update

README.md

@@ -231,14 +231,13 @@ See `example/README.md` for a complete runnable dotfiles/setup fixture.
 
 ```text
 _shared/
+  _root/
+    etc/hostname
   zsh/
     .zshrc
   nvim/
     .config/nvim/
       _module.yaml
-  system/
-    _root/
-      etc/hostname
 
 linux-work/
   i3/
@@ -246,7 +245,8 @@ linux-work/
 ```
 
 `_shared/` applies to every profile. Profile directories add or override package
-sets. `_root/` marks absolute paths and plans sudo-backed link actions.
+sets. A layer-level `_root/` directory, such as `_shared/_root/` or
+`linux-work/_root/`, marks absolute paths and plans sudo-backed link actions.
 
 External module repos are declared with `_module.yaml`:
 
@@ -301,6 +301,13 @@ Direct commands are equivalent:
 ```bash
 uv run pytest tests/ -q --ignore=tests/e2e
 FLOW_RUN_E2E=1 uv run pytest tests/e2e/ -v
+FLOW_RUN_E2E=1 uv run pytest tests/e2e/test_dotfiles_e2e.py::test_cli_paths_run_in_disposable_container -q
+FLOW_RUN_E2E=1 uv run pytest tests/e2e/test_dotfiles_e2e.py::test_dotfiles_init_and_link_in_container -q
 uv build
 uv run pyinstaller --noconfirm --clean --onefile --name flow --paths src src/flow/__main__.py
 ```
+
+For local container-only command validation, run the e2e module directly with
+`FLOW_RUN_E2E=1`. That executes all commands inside a disposable container
+instance with isolated `HOME`/`XDG_*` and a read-only example repo mount, so it
+does not touch host dotfiles or global state.