diff --git a/docs/releasing.md b/docs/releasing.md
index fb1248b9..fc1f7fe5 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -43,10 +43,10 @@ A security notice is a sticky warning card about something outside Codeman that
   "id": "opencode-console-breach-2026-10",
   "severity": "warning",
   "cli": "opencode",
-  "published": "2026-10-18",
+  "published": "2026-10-17",
   "expires": "2026-12-31",
   "title": "OpenCode Console breach: check your API keys",
-  "message": "One or two plain sentences: what happened and what to do.",
+  "message": "A few short plain sentences, about 50 words at most: what happened and what to do.",
   "link": { "label": "Read OpenCode's notice", "url": "https://..." },
   "i18n": { "zh-CN": { "title": "...", "message": "...", "label": "..." } }
 }
@@ -54,7 +54,8 @@ A security notice is a sticky warning card about something outside Codeman that
 
 - `id` is stable and unique, and never reused: a browser that closed a notice remembers its id (`codeman-security-notices-seen` in localStorage), so a reworded notice under the same id is NOT shown again to anyone who closed it. Give a materially new warning a new id.
 - `cli` (optional) is a registry CLI id. The notice is then shown only on a server where that CLI is installed and enabled; without `cli` it is shown to everyone.
-- `published` and `expires` are inclusive `YYYY-MM-DD` days in the viewer's local time. `expires` is what keeps an old notice from alarming a browser that first opens Codeman months later, so always set one.
+- `published` and `expires` are inclusive `YYYY-MM-DD` days in the viewer's local time. Set `published` a day before the release ships, so the notice is already live in every timezone when it lands (a browser still on the previous day would otherwise take the plain update toast and see the notice later as a separate card). `expires` is what keeps an old notice from alarming a browser that first opens Codeman months later, so always set one.
+- Keep `message` to about 50 words and do not repeat the card's chrome (the "Security notice" eyebrow and the title are already on it): on a phone the card shares the screen with the update toast's text, and a longer one has to be scrolled to reach its buttons. State only what the affected vendor has said.
 - `title` (optional) is the card's bold line; keep it short. `link.url` must be https. `i18n` is optional; a missing string falls back to the English one.
 - Run `npx prettier --write src/web/public/security-notices.json` and `npm test -- test/security-notices.test.ts`, which validates the file (unique ids, real dates, https links, every `cli` a stock registry id, a zh-CN title wherever there is an English one).
 
diff --git a/src/web/public/security-notices.json b/src/web/public/security-notices.json
index 8b0e281b..13402a07 100644
--- a/src/web/public/security-notices.json
+++ b/src/web/public/security-notices.json
@@ -4,15 +4,15 @@
       "id": "opencode-console-breach-2026-10",
       "severity": "warning",
       "cli": "opencode",
-      "published": "2026-10-18",
+      "published": "2026-10-17",
       "expires": "2026-12-31",
       "title": "OpenCode Console breach: check your API keys",
-      "message": "Security notice for OpenCode users: on 17 October OpenCode reported unauthorized access to a legacy OpenCode Console system. Provider API keys some users had saved in a Console workspace (OpenAI, Anthropic and others) may have been exposed. OpenCode emailed the affected users: if you got that email, revoke and replace those keys and check their recent usage. The opencode CLI itself is not reported as affected.",
+      "message": "OpenCode reported unauthorized access to a legacy system on 17 October. Provider API keys (OpenAI, Anthropic and others) saved in some OpenCode Console workspaces may have been exposed. If OpenCode emailed you about it, revoke and replace those keys and check their recent usage. If you got no email, OpenCode says you were not affected.",
       "link": { "label": "Read OpenCode's notice", "url": "https://x.com/opencode/status/2111519637049319818" },
       "i18n": {
         "zh-CN": {
           "title": "OpenCode Console 遭入侵：请检查你的 API 密钥",
-          "message": "OpenCode 用户安全提示：OpenCode 于 10 月 17 日报告，其旧版 OpenCode Console 系统遭到未授权访问。部分用户保存在 Console 工作区中的提供商 API 密钥（OpenAI、Anthropic 等）可能已泄露。OpenCode 已向受影响的用户发送邮件：如果你收到了该邮件，请吊销并更换这些密钥，并检查近期用量。目前没有报告称 opencode CLI 本身受到影响。",
+          "message": "OpenCode 于 10 月 17 日报告，其一个旧系统遭到未授权访问，部分用户保存在 OpenCode Console 工作区中的提供商 API 密钥（OpenAI、Anthropic 等）可能已泄露。如果你收到了 OpenCode 的相关邮件，请撤销并更换这些密钥，同时检查近期用量。OpenCode 表示，没有收到邮件的用户不受影响。",
           "label": "查看 OpenCode 公告"
         }
       }