docs: the install proxy is live, and the manual says so

docs/GUIDE.md

@@ -66,36 +66,38 @@ goes to home from a conversation and `esc` comes back untouched.
 
 ## Install
 
+### The installer
+
+```bash
+curl -fsSL https://agentfield.ai/get/codeaf | bash                                                    # the supported line
+curl -fsSL https://raw.githubusercontent.com/Agent-Field/codeaf/main/scripts/install.sh | bash     # the script under it
+```
+
+The first proxies the second: `agentfield.ai/get/codeaf` serves `scripts/install.sh` from
+this repository's `main` branch, byte for byte, and a channel on the path — `/dev`,
+`/staging`, `/rc` — rewrites the one line that sets the default channel. Pipe it to
+`bash`, not `sh`; the script uses `pipefail` and `[[ ]]`, which dash rejects.
+
 ### Build from the repository
 
-The road that works today is a source checkout. The module needs Go 1.26.5, and
-`make build` is the one supported build command; it writes `bin/codeaf`.
+The module needs Go 1.26.5, and `make build` is the one supported build command; it
+writes `bin/codeaf`.
 
 ```bash
-git clone https://github.com/Agent-Field/codeaf.git  # needs repository access while it is private
+git clone https://github.com/Agent-Field/codeaf.git
 cd codeaf
 make build   # fetches the pinned Furrow artifact, so it needs the network;
              # FURROW_ARTIFACT=/path/to/furrow supplies it offline
 bin/codeaf
 ```
 
-### The installer, and what it is waiting on
-
-```bash
-curl -fsSL https://agentfield.ai/get/codeaf | bash                                                    # the preferred form
-curl -fsSL https://raw.githubusercontent.com/Agent-Field/codeaf/main/scripts/install.sh | bash     # the script under it
-```
-
-The first is the road that will be supported, and it is not serving yet — the route is
-written and unmerged. The second answers 404 to anyone not signed in, and starts working
-when the repository is public and `scripts/install.sh` has reached `main`.
-
 <details>
 <summary>Installer channels, flags, and checks</summary>
 
-The repository currently has no rc or staging publication. Those channel selections
-therefore stop with `no <channel> build has been published yet`. Recognizing a channel
-does not mean a matching release exists.
+A push to `dev`, `staging` or `main` publishes that channel's build, marked as a
+prerelease; stable is published only when a person dispatches `Release` on `main`. A
+channel with nothing published stops with `no <channel> build has been published yet`.
+Recognizing a channel does not mean a matching release exists.
 
 ```bash
 curl -fsSL https://agentfield.ai/get/codeaf/dev | bash

docs/changes/unreleased/1076-install-proxy-is-live.md

@@ -0,0 +1,15 @@
+---
+kind: changed
+title: The manual and the guide say the install proxy is live, because it is
+pr: 1076
+surface: [docs, chat]
+invalidates:
+  - "`internal/manual/chat/running-from-the-terminal.md` said the repository is private, that the raw installer answers 404 to anyone not signed in, and that `https://agentfield.ai/get/codeaf` is not serving yet. The repository has been public and that address has served `scripts/install.sh` from `main` since 2026-09-16; the section now opens with `curl -fsSL https://agentfield.ai/get/codeaf | bash`, names the raw GitHub line as the script under it, and gives `/dev`, `/staging` and `/rc` on the path beside the `bash -s --` flags."
+  - "`docs/GUIDE.md` said a source checkout is the road that works today, that the proxy route is written and unmerged, that the clone needs repository access while it is private, and that the repository has no rc or staging publication. The installer now comes first under `## Install`, the clone line carries no access caveat, and the channel sentence is a condition: a push to `dev`, `staging` or `main` publishes that channel's build, and a channel with nothing published stops with `no <channel> build has been published yet`."
+  - "Neither page said which shell to pipe the installer into. Both now say `bash`, not `sh`: the script uses `set -o pipefail` and `[[ ]]`, and `sh` is dash on Debian and Ubuntu, which rejects both."
+---
+
+The proxy refuses rather than misleads — a script without its channel line exactly
+once, or a body that is not a shell script, is a 502 — and the manual now says so,
+because that is what the route does. Still true and unchanged: nothing self-updates;
+there is no `internal/update` on `dev`.

internal/manual/chat/running-from-the-terminal.md

@@ -2,37 +2,46 @@
 
 ## How do I install or update codeaf to the latest version — the curl line, dev, staging, rc and stable
 
-Build from source needs nothing published: clone the repository, run `make build`,
-then run `bin/codeaf` from the checkout. While the repository is private, both the
-clone and the raw installer need repository access and the raw address answers 404
-to anyone who is not signed in. Once it is public and `scripts/install.sh` is on
-`main`, this road works:
+The install line is one curl, the same one the README prints:
+
+```sh
+curl -fsSL https://agentfield.ai/get/codeaf | bash
+```
+
+`https://agentfield.ai/get/codeaf` serves `scripts/install.sh` from the `main` branch of
+the public repository, byte for byte. The script under it can be run directly:
 
 ```sh
 curl -fsSL https://raw.githubusercontent.com/Agent-Field/codeaf/main/scripts/install.sh | bash
 ```
 
+Pipe it to `bash`, not `sh`: the script uses `set -o pipefail` and `[[ ]]`, and `sh` is
+dash on Debian and Ubuntu, which rejects both.
+
 A push to `dev` publishes a `dev-*` build, a push to `staging` publishes a
 `staging-*` build, and a push to `main` publishes an rc. Each is marked as a
 prerelease. Stable is published only when a person dispatches `Release` on `main`.
-A channel with nothing published stops with `no <channel> build has been published
-yet`.
-
-Once the script can be read, `--stable` is the default and reads GitHub's
-`releases/latest`, which excludes prereleases. The bare curl line therefore stops
-with `no stable build has been published yet` until a person dispatches `Release`
-on `main` for stable. Pass `--dev`, `--staging`, or `--rc` after `bash -s --` for
-another channel. To pin one complete tag, replace the final pipe with
-`| VERSION=<tag> bash`; for example:
+`--stable` is the default and reads GitHub's `releases/latest`, which excludes
+prereleases. To take another channel, put it on the path —
+`https://agentfield.ai/get/codeaf/dev`, `/staging` or `/rc` — or pass `--dev`,
+`--staging` or `--rc` after `bash -s --`. A channel with nothing published stops with
+`no <channel> build has been published yet`. To pin one complete tag, replace the
+final pipe with `| VERSION=<tag> bash`; for example:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/Agent-Field/codeaf/main/scripts/install.sh | VERSION=v0.3.0 bash
+curl -fsSL https://agentfield.ai/get/codeaf | VERSION=v0.2.0 bash
 ```
 
-`https://agentfield.ai/get/codeaf` is not serving yet. Once it serves, it is the
-supported proxy for the same script, with `/dev`, `/staging`, or `/rc` selecting
-another channel. The installer writes `~/.codeaf/bin/codeaf`; its last line is
-`codeaf version`. Nothing self-updates: run it again when you want a newer build.
+For the bare address the proxy hands the script out unchanged; for a channel path it
+rewrites the one line that sets the default channel. If it cannot find that line exactly
+once, or what it fetched is not a shell script, it answers 502 rather than serve the
+wrong thing.
+
+Building from source needs nothing published: clone the repository, run `make build`,
+then run `bin/codeaf` from the checkout.
+
+The installer writes `~/.codeaf/bin/codeaf`; its last line is `codeaf version`. Nothing
+self-updates: run the line again when you want a newer build.
 
 ## Why codeaf do may download rtk — compressed shell output and how to turn it off