docs: link the primary-instance deploy gap runbook from DEVELOPING/RELEASING/AGENTS

Author: beingben

AGENTS.md

@@ -132,6 +132,13 @@ Run the browser suites only when your change touches them or when you are explic
 
 For normal issue work, run the smallest relevant verification first. Do not default to repo-wide typecheck/build/test on every heartbeat when a narrower check is enough to prove the change.
 
+For any change you intend to verify against a live, already-running server rather than a freshly
+started one, first confirm which commit that server is actually running (`GET /api/health` ->
+`commit`) — a long-lived primary/production instance can be many commits behind `master`. See
+`doc/PRIMARY-DEPLOY-GAP.md` for the deploy path, the operator-restart requirement, and the required
+disclosure ("verified against local dev on commit X" vs. "verified against the primary instance")
+when reporting a server-side fix as verified.
+
 Run this full check before claiming repo work done in a PR-ready hand-off, or when the change scope is broad enough that targeted checks are not sufficient:
 
 ```sh

doc/DEVELOPING.md

@@ -749,6 +749,14 @@ Expected:
 - `/api/health` returns `{"status":"ok"}`
 - `/api/companies` returns a JSON array
 
+`/api/health` also returns `version`/`serverVersion` and `commit` (the running build's git SHA) once
+the caller has full-details access (board/agent actor, or any caller in `local_trusted` dev). Compare
+that `commit` against the commit you are trying to verify before treating a running server's behavior
+as proof your change is live — a long-lived primary/production instance is not guaranteed to be
+running the commit you just merged. See `doc/PRIMARY-DEPLOY-GAP.md` for the full deploy path, the
+operator-restart requirement, and the standing rule for saying explicitly which server ("local dev"
+vs. "primary instance") a fix was verified against.
+
 ## Reset Local Dev Database
 
 To wipe local dev data and start fresh:

doc/RELEASING.md

@@ -254,3 +254,6 @@ Then fix forward with a new stable release.
 - [`scripts/rollback-latest.sh`](../scripts/rollback-latest.sh)
 - [`doc/PUBLISHING.md`](PUBLISHING.md)
 - [`doc/RELEASE-AUTOMATION-SETUP.md`](RELEASE-AUTOMATION-SETUP.md)
+- [`doc/PRIMARY-DEPLOY-GAP.md`](PRIMARY-DEPLOY-GAP.md) — the manual steps after npm publish (global
+  install upgrade + process restart) that this file does not cover, and the verification rule that
+  applies until an operator performs them