PUBKEY defaults to empty now — empty means no key is authorised, and some users need none. GROUPS was always split on whitespace by deploy.py, so the comma-separated prompt label and README were documenting a bug; both now say space-separated. The deploy script checks the Users fact up front and noops when the user exists, since rerunning reset the password and overwrote ~/.config/fish. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ce5atB2tXDXyz2jd9s1bqE