diff --git a/.up/phase5a-webhooks.md b/.up/phase5a-webhooks.md
index 1b4ee49af5031671bda2205cc747f4b6706b41ab..90e759cb595fa3dcd7796187e8445b6f8aef6121 100644
--- a/.up/phase5a-webhooks.md
+++ b/.up/phase5a-webhooks.md
@@ -56,6 +56,15 @@   override on /query makes NewAuthConfig/FilterWebhooks accept the owner (they
   refuse AUTH_COOKIE). Owner "user" row seeded at startup so core-go's LookupUser
   never calls out to meta.sr.ht.
 
+### New deploy requirements (faithful path)
+- `[mail] smtp-from` is now REQUIRED — WithDefaultMiddleware builds core-go's
+  notification/email queue, which panics without it. A valid address; SMTP need
+  not actually work for webhooks.
+- Redis: WithDefaultMiddleware creates a client (default `redis://`), but it is
+  lazy and outbound webhook delivery never touches it — no redis server needed.
+- Agents can no longer read GraphQL /query (core-go auth is OAuth2/cookie only);
+  they use MCP + REST. Owner keeps /query (cookie).
+
 ### Deferred (needs user input)
 - extensions-go / `sr-ht-ext` module — extracting spec's agent model into a
   shared module (location, name, publish target, CI wiring). User said it's