diff --git a/demo/DEPLOY.md b/demo/DEPLOY.md
index fbc8b438..a89b73b5 100644
--- a/demo/DEPLOY.md
+++ b/demo/DEPLOY.md
@@ -42,13 +42,19 @@ changes. Sessions already running keep theirs.
 
 ## 4. The service (~5 min)
 
+Ubuntu's `ttyd` package starts its own `ttyd.service`, which runs **`login` on port 7681** -- our
+port. Left running, it takes the port, and Apache hands visitors the server's own login prompt
+(found 2026-11-08, after step 5). Disable it first:
+
 ```bash
+systemctl disable --now ttyd                 # the package's service: a login prompt on 7681
 useradd --system --home /var/lib/starshipos-demo --shell /usr/sbin/nologin starshipos-demo
 chown -R starshipos-demo: /var/lib/starshipos-demo
 cp demo/starshipos-demo.service /etc/systemd/system/
 systemctl daemon-reload && systemctl enable --now starshipos-demo
 systemctl status starshipos-demo --no-pager | head -5
 curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:7681/     # 200: ttyd answers
+ss -ltnp | grep 7681                          # the ttyd of starshipos-demo, nothing else
 ```
 
 The service expects the checkout's `demo/` at `/opt/starshipos-demo/demo` (step 1 put it there).
@@ -67,7 +73,13 @@ curl -sI https://try.starshipos-f18.com/ | head -3                   # 200, its
 
 `apache-demo.conf` lets only the .com frame the terminal (`frame-ancestors`).
 
-## 6. Tell Claude
+## 6. The check (done 2026-11-08)
+
+From outside: a session ready 1.5 s after the page opens; `3 4 + .` answers `7  ok`, `: SQUARE DUP *
+;  7 SQUARE .` answers `49  ok`; a third visitor at once is told every machine is busy. The
+certificate is try.starshipos-f18.com's own (Let's Encrypt), and only the .com may frame it.
+
+## 7. Tell Claude
 
 Then I check from outside: a session reaches `[zuse@Hera] ok>`, `3 4 + .` answers `7 ok`, a third
 visitor gets the busy message, and the .com's Try it page shows the console. Then the "Try it" link