docs: the layer-nerdctl prose names the containerd engine word, not the retired nerdctl

.agents/skills/layer-nerdctl/SKILL.md

@@ -5,14 +5,14 @@ description: 'nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI st
   on Fedora/Debian/Ubuntu, nerdctl.toml with namespace=default, the charly CNI conflist,
   the written rootless containerd/buildkit user units, the CONTAINERD.md §2/§4
   checklist (uidmap helpers, subuid/subgid, delegation, /dev/fuse, user D-Bus,
-  slirp4netns), and the nested-pod posture. Use when working with the nerdctl engine,
-  the layer-nerdctl candy, or engine: nerdctl deploys.'
+  slirp4netns), and the nested-pod posture. Use when working with the containerd engine
+  (driven through the nerdctl CLI), the layer-nerdctl candy, or engine: containerd deploys.'
 ---
 
 # layer-nerdctl
 
 nerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI
-stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`
+stack, as ONE candy. Composed by a box that wants the opt-in `engine: containerd`
 engine.
 
 ## What it installs
@@ -85,9 +85,12 @@ specific deploy needs the publish side, set it deliberately in
 
 ## Engine capability
 
-The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`
+The `engine: containerd` word is served by `opencharly/plugin-nerdctl`
 (out-of-process) or compiled in; every engine op delegates to
-`container.InvokeEngineOp("nerdctl", …)` in the spec module. nerdctl has no
+`container.InvokeEngineOp("containerd", …)` in the spec module. `containerd` is
+the engine WORD; `nerdctl` is the CLI BINARY that drives it — the spec-owned
+`#EngineBinaries` map (`containerd → nerdctl`) is the one home for that mapping.
+nerdctl has no
 `--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the
 host user under rootless), guaranteeing uid-identical sharing; a non-zero uid
 needs the subuid caveat.
@@ -108,5 +111,6 @@ needs the subuid caveat.
 
 ## Use when
 
-Working with the nerdctl engine, the layer-nerdctl candy, the rootless
-containerd/buildkit checklist, or an `engine: nerdctl` deploy.
+Working with the containerd engine (driven through the nerdctl CLI), the
+layer-nerdctl candy, the rootless containerd/buildkit checklist, or an
+`engine: containerd` deploy.

AGENTS.md

@@ -24,11 +24,12 @@ Canonical files:
 
 ## Load these skills first (R0)
 
-- `/charly-distros:layer-nerdctl` — the owning skill. The nerdctl engine, the
-  `layer-nerdctl` candy, the nested-pod posture, and `engine: nerdctl` deploys.
+- `/charly-distros:layer-nerdctl` — the owning skill. The containerd engine
+  (driven through the nerdctl CLI), the `layer-nerdctl` candy, the nested-pod
+  posture, and `engine: containerd` deploys.
   Load before editing or troubleshooting the layer.
 - `/charly-internals:plugin-nerdctl` — the out-of-tree engine plugin that serves
-  `engine: nerdctl`.
+  `engine: containerd`.
 - `/charly-image:layer` — the candy authoring reference (`charly.yml` schema,
   `plan:` step verbs incl. `mkdir:`/`write:`/`check:`, per-distro `distro:` arms,
   package/repo sections, and service declarations). Load before editing any
@@ -54,10 +55,11 @@ Canonical files:
 
 ## Modify this repo
 
-- Edit the `layer-nerdctl:` candy entity AND the `layer-nerdctl-skill:` skill
-  entity in `candy/layer-nerdctl/charly.yml` together. The skill is the projected
-  usage source, so a behaviour change not mirrored in the skill leaves the corpus
-  stale.
+- Edit the `layer-nerdctl:` candy entity in `candy/layer-nerdctl/charly.yml` AND
+  the skill body in `.agents/skills/layer-nerdctl/SKILL.md` together. The
+  `layer-nerdctl-skill:` node carries ROUTING only; the file is the source of
+  record for the skill's prose, so a behaviour change not mirrored there leaves
+  the corpus stale.
 - The pinned `NERDCTL_FULL_VERSION` and its sha256 verification are the contract;
   the native-package distro arms (arch/alpine) short-circuit the tarball step —
   preserve that split.

README.md

@@ -3,7 +3,7 @@
 nerdctl (the containerd CLI) plus the full rootless containerd + buildkit + CNI
 stack, as a standalone OpenCharly layer repo.
 
-Composed by a box that wants the opt-in `engine: nerdctl` engine. On
+Composed by a box that wants the opt-in `engine: containerd` engine. On
 Arch/CachyOS/Omarchy and Alpine the candy uses native distro packages; on Fedora,
 Debian, and Ubuntu it installs the pinned, **fatally** sha256-verified
 `nerdctl-full` tarball (which supplies nerdctl + containerd +
@@ -24,8 +24,11 @@ containerd/buildkit user units.
 | Nested-pod posture | userns-scoped `cap_add: ALL`, `/dev/fuse`, `/dev/net/tun`, `unmask=/proc/*` |
 | Service / port | none |
 
-The engine word is served by `opencharly/plugin-nerdctl` (out-of-process) or
-compiled in; every engine op delegates to `container.InvokeEngineOp("nerdctl", …)`.
+The `engine: containerd` word is served by `opencharly/plugin-nerdctl`
+(out-of-process) or compiled in; every engine op delegates to
+`container.InvokeEngineOp("containerd", …)`. `containerd` is the engine word;
+`nerdctl` is the CLI binary that drives it (the spec-owned `#EngineBinaries` map
+holds `containerd → nerdctl`).
 
 ## Rootless networking
 
@@ -67,8 +70,9 @@ my-nested-box:
 
 ## Related
 
-- Owning skill: `/charly-distros:layer-nerdctl` — the nerdctl engine, the
-  `layer-nerdctl` candy, the rootless checklist, and `engine: nerdctl` deploys.
+- Owning skill: `/charly-distros:layer-nerdctl` — the containerd engine (driven
+  through the nerdctl CLI), the `layer-nerdctl` candy, the rootless checklist,
+  and `engine: containerd` deploys.
 - `/charly-internals:plugin-nerdctl` — the out-of-tree engine plugin.
 - `/charly-image:layer` — candy authoring reference.
 - [`opencharly/charly`](https://github.com/opencharly/charly) — the charly CLI and image builder