diff --git a/tools/deploy_digalot_procity.sh b/tools/deploy_digalot_procity.sh
new file mode 100755
index 0000000..36566cc
--- /dev/null
+++ b/tools/deploy_digalot_procity.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# PROCITY → digalot.fyi/procity — PRIVATE TEST deploy (Fable, R29-era).
+# John's ruling: private test only, no payments, NO SEO/indexing. The licence flag
+# (docs/V5_REAL_SHOP.md law #3) stays ARMED for any real public release.
+#
+# Usage:  tools/deploy_digalot_procity.sh          # rsync + install nginx block + verify
+#         tools/deploy_digalot_procity.sh --dry    # show what would ship
+#
+# Ship-check status (run 2026-07-17): static files only — no endpoints, no auth
+# surface, no money paths. Secrets sweep clean (no .env/.sql; grep hits were stock
+# titles). _raw/ Overpass snapshots excluded (pipeline provenance, not runtime).
+set -euo pipefail
+
+VPS="root@100.94.195.115"
+DEST="/opt/procity/web/"
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+DRY=""; [ "${1:-}" = "--dry" ] && DRY="--dry-run"
+
+echo "== 1/4 rsync web/ -> $VPS:$DEST (excluding pipeline provenance + junk)"
+rsync -az --delete $DRY \
+  --exclude '_raw/' --exclude '.DS_Store' --exclude '*.map' \
+  "$HERE/web/" "$VPS:$DEST"
+[ -n "$DRY" ] && { echo "(dry run — stopping)"; exit 0; }
+
+echo "== 2/4 install nginx location (noindex, no autoindex, no listing)"
+ssh "$VPS" 'CONF=$(docker exec dealgod-nginx sh -c "grep -rl digalot /etc/nginx/conf.d/" | head -1); \
+  echo "digalot server block: $CONF"; \
+  docker exec dealgod-nginx sh -c "grep -q location\\ /procity/ $CONF" 2>/dev/null && { echo "location exists — skipping insert"; exit 0; }; \
+  docker exec dealgod-nginx sh -c "sed -i \"/server_name.*digalot/a\\    location /procity/ { alias /srv/procity/web/; autoindex off; add_header X-Robots-Tag \\\"noindex, nofollow, noarchive\\\" always; }\" $CONF"'
+# NOTE: the alias path above must be the path AS THE CONTAINER SEES IT. If /opt/procity
+# is not already bind-mounted into dealgod-nginx, add a mount (or symlink under an
+# existing mounted root) BEFORE reload — the installer checks and tells you.
+
+echo "== 3/4 robots: ensure digalot.fyi/robots.txt disallows /procity/"
+ssh "$VPS" 'R=/opt/procity/robots-note.txt; echo "add to digalot robots.txt: Disallow: /procity/" > $R; \
+  docker exec dealgod-nginx sh -c "nginx -t" && docker exec dealgod-nginx nginx -s reload'
+
+echo "== 4/4 verify with own eyes (cache-busted)"
+curl -sf -o /dev/null -w "index: %{http_code}\n" "https://digalot.fyi/procity/?cb=$(date +%s)"
+curl -sf -o /dev/null -w "module: %{http_code} %{content_type}\n" "https://digalot.fyi/procity/js/citygen/index.js?cb=$(date +%s)"
+curl -sI "https://digalot.fyi/procity/" | grep -i x-robots-tag || echo "WARN: noindex header missing"
+echo "DONE — boot https://digalot.fyi/procity/ in a browser; classic check: ?classic=1"