fix false missing Hermes CLI detection after deployment

DEVELOPMENT.md

@@ -33,6 +33,23 @@ npm run build
 - `npm run test:e2e` runs Playwright browser tests against a mocked BFF API.
 - `npm run build` type-checks and builds both client and server.
 
+## Hermes CLI Detection
+
+The installation probe runs `hermes --help` in the Web UI service environment.
+Some Hermes versions synchronously check upstream updates during `--version`, so
+version output is not a reliable installation/liveness probe. A timeout does not
+mean Hermes is absent and must not send users to the installation guide.
+
+`GET /api/hermes/cli-status` reports `available`, `bin`, and `reason` (`ready`,
+`missing`, `permission_denied`, `timeout`, or `failed`). `?refresh=1` bypasses the
+completed-result cache while sharing an in-flight probe. Deploy validation must
+check this endpoint as well as HTTP health; a running Node process alone does not
+prove that its service user can execute Hermes.
+
+When investigating, reproduce with the service's `HERMES_BIN`, `PATH`, `HOME`, and
+`HERMES_HOME`. Inspect the complete launcher/interpreter path before changing
+permissions. Do not use recursive permission changes to treat a probe timeout.
+
 ## One-Click Deploy
 
 `deploy.sh` deploys a checkout to a host that runs the built server under