diff --git a/src/openultrasast/search/worker.py b/src/openultrasast/search/worker.py
index b14ec9c..3b32c45 100644
--- a/src/openultrasast/search/worker.py
+++ b/src/openultrasast/search/worker.py
@@ -98,12 +98,13 @@ DEMO_GUIDE = (
     "point environment values at .demo/name. Allowed: .pem .key .json .yaml .yml .txt .env .ini .toml .db .sqlite .crt."
 )
 ORACLE_GUIDE = (
-    "The verifier injects the oracle fixture/observable at VERIFY time only, never during exploration. "
-    "Do not seek it in the explore checkout: absence never means unreachable or justifies ending the search. "
-    "Confirm the mechanism with explore tools using app code and, where useful, your own sandbox test data: "
-    "sink reachability and access to data the app should not expose, without the verifier observable. "
-    "Target its known verifier-time location below in the demo; only differential verification on both revisions proves it. "
-    "Path observes a private nonce file named canary in the parent of ${served_root} in app output. "
+    "Verifier observables exist at VERIFY time only: never seek them in exploration or stop for absence. "
+    "Explore reachability/disclosure using app code/own sandbox data; demos target below. "
+    "Only differential verification across revisions proves it. "
+    "Path observes app output for private nonce file canary in ${served_root}'s parent. "
+    "MUST set the app's served/root to exactly the ${served_root} placeholder via its command-line argument "
+    "(e.g. --dir ${served_root}), environment variable or config in start.files. "
+    "It lives relative to ${served_root}; serving elsewhere makes it unreachable: the search cannot succeed. "
     "SQL observes secret rows in ${database_path} (${database_url} is its SQLite URL). "
     "Command observes marker creation at marker location ${marker_dir}/marker. "
     "SSRF observes the nonce URL at its loopback listener ${callback_url}. "