seven platforms, and the login is per host

deadpool-rezio-bridge joins the list: 100.64.0.21, checkout /home/br/officerdev/platform, deployed by
hand and verified — 7/7 processes online, username NOT NULL, uq_users_username_lower present, HEAD at
bd41dff5.

Its login is `br` and always will be. That makes the SSH user a per-host fact rather than a constant,
so the table carries it and the deploy prompt reads it. Worth stating plainly because the failure is
misleading: an orchestrator assuming `pastilhas` gets "Permission denied (publickey)", which reads as a
broken key rather than a wrong username.

Also folded in what tonight established. Three hosts answer to names that disagree with
`tailscale status` — edge-bridge and gitea-bridge are the old ones — so the table says which to use.
`edge-bridge` was listed as "not SSH-reachable" and that was wrong: its SSH was down at the moment I
checked, not absent. The pm2/nvm PATH trap is written in, including that `-lc` is not enough and cost
two wrong conclusions, and that macbookpro must not be helped with an exported PATH because doing so
breaks pm2. And a dirty tree means TRACKED changes; plain --porcelain skipped a host over a stray file.

officer.rezio.dev is recorded under "known wrong, waiting on someone else": it points at gateway rather
than deadpool, which is worse than unavailable — it will serve the wrong box the moment gateway answers
on 443.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prompts/deploy-commander.md

@@ -49,8 +49,13 @@ at, and guessing is how a database gets a schema it was not ready for.
 **Read `docs/servers.md`.** Do not take a list of hosts from this file — there is deliberately none here,
 because a copy rots the day a server moves and the copy is always the one somebody trusts.
 
-That document holds every machine, its tailnet name, its checkout and whether a platform runs on it. Read
-it at the start of every deploy, and treat the hosts marked as having no platform as out of scope.
+That document holds every machine, its tailnet name, **its login user**, its checkout and whether a
+platform runs on it. Read it at the start of every deploy, and treat the hosts marked as having no
+platform as out of scope.
+
+**The login is not always `pastilhas`.** `deadpool-rezio-bridge` runs as `br`, permanently, and more will.
+Take the user from the table — an orchestrator that hard-codes one fails on that host silently, because
+`Permission denied (publickey)` looks like a broken key rather than a wrong username.
 
 Four things that will catch you out, all verified rather than assumed:
 
@@ -71,8 +76,10 @@ Four things that will catch you out, all verified rather than assumed:
 Per host, in this order. Do them **one host at a time** and keep a record as you go — a report you
 assemble at the end from memory is a report that will be wrong about the host that failed.
 
-1. **Refuse a dirty tree.** `git status --porcelain` — if anything is uncommitted, skip this host and say
-   so. Never discard someone's work to ship a release.
+1. **Refuse a dirty tree — TRACKED changes only.** `git status --porcelain --untracked-files=no`. Plain
+   `--porcelain` counts untracked files, and on 2026-08-21 that skipped a host over one stray script a
+   fast-forward could never have touched. Untracked files get a note in the report, not a skip. Never
+   discard someone's work to ship a release.
 2. `git pull --ff-only`. A non-fast-forward means that checkout has diverged: skip and report.
 3. **Update the plugins.** `bun run plugins:update`. Sequential by design, one plugin failing does not
    stop the rest, and it exits non-zero if any did — so a failure is something you report rather than