diff --git a/STATUS.md b/STATUS.md
index f50e133..2e6c80d 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -53,7 +53,7 @@ Source of truth: this repo, `techy/Media-Server-Setup` on the stack's own Gitea
 | MediaMTX | RTMP/SRT ingest, records fMP4; publish auth delegated to dumpd (tokens via `/mtx-auth`); on-ready hook posts "is live" and runs the WebRTC audio mirror (`<path>.webrtc`, audio → Opus, never recorded) | live, token auth verified |
 | copyparty | browse/scrub/download/finals upload | behind Authentik, group permissions (`editors`, `media-admins`), Discord-only, no WebDAV | live |
 | dumpd + dock | dump, stream tokens, MediaMTX auth hook, `/time`, `/me` identity (on `live.`), `/me/clips` Syncthing self-service (on `clips.`); OBS dock with timecode-band setup | identity from Authentik headers | live |
-| `media.` gateway, `clips.` self-service | static pages behind the gate | — | live (first real pairing pending) |
+| `media.` gateway, `clips.` self-service | static pages behind the gate | — | live; **first real pairing 2026-11-01 (thrahg)** — exposed a missing `.stlocal` on fresh folders, fixed |
 | Timecode | `bin/vgstrip.py` decoder, `tmcd` + sidecar in the sweep, `/dock/clock/` strip page, Go Live band composite, portal crop | server clock is the reference | **live, verified** (OBS: frame-accurate, 0 gaps) |
 | Syncthing | clip intake, UI at `sync.` | UI behind Authentik + `media-admins`, own GUI auth off | live |
 | normalize sweep | editing standard, one copy per clip | live |
diff --git a/addClipUser.sh b/addClipUser.sh
index 6b7aa2b..df78bce 100755
--- a/addClipUser.sh
+++ b/addClipUser.sh
@@ -6,5 +6,6 @@ cd "$(dirname "$0")"
 u="${1:-}"; [[ $u =~ ^[a-z0-9_.-]{2,32}$ ]] || { echo "usage: $0 <username>  (lowercase letters, digits, _ . -)"; exit 1; }
 sudo install -d -o 1000 -g 1000 "/srv/media/clips/$u"
 sudo install -m 0644 -o 1000 -g 1000 syncthing/stignore "/srv/media/clips/$u/.stignore"
+[[ -e "/srv/media/clips/$u/.stlocal" ]] || sudo install -m 0644 -o 1000 -g 1000 /dev/null "/srv/media/clips/$u/.stlocal"   # #include'd by .stignore
 echo "ready: /srv/media/clips/$u  (Syncthing path: /var/syncthing/clips/$u)"
-echo "next: pair their device in https://$(grep -E '^# vanguard:main' -A1 Caddyfile 2>/dev/null | tail -1 | awk '{print $1}')/sync/ and accept their folder at that path, Receive Only, min free 300 GB"
+echo "next: the gamer pairs at the clips host (self-service), or you accept their folder in the Syncthing UI at that path, Receive Only, min free 300 GB"
diff --git a/bin/dumpd.py b/bin/dumpd.py
index 479e0a3..23d0c4e 100755
--- a/bin/dumpd.py
+++ b/bin/dumpd.py
@@ -222,6 +222,9 @@ def clips_setup(user, device_id, device_name=None):
     ign = d / ".stignore"
     if not ign.exists() and STIGNORE_SRC.exists():
         ign.write_text(STIGNORE_SRC.read_text()); shutil.chown(ign, 1000, 1000); ign.chmod(0o644)
+    loc = d / ".stlocal"                     # #include'd by .stignore; Syncthing refuses to scan while it is missing
+    if not loc.exists():
+        loc.write_text(""); shutil.chown(loc, 1000, 1000); loc.chmod(0o644)
     # 2. their device
     my_id = st("GET", "/rest/system/status")["myID"]
     if device_id == my_id: raise ValueError("that is the server's own Device ID — paste yours (your Syncthing → Actions → Show ID)")
diff --git a/install.sh b/install.sh
index b7a54cb..5d989af 100755
--- a/install.sh
+++ b/install.sh
@@ -45,6 +45,7 @@ install -d -o "$OWNER" /srv/live                 # live portal static build (dep
 install -d -o 1000 -g 1000 /srv/media/streams/{techy,diceofire} /srv/media/clips/{techy,diceofire}
 for d in /srv/media/clips/*/; do
   [[ -e "$d/.stignore" ]] || install -m 0644 -o 1000 -g 1000 syncthing/stignore "$d/.stignore"
+  [[ -e "$d/.stlocal" ]] || install -m 0644 -o 1000 -g 1000 /dev/null "$d/.stlocal"     # #include'd by .stignore
 done
 
 echo "== host scripts + units"
diff --git a/syncthing/stignore b/syncthing/stignore
index 33777d4..ae0405f 100644
--- a/syncthing/stignore
+++ b/syncthing/stignore
@@ -1,5 +1,5 @@
 // Server-side ignore list for a clips receive folder (clips/<user>): pull video only.
-// .stlocal is appended to by the sweep: raws it converted (then deleted locally) and the standard
+// .stlocal must exist (created empty with the folder) and is appended to by the sweep: raws it converted (then deleted locally) and the standard
 // files it produced. Ignored = not tracked, not flagged, never re-pulled, never sent back.
 #include .stlocal
 // Ignored files are never downloaded from the sender. Subfolders are still traversed