diff --git a/persistent-memory.d/2026-09-01-althing-320-deploy.md b/persistent-memory.d/2026-09-01-althing-320-deploy.md
index 9ff46e4..ab6ef0f 100644
--- a/persistent-memory.d/2026-09-01-althing-320-deploy.md
+++ b/persistent-memory.d/2026-09-01-althing-320-deploy.md
@@ -444,6 +444,60 @@ plugin in a way that looks like an upstream bug.
 unnoticed. Offered to write one; it installs to a per-machine path so ownership (althing repo
 vs eshpfi) is forseti's call.
 
+## ✅ 3.2.4 + THE FOURTH DEPLOY SURFACE CLOSED (plugin cache 0.0.1 -> 0.1.1)
+
+    1. uv tool install --force .   3.2.3 -> 3.2.4 (d24bd5e)
+    2. systemctl --user restart althing-po-herald
+    3. scripts/sync_skill.sh       (already current at 3.2.4)
+    4. claude plugin update althing    <- THE NEW, FOURTH SURFACE
+
+⚠ **`ALTHING DEPLOY = FOUR SURFACES`, not three.** Tool install, herald restart, skill sync,
+**plugin reinstall**. The fourth had no runbook step and nobody had run it since 0.0.1.
+
+⚠ **`claude plugin` IS A REAL CLI — I claimed it needed the operator without looking.**
+`claude plugin install|update|uninstall|list|details|validate|marketplace|tag|prune` all exist.
+`claude plugin update althing` moved the cache cleanly ("updated from 0.0.1 to 0.1.1, restart
+to apply"). I had told forseti step 4 required a `/plugin` update from the operator because I
+would not hand-edit `installed_plugins.json` — **the refusal to hand-edit was right, the
+conclusion that no supported path existed was an untested assumption.**
+
+⚠ **Restart required to apply** — the SessionStart auto-declare goes live for NEW sessions.
+
+## ⚠⚠ THE PATTERN, RECORDED ONCE INSTEAD OF FOUR TIMES
+
+Four times in one session I reported a **proxy or an assumption as the fact itself**:
+
+    sudo -n -v            for NOPASSWD sudo        -> wrong on sudo >= 1.9.15
+    command -v nvcc       for "is CUDA installed"  -> it was at /usr/local/cuda/bin
+    a lock file's pid     for a flock              -> flock is fd-held; stale files are inert
+    "no CLI path exists"  for a CLI I never ran    -> claude plugin update did it
+
+⚠ **Each was cheap to test and expensive to assert.** The failure is not carelessness about any
+one of them — it is reaching for the nearest observable and reporting it as the thing.
+[[feedback_assert_effective_value_not_substring]]
+
+## ⚠ 3.2.4: A SEAT COULD HAVE BEEN SILENTLY PULL-ONLY SINCE 3.1.2 — and one may be
+
+`_declare_push` devnulled both streams with `check=False`, so a missing binary, a non-zero exit
+and a server-side rejection were **three facts with one rendering, and that rendering was
+silence**. 3.2.4 prints that the waiter is arming PULL-ONLY plus how to retry, and appends to
+`$ALTHING_ROOT/listen.log`. Success stays silent by design.
+
+**Audit run on nh3-dev — live waiter locks vs what the post office believes:**
+
+    9 of 10 seats   live waiter -> mode: push        (correct)
+    regin-smithy-dev  live waiter pid 71457 -> mode: **pull**   <- looks armed, will not be poked
+
+⚠ **AMBIGUOUS, deliberately not filed as confirmed.** regin **intentionally released** their
+pane route earlier and chose pull-only (operator composes in their pane; guard 4 cannot read a
+`pi` cursor). Release-then-arm ordering explains the same observation with no bug. **Cannot be
+distinguished from outside** — asked regin, who has the local history. Handing forseti an
+ambiguous instance beats a confidently mislabelled one.
+
+**Standing audit command** for "looks armed but isn't" — worth re-running after any incident:
+cross-reference `~/.althing/wake-listener-*.lock` (live pid?) against
+`postbox status --handle <h>`. From the next arm onward `listen.log` answers it directly.
+
 ## Rollback (unused)
 
 `uv tool install althing-core==3.1.2` restores the six binaries; the SessionStart hook returns