diff --git a/lib/worktree.sh b/lib/worktree.sh
index c9fb25c..1121c71 100644
--- a/lib/worktree.sh
+++ b/lib/worktree.sh
@@ -64,12 +64,12 @@ ocsb_wt_rm() {
   [[ $(realpath "${dir}") != "$(realpath "${main}")" ]] || ocsb_die "refusing to remove the main worktree"
   branch=$(git -C "${dir}" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
   export WT_DIR=${dir} WT_BRANCH=${branch} WT_SLUG=${name##*/} MAIN_ROOT=${main}
-  ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
   status=$(git -C "${dir}" status --porcelain)
   if [[ -n ${status} && ${force} -ne 1 ]]; then
     echo "${status}" >&2
     ocsb_die "worktree has uncommitted changes — commit them or pass --force (they will be lost)"
   fi
+  ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
   if [[ ${force} -eq 1 ]]; then
     git -C "${main}" worktree remove --force "${dir}"
   else
diff --git a/opencode/AGENTS.md b/opencode/AGENTS.md
index 735a9de..1fcd294 100644
--- a/opencode/AGENTS.md
+++ b/opencode/AGENTS.md
@@ -7,4 +7,8 @@ network, files outside the project, git remotes, Docker, or worktrees. In short:
   the system is read-only. "Read-only file system" is the sandbox, not a bug — do not retry.
 - Network goes through a filtering proxy. A 403 from the proxy is policy: tell the user which
   domain you need and why; do not try to bypass it.
-- You cannot open a browser; give the user the link instead.
+- You cannot open the user's browser (`xdg-open` is disabled); give the user the link instead.
+  Browser tools (Playwright) run inside the sandbox: headless, or in a window on the user's
+  desktop when `WAYLAND_DISPLAY` is set.
+- `.opencode-sandbox/`, `.cc-safety-net/`, `.git/hooks` and `.git/config` are read-only: the
+  host runs them. Ask the user to change them.
diff --git a/skills/opencode-sandbox/SKILL.md b/skills/opencode-sandbox/SKILL.md
index b9a0374..c020608 100644
--- a/skills/opencode-sandbox/SKILL.md
+++ b/skills/opencode-sandbox/SKILL.md
@@ -44,7 +44,7 @@ sandbox is on.
 
 ## Things you cannot do
 
-- Open a browser (`xdg-open` is disabled): print the link for the user.
+- Open the user's browser (`xdg-open` is disabled): print the link for the user.
 - Run GUI programs, unless `WAYLAND_DISPLAY` is set (the project enabled `OCSB_DISPLAY=1`): then
   windows open on the user's desktop through Wayland. Without it browsers must run headless.
 - `sudo`, `systemd-run`: denied.