memory: althing deploy is four surfaces, and the plugin CLI existed all along

Deployed 3.2.4 and closed the fourth deploy surface. The plugin cache
moved 0.0.1 to 0.1.1 via `claude plugin update althing`, which means the
step I had escalated to the operator was mine to do. Refusing to
hand-edit installed_plugins.json was right; concluding no supported path
existed was an untested assumption, and `claude plugin` has install,
update, uninstall, list, details, validate and marketplace subcommands.

Recording the pattern once rather than four separate lessons: four times
tonight I reported a proxy or an assumption as the fact itself. sudo -n -v
for NOPASSWD, command -v nvcc for the toolkit, a lock file's pid for a
flock, and "no CLI path exists" for a CLI I never ran. Each was cheap to
test and expensive to assert.

Also ran the audit forseti's 3.2.4 makes possible, since a seat could have
been silently pull-only since 3.1.2 with every failure rendering as
silence. Nine of ten seats with a live waiter report push. regin-smithy-dev
holds a live waiter and the post office has it pull-only -- but regin
deliberately released their pane route earlier tonight, so release-then-arm
ordering explains the same observation with no bug involved. Not
distinguishable from outside, so it went to regin as a question rather
than to forseti as a confirmed instance.

persistent-memory.d/2026-09-01-althing-320-deploy.md

@@ -444,6 +444,60 @@ plugin in a way that looks like an upstream bug.
 unnoticed. Offered to write one; it installs to a per-machine path so ownership (althing repo
 vs eshpfi) is forseti's call.
 
+## ✅ 3.2.4 + THE FOURTH DEPLOY SURFACE CLOSED (plugin cache 0.0.1 -> 0.1.1)
+
+    1. uv tool install --force .   3.2.3 -> 3.2.4 (d24bd5e)
+    2. systemctl --user restart althing-po-herald
+    3. scripts/sync_skill.sh       (already current at 3.2.4)
+    4. claude plugin update althing    <- THE NEW, FOURTH SURFACE
+
+⚠ **`ALTHING DEPLOY = FOUR SURFACES`, not three.** Tool install, herald restart, skill sync,
+**plugin reinstall**. The fourth had no runbook step and nobody had run it since 0.0.1.
+
+⚠ **`claude plugin` IS A REAL CLI — I claimed it needed the operator without looking.**
+`claude plugin install|update|uninstall|list|details|validate|marketplace|tag|prune` all exist.
+`claude plugin update althing` moved the cache cleanly ("updated from 0.0.1 to 0.1.1, restart
+to apply"). I had told forseti step 4 required a `/plugin` update from the operator because I
+would not hand-edit `installed_plugins.json` — **the refusal to hand-edit was right, the
+conclusion that no supported path existed was an untested assumption.**
+
+⚠ **Restart required to apply** — the SessionStart auto-declare goes live for NEW sessions.
+
+## ⚠⚠ THE PATTERN, RECORDED ONCE INSTEAD OF FOUR TIMES
+
+Four times in one session I reported a **proxy or an assumption as the fact itself**:
+
+    sudo -n -v            for NOPASSWD sudo        -> wrong on sudo >= 1.9.15
+    command -v nvcc       for "is CUDA installed"  -> it was at /usr/local/cuda/bin
+    a lock file's pid     for a flock              -> flock is fd-held; stale files are inert
+    "no CLI path exists"  for a CLI I never ran    -> claude plugin update did it
+
+⚠ **Each was cheap to test and expensive to assert.** The failure is not carelessness about any
+one of them — it is reaching for the nearest observable and reporting it as the thing.
+[[feedback_assert_effective_value_not_substring]]
+
+## ⚠ 3.2.4: A SEAT COULD HAVE BEEN SILENTLY PULL-ONLY SINCE 3.1.2 — and one may be
+
+`_declare_push` devnulled both streams with `check=False`, so a missing binary, a non-zero exit
+and a server-side rejection were **three facts with one rendering, and that rendering was
+silence**. 3.2.4 prints that the waiter is arming PULL-ONLY plus how to retry, and appends to
+`$ALTHING_ROOT/listen.log`. Success stays silent by design.
+
+**Audit run on nh3-dev — live waiter locks vs what the post office believes:**
+
+    9 of 10 seats   live waiter -> mode: push        (correct)
+    regin-smithy-dev  live waiter pid 71457 -> mode: **pull**   <- looks armed, will not be poked
+
+⚠ **AMBIGUOUS, deliberately not filed as confirmed.** regin **intentionally released** their
+pane route earlier and chose pull-only (operator composes in their pane; guard 4 cannot read a
+`pi` cursor). Release-then-arm ordering explains the same observation with no bug. **Cannot be
+distinguished from outside** — asked regin, who has the local history. Handing forseti an
+ambiguous instance beats a confidently mislabelled one.
+
+**Standing audit command** for "looks armed but isn't" — worth re-running after any incident:
+cross-reference `~/.althing/wake-listener-*.lock` (live pid?) against
+`postbox status --handle <h>`. From the next arm onward `listen.log` answers it directly.
+
 ## Rollback (unused)
 
 `uv tool install althing-core==3.1.2` restores the six binaries; the SessionStart hook returns