From c12b2adbfd20cc3008df177ae9596addc6b4f26b Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Thu, 24 Sep 2026 18:59:39 -0700
Subject: [PATCH] disk-health plan: deploy via committed master + doas (per
 CLAUDE.md)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/disk-health-plan.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/disk-health-plan.md b/docs/disk-health-plan.md
index 92170b2..46dd96a 100644
--- a/docs/disk-health-plan.md
+++ b/docs/disk-health-plan.md
@@ -198,6 +198,10 @@ emit** before merging (run a `curl` of each `/metrics`).
   only shortens time-to-notice.
 
 ## 6. Deploy notes
+- **Commit first.** `rebuild-nixos` deploys committed `master` only;
+  uncommitted changes are never deployed. NixOS hosts use **`doas`**, not sudo
+  (see `CLAUDE.md`). A per-host dry run is
+  `nixos-rebuild build --flake .#<host>`.
 - **rebuild-nixos:** runs root `nixos-rebuild switch --flake .` from `/etc/nixos`
   (a clone of `~/src/nixos`, remote `local`). Pull first, and watch for the
   "hadn't pulled master" race.