diff --git a/.agents/memory/bot-agents-migration-decisions.md b/.agents/memory/bot-agents-migration-decisions.md
index d392c23..e345d9c 100644
--- a/.agents/memory/bot-agents-migration-decisions.md
+++ b/.agents/memory/bot-agents-migration-decisions.md
@@ -15,9 +15,9 @@ Node + Vite+ migration (PR #20, `node-migration`, 2026-10-15/16):
   removed the only runtime dependency (`@std/yaml`); keep it free of runtime
   dependencies (`@eslint/core` and the other devDependencies serve only the
   tooling).
-- **Node 24.2+**, not 22: `src/post.ts` uses `import.meta.main`. `engines.node`
-  is `>=24.2`, which the user accepted for this repo
-  ([[bot-agents-runtime-no-build]]).
+- **Node 24.2+**, not 22: `src/post.ts` uses `import.meta.main`. There is no
+  `engines` (user decision 2026-10-18): the `node:24-bookworm` job image
+  decides the version ([[bot-agents-runtime-no-build]]).
 - **Deno stays in the action's global npm install** (`action.yml`), only
   because the agents still check Deno-based consumer repos (memona,
   memona-home). Remove it once those repos have moved; it is not a
diff --git a/.agents/memory/bot-agents-runtime-no-build.md b/.agents/memory/bot-agents-runtime-no-build.md
index 86bf444..fdb1700 100644
--- a/.agents/memory/bot-agents-runtime-no-build.md
+++ b/.agents/memory/bot-agents-runtime-no-build.md
@@ -10,8 +10,9 @@ dependency**. Hence `tsconfig.json` has `erasableSyntaxOnly` and
 properties, no decorators) and relative `.ts` imports.
 
 - **Image:** the steps assume the `node:24-bookworm` job container. Node must
-  be 24.2+ for `import.meta.main` in `post.ts`; `check.yml` prints
-  `node --version` to confirm the cached image's minor.
+  be 24.2+ for `import.meta.main` in `post.ts`. That image is the only Node
+  pin (`package.json` has no `engines`); `check.yml` prints `node --version`
+  to confirm the cached image's minor.
 - **Root-owned source copy:** `scripts/protect-source.sh` copies the action
   into `$RUNNER_TEMP` so an agent editing the checkout can't swap a later
   phase. It copies exactly `src/*.ts`, `package.json` (`"type": "module"`
diff --git a/.agents/memory/package-json-shape.md b/.agents/memory/package-json-shape.md
index 62346d4..b3d34cd 100644
--- a/.agents/memory/package-json-shape.md
+++ b/.agents/memory/package-json-shape.md
@@ -14,7 +14,9 @@ The `imports` key order can carry meaning: the modules plugin's
 
 ## Fields
 
-- **Standard fields only.** `engines` has only `node` (never `engines.bun`).
+- **Standard fields only.** App repos have no `engines` field (user decision
+  2026-10-18; images pin Node, [[toolchain-node-vite-plus]]). Published
+  packages keep `engines` with only `node` (never `engines.bun`).
   A tool-owned key (`eslint-doc-generator`) is allowed only because the tool
   reads nothing else and no other config file is allowed.
 - **No `packageManager`.** npm is detected from `package-lock.json`.
diff --git a/.agents/memory/toolchain-node-vite-plus.md b/.agents/memory/toolchain-node-vite-plus.md
index 86cff76..2f14f02 100644
--- a/.agents/memory/toolchain-node-vite-plus.md
+++ b/.agents/memory/toolchain-node-vite-plus.md
@@ -1,12 +1,20 @@
 ---
-description: Node.js 22+ with Vite+ (vp) and npm; only package.json, tsconfig.json, vite.config.ts plus a committed package-lock.json
+description: Node.js (no engines in apps; images pin 24) with Vite+ (vp) and npm; only package.json, tsconfig.json, vite.config.ts plus a committed package-lock.json
 ---
 
 ## The stack
 
-- **Runtime:** Node.js 22 or newer. `engines` is `{ "node": ">=22" }` and
-  nothing else. Containers and the publish job use Node 24 (LTS); a repo may
-  need more where a feature demands it (bot-agents uses Node 24.2+).
+- **Runtime:** Node.js. App repos have no `engines` field (user decision
+  2026-10-18): the container or runner image decides the version, so the
+  Containerfile base image (`node:24-alpine`) and CI's `node-version: "24"`
+  are the pins. Published packages (the lint plugins) keep
+  `engines: { "node": ">=22" }`. `npm run lit-check` runs
+  `node scripts/lit-check.ts`, which needs Node 22.18+ (unflagged type
+  stripping and `module.registerHooks`); Node 24 satisfies it. Without
+  `engines` or a `.node-version`, local `vp` uses its default Node
+  (`vp env default`). bot-agents has no Containerfile or setup step: the
+  self-hosted runner's `node:24-bookworm` job image runs the action and its
+  checks, and `src/post.ts` needs 24.2+ (`import.meta.main`).
 - **Bun is not supported** (dropped 2026-10-15). No Bun CI legs, docs, or
   runtime branches. Oxlint's `RuleTester` refuses to run under Bun anyway, and
   `vp` brings its own Node, the way uv brings its own Python.
diff --git a/AGENTS.md b/AGENTS.md
index 4f223d5..237f81c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,8 @@ explicit permission.
 # Runtime and checks
 
 The action's TypeScript runs directly on the job image's Node.js (24.2 or
-newer), which strips the types itself: there is no build step and no runtime
+newer; `package.json` has no `engines`, the `node:24-bookworm` image pins it),
+which strips the types itself: there is no build step and no runtime
 dependency. Keep the sources to erasable syntax and `.ts` imports, which
 `tsconfig.json` enforces. Its strictness set is fixed and leaves
 `exactOptionalPropertyTypes` off
diff --git a/package-lock.json b/package-lock.json
index 6479904..e0ecd3b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,9 +11,6 @@
         "@typescript-eslint/types": "^8.71.2",
         "vite-plus": "^1.2.0",
         "yaml": "^2.9.1"
-      },
-      "engines": {
-        "node": ">=24.2"
       }
     },
     "node_modules/@babel/code-frame": {
diff --git a/package.json b/package.json
index 70fbfc7..dd805a7 100644
--- a/package.json
+++ b/package.json
@@ -12,8 +12,5 @@
     "@typescript-eslint/types": "^8.71.2",
     "vite-plus": "^1.2.0",
     "yaml": "^2.9.1"
-  },
-  "engines": {
-    "node": ">=24.2"
   }
 }