diff --git a/README.md b/README.md
index c912b0b..9263d95 100644
--- a/README.md
+++ b/README.md
@@ -127,6 +127,10 @@ apps.
 - **Fail-closed access control** — see the badge lane above.
 - Battery room sensors and locks are cloud-fed; credentials also live
   in `secrets.yaml`.
+- **HomeKit is controller-only (founder ruling 2026-09-04).** HA pulls
+  *from* HomeKit accessories when one enters the fleet; HA entities are
+  NEVER exposed *to* Apple Home — no `homekit` bridge integration, no
+  outward QR pairing.
 
 ## 🚀 Deployment pipeline