docs(ansible): mark -u root as a placeholder for the image's bootstrap user

Also note that a per-host ansible_user must be added only after bootstrap,
since it overrides -u on the first converge.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: thiras

ansible/README.md

@@ -96,14 +96,16 @@ bootstrap each new host once as a sudo-capable user (root, or the image's defaul
 as `ubuntu`):
 
 ```bash
-make deploy LIMIT=decdn-node-1 ANSIBLE_ARGS='-u root'   # first converge only
-make deploy LIMIT=decdn-node-1                          # every run after that
+make deploy LIMIT=decdn-node-1 ANSIBLE_ARGS='-u root'   # first converge only; swap root for your image's bootstrap user
+make deploy LIMIT=decdn-node-1                          # every run after that first converge succeeds
 ```
 
 Set a per-host `ansible_user` only when the admin account's name differs from your `$USER`
 (you listed a different name in `baseline_sudo_users`) or you set
 `baseline_sudo_autodetect_runner: false`. Never set it to the bootstrap user: an inventory
-`ansible_user` beats `-u`, and root login is gone after the first converge.
+`ansible_user` beats `-u`, and root login is gone after the first converge. For the same
+reason, add a per-host `ansible_user` only after that host's bootstrap run, or `-u` is
+ignored on the first converge.
 
 ---
 

ansible/inventory/hosts.yml.example

@@ -7,12 +7,13 @@
 # account the baseline role creates (the auto-detected runner). A fresh box doesn't have
 # it yet, so bootstrap each new host ONCE as a user that can sudo (root, or the image's
 # default user such as ubuntu):
-#   make deploy LIMIT=<host> ANSIBLE_ARGS='-u root'
+#   make deploy LIMIT=<host> ANSIBLE_ARGS='-u root'   # swap root for your image's bootstrap user
 # After that first converge ssh_hardening disables root login, and plain `make deploy`
 # connects as $USER. Set a per-host ansible_user only if the admin account's name differs
 # from your $USER (you listed another name in baseline_sudo_users) or you set
 # baseline_sudo_autodetect_runner: false. Never set it to the bootstrap user: an
 # inventory ansible_user overrides -u, and root login is gone after the first converge.
+# For the same reason, add a per-host ansible_user only AFTER that host's bootstrap run.
 #
 # Ubuntu sudo-rs workaround: 25.10 (Questing) and 26.04 ship sudo-rs as the default
 # /usr/bin/sudo. Ansible's sudo become plugin passes a custom `-p` prompt sentinel and
@@ -35,5 +36,5 @@ decdn_nodes:
   hosts:
     decdn-node-1:
       ansible_host: REPLACE_WITH_NODE_VPS_IP_OR_DNS
-      # ansible_user: alice   # only if the admin account's name ≠ your $USER — see note above
+      # ansible_user: alice   # post-bootstrap, only if the admin account's name ≠ your $USER — see note above
       # ansible_become_exe: /usr/bin/sudo.ws   # Ubuntu sudo-rs workaround — see note above