diff --git a/credentials b/credentials
index c959cb2..c773593 100755
--- a/credentials
+++ b/credentials
@@ -389,10 +389,10 @@ PDM_BREAKGLASS_USER="admin@pam"
 PDM_BREAKGLASS_PASS="7redditGold"
 
 # Conduit GUI admin login (http://100.64.0.12:8010/login) — CT 104
-# Created 2026-07-14 via conduit-admin create-operator (GUI slice 1)
+# Recreated 2026-07-15 via conduit-admin create-operator (full DB rebuild; old operator gone)
 CONDUIT_GUI_URL="http://100.64.0.12:8010/login"
 CONDUIT_GUI_USER="admin"
-CONDUIT_GUI_PASS="GQNvu72dPmPsXt8vpi0wy_L2b8RxiTgy"
+CONDUIT_GUI_PASS="7redditGold"
 
 # ARGUS web UI (https://argus.echo6.co) — utility CT 101 Caddy, HTTP basic auth
 # Backend: ARGUS app CT 103 tailnet 100.64.0.25:8090. Added 2026-07-03.
diff --git a/engine/lint-report.md b/engine/lint-report.md
index 96275d3..c0b8ce0 100644
--- a/engine/lint-report.md
+++ b/engine/lint-report.md
@@ -1,6 +1,6 @@
 # Vault Lint Report
 
-Generated: 2026-07-14T18:00:17Z  |  Docs scanned: 107  |  Elapsed: 0.0s
+Generated: 2026-07-15T00:00:18Z  |  Docs scanned: 107  |  Elapsed: 0.0s
 
 ## Summary
 
diff --git a/vault/.obsidian/workspace.json b/vault/.obsidian/workspace.json
index 0a6abb4..b1804f2 100644
--- a/vault/.obsidian/workspace.json
+++ b/vault/.obsidian/workspace.json
@@ -199,6 +199,8 @@
   },
   "active": "17bd4a6166f789d0",
   "lastOpenFiles": [
+    "runbooks/conduit-operations.md.tmp.1002651.4b545d0c7965",
+    "runbooks/conduit-operations.md.tmp.1002651.015f0192a793",
     "docs/hardware/ip-allocation.md.tmp.767109.ecc1c9977e03",
     "docs/hardware/ip-allocation.md.tmp.767109.c1f2a642bed7",
     "docs/hardware/ip-allocation.md.tmp.767109.d6ca8e1e1a1c",
@@ -210,8 +212,6 @@
     "runbooks/conduit-operations.md.tmp.2217597.e825be725a27",
     "docs/software/conduit.md",
     "docs/software/conduit.md.tmp.2217597.5f47d4e96ae8",
-    "docs/software/central.md.tmp.2217597.5f057dc86d0a",
-    "docs/software/central.md.tmp.2217597.f65fc65a678c",
     "archive/projects/vaultwarden-plan.md",
     "archive/projects/meshai-native-fire-severity-audit-cc-handoff.md",
     "projects/meshai-native-fire-severity-audit-cc-handoff.md",
diff --git a/vault/runbooks/conduit-operations.md b/vault/runbooks/conduit-operations.md
index 20a9d38..8412040 100644
--- a/vault/runbooks/conduit-operations.md
+++ b/vault/runbooks/conduit-operations.md
@@ -8,7 +8,7 @@ related:
   - [[conduit]]
   - [[central]]
   - [[navi]]
-updated: 2026-07-14
+updated: 2026-07-15
 ---
 
 # Conduit — Operations Runbook
@@ -61,6 +61,26 @@ curl -sS -o /dev/null -w '%{http_code}\n' http://localhost:8010/up/tomtom_flow_t
 
 ---
 
+## Fresh deploy from scratch
+
+`scripts/provision.sh` (repo root) is the canonical from-scratch installer — it stands up one Conduit instance from nothing: Postgres role + database (plain Postgres, no timescaledb/postgis), generated secrets (AES-256 master key + session secret), a uv-managed venv with an editable install, schema migrations, an optional GUI operator, and (optionally) a systemd unit. It takes every name/path/port as an env var or flag — no Matt-specific values are hardcoded, so it's the same script for the live deploy and for a disposable test instance.
+
+Example (adjust for a real deploy — this example matches the throwaway shape used to prove the script works):
+
+```bash
+DB_NAME=conduit_fresh DB_ROLE=conduit_fresh \
+INSTALL_DIR=/tmp/conduit-fresh ENV_FILE=/tmp/conduit-fresh/env \
+MASTER_KEY_PATH=/tmp/conduit-fresh/master.key BIND_PORT=8011 \
+SYSTEMD=off ADMIN_USER=admin SERVICE_NAME=conduit-fresh \
+/tmp/conduit-fresh/scripts/provision.sh
+```
+
+For a real systemd-managed deploy, set `SYSTEMD=on` plus `SERVICE_NAME`/`SERVICE_USER`/`SERVICE_GROUP`/`BIND_HOST`/`BIND_PORT` to taste; the script renders, installs, enables, and starts the unit. Run `scripts/provision.sh --help` for the full parameter list.
+
+**Migrations are schema-only.** As of the `feat/provisioning` schema-only-migrations change, `003_sources.sql` creates the `sources` table but seeds no rows — a fresh install's `sources` table is empty after `conduit-migrate`. Sources (and the API keys they reference) are provisioned **after** the schema exists, via the GUI or `conduit-admin`/SQL — see "Add a pull source" and "Provision an API key" below. (The live `conduit` DB's `tomtom_flow_tiles` row predates this change and is untouched — 003 already applied there and won't re-run.)
+
+---
+
 ## Add a pull source
 
 Sources are rows in the `sources` table — there is **no hot-reload**, `app.py` loads enabled sources once at startup. Any INSERT/UPDATE/DELETE requires a `systemctl restart conduit` to take effect.