diff --git a/.gitignore b/.gitignore
index eeadcaa..eb4b530 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,3 +132,7 @@ skills-external/frontend-design/
 # pollution dir is ignored.
 /.agents/
 /skills-lock.json
+
+# deploy: transient per-deploy state (the runbook/ledger/oracle ARE committed)
+.claude/deploy/NEXT.sh
+.claude/deploy/PENDING.json
diff --git a/templates/deploy/INCIDENTS.md b/templates/deploy/INCIDENTS.md
new file mode 100644
index 0000000..0dfaaec
--- /dev/null
+++ b/templates/deploy/INCIDENTS.md
@@ -0,0 +1,10 @@
+# Deploy incidents (append-only) — DEP-NNN
+
+<!-- One entry per incident. Next ID = grep '^## DEP-' | max+1. Mirrors blockers.md. -->
+<!-- ## DEP-NNN — <step> failed
+     - date: YYYY-MM-DD
+     - step: <runbook step + label>
+     - error: `<verbatim error>`
+     - cause: <root cause>
+     - fix: <what changed in PROCEDURE.md>
+     - resolved-by: <commit sha> -->
diff --git a/templates/deploy/PROCEDURE.md b/templates/deploy/PROCEDURE.md
new file mode 100644
index 0000000..1256a3a
--- /dev/null
+++ b/templates/deploy/PROCEDURE.md
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# === deploy runbook (reference) — NOT run directly. Instantiated to NEXT.sh per delta. ===
+# Fixed steps run every deploy; annotated steps (@delta lines) re-instantiate from the delta.
+# @config push_deploy_tags=false
+# NOTE grammar: glob=<pat>:each repeats the command per matching file (e.g. psql -f <each>);
+#               glob=<pat>:list runs once + lists matching files as VERIFY items; when=<pat,...> is conditional.
+
+# 1) backup BEFORE any forward-only migration
+ssh "$DEPLOY_HOST" 'pg_dump "$DB" > ~/backups/pre-deploy-$(date +%F-%H%M).sql'   # VERIFY: dump size > 0
+
+# @delta:migrations glob=supabase/migrations/*.sql:list
+# 2) apply NEW migrations (one command; skill lists the delta migrations to VERIFY)
+ssh "$DEPLOY_HOST" 'supabase migration up'                                       # VERIFY: "Applied" for each
+
+# @delta:rebuild when=docker-compose*.yml,Dockerfile,*.dockerfile
+# 3) rebuild + restart services (only if build inputs changed)
+ssh "$DEPLOY_HOST" 'docker compose up -d --build'                                # VERIFY: docker compose ps healthy
+
+# @delta:deps when=package.json,*lock*,requirements.txt,pyproject.toml
+# 4) install deps (only if manifests changed)
+ssh "$DEPLOY_HOST" 'cd app && npm ci'                                            # VERIFY: exit 0
+
+# 5) reload cache + smoke test (fixed)
+ssh "$DEPLOY_HOST" 'systemctl reload app'
+curl -fsS https://$DEPLOY_HOST/health                                            # VERIFY: HTTP 200