diff --git a/bootstrap.sh b/bootstrap.sh
index 11322e1..9a5f470 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -101,31 +101,9 @@ remote() { ssh "${SSH_OPTS[@]}" "$FLIT_USER@$HOST" "$@"; }
 FLIT_LAPTOP_HOME=$HOME
 export FLIT_LAPTOP_HOME
 
-# flit_remote_env — the FLIT_NAME/FLIT_USER/FLIT_SERVER/FLIT_LAPTOP_HOME
-# assignment list every ssh call that runs on a stripped environment (`sudo`
-# strips it; so does a non-login remote command) must carry explicitly. ONE
-# function rather than five hand-written copies, so a variable added here
-# reaches every call site instead of whichever ones happened to get edited —
-# the failure this exists to prevent (§13.2). Callers append whatever else
-# that particular remote script needs (NO_EXTERNAL_STATE, STORAGEBOX_USER,
-# ...) after this.
-flit_remote_env() {
-  # FLIT_GIT_NAME/FLIT_GIT_EMAIL are identifying (CLAUDE.md), so they live
-  # only in the gitignored local.conf, which phase_2_deliver() excludes from
-  # the rsync push by design — forwarding them here is the only route by
-  # which a value set there reaches the server at all.
-  #
-  # %q, not '%s'. A '%s' format is safe only while no value can contain a
-  # single quote, and FLIT_GIT_NAME breaks that assumption: an apostrophe in a
-  # personal name would close the quoting and hand the remainder of the
-  # assignment list to the far shell as code. %q quotes for a shell to read
-  # back, exists in bash 3.2 as well as 5, and renders an empty value as ''
-  # rather than as nothing — which is what stops an unset FLIT_GIT_EMAIL from
-  # swallowing the word after it.
-  printf "FLIT_NAME=%q FLIT_USER=%q FLIT_SERVER=%q FLIT_LAPTOP_HOME=%q FLIT_IN_DRILL=%q FLIT_GIT_NAME=%q FLIT_GIT_EMAIL=%q" \
-    "$FLIT_NAME" "$FLIT_USER" "$FLIT_SERVER" "$FLIT_LAPTOP_HOME" "${FLIT_IN_DRILL:-}" \
-    "${FLIT_GIT_NAME:-}" "${FLIT_GIT_EMAIL:-}"
-}
+# flit_remote_env() lives in lib/common.sh: laptop/sync-config.sh runs the same
+# server-side script this file does, and a second hand-written copy of the
+# assignment list is exactly the drift §13.2 keeps counting.
 
 # --------------------------------------------------------------- preflight
 
@@ -555,7 +533,28 @@ phase_6_terminal() {
   fi
 }
 
-phase_7_sshconfig()   { log "phase 7: server ssh config"; run_server_lib 45-ssh-config.sh; }
+# The key is installed BEFORE the ssh config that names it, so a run never
+# leaves a config pointing at a path with nothing at it — ssh treats a missing
+# IdentityFile as no identity at all and falls through to "Permission denied
+# (publickey)", which reads like an unregistered key rather than a missing one.
+#
+# Skipped under --no-external-state: registering a key against the Tangled
+# account is state shared with production, and a drill must not touch it. The
+# drill box therefore has no Tangled key, which is why verify.sh's assertion is
+# one the drills are expected to fail on rather than one they assert.
+phase_7_sshconfig() {
+  log "phase 7: server ssh config"
+  if [[ $NO_EXTERNAL_STATE -eq 1 ]]; then
+    info "skipping the Tangled key: --no-external-state"
+  else
+    # EXIT_DEFERRED is success at the script's real job (§5.8), not failure:
+    # the key is installed and only its registration with the Tangled account
+    # is left to the operator, which no script here can do.
+    laptop/tangled-key.sh "$HOST" \
+      || { [[ $? -eq $EXIT_DEFERRED ]] || die "tangled-key.sh failed"; }
+  fi
+  run_server_lib 45-ssh-config.sh
+}
 
 phase_8_alerting() {
   log "phase 8: alerting (laptop half)"
diff --git a/laptop/sync-config.sh b/laptop/sync-config.sh
new file mode 100755
index 0000000..b529578
--- /dev/null
+++ b/laptop/sync-config.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# laptop/sync-config.sh — push the WORKING TREE of the global agent
+# configuration to the box, without a full provisioning run.
+#
+#   laptop/sync-config.sh [host]
+#
+# WHY THIS EXISTS: bootstrap.sh phase_2_deliver() moves ~/.claude and
+# ~/misc/chook with `git archive HEAD`, so the box runs whatever was committed
+# at the last provisioning run and drifts behind every edit since — and
+# check_clean() refuses a dirty tree outright, because git archive ships the
+# last commit and silently omits the rest. That guard is correct for an archive
+# and pointless here: this script ships the working tree, so an uncommitted
+# tweak is the case it exists to serve rather than the case it must refuse.
+#
+# WHY THIS IS IN laptop/: it is a push, and the box never fetches its own
+# configuration (§5.1). The direction IS the design.
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+# shellcheck source=lib/common.sh
+source lib/common.sh
+load_laptop_conf
+
+HOST=${1:-$FLIT_SERVER}
+
+# Set here for the same reason bootstrap.sh sets it: flit_remote_env() forwards
+# it, and no server-side default could guess this laptop's home.
+FLIT_LAPTOP_HOME=$HOME
+export FLIT_LAPTOP_HOME
+
+SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+remote() { ssh "${SSH_OPTS[@]}" "$FLIT_USER@$HOST" "$@"; }
+
+need_cmd rsync
+need_cmd git
+
+# sync_tree <source-repo> <remote-dir> <label>
+#
+# The file list comes from git, not from the filesystem: `git ls-files --cached
+# --others --exclude-standard` is every tracked file plus every untracked one
+# that is not ignored, which is the working tree's version of what `git archive
+# HEAD` would have shipped, plus new files, minus anything ignored. That last
+# part is load-bearing rather than tidy — ~/.claude's .gitignore is deny-by-
+# default with an allowlist, so the payload is about 2 MB while the directory
+# itself is over a gigabyte of session transcripts and caches. A plain rsync of
+# the tree would move all of it, and would move settings.local.json with it,
+# which is ignored precisely because it can hold credentials captured from an
+# approved command line.
+#
+# The remote directory is cleared first. It is staging that only this script
+# writes and only server/lib/22-claude-config.sh reads, so replacing it whole is
+# safe, and it is the only way a file deleted from the repository stops existing
+# on the box — neither `git archive | tar -x` nor an --files-from rsync removes
+# anything, so today a deleted skill lives on the box forever.
+sync_tree() {
+  local src=$1 dir=$2 label=$3
+  [[ -d "$src/.git" ]] || die "$label ($src) is not a git repository"
+
+  local list; list=$(mktemp)
+  # shellcheck disable=SC2064
+  trap "rm -f '$list'" RETURN
+  git -C "$src" ls-files --cached --others --exclude-standard >"$list" \
+    || die "could not list files for $label ($src)"
+  [[ -s "$list" ]] || die "$label ($src) listed no files; refusing to replace ~/$dir with nothing"
+
+  local n; n=$(wc -l <"$list" | tr -d ' ')
+
+  if [[ $PRINT_ONLY -eq 1 ]]; then
+    info "would replace ~/$dir on $HOST with $n files from $label"
+    return 0
+  fi
+
+  remote "rm -rf ~/$dir && mkdir -p ~/$dir" \
+    || die "could not clear ~/$dir on $HOST"
+  rsync -a --files-from="$list" -e "ssh ${SSH_OPTS[*]}" \
+    "$src/" "$FLIT_USER@$HOST:$dir/" \
+    || die "could not sync $label to $HOST:~/$dir"
+  log "synced $n files: $label -> ~/$dir"
+}
+
+log "sync config -> $HOST"
+sync_tree "$HOME/.claude" claude-config "the ~/.claude repository"
+sync_tree "$(cd .. && pwd)/chook" chook "the ~/misc/chook repository"
+
+# Rendering is not repeated here. server/lib/22-claude-config.sh owns the
+# per-machine rewrite of settings.json and chook.toml and the §5.8 contract that
+# refuses to overwrite a destination that differs; a second renderer on this
+# side would be the same content produced two ways, disagreeing the first time
+# one of them changed. Invoked exactly as bootstrap.sh run_server_lib() does,
+# through the shared flit_remote_env().
+if [[ $PRINT_ONLY -eq 1 ]]; then
+  info "would run server/lib/22-claude-config.sh on $HOST"
+  finish 0
+fi
+
+#
+# SYNC_OVERWRITE=1 is what makes this command idempotent rather than
+# single-use. deliver_rendered() defers on any difference, which is right for a
+# bootstrap run — the difference might be something the box meant to keep — but
+# for a command whose whole purpose is making the box match the laptop it would
+# mean every settings change defers forever and has to be applied by hand
+# (standing rule 18). The box's own state lives in settings.local.json, which
+# that script never touches, so what gets replaced is only the delivered
+# artifact, and only after a backup.
+rc=0
+remote "sudo $(flit_remote_env) SYNC_OVERWRITE=1 ~/$FLIT_NAME/server/lib/22-claude-config.sh" || rc=$?
+# EXIT_DEFERRED means the step ran and declined to overwrite something. That is
+# the contract working, not a failure — but it must not be silent, because a
+# config change that stops in ~/claude-config and never reaches ~/.claude leaves
+# the box running the old one while this script reports success. Compared
+# against the constant rather than a literal 3, so the two cannot drift.
+if [[ $rc -eq $EXIT_DEFERRED ]]; then
+  warn "22-claude-config.sh deferred a change on $HOST; see its output above — the box is NOT yet running it"
+elif [[ $rc -ne 0 ]]; then
+  die "22-claude-config.sh failed on $HOST (exit $rc)"
+fi
+
+finish 0
diff --git a/laptop/tangled-key.sh b/laptop/tangled-key.sh
new file mode 100755
index 0000000..2717384
--- /dev/null
+++ b/laptop/tangled-key.sh
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# laptop/tangled-key.sh — the box's own key for pushing to Tangled (§7.2).
+#
+# WHY THIS IS NOT IN server/lib/: escrow WRITES need the operator's
+# authenticated pass-cli session, and the server holds only the read-only
+# access token (§7.1, §7.3). Same reason laptop/backup-credentials.sh is here,
+# and the same order for the same reason: generate on the laptop, escrow,
+# verify the readback, and only then push. Generating on the box would leave a
+# window where the only copy lives on the machine it authorises.
+#
+#   laptop/tangled-key.sh [--replace] <host>
+#
+# --replace rotates a key that already has a value. Without it an existing
+# escrowed key is reused, which is what makes a rebuild reproduce the box
+# rather than mint a second key the account has never seen.
+#
+# WHAT THIS DELIBERATELY CANNOT DO: register the public half with Tangled.
+# There is no API for it, so the run ends by deferring that one step to the
+# operator with the exact key text to paste. Until it is done the key exists
+# and authenticates as nobody, which is why verify.sh asserts the push path
+# rather than the key file's existence — a key present but unregistered fails
+# in exactly the way a missing key does, and only the push tells them apart.
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+# shellcheck source=lib/common.sh
+source lib/common.sh
+
+REPLACE=0
+HOST=""
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --replace) REPLACE=1; shift ;;
+    *) HOST=$1; shift ;;
+  esac
+done
+HOST=${HOST:?usage: tangled-key.sh [--replace] <host>}
+
+remote() { ssh -o BatchMode=yes "$FLIT_USER@$HOST" "$@"; }
+
+# §6.2: escrow WRITES need the operator's session, not the read-only token.
+# Checked before anything is generated, so a run cannot mint a key it would
+# then be unable to store.
+if [[ $PRINT_ONLY -eq 0 ]]; then
+  vault_session_ok \
+    || die "no authenticated pass-cli session; escrow (§6.2) cannot write. Run 'pass-cli login' first."
+fi
+
+KEY_ITEM=tangled-key
+DEST=.ssh/tangled_ed25519
+
+# ONE working directory and ONE trap. A second `trap ... EXIT` later in the
+# script would replace this one rather than add to it, silently leaking
+# whichever directory the earlier trap named — with private key material in it.
+WORKDIR=$(mktemp -d)
+trap 'rm -rf "${WORKDIR:-}"' EXIT
+chmod 700 "$WORKDIR"
+
+# The comment carries the date of generation, matching
+# laptop/backup-credentials.sh storagebox_key_comment(): a rotation adds a key
+# rather than replacing one, so the account can hold several and the date is
+# what tells the operator which is which in Tangled's key list.
+key_comment() { printf '%s box %s\n' "$FLIT_NAME" "$(date -u +%Y-%m-%d)"; }
+
+EXISTING=$(vault_get "$KEY_ITEM" 2>/dev/null || true)
+
+if [[ -n "$EXISTING" && $REPLACE -eq 0 ]]; then
+  info "reusing the escrowed $KEY_ITEM; --replace rotates it"
+  PRIVATE=$EXISTING
+elif [[ $PRINT_ONLY -eq 1 ]]; then
+  info "plan: generate an ed25519 key, escrow it as $KEY_ITEM, install it at ~/$DEST on $HOST"
+  finish 0
+else
+  ssh-keygen -t ed25519 -N '' -C "$(key_comment)" -f "$WORKDIR/tangled_ed25519" >/dev/null \
+    || die "ssh-keygen failed"
+  PRIVATE=$(cat "$WORKDIR/tangled_ed25519")
+
+  vault_put "$KEY_ITEM" "$PRIVATE" || die "could not escrow $KEY_ITEM"
+  # Readback before proceeding, the §6.2 pattern: an escrow that silently
+  # stored nothing is indistinguishable from one that worked until the day a
+  # rebuild needs it.
+  READBACK=$(vault_get "$KEY_ITEM" || true)
+  [[ "$READBACK" == "$PRIVATE" ]] \
+    || die "escrowed $KEY_ITEM did not read back byte for byte; refusing to continue"
+  info "escrowed $KEY_ITEM and verified the readback"
+fi
+
+[[ -n "$PRIVATE" ]] || die "no key material for $KEY_ITEM"
+
+if [[ $PRINT_ONLY -eq 1 ]]; then
+  info "plan: install the escrowed $KEY_ITEM at ~/$DEST on $HOST"
+  finish 0
+fi
+
+# Never as a command-line argument: an argv entry sits in the process table for
+# as long as the command runs. Same shape backup-credentials.sh uses for the
+# Storage Box key.
+remote "install -d -m700 ~/.ssh" || die "cannot create ~/.ssh on $HOST"
+printf '%s\n' "$PRIVATE" | remote "install -m600 /dev/stdin ~/$DEST" \
+  || die "could not install the key at ~/$DEST on $HOST"
+info "installed ~/$DEST on $HOST (mode 0600)"
+
+# The public half is derived from the private one rather than carried
+# alongside it, so the two cannot disagree — a rebuild reads only the private
+# key out of the vault.
+#
+# Via a real file, not a pipe: ssh-keygen -y stats its -f argument and rejects
+# /dev/stdin, so the obvious pipeline fails with an error that names nothing
+# useful. The file is created 0600 BEFORE the key is written into it — created
+# then chmodded would leave the material world-readable for the width of that
+# window, on the laptop, which is the one machine holding every key here.
+(umask 077; printf '%s\n' "$PRIVATE" >"$WORKDIR/derive")
+PUBLIC=$(ssh-keygen -y -f "$WORKDIR/derive") \
+  || die "could not derive the public half of $KEY_ITEM"
+
+# Is the key already authorised? A key that exists but was never registered
+# fails exactly like a missing one, so this asks the service rather than the
+# filesystem. ControlPath=none because ssh multiplexing would answer from an
+# existing connection and make a lockout look like a pass.
+if remote "ssh -o BatchMode=yes -o ControlPath=none -o StrictHostKeyChecking=accept-new -T git@tangled.org" >/dev/null 2>&1; then
+  info "the box authenticates to Tangled with its own key"
+else
+  defer "Tangled account keys" \
+    "the box holds its key but Tangled does not yet accept it; add the public half to the account's ssh keys, after which the box can push with no forwarded agent" \
+    "$PUBLIC"
+fi
+
+finish 0
diff --git a/lib/common.sh b/lib/common.sh
index 91cb582..e114e34 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -437,6 +437,36 @@ load_laptop_conf() {
   source local.conf
 }
 
+# flit_remote_env — the assignment list every ssh call that runs on a stripped
+# environment (`sudo` strips it; so does a non-login remote command) must carry
+# explicitly. ONE function rather than a copy per caller, so a variable added
+# here reaches every call site instead of whichever ones happened to get edited
+# — the failure this exists to prevent (§13.2). It lives here rather than in
+# bootstrap.sh because laptop/sync-config.sh runs the same server-side script
+# and needs the identical list. Callers append whatever else that particular
+# remote script needs (NO_EXTERNAL_STATE, STORAGEBOX_USER, ...) after this.
+#
+# FLIT_GIT_NAME/FLIT_GIT_EMAIL are identifying (CLAUDE.md), so they live only in
+# the gitignored local.conf, which is excluded from the rsync push by design —
+# forwarding them here is the only route by which a value set there reaches the
+# server at all.
+#
+# %q, not '%s'. A '%s' format is safe only while no value can contain a single
+# quote, and FLIT_GIT_NAME breaks that assumption: an apostrophe in a personal
+# name would close the quoting and hand the remainder of the assignment list to
+# the far shell as code. %q quotes for a shell to read back, exists in bash 3.2
+# as well as 5, and renders an empty value as '' rather than as nothing — which
+# is what stops an unset FLIT_GIT_EMAIL from swallowing the word after it.
+#
+# FLIT_LAPTOP_HOME has no committed default and is set by the caller before the
+# first remote invocation; defaulted to empty here so sourcing this file under
+# `set -u` on the server, where it is meaningless, cannot abort.
+flit_remote_env() {
+  printf "FLIT_NAME=%q FLIT_USER=%q FLIT_SERVER=%q FLIT_LAPTOP_HOME=%q FLIT_IN_DRILL=%q FLIT_GIT_NAME=%q FLIT_GIT_EMAIL=%q" \
+    "$FLIT_NAME" "$FLIT_USER" "$FLIT_SERVER" "${FLIT_LAPTOP_HOME:-}" "${FLIT_IN_DRILL:-}" \
+    "${FLIT_GIT_NAME:-}" "${FLIT_GIT_EMAIL:-}"
+}
+
 # ------------------------------------------------------------ operator ssh key
 # LAPTOP ONLY: both functions below call `hcloud` (ensure_operator_key()) or
 # `ssh-add`/`ssh-keygen` (resolve_operator_key()), none of which exist on the
diff --git a/server/lib/22-claude-config.sh b/server/lib/22-claude-config.sh
index f196ae0..ac0a253 100755
--- a/server/lib/22-claude-config.sh
+++ b/server/lib/22-claude-config.sh
@@ -25,7 +25,8 @@ if [[ $(id -un) != "$U" ]]; then
   # carry the rest of the environment across this re-exec, and OLD_HOME below
   # needs FLIT_LAPTOP_HOME to still be set once running as the operator.
   exec sudo -u "$U" -H PRINT_ONLY="${PRINT_ONLY:-0}" DEFERRALS="${DEFERRALS:-}" \
-       FLIT_USER="$U" FLIT_LAPTOP_HOME="${FLIT_LAPTOP_HOME:-}" bash "$0" "$@"
+       FLIT_USER="$U" FLIT_LAPTOP_HOME="${FLIT_LAPTOP_HOME:-}" \
+       SYNC_OVERWRITE="${SYNC_OVERWRITE:-0}" bash "$0" "$@"
 fi
 
 SRC="$H/claude-config"
@@ -95,6 +96,22 @@ deliver_rendered() {
     fi
     if [[ $same -eq 1 ]]; then
       info "already satisfied: $dst matches the rendered config"
+    elif [[ ${SYNC_OVERWRITE:-0} -eq 1 ]]; then
+      # Set only by laptop/sync-config.sh, never by a bootstrap run. Deferring
+      # is right when the difference might be something the box meant to keep;
+      # it is wrong for a command whose entire purpose is "make the box match
+      # the laptop", where a permanent deferral means the tool never works
+      # twice (standing rule 18). The box's own state belongs in
+      # settings.local.json, which nothing here touches — so what is replaced
+      # is only ever the delivered artifact.
+      #
+      # Backed up first regardless: §1 success criterion 8 says no script
+      # destroys an existing config file, and "the operator asked for it" does
+      # not exempt this one.
+      cp -p "$dst" "${dst}.${FLIT_NAME}.$(date +%Y%m%d%H%M%S).bak" \
+        || die "could not back up $dst before replacing it"
+      cat "$tmp" >"$dst"
+      log "replaced $dst from the rendered delivery (previous content backed up)"
     else
       defer "$dst" "$reason" "$(cat "$tmp")"
     fi
diff --git a/server/lib/45-ssh-config.sh b/server/lib/45-ssh-config.sh
index ca3abf6..fce1a3a 100755
--- a/server/lib/45-ssh-config.sh
+++ b/server/lib/45-ssh-config.sh
@@ -20,8 +20,22 @@ fi
 install -d -m700 "$H/.ssh"
 
 # AddressFamily inet is per Tangled's documented configuration — they have
-# IPv6 trouble and this box has IPv6. No IdentityFile: there is no key here by
-# design; keys arrive from the operator's forwarded agent (§7.2).
+# IPv6 trouble and this box has IPv6.
+#
+# IdentityFile names a key that lives HERE, which reverses the earlier design
+# of carrying no key and relying on the operator's forwarded agent. A forwarded
+# agent exists only while the operator is connected, so an agent working
+# unattended had no route for its work to leave the box — the reason the key
+# now exists (laptop/tangled-key.sh installs it, escrowed from the vault).
+# IdentitiesOnly yes so ssh offers this key and nothing else: with an agent
+# forwarded as well, ssh would otherwise offer the agent's keys first and the
+# assertion would pass on the operator's identity while the box's own key was
+# missing or unregistered — a check that proves the wrong thing.
+#
+# Both host names, because a remote may be written either way:
+# `git@tangled.org:...` and `git@tangled.sh:...` both occur across the
+# projects on this box, and a block naming one silently fails to match the
+# other.
 #
 # StrictHostKeyChecking accept-new for the same reason the Storage Box path
 # uses it (laptop/backup-credentials.sh): tangled.org has never been connected
@@ -35,10 +49,18 @@ install -d -m700 "$H/.ssh"
 # SSH takes the FIRST value obtained for each keyword, so this must go at the
 # TOP of the file. Appended below an existing `Host *` it is silently ignored,
 # and git push fails with no useful error.
-cfg_apply "$H/.ssh/config" prepend "$(cat <<'EOF2'
-Host tangled.org
-    Hostname tangled.org
+# The heredoc is UNQUOTED so $H expands into IdentityFile — ssh does not expand
+# ~ or a shell variable in that setting, so the path has to be absolute and
+# baked in here. Any future line added to this block is therefore subject to
+# expansion too; a literal $ in one needs escaping.
+#
+# No Hostname line: both Host patterns are the real hostnames, which is what
+# ssh already uses when Hostname is absent.
+cfg_apply "$H/.ssh/config" prepend "$(cat <<EOF2
+Host tangled.org tangled.sh
     User git
+    IdentityFile $H/.ssh/tangled_ed25519
+    IdentitiesOnly yes
     AddressFamily inet
     StrictHostKeyChecking accept-new
 EOF2
diff --git a/verify.sh b/verify.sh
index ccacd16..cb0cd41 100755
--- a/verify.sh
+++ b/verify.sh
@@ -5,7 +5,7 @@
 # user-scoped, and as root it would read root's configuration and report
 # confidently on the wrong user.
 #
-# Reports PASS / FAIL / SKIP. Only two assertions may SKIP; every other one
+# Reports PASS / FAIL / SKIP. Only one assertion may SKIP; every other one
 # that cannot run is a FAIL. A run that skipped everything must NOT look
 # healthy — that is the cheapest possible way to disable this whole layer.
 
@@ -39,7 +39,7 @@ declare -a FAILED=() SKIPPED=()
 
 pass() { printf '  PASS  %s\n' "$1"; P=$((P+1)); }
 fail() { printf '  FAIL  %s — %s\n' "$1" "${2:-}"; F=$((F+1)); FAILED+=("$1"); }
-# skip() is deliberately available to only two call sites (see §5.3).
+# skip() is deliberately available to only one call site (see §5.3).
 skip() { printf '  SKIP  %s — %s\n' "$1" "${2:-}"; S=$((S+1)); SKIPPED+=("$1"); }
 
 # check <name> <expected> <command...> — non-skippable by construction:
@@ -189,13 +189,17 @@ else
   done
 fi
 
-echo "=== git push (§7.2) — SKIPPABLE ==="
-# Requires the operator's forwarded agent, absent in timer runs and drills.
-if [[ -z "${SSH_AUTH_SOCK:-}" ]]; then
-  skip "tangled push works" "no forwarded SSH agent (normal in timer runs and drills)"
-else
-  check_true "tangled push works" ssh -o BatchMode=yes -T git@tangled.org
-fi
+echo "=== git push (§7.2) ==="
+# No longer skippable. The box has its own key (laptop/tangled-key.sh), so this
+# no longer depends on the operator's forwarded agent being present, which is
+# what made it skip in every timer run and drill.
+check "tangled key mode 0600" "600" stat -c %a "$HOME/.ssh/tangled_ed25519"
+# IdentityAgent=none, not merely BatchMode: with an agent forwarded, ssh offers
+# the agent's keys as well, and this would pass on the operator's identity while
+# the box's own key was missing or unregistered — proving the opposite of what
+# it claims. Forcing the agent out is what makes the assertion about THIS box.
+check_true "tangled push works with the box's own key" \
+  ssh -o BatchMode=yes -o IdentityAgent=none -o ControlPath=none -T git@tangled.org
 
 # ---------------------------------------------------------------- reporting
 echo
@@ -203,14 +207,15 @@ echo "PASS=$P FAIL=$F SKIP=$S"
 (( ${#FAILED[@]}  )) && printf 'failed: %s\n' "${FAILED[*]}"
 (( ${#SKIPPED[@]} )) && printf 'skipped: %s\n' "${SKIPPED[*]}"
 
-# The floor: only the two assertions above may skip. If we somehow skipped
-# more, or evaluated almost nothing, this run proves nothing and must not
-# ping success.
-if (( S > 2 )); then
-  echo "ABORT: $S assertions skipped, but only 2 are skippable (§5.3)" >&2
+# The floor: only the backup-escrow assertion above may skip (§6.2) — the
+# Tangled push now runs on the box's own key, not a forwarded agent, so it is
+# unconditional like everything else. Skipping more, or evaluating almost
+# nothing, means this run proves nothing and must not ping success.
+if (( S > 1 )); then
+  echo "ABORT: $S assertions skipped, but only 1 is skippable (§5.3)" >&2
   exit 1
 fi
-if (( P < 10 )); then
+if (( P < 11 )); then
   echo "ABORT: only $P assertions evaluated; verify.sh is not doing its job" >&2
   exit 1
 fi