docs: mark merge-redact hardening deployed; record Spark SSH alias (modelo32)

AGENTS.md

@@ -39,7 +39,10 @@ flat JSON in a writable `state/` mount.
 - **Deploy:** the Spark's `~/gitea-review-bot` is a Gitea clone tracking `master`; deploy =
   `git fetch && git reset --hard origin/master && docker compose up -d --build` (or a Spark Control
   Update tile, once added — captured in the inbox). `config.toml` is gitignored — refresh it on the
-  Spark separately (scp) like matrix-bridge.
+  Spark separately (scp) like matrix-bridge. Reach the Spark from the Mac as **`ssh modelo32`** (the
+  **NVIDIA Sync** alias — host `spark-32d0`, user `modelo`, key-based; injected into `~/.ssh/config`
+  via an `Include`. `modelo27`/`spark-27ea` is a second Spark on another LAN). `reset --hard` is safe:
+  `.env`/`config.toml`/`state/` are gitignored.
 - **Onboard a repo:** create a Matrix room named like the repo, invite this bot → it auto-joins,
   maps the room to `<owner>/<roomname>` (+ `~/Projects/<roomname>` on the Mac), and posts an
   onboarding message. Pick review agents in-chat: `agents +reviewer +security -adjudicator`.
@@ -91,13 +94,13 @@ to its repo, and the subagent panel is configured in-chat. Proven end-to-end on
 the previously-unproven bit, **headless `claude -p` spawning the reviewer/adjudicator/security
 subagents, works**. The ten31-site colleague is onboarded; the pipeline is in steady use.
 
-**This session's hardening (NOT yet on the Spark — needs a redeploy: `git fetch && git reset --hard
-origin/master && docker compose up -d --build`):** a merge now **always redacts** the thread on merge
-success; a failed post-merge deploy posts its "deploy manually" warning at **top level** so it
-survives the redaction instead of orphaning the thread (the bug PR #4 hit when the Mac was left off
-`master`). New **`clear`/`resolve`** command redacts an orphaned thread without touching the PR.
+**This session's hardening (DEPLOYED to the Spark at `063e694`):** a merge now **always redacts** the
+thread on merge success; a failed post-merge deploy posts its "deploy manually" warning at **top
+level** so it survives the redaction instead of orphaning the thread (the bug PR #4 hit when the Mac
+was left off `master`). New **`clear`/`resolve`** command redacts an orphaned thread without touching
+the PR.
 
 **Deploy gotcha (still true):** the Spark needs a *dedicated* per-repo Gitea deploy key + a `Host`
 alias (the default `immense-voyage.local` block uses matrix-bridge's key); Gitea won't reuse one SSH
-key across repos' deploy keys. A Spark Control tile is captured in the inbox. **Next:** redeploy on
-the Spark, then clear ten31-site's orphaned PR #4 thread (reply `clear` in it, or `reject`).
+key across repos' deploy keys. A Spark Control tile is captured in the inbox. **Next:** clear
+ten31-site's orphaned PR #4 thread (reply `clear` in its thread). Future redeploys: `ssh modelo32`.