diff --git a/deploy/2026.08.21.01.report.md b/deploy/2026.08.21.01.report.md
new file mode 100644
index 00000000..9d6daee1
--- /dev/null
+++ b/deploy/2026.08.21.01.report.md
@@ -0,0 +1,42 @@
+# 2026.08.21.01 — deployed
+
+**6/6 hosts.** Every platform is on `eee73e77`, schema pushed, processes online and every domain
+answering 200.
+
+Rolled out by hand from `officer-dev`, one host at a time, because nothing wakes the commander yet.
+
+| Host                         | Before     | After      | install | db:push | plugins        | restarted                 | domain |
+| ---------------------------- | ---------- | ---------- | ------- | ------- | -------------- | ------------------------- | ------ |
+| `alpha`                      | `44f6c6d6` | `eee73e77` | ok      | applied | 12/12          | officer, claude-code, pty | 200    |
+| `fofos`                      | `6db26ae4` | `eee73e77` | ok      | applied | 1/1            | officer, claude-code, pty | 200    |
+| `edge-pertento-bridge`       | —          | `eee73e77` | ok      | applied | 2/2            | officer, claude-code, pty | —      |
+| `production-pertento-bridge` | —          | `eee73e77` | ok      | applied | 1/1            | officer, claude-code, pty | —      |
+| `macbookpro`                 | `2e76cabf` | `eee73e77` | ok      | applied | none installed | officer, claude-code, pty | —      |
+| `officer-dev`                | `eee73e77` | `eee73e77` | ok      | applied | 3/3            | officer, pty              | 200    |
+
+`bun install` reported no changes everywhere — the lockfile diff was `sharp` leaving, and nothing had
+it as a transitive need.
+
+## What was NOT done, and why
+
+- **`officer-claude-code` was not restarted on `officer-dev`.** That sidecar holds the session doing
+  the deploy; restarting it would have ended the conversation mid-rollout. Every other host got it.
+  **Outstanding — run it when convenient.**
+- **`fofos` did not sync its capabilities.** `git` refused the checkout as "dubious ownership" and
+  printed the usual `safe.directory` remedy. Ownership is actually correct (`pastilhas:pastilhas`,
+  running as `pastilhas`), so the cause is not what the message suggests and papering over it with a
+  config entry would hide a real question. Its one plugin updated fine. **Unexplained.**
+- **`macbookpro` has no plugins installed**, so `plugins:update` was a no-op there. Not a failure —
+  worth knowing before someone expects the browser relay on it.
+
+## Notes for the next one
+
+- **The dirty-tree check was too strict.** `git status --porcelain` counts UNTRACKED files, and
+  `fofos` was skipped on the first pass for one stray `scripts/chk.ts` that a fast-forward could never
+  touch. The rule is `--untracked-files=no`; untracked files get a note, not a skip.
+  `prompts/deploy-commander.md` says "refuse a dirty tree" and should say which kind.
+- **`macbookpro` needs `$SHELL -ic` and nothing else.** Exporting a PATH to reach `bun` broke `pm2`,
+  which is only on the interactive shell's path. Do not help it.
+- **The pre-flight was worth it.** `users.username` became `NOT NULL` with a case-insensitive unique
+  index; checked across all six first — 12 users, zero nulls, zero collisions — so `db:push` applied
+  everywhere without a data fix.