diff --git a/clientdocs/jenkins-kubernetes-guide.md b/clientdocs/jenkins-kubernetes-guide.md
index 6127c09..3807599 100644
--- a/clientdocs/jenkins-kubernetes-guide.md
+++ b/clientdocs/jenkins-kubernetes-guide.md
@@ -166,7 +166,7 @@
       --coe kubernetes \
       --image ubuntu-jammy-kube-v1.34.8 \
       --external-network provider-ext \
-      --master-flavor gp.mid --flavor <worker-flavor> \
+      --master-flavor <master-flavor> --flavor <worker-flavor> \
       --network-driver calico --docker-storage-driver overlay2 \
       --master-lb-enabled --floating-ip-enabled \
       --fixed-network {{TENANT_SHORT_NAME}}-net \
@@ -226,9 +226,9 @@
   has administrative access to your cluster -- treat it exactly like a password.
 - The certificate is time-limited. When it expires, `kubectl` and your pipelines
   start failing to authenticate; re-fetch the kubeconfig with the same command
-  and update the stored credential (section 4). [VERIFY-LIVE: confirm the exact
-  certificate validity period against your delivered cluster and set a renewal
-  reminder ahead of it.]
+  and update the stored credential (section 4). Confirm the expiry date for your
+  cluster -- you can read it from the certificate embedded in the kubeconfig, or
+  ask {{ACCOUNT_CONTACT}} -- and set a renewal reminder ahead of it.
 
 Never commit the kubeconfig to a repository. It goes into the Jenkins credential
 store next, and nowhere else.
@@ -257,6 +257,17 @@
 using the stored kubeconfig. Nothing here needs the cluster password; deploying
 into an existing cluster is ordinary automation.
 
+### 5.0 Build and publish your image first
+
+Deploying pulls a container image; it does not build one. Building your app into
+an image and pushing it to a registry the cluster can pull from is an upstream
+step, and in a real pipeline it is a Build stage (and a push stage) that runs
+before the Deploy stage below. The examples here use the public `nginx:stable`
+image so you can prove the deploy path without a registry; swap in your own
+image once it is built and pushed. If your registry is private, create a
+Kubernetes image-pull secret in the cluster and reference it from your
+Deployment's `imagePullSecrets`, so the cluster can authenticate to pull it.
+
 ### 5.1 A minimal application manifest
 
 Keep your Kubernetes manifests in your application repository, for example in a
@@ -308,6 +319,9 @@
             // The Kubernetes CLI plugin loads the stored kubeconfig for this
             // block and masks it in the log.
             withKubeConfig([credentialsId: 'omega-k8s-kubeconfig']) {
+              // Applying the whole k8s/ directory keeps deploy and teardown
+              // symmetric: `kubectl delete -f k8s/` later removes everything
+              // this created, including the Service (and its load balancer).
               sh 'kubectl apply -f k8s/'
               sh 'kubectl rollout status deployment/sample-app --timeout=5m'
             }
@@ -406,7 +420,7 @@
 
 5. Deploy the sample app (5.1):
 
-       kubectl apply -f k8s/app.yaml
+       kubectl apply -f k8s/
        kubectl rollout status deployment/sample-app --timeout=5m
 
 6. Read the external address (wait for it to move from <pending> to an IP; the
@@ -418,8 +432,8 @@
 
 7. Tear the example down (8):
 
-       kubectl delete -f k8s/app.yaml     # deletes the Service too -> releases
-                                          # the load balancer and floating IP
+       kubectl delete -f k8s/         # deletes the Service too -> releases
+                                      # the load balancer and floating IP
        openstack coe cluster delete demo-k8s
 
 --------------------------------------------------------------------------------
@@ -429,8 +443,9 @@
 Delete in reverse order of creation, and delete the Service before anything
 else, so the load balancer and floating IP are released:
 
-1. `kubectl delete -f k8s/app.yaml` (or `kubectl delete service <name>`). This
-   is what releases the load balancer and its floating IP.
+1. `kubectl delete -f k8s/` (or `kubectl delete service <name>`). This is what
+   releases the load balancer and its floating IP. Deleting the same directory
+   you applied catches every manifest, so no Service is left stranded.
 2. Delete other cloud resources your build created (servers, volumes, extra
    floating IPs), newest first.
 3. If you are finished with the cluster itself, delete it as
diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt
index 6db6f4b..4331d87 100644
--- a/clientdocs/sweep-receipt.txt
+++ b/clientdocs/sweep-receipt.txt
@@ -15,7 +15,7 @@
 ae51da963d4d3704e6a1bd8613a243616ac22c0b973833b31f1bd22a40f3c66e  clientdocs/ci-integration-guide.md
 60c890b551e0a16d8d249fc809e2b561d44c6ec6121bf8a20f21e5fe6e2e9c60  clientdocs/handover-pack.md
 3f08eb458bcbb36172a5ca2785a6ec72a69a4f8cd440fec53ed604f074b1b8c6  clientdocs/intake-form.md
-3f8eed5359c7067d778e5ad63f40c971b759f379ca2fde2245c38a1f27c2fbd5  clientdocs/jenkins-kubernetes-guide.md
+bd54094610aed79687def82200f74b52e5be68fc004e0984ea19055d4aa2e9c4  clientdocs/jenkins-kubernetes-guide.md
 96a077bb2e5732a0443683755bcefa044a603fe323024ca887165177e05c390b  clientdocs/scripts/Jenkinsfile.example
 1955db5d789a2e48d9054e307fbec2678efc1fbafda18103caa389cb896701fd  clientdocs/scripts/acceptance-run.sh
 c2a2ff7ad719cb5866b1b58f5ca2cac930ccc99b96efaf8a3f12301d645727d3  clientdocs/scripts/ci-cleanup-sweep.sh