`) — the installer can
-   read the root cert and write one NRPT rule per activated TLD; adding a TLD
-   on-chain later triggers a re-sync, not a reinstall. (📐 to build.)
-4. **Registrar hygiene** — a permissionless registrar (see `ROADMAP-IDEAS.md §3`)
-   must sell names only under activated TLDs; the root cert is the check.
+**The root cert does NOT gate resolution.** The resolver stays TLD-agnostic —
+any registered name under any TLD resolves. The activated list has three real
+consumers:
+
+1. **Registrar** (`register.html`) — the TLD dropdown for buyers is limited to
+   activated TLDs. Storefront quality bar; keeps stray experimental TLDs out of
+   the buying UI. Names *already* registered under unlisted TLDs still resolve.
+2. **Surgical-mode routing** (`install.ps1 -Mode nrpt`) — the installer reads
+   the root cert and writes one NRPT rule per activated TLD. Adding a TLD
+   on-chain + re-running the installer picks it up (no code change). Users who
+   want any-TLD system-wide routing pick **Full mode** instead.
+3. **Collision-mode classifier** (soft "Open with…" prompt) — clients use it as
+   a hint: "is this TLD BCNR-native → probably not a collision, don't prompt."
+   A TLD not on the list falls through to normal collision handling; the list
+   is a *preemption* aid, not a filter.
+
+The resolver never consults the list. Registration and resolution are separate
+concerns; permissionless resolution + curated activation is deliberate.
 
 ## Not in scope here