diff --git a/docs/notes/git-sync-images-and-repo-size.md b/docs/notes/git-sync-images-and-repo-size.md
index e7912b9..85eef93 100644
--- a/docs/notes/git-sync-images-and-repo-size.md
+++ b/docs/notes/git-sync-images-and-repo-size.md
@@ -80,6 +80,23 @@ pre-seed (not depth-1) also sidesteps the shallow-push sharp edge. remanso
 keeps working, the device gets everything, and repo size stops being anyone's
 problem.
 
+Implemented in firmware/justfile as three recipes, each ejecting the card when
+done so it goes straight into Typoena:
+
+- `just init <repo-path>` — full prep of a fresh card: copies a full clone to
+  the card's `repo/`, excluding everything the repo's `.gitignore` ignores (so
+  `node_modules` and local secrets like `firmware/.env` never land on the card),
+  then writes `/sd/typoena.conf` — Wi-Fi creds + PAT + git identity — from the
+  TW_* vars already in `firmware/.env` (no re-typing, no prompts).
+- `just load <repo-path>` — the repo copy on its own (refresh after big upstream
+  changes).
+- `just provision` — the config on its own (rotate the PAT / switch networks
+  without re-copying the repo).
+
+The firmware still reads those values via `env!()` today; reading
+`/sd/typoena.conf` at boot is a TODO that rides with the SD wiring into
+`main.rs`.
+
 ## What happens on an ongoing pull
 
 In the single-writer model the device usually doesn't pull at all:
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 06d9b20..600232b 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -115,12 +115,20 @@ lives in the `git_sync` / `sd_fat` spike bins, not `main.rs`.
 
 - [~] ESP32-S3 boots (✓); e-ink shows Typoena splash + boot log — splash pending Spike 9
 - [x] USB host enumerates the Nuphy, key events reach the editor (Spike 4)
-- [ ] One hard-coded file (`/sd/repo/notes.md`) opens on boot — SD spike-only, not in `main.rs`
+- [ ] One hard-coded file (`/sd/repo/notes.md`) opens on boot — SD spike-only,
+      not in `main.rs`. The card is pre-seeded from a computer (`just init`
+      copies a full clone to `/sd/repo` + writes config), never cold-cloned on
+      device — see [note](notes/git-sync-images-and-repo-size.md).
 - [x] Insert-only editing, backspace, enter, arrow keys — modal editor overshot this early (see v0.2)
 - [x] Line wrap, no line numbers yet — soft-wrap done early (see v0.6)
 - [ ] Save on `Ctrl-S` → SD — SD blocked, not wired to `main.rs`
-- [x] Wi-Fi credentials + remote URL + PAT + author baked into the binary at
-      build time via env vars (no NVS, no on-device provisioning UI in v0.1)
+- [~] Wi-Fi credentials + remote URL + PAT + author: today baked into the binary
+      via `env!()` (no NVS, no on-device provisioning UI in v0.1). Migrating to
+      `/sd/typoena.conf` on the card, provisioned by `just provision` (or
+      `just init` for a fresh card) from the same `firmware/.env` the build uses
+      (minimum input — rotate the PAT or switch networks without a reflash, no
+      card re-copy). Firmware to read it at boot instead of
+      `env!()` — TODO, rides with the SD wiring into `main.rs`.
 - [~] `Ctrl-G` runs: `git add .` → commit with an ISO-8601 timestamp message →
   `git push`; on push failure, `git pull --no-edit` then retry the push
   (no-op short-circuit when nothing is staged). Proven on device in the