diff --git a/apps/infra-local/README.md b/apps/infra-local/README.md
index 70cd295b0..d78f5e5e4 100644
--- a/apps/infra-local/README.md
+++ b/apps/infra-local/README.md
@@ -89,10 +89,13 @@ relies on — read-write host volumes + host port mapping — is pinned by
 | Any L1 box misbehaving | its stateful in-box process is wedged | `make restart COMPONENTS=<box>` |
 | "Create Box" from the UI is incomplete | image resolution is mid-rewrite upstream + the picker is PostHog flag-gated | known limitation; use `POST /api/box` directly |
 
-> **Box boot is unverified on this stack** — image resolution is mid-rewrite
-> upstream (`TODO(image-rewrite)` in `apps/api/src/box/services/box.service.ts`)
-> and the dashboard image picker was removed. L1 services, API, runner, auth, and
-> the dashboard all work.
+> **Box boot via the API works** (verified 2026-06-29). `POST /api/v1/boxes` with
+> no `image` default-resolves to the first curated `boxlite-agent-base` ref (see
+> `apps/api/src/box/constants/curated-images.constant.ts` — the tag rotates, so
+> it's not pinned here), creates the box, and it boots `creating → started`;
+> `POST .../stop` stops it. The dashboard's **"Create Box" UI** is still incomplete
+> (image picker removed / PostHog-gated) — drive box creation through the API
+> directly. L1 services, API, runner, auth, and the dashboard all work.
 
 ## Layout