fix: close Pi management final review findings

docs/install/pi-management.md

@@ -77,9 +77,12 @@ running application with one confirmed restart:
 
 `--yes` confirms that core will be recreated. Without `--drain`, restart refuses active sessions;
 with it, ThothII closes admission and waits for active sessions to finish without terminating them.
-The wait is bounded. Restart retains the current image: it does not build, pull, select, or upgrade
-an image. It will restart only core, then verifies health, Pi version, settings/model smoke,
-non-secret rendered configuration, and persistence mounts before reopening admission.
+The wait is bounded. Restart retains the exact captured running image: it does not build, pull, or
+upgrade an image. Before recreating core, it pins that image through transaction-scoped Compose
+override material so a configured tag moving during the operation cannot change the selected
+image, and Compose is explicitly told never to build or pull. It will restart only core, then
+verifies health, Pi version, settings/model smoke, non-secret rendered configuration, and
+persistence mounts before reopening admission.
 
 Use `pi restart --yes` when there are already no active sessions. Do not substitute `thothctl stop`
 and `thothctl start` or raw Compose commands for this reload workflow.
@@ -110,8 +113,8 @@ volumes.
 ## Recover a failed lifecycle operation
 
 If a restart or update fails after core recreation, leave maintenance enabled and preserve the
-reported recovery state. Do not delete `.thothctl`, state files, containers, or volumes. Inspect
-status and sanitized logs:
+reported recovery state and transaction override. Do not delete `.thothctl`, state files,
+containers, or volumes. Inspect status and sanitized logs:
 
 ```sh
 "$THTCTL" --installation "$INSTALLATION" pi maintenance status