diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 93b5290..5b8387b 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -174,7 +174,7 @@ The test stack on docker-1 lives under /home/spencerm/packetstation/test (stack.
 
 ## Doctor
 
-`packetstation doctor` proves a host and a stack are ready. Run it inside the image:
+`packetstation doctor` proves a host and a stack are ready. Run it with `compose run`, not `compose exec`: the entrypoint exports MFILES_PASSWORD from its secret file, and `exec` skips the entrypoint, so the M-Files password check fails under `exec` even though the running worker has it.
 
 ```bash
 docker compose -p packetstation-test --env-file /etc/packetstation/test/stack.env \
@@ -195,6 +195,10 @@ It checks:
 
 Use `--skip visual,mfiles,ldap,smtp` to run only the local checks. The network checks need the secrets and the CA bundle in place.
 
+### Test stack first start (2026-10-17, phase 5 image)
+
+The test stack came up healthy on docker-1 through NPM (https://packetstation-test.pescoinc.biz). Doctor: VISUAL DEV connect as visualkit_ro through the named instance, M-Files all four drawing classes, SMTP STARTTLS verified, database at 0006, assets volume. Only the LDAP bind failed (AD data 52e, wrong password for svc-packetstation) until the service account password was reset and re-entered.
+
 ### Verified on docker-1 (2026-10-15, phase 0)
 
 The image built on docker-1 from this tree (python:3.12-slim-bookworm, ODBC Driver 18, visualkit 0.3.0, mfileskit 0.1.2). The CI stack (`deploy/compose.ci.yaml` with throwaway secrets) came up with postgres, migrate, app and worker all healthy. Inside it, `doctor --skip visual,mfiles,ldap,smtp` passed: migrations at head, the audit UPDATE denied for `ps_app`, LISTEN/NOTIFY round trip, assets volume, tzdata. `visualkit doctor` in the image found the ODBC driver and pyodbc on Linux; the connection itself was not tried because the CI stack has no VISUAL credentials. `mfileskit doctor` imported and ran on Linux up to its settings check for the same reason. The full doctor with the real secrets, the CA bundle and both domain controllers is the first step of the test stack deployment.