diff --git a/bootstrap.sh b/bootstrap.sh
index 82c8e03..6986de9 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -62,19 +62,35 @@ else
   warn "NOT marking first-boot done — fix and re-run $0"
 fi
 
+# ---- announce the result on ntfy (best-effort, never blocks) ---------------------
+# The box tells Mike's phone directly — publish path verified from 10.0.1.20
+# (HTTP 200) on 2026-08-01. A notification failure must never fail the bootstrap.
+NTFY_URL="https://ntfy.thewichersfamily.com/arrsstack-alerts"
+MOUNTS_OK="$("$REPO_DIR/scripts/20-cifs.sh" --verify >/dev/null 2>&1 && echo yes || echo no)"
+if [ ${#FAILED[@]} -eq 0 ]; then
+  NTFY_TITLE="mediabox: first boot COMPLETE"
+  NTFY_MSG="All bootstrap stages OK on $(hostname) ($(hostname -I | awk '{print $1}')). NAS mounts: ${MOUNTS_OK}. Next: message Claude 'box is up' to start the D: copy."
+else
+  NTFY_TITLE="mediabox: first boot NEEDS ATTENTION"
+  NTFY_MSG="Stages failed: ${FAILED[*]}. NAS mounts: ${MOUNTS_OK}. SSH in (thethreemagi@10.0.1.20) or tell Claude which stage failed. Log: /var/log/mediabox-bootstrap.log"
+fi
+curl -s -m 10 -H "Title: ${NTFY_TITLE}" -d "${NTFY_MSG}" "$NTFY_URL" >/dev/null 2>&1 \
+  || warn "ntfy notification failed (non-fatal)"
+
 cat <<'NEXT'
 
 --------------------------------------------------------------------------------
   REMAINING STEPS — deliberately NOT automated (2026-07-31 flow)
 --------------------------------------------------------------------------------
-  1. Write the NAS password into the credentials file (over the MCP, never
-     onto the USB), then verify the seven mounts — the six library shares
-     must REFUSE writes, media_pc must accept them:
+  1. NAS credentials: the CIDATA stick copy of user-data now writes
+     /etc/cifs/korval.cred on first boot, so the mounts normally come up on
+     their own. If they did not, write the cred file by hand and verify:
          printf 'username=<nas-user>\npassword=<nas-pass>\ndomain=WORKGROUP\n' \
            > /etc/cifs/korval.cred
          chmod 600 /etc/cifs/korval.cred
          systemctl daemon-reload
          /srv/mediabox-bootstrap/scripts/20-cifs.sh --verify
+     The six library shares must REFUSE writes, media_pc must accept them.
 
   2. Verify Quick Sync before anything Plex-related:
          vainfo --display drm --device /dev/dri/renderD128