diff --git a/CLAUDE.md b/CLAUDE.md
index ca39251..f4f585e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -119,7 +119,12 @@ pnpm --dir frontend test:e2e     # Playwright smoke; needs `pnpm exec playwright
 **Trigger a redeploy (fire-and-forget per global CLAUDE.md rule):**
 
 ```bash
-# Requires COOLIFY_URL, COOLIFY_KEY exported and deploy.json populated.
+# 1) MAKE SURE origin/main is at the ref you want deployed. Coolify's git
+#    clone at build time reads from origin/main; local commits that haven't
+#    been pushed don't ship. Push first, deploy second — always.
+git push origin main
+# 2) Trigger the deploy. Requires COOLIFY_URL, COOLIFY_KEY exported and
+#    deploy.json populated.
 APP=$(jq -r '.app.uuid' deploy.json)
 curl -sS -X POST "$COOLIFY_URL/api/v1/deploy?uuid=$APP" \
   -H "Authorization: Bearer $COOLIFY_KEY" \
diff --git a/docs/superpowers/plans/2026-08-31-plan-4-coolify-deploy.md b/docs/superpowers/plans/2026-08-31-plan-4-coolify-deploy.md
index b6ac6f5..574e77b 100644
--- a/docs/superpowers/plans/2026-08-31-plan-4-coolify-deploy.md
+++ b/docs/superpowers/plans/2026-08-31-plan-4-coolify-deploy.md
@@ -765,6 +765,8 @@ git status --short deploy.json
 
 Uses `deploy.json` from Task 6. Handles both fresh-create (`app.uuid` empty) and idempotent PATCH (`app.uuid` populated). After the create step the `git_repository` truncation bug is repaired, `docker_compose_domains` is PATCHed in the array form (mandatory port suffix baked in from Task 6), env vars are POSTed, and a deploy is triggered fire-and-forget per the global CLAUDE.md rule (return the deployment id; do NOT poll).
 
+**IMPORTANT ORDERING (learned the hard way on the first run):** Coolify's git clone reads from `origin/main` at build time. The `Dockerfile` + `docker-compose.yml` + all Plan-4 code MUST be on `origin/main` BEFORE the deploy is triggered — otherwise Coolify clones a pre-Plan-4 ref and fails with `Deployment failed: Docker Compose file not found at: /docker-compose.yml (branch: main)`. **Run Task 8's push step BEFORE Task 7's deploy step.** The physical order in this document is legacy; the correct execution order is: Tasks 1–6 → Task 8 Steps 1–7 (push everything to origin) → Task 7 (trigger deploy). Task 8's Step-6 head-SHA backfill can happen either way (it only touches CLAUDE.md, not any file Coolify reads).
+
 **Files:**
 - No repo files change (all API calls). `deploy.json` gets `.app.uuid` written back on create.