Clarify Docker-first deploy workflow

deployment/docker/README.md

@@ -2,10 +2,10 @@
 
 This directory contains the Docker runtime for Islandflow VPS deployments.
 
-Docker remains the default server rollout path, but the repo-root `deploy` helper can now target either:
+Docker remains the default and recommended server rollout path, but the repo-root `deploy` helper can now target either:
 
 - `--runtime docker` for this Docker Compose stack
-- `--runtime native` for a host-native Bun + systemd rollout described in `deployment/native/README.md`
+- `--runtime native` for an experimental host-native Bun + systemd rollout described in `deployment/native/README.md`
 
 The repo no longer ships or supports a separate `deployment/npm` stack. If you want a reverse proxy, point it at the host ports published by this stack.
 
@@ -190,6 +190,8 @@ docker compose build web
 
 ## Safe rollouts on `152.53.80.229`
 
+The current live VPS uses Nginx Proxy Manager on the shared Docker network and routes public traffic to the Docker `web` and `api` containers by container name. Because of that, this Docker path remains the operationally correct default for the live server today.
+
 The checked-in deploy helper is meant to run from your local repo checkout, not from the VPS shell. It always targets:
 
 - SSH host: `delta@152.53.80.229`

deployment/native/README.md

@@ -1,13 +1,13 @@
 # Native Deployment
 
-This directory documents the host-native Islandflow rollout path used by:
+This directory documents the experimental host-native Islandflow rollout path used by:
 
 ```bash
 ./deploy main --runtime native
 ./deploy current-branch --runtime native
 ```
 
-This runtime is intended for faster server iteration during the transition away from Docker-only app rollouts. Local development should still prefer:
+This runtime is intended for faster server iteration during the transition away from Docker-only app rollouts. It is not the recommended path for the current production VPS, which still uses Nginx Proxy Manager to reach the Docker `web` and `api` containers by container name on the shared Docker network. Local development should still prefer:
 
 - Docker for infra (`bun run dev:infra`)
 - native Bun services (`bun run dev:services`)
@@ -57,7 +57,7 @@ Available overrides:
 By default the deploy helper uses:
 
 ```bash
-sudo systemctl
+sudo -n systemctl
 ```
 
 If the server uses user units or another wrapper, override it locally before invoking `./deploy`:
@@ -86,6 +86,23 @@ Scope behavior:
 - `--services-only`: restart API + backend units without touching the web unit
 - `--no-build`: skip `bun install --frozen-lockfile` and skip the web build step
 
+## Current status
+
+On the current live VPS, native deploys should be treated as opt-in infrastructure work, not the default rollout path. Before a native deploy can succeed there, all of the following must be true at the same time:
+
+- Bun is installed on the host.
+- The selected `systemctl` command works non-interactively.
+- Islandflow systemd units exist for the requested scope.
+- Host-native services can reach the intended NATS, ClickHouse, and Redis endpoints.
+- If `web` or `api` move native, the reverse proxy topology is updated deliberately.
+
+Until that is prepared intentionally, prefer:
+
+```bash
+./deploy main --runtime docker
+./deploy current-branch --runtime docker
+```
+
 ## Server preparation checklist
 
 Before the first native rollout, ensure the VPS has:
@@ -115,7 +132,7 @@ Rollback remains manual for now:
 2. rerun the appropriate native deploy command
 3. if needed, restart only the affected units with `systemctl`
 
-Docker remains available as the fallback runtime during the transition:
+Docker remains the fallback and currently recommended runtime during the transition:
 
 ```bash
 ./deploy main --runtime docker