From 6dc5c8a740a3ac0b4fe874bda04d35e09ad5f271 Mon Sep 17 00:00:00 2001
From: Keysat <licensing@keysat.xyz>
Date: Tue, 16 Jun 2026 20:05:54 -0500
Subject: [PATCH] Document publish.sh make-install deploy step (now step 5)

---
 AGENTS.md                        | 9 +++++----
 docs/guides/startos-packaging.md | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8531b3c..037b511 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -114,10 +114,11 @@ Operator-specific memories at `~/.claude/projects/-Users-macpro-Projects-keysat/
   publish **`0.2.0:57`** — universal multi-arch (x86_64 + aarch64), GitHub release
   `v0.2.0-57`. Migrations 0020–0023; four SDKs published; `keysat.xyz` +
   `docs.keysat.xyz` deployed.
-- **Live server `immense-voyage.local` still runs `:56`** — `:57` was published to the
-  registry this session but NOT `make install`-deployed to the box (`publish.sh` doesn't
-  touch the live host). Run `make install` from `licensing-service-startos/` to put the
-  new role on the live server when ready.
+- **Live server `immense-voyage.local` still runs `:56`** — `:57` shipped to the registry
+  this session, but the box wasn't redeployed (that publish run predated this session's
+  change adding `make install` as `publish.sh` step 5). Run `make install` from
+  `licensing-service-startos/` once to catch the box up to `:57`; future `publish.sh` runs
+  now deploy to the live host automatically (best-effort, non-fatal).
 - **Shipped this session as `:57`** (feature `d5885d1`, bump `069cf1e`; pushed
   origin+gitea) — **`merchant-onboard` scoped-key role** for least-privilege self-serve
   onboarding: read + `products:write` + `policies:write` + `licenses:write` (create
diff --git a/docs/guides/startos-packaging.md b/docs/guides/startos-packaging.md
index 86dab66..a233d2e 100644
--- a/docs/guides/startos-packaging.md
+++ b/docs/guides/startos-packaging.md
@@ -38,7 +38,7 @@ silently no-ops an install whose version equals what's already installed. Run
 ## Release (operator-local scripts, in `~/.keysat/`, gitignored)
 
 ```
-~/.keysat/publish.sh                       # version-gate → make universal → FileBrowser upload → registry register → GitHub mirror
+~/.keysat/publish.sh                       # version-gate → make universal → FileBrowser upload → registry register → GitHub mirror → make install (deploy to live host, best-effort)
 ~/.keysat/deploy-sites.sh landing docs     # push static sites; accepts: landing | docs | registry-landing
 ```