diff --git a/CHANGELOG.md b/CHANGELOG.md
index 248219d..494109a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -87,7 +87,10 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   such a failure only inside its JSON stream: `stopReason=error`, rc 0. Before
   this, an expired Bedrock session failed every task as "no fenced json
   envelope". The `fork` tool does not read this key. Documented in pi-toolkit's
-  README.
+  README. It complements `/aws-sso` (below), which by design acts only in
+  interactive sessions (`ctx.hasUI`; pi-extensions `docs/aws-sso.md`,
+  troubleshooting). A `task` child that meets an ended SSO session gets no help
+  from the keeper.
 
 - **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO
   session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for