diff --git a/ledger/2026-07.jsonl b/ledger/2026-07.jsonl
index 31faa0a..b91313b 100644
--- a/ledger/2026-07.jsonl
+++ b/ledger/2026-07.jsonl
@@ -2,3 +2,4 @@
 {"ts": "2026-07-06T11:15:04+00:00", "agent": "mac-mini", "entity": "repo:Homelab-Docs", "action": "register-webhook", "risk": "config_mutation", "result": "ok", "notes": "webhook id 14 for oikos-console deploy"}
 {"ts": "2026-07-06T11:29:56+00:00", "agent": "mac-mini", "entity": "service:caddy", "action": "add-site-block", "risk": "config_mutation", "verification": "curl -s https://git.hubris.network (unrelated route still healthy after reload)", "result": "ok", "notes": "oikos.hubris.network -> 192.168.8.205:8091, Authentik-gated, in dtoro/caddy-conf@c195142"}
 {"ts": "2026-07-06T11:40:28+00:00", "agent": "mac-mini", "entity": "host:dns", "action": "add-record", "risk": "config_mutation", "verification": "dig @192.168.8.2 +short oikos.hubris.network", "result": "ok", "notes": "oikos.hubris.network A -> 192.168.8.175 (Caddy LAN IP), via Technitium API, no token persisted"}
+{"ts": "2026-07-06T11:57:21+00:00", "agent": "mac-mini", "entity": "host:apps", "action": "deploy-oikos-console", "risk": "config_mutation", "verification": "curl http://127.0.0.1:8091/ on apps -> 200; https://oikos.hubris.network/ -> 302 (Authentik gate)", "result": "ok"}
diff --git a/oikos/console/deploy/deploy.sh b/oikos/console/deploy/deploy.sh
index ac44449..13381ee 100755
--- a/oikos/console/deploy/deploy.sh
+++ b/oikos/console/deploy/deploy.sh
@@ -32,6 +32,13 @@ if [ ! -d /opt/homelab-context/.git ]; then
     exit 1
 fi
 
+# signals/ and approvals/ are untracked-when-empty (git doesn't version
+# empty directories), so a fresh clone won't have them. The systemd unit's
+# ReadWritePaths need these to exist before the process starts (confirmed
+# the hard way on first deploy, 2026-07-06 — a missing dir here is a
+# 226/NAMESPACE crash-loop, not a graceful degradation).
+mkdir -p /opt/homelab-context/signals /opt/homelab-context/approvals
+
 systemctl daemon-reload
 if systemctl is-active --quiet oikos-console.service; then
     systemctl restart oikos-console.service
diff --git a/oikos/console/deploy/oikos-console.service b/oikos/console/deploy/oikos-console.service
index 6cc1ecd..3bd20d7 100644
--- a/oikos/console/deploy/oikos-console.service
+++ b/oikos/console/deploy/oikos-console.service
@@ -21,7 +21,12 @@ ProtectHome=true
 PrivateTmp=true
 NoNewPrivileges=true
 ReadOnlyPaths=/opt/homelab-context /opt/oikos-console
-ReadWritePaths=/opt/homelab-context/signals /opt/homelab-context/approvals /opt/homelab-context/ledger /opt/homelab-context/oikos
+# "-" prefix marks each path optional — signals/ and approvals/ are
+# untracked-when-empty (git doesn't version empty dirs), so a fresh
+# /opt/homelab-context clone won't have them yet. Without "-", systemd
+# refuses to start at all (226/NAMESPACE) until something else creates
+# them first — confirmed the hard way on first deploy (2026-07-06).
+ReadWritePaths=-/opt/homelab-context/signals -/opt/homelab-context/approvals -/opt/homelab-context/ledger -/opt/homelab-context/oikos
 
 [Install]
 WantedBy=multi-user.target