diff --git a/.claude/tasks/0017-hardware-detection-refresh.md b/.claude/tasks/0017-hardware-detection-refresh.md
index 49fab3b..b3d7f5d 100644
--- a/.claude/tasks/0017-hardware-detection-refresh.md
+++ b/.claude/tasks/0017-hardware-detection-refresh.md
@@ -14,7 +14,27 @@ Generating the scan requires root on the target machine.
 
 ## Acceptance criteria
 
-- [ ] The detection file's contents come from a scan of the running machine rather than a guess
-- [ ] Filesystem and swap declarations are absent from it, leaving the disk layout as the sole source of those
-- [ ] The file no longer describes itself as a placeholder, and says plainly what it holds
-- [ ] `nix flake check` builds the `neogaia` toplevel
+- [x] The detection file's contents come from a scan of the running machine rather than a guess
+- [x] Filesystem and swap declarations are absent from it, leaving the disk layout as the sole source of those
+- [x] The file no longer describes itself as a placeholder, and says plainly what it holds
+- [x] `nix flake check` builds the `neogaia` toplevel
+
+## Implementation Notes
+
+**The guess was wider than the measurement, not narrower.**
+It named `thunderbolt`, `usb_storage`, and `sd_mod`, none of which the scan reports; the scan adds `rtsx_pci_sdmmc` for the card reader.
+Nothing needed to reach the root device was missing, so the guess was adequate as the task assumed, but it was not accurate.
+`sd_mod` survives in the resolved list regardless, supplied by nixpkgs' own defaults; `thunderbolt` and `usb_storage` now genuinely go, and they matter only for booting from external media, which this machine does not do.
+
+**Two further lines from the scan were dropped beyond the filesystem and swap declarations the task named.**
+`boot.initrd.luks.devices."cryptroot".device` is derived by the disk layout, which the layout file already states, so keeping it would have created the same duplicate definition the task drops the filesystems to avoid.
+`hardware.cpu.intel.updateMicrocode` falls outside the three things the task keeps, and the hardware profile supplies it anyway.
+Both were checked rather than assumed: after the change the LUKS device, all four filesystems, and microcode all still resolve.
+
+**The header was rewritten twice.**
+Its first form enumerated the file's three attributes, which the repo's comment convention names as a feature inventory and forbids in a file-top header.
+It now carries provenance and the absence pointer only.
+
+**Not verified by a boot.**
+`nix flake check` proves the configuration evaluates and builds, not that the initrd it produces can unlock LUKS and mount root.
+Only a rebuild and reboot establishes that, with the previous generation available at the bootloader as the fallback.
diff --git a/hosts/neogaia/hardware-configuration.nix b/hosts/neogaia/hardware-configuration.nix
index b1e2bbe..cf45488 100644
--- a/hosts/neogaia/hardware-configuration.nix
+++ b/hosts/neogaia/hardware-configuration.nix
@@ -1,14 +1,13 @@
 { lib, modulesPath, ... }:
-# Placeholder: regenerate with nixos-generate-config on the target machine.
+# Hardware detected by nixos-generate-config on this machine.
+# disko derives `fileSystems` and the LUKS device; none declared here.
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
   boot.initrd.availableKernelModules = [
     "xhci_pci"
-    "thunderbolt"
     "nvme"
-    "usb_storage"
-    "sd_mod"
+    "rtsx_pci_sdmmc"
   ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];