Sync the self-hosting stack

README.md

@@ -195,8 +195,9 @@ to how the containers are scheduled.
 - A hostname and a TLS terminator in front of it. Jarvis speaks plain HTTP and does not manage
   certificates.
 - An API key for an OpenAI-compatible endpoint — or a paid or trial licence that includes the
-  [managed model](#if-you-choose-the-managed-model), which you choose after installing. The install
-  screen asks for the key and tests it before saving; you do not need it in hand before you start.
+  [managed model](#if-you-choose-the-managed-model), which the install screen offers once the licence
+  is in. The install screen asks for either, and tests a key before saving it; you do not need
+  either in hand before you start.
 - **No licence key.** Jarvis runs the [community edition](#the-community-edition) out of the box; a
   key raises the limits when you outgrow them.
 - Roughly 2 GB of RAM for the stack and room for Postgres to grow.
@@ -212,13 +213,23 @@ That is the whole first deployment. **There is no `.env` step.** First boot gene
 secrets, syncs the database schema and runs its data backfills before the API listens, so give it
 about a minute. Then point your reverse proxy at port 8080 and open the address in a browser.
 
-An install screen takes it from there. It welcomes you, creates the first administrator inside a
-bounded window, then asks for the address this instance answers on and who may create an account on
-it, the model, your first organization, and — every one of them skippable — mail, a licence and
-whether this instance reports anything about itself. It finishes by showing you what the deployment
-actually looks like from inside, and by making you take a backup of the one value nothing can
-reconstruct. Ten screens, about five minutes, and **only the address really needs you**: everything
-else has a "later" that costs nothing.
+An install screen takes it from there. It welcomes you, creates the first administrator, then asks
+for the address this instance answers on and who may create an account on it, a licence, the model,
+your first organization and mail — the licence, the model and mail all skippable. It finishes by
+showing you what the deployment actually looks like from inside, and by making you take a backup of
+the one value nothing can reconstruct. Nine steps, about five minutes, and **only the address really
+needs you**: everything else has a "later" that costs nothing.
+
+**The licence comes before the model, and with a paid or trial key it sends something.** Adding the
+key on the install screen's licence step makes this instance send its licence report to your Jarvis
+provider straight away, rather than once the install is finished — and so does opening that step
+with a key the instance already holds from `JARVIS_LICENSE_KEY`. That report is what links the
+instance to its licence, and the [managed model](#if-you-choose-the-managed-model) is only offered
+to a linked instance. So the model step can offer it beside your own endpoint, with the same
+statement of what it sends as the settings screen, and a licensed install can be finished without a
+model key of your own. What the report carries is
+[listed field by field below](#licence-keys-and-what-your-instance-reports). Without a key, nothing
+leaves until the install is finished.
 
 Everything it asks is a setting you can change afterwards from an ordinary screen. Nothing it asks
 needs a container restart to change.
@@ -735,6 +746,18 @@ key; a community one to `checkin.luxit.be`, compiled into the build. The interva
 to set — every ten minutes on the current arrangement, so that a renewal or a revocation reaches you
 promptly rather than tomorrow.
 
+**An instance that is still being installed reports nothing — until a licence is adopted and its
+address is set, and then only from the install screen's licence step.** A community instance sends
+its first report once the install screen is finished. A licensed one sends it from the licence
+step, which comes after the step that sets the address: the moment the key is added there, or, for
+a key that came from `JARVIS_LICENSE_KEY`, when that step opens. Nothing reports on its own before
+the install is finished, so a stack that brings both its key and its address in the environment
+still sends nothing until somebody reaches that step. That early report is the same report, with the
+same fields — it goes early because it is what links the instance to its licence, which the managed
+model needs. An address that is still `localhost` or another loopback address does not count as
+set, and neither does an example one such as `jarvis.example.com`: that instance sends nothing from
+the licence step.
+
 This is everything the licence report and a licence request send, in full. The managed model, if you
 choose it, sends conversation content — see
 [If you choose the managed model](#if-you-choose-the-managed-model).
@@ -784,9 +807,11 @@ checked without a network.
 **Off unless a platform administrator turns it on, and only on a paid or trial licence.** Your
 Jarvis provider can run a model for licensed instances, so that the assistant works without an
 endpoint or a key of your own. A platform administrator chooses it under **Settings → Platform →
-Model**, on a screen that states everything below and asks them to confirm they have read it.
-Nothing else selects it: no environment variable, no licence, no answer from the licence server. A
-community instance cannot use it; its assistant runs on your own provider, as it always has.
+Model**, or on the model step of the install screen, which shows the same choice once the licence
+step before it has linked the instance to its licence. Either way it is chosen on a screen that
+states everything below and asks them to confirm they have read it. Nothing else selects it: no
+environment variable, no licence, no answer from the licence server. A community instance cannot use
+it; its assistant runs on your own provider, as it always has.
 
 **While it is chosen, conversation content goes to your Jarvis provider instead of the endpoint you
 configured.** Every request the assistant then makes to the model carries:
@@ -805,9 +830,10 @@ exactly as its licence report is, which carries the product (`jarvis`), the lice
 id and public key, and the version — nothing else — and it keeps the credential in memory only.
 
 **Opening the screen already asks.** On a licensed instance, opening **Settings → Platform → Model**
-sends that signed request, so the screen can say whether the managed model is offered to you and
-which model it is — whether or not anybody then chooses it. It carries the fields above and no
-conversation content, and your Jarvis provider sees that this instance asked.
+— or reaching the model step of the install screen — sends that signed request, so the screen can
+say whether the managed model is offered to you and which model it is, whether or not anybody then
+chooses it. It carries the fields above and no conversation content, and your Jarvis provider sees
+that this instance asked.
 
 **Where it goes.** Over HTTPS to the host your licence reports to — the address written into your
 licence key, `checkin.luxit.be` on current licences, which is where its licence report goes too. The