diff --git a/.gitattributes b/.gitattributes
index 2b8f1fee..1cb59805 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -7,4 +7,9 @@
 # shebang reads as the interpreter `bash\r`, which does not exist. Nothing about
 # that failure names line endings, and the same clone builds and tests fine
 # everywhere else, so it reads as a broken image rather than a broken checkout.
+#
+# A clone checked out before this rule keeps its carriage returns, because the
+# blob is unchanged and git has no reason to rewrite the file. The one-line
+# repair is in native/GameCult.Mesh.Quic.Native/README.md, beside the container
+# path it unblocks.
 *.sh text eol=lf
diff --git a/native/GameCult.Mesh.Quic.Native/README.md b/native/GameCult.Mesh.Quic.Native/README.md
index c9fd1e63..7248f3bd 100644
--- a/native/GameCult.Mesh.Quic.Native/README.md
+++ b/native/GameCult.Mesh.Quic.Native/README.md
@@ -117,6 +117,15 @@ it is: `${PWD}` in PowerShell, `$(pwd)` in a POSIX shell. The second is one line
 because the shell it is offered to is not decided here; a continuation would have
 to pick one, and a backtick pasted into a POSIX shell is not a continuation.
 
+A Windows clone made before `.gitattributes` kept shell scripts at LF still has
+`scripts/build-quic-native.sh` with carriage returns, and pulling does not fix
+it: the script's content did not change, so git neither rewrites it nor reports
+it modified. The container then dies at once on the interpreter `bash\r`. From
+the repository root, in either shell, this checks the script out again under the
+current attributes:
+
+    git rm --cached -q scripts/build-quic-native.sh; git checkout HEAD -- scripts/build-quic-native.sh
+
 `--security-opt seccomp=unconfined` is load-bearing, not caution. The
 ThreadSanitizer configuration needs the process's address space where it expects
 it, so `scripts/mutate-cultmesh.mjs` re-executes those runs under `setarch -R`,