One command per resync round now: sweep the old accounts, render a
fresh identity, open it for approval.

Assisted-by: GLM 5.2 via pi

diff --git a/Rakefile b/Rakefile
index d8321c8..1d75732 100644
--- a/Rakefile
+++ b/Rakefile
@@ -33,10 +33,8 @@ file "carddav.mobileconfig" => "lib/pro_tacts/profile.rb" do |task|
 end
 
 namespace :profile do
-  # A fresh identity per install is the point, so this renders directly
-  # instead of going through the mtime-based file task.
-  desc "Stage a fresh configuration profile; approve it in System Settings → Profiles"
-  task :install do
+  desc "Remove installed pro-tacts profiles, then stage a fresh one for approval"
+  task install: :remove do
     require "pro_tacts/profile"
 
     File.write("carddav.mobileconfig", ProTacts::Profile.render(
diff --git a/docs/macos-contacts.md b/docs/macos-contacts.md
index a5455be..cdae80c 100644
--- a/docs/macos-contacts.md
+++ b/docs/macos-contacts.md
@@ -27,22 +27,22 @@ refusing a redirect) that never reach the server at all.
 ## The account setup path
 
 The fastest path is a configuration profile: `rake profile:install` (with
-`PRO_TACTS_HOSTNAME` set) renders `carddav.mobileconfig`, opens it, and
+`PRO_TACTS_HOSTNAME` set) first removes any installed pro-tacts profiles,
+then renders `carddav.mobileconfig`, opens it, and
 opens System Settings on the Profiles pane (via the
 `x-apple.systempreferences:` deep link) — the profiles CLI no longer
 supports installs, so the profile lands there as pending until you click
-Install. That click is the whole manual step. `rake profile:remove` still
-tries `sudo profiles remove`; if the CLI refuses that too, remove it in the
-same Settings pane.
+Install. That click is the whole manual step. `rake profile:remove` runs
+the removal half alone via `profiles remove`.
 
 The profile carries the hostname, fixed dev credentials, and SSL —
 `CardDAVPrincipalURL` is deliberately omitted so the
 account gets an empty Server Path, exercising discovery. Every render gets a
 fresh identifier and UUIDs, so each install provisions a cold account with
-no cached sync state — that is deliberate for the experiment loop. The flip
-side: installing without removing first orphans the previous account, so
-`rake profile:remove` sweeps every profile carrying the pro-tacts prefix
-by parsing `profiles list`. Apple's device-management
+no cached sync state — that is deliberate for the experiment loop, and
+`rake profile:install` sweeping the old profiles first is what keeps it
+cold. `profile:remove` finds them by scanning `profiles list` output for
+the pro-tacts prefix. Apple's device-management
 reference marks the CardDAV payload as allowing manual install, so no MDM is
 involved.