diff --git a/scripts/verify-fluid-telegram-lane.sh b/scripts/verify-fluid-telegram-lane.sh
index 3069a6b..bebe8f8 100755
--- a/scripts/verify-fluid-telegram-lane.sh
+++ b/scripts/verify-fluid-telegram-lane.sh
@@ -21,11 +21,17 @@ case "$mode" in member|non-member) ;; *) echo "usage: $0 member|non-member" >&2;
 umask 077
 mkdir -p "$RECEIPTS"
 receipt="$RECEIPTS/fluid-telegram-lane-$mode.txt"
-echo "Sign in as the $mode identity in your browser (URL below)." >&2
+echo "Sign in as the $mode identity in your browser (URL below). Use a private window so" >&2
+echo "an existing KeyCape session (e.g. platform-root) is not reused." >&2
 
 if ! token="$(bao login -token-only -method=oidc -path=netkingdom role="$ROLE")" || [ -z "$token" ]; then
     { echo "mode=$mode at=$(date -u +%FT%TZ)"; echo "login=refused"; } > "$receipt"
-    echo "login refused (expected for non-member); receipt: $receipt" >&2
+    if [ "$mode" = non-member ]; then
+        echo "login refused, as expected for a non-member; receipt: $receipt" >&2
+    else
+        echo "login REFUSED for the member run. If the browser reused another KeyCape session" >&2
+        echo "(e.g. platform-root), retry in a private window signed in as a group member." >&2
+    fi
     [ "$mode" = non-member ] && exit 0 || exit 1
 fi