diff --git a/docs/reference/code-queue-supervision.md b/docs/reference/code-queue-supervision.md
index 4e9ddc56..95f65100 100644
--- a/docs/reference/code-queue-supervision.md
+++ b/docs/reference/code-queue-supervision.md
@@ -111,9 +111,14 @@ Examples of infrastructure defects include:
 - a proxy path that differs between WebUI and CLI;
 - a deploy job that reports failure even though the service API is healthy.
 - a supervisor-side submit burst that can saturate the Code Queue manager or low-memory host before the queue has a chance to acknowledge tasks.
+- a Code Queue container missing a basic operator tool or credential path needed for supervision, such as `gh`, `hub`, or a GitHub token injection path.
 
 These defects should be assigned to infrastructure queues with prompts that include the concrete observed failure, the expected long-term contract, and the recovery action required for the original delivery task.
 
+When the defect is only in the Code Queue execution environment and the service can be safely patched live in dev without touching prod, prefer the smallest temporary live remedy first. Then persist the fix in the relevant Dockerfile, container image, or credential propagation path, and verify the persistent fix in dev before considering the issue closed.
+
+If a business task discovers this kind of missing tool or missing credential path, the supervisor should split it into a dedicated infra task rather than leaving it buried in the business task prompt. The business task should continue with the bridge in place when possible.
+
 ## Supervisor Boundaries
 
 The supervisor may: