deploy report 2026.09.14.01 — 4 of 4 targets

alpha, fofos, macbookpro, deadpool-rezio-bridge all at the tag, officer
back online, health answering. officer-dev skipped as the rollout host;
macbruno unreachable; both Pertento hosts on the skip list.

deploy/2026.09.14.01.report.md

@@ -0,0 +1,71 @@
+# 2026.09.14.01 — report
+
+**4 of 4 hosts succeeded.** `officer-dev`, `macbruno` and both Pertento hosts skipped, all deliberately.
+
+Backend-only release (`be3139f9..4a37cfd2`): three new self-reported `command-hq` routes. No schema
+change, so no `db:push` and no schema query — the plan's two checks (`pm2 jlist`, `/api/health`) are the
+whole verification, and both ran on every host.
+
+Every host went `be3139f9` (`deploy/2026.09.09.01`) → `4a37cfd2` (`deploy/2026.09.14.01`), by
+`git merge --ff-only` onto the TAG, not `master`. Every checkout path was read from that host's own
+`officer` `pm_cwd`, never assumed.
+
+## Per host
+
+| Host                    | Before     | After      | Dirty | plugins:update | Restarted | Back?                       |
+| ----------------------- | ---------- | ---------- | ----- | -------------- | --------- | --------------------------- |
+| `alpha`                 | `be3139f9` | `4a37cfd2` | clean | 17/17          | `officer` | online, 0→1, health `401`   |
+| `fofos`                 | `be3139f9` | `4a37cfd2` | clean¹| 5/5            | `officer` | online, 1→2, health `401`   |
+| `macbookpro`            | `be3139f9` | `4a37cfd2` | clean | none installed | `officer` | online, 1→2, health `401` (:9010) |
+| `deadpool-rezio-bridge` | `be3139f9` | `4a37cfd2` | clean | 3/3            | `officer` | online, 0→1, health `401`   |
+
+¹ `fofos` carries two UNTRACKED files — `flip-records.ts` and `scripts/chk.ts`. Untracked is a note, not
+a skip: a fast-forward cannot touch them and nobody's work was discarded.
+
+All four checkouts were clean of TRACKED changes, so no host was skipped for a dirty tree and every merge
+was a genuine fast-forward.
+
+`401` is healthy here — `/api/health` is authenticated, and the plan names `200` or `401` as pass. The
+port was read from each host's own `.env` rather than assumed: `9010` on `macbookpro`, `9000` elsewhere.
+
+## Steps that ran
+
+Per host, in order: tracked-only dirty check → `git fetch origin --tags` → `git merge --ff-only
+deploy/2026.09.14.01` → `bun run plugins:update` → `pm2 restart officer` → `pm2 jlist` → health.
+
+No `bun install` and no `bun db:push` on any host. The plan says neither is needed; running either would
+not have been a finding, but it was not needed and was not done.
+
+`plugins:update` restarts sidecars itself. On `alpha` that is more processes moving than the one line
+above suggests — the table's "restarted" column is what the PLAN asked for, not the full count of what
+bounced.
+
+## Skipped — none of these is a failure
+
+- **`officer-dev`** — the host this rollout ran on. Skipped entirely per the standard rule: not pulled,
+  nothing restarted. **It is still on `be3139f9` and the owner restarts it deliberately.**
+- **`macbruno`** — `ssh` timed out on port 22 (`Connection timed out`, 8s). The plan names it as
+  check-live, unreachable-is-a-skip. Not attempted further; it cost one probe, not a retry budget.
+- **`production-pertento-bridge`, `edge-pertento-bridge`** — on the deliberately-skipped list in
+  `docs/servers.md` since 2026-09-08. Owner's call. Nothing spent on either.
+
+## What the owner must act on
+
+- **`officer-dev` has not been deployed.** It is the one host still on the previous release. This is the
+  designed outcome, not an oversight — restarting `officer` here would have killed the rollout mid-flight.
+- **`macbruno` is behind by one release** and unreachable as of this rollout. It will need the same
+  four-step sequence whenever it is back.
+- Nothing else. No host failed, no process came back `errored`, no step was refused.
+
+## Carried, not introduced
+
+`bunx tsgo` reports one pre-existing type error in `src/servers/sidecar/claude/claude-manager.ts:667`
+(`SdkUserMessage` vs `SDKUserMessage`, from the agent SDK's own types). Named in the plan, present before
+this release, type-only. Not checked again here and not caused by this rollout.
+
+## About this run
+
+First release under a new watcher. The rollout procedure is proven — this is the tenth report — but this
+loop had never executed it before, so every host was narrated before it was touched. The claim was taken
+by the watcher that spawned this agent; this agent did not re-claim, and recorded `done` only after the
+fourth host came back healthy.