diff --git a/agent-queue/README.md b/agent-queue/README.md
index c7591a6..136f45d 100644
--- a/agent-queue/README.md
+++ b/agent-queue/README.md
@@ -215,6 +215,21 @@ Wired into the repo's unified CLI (no GitHub token required for this subcommand)
 ./bytelyst-cli.sh aq status                   # short alias
 ```
 
+## Boot-persistence (auto-start on login)
+
+To run the worker non-stop and survive **reboot / crash / logout** (not just a
+closed terminal), install the macOS LaunchAgent — it auto-starts `agent-queue run`
+on login under `caffeinate` and restarts it via `KeepAlive`:
+
+```bash
+bash launchd/install.sh             # install + start now
+bash launchd/install.sh --uninstall # stop + remove
+```
+
+Override engine/concurrency/secrets in `~/.agent-queue.env` (e.g.
+`AGENT_QUEUE_ENGINE=codex`, `AGENT_QUEUE_MAX=1`). See [`launchd/README.md`](launchd/README.md)
+for the full layer comparison (tmux/caffeinate vs LaunchAgent) and gotchas.
+
 ## Folder layout
 
 ```
@@ -412,6 +427,7 @@ AQ_FLEET=1 AQ_FLEET_TOKEN=… AQ_PRODUCT_ID=… agent-queue.sh run            #
 | --- | ------- | ------- |
 | `AQ_FLEET` | `0` | master switch — `1` enables coordinator integration; `0`/unset = offline git-queue (zero coordinator calls) |
 | `AQ_FLEET_ROUTE` | `1` | `route_via_service`: `1` = coordinator is authoritative for claim (P2-S3 behavior); `0` = local inbox authoritative (coordinator not used to source work) |
+| `AQ_FLEET_AUTOSHIP` | `0` | `1` = when the local verify gate passes, advance the coordinator job `testing → shipped` (the factory's verify **is** the test phase); `0` = report `testing` and rest for the human review gate |
 | `AQ_FLEET_SHADOW` | `0` | shadow/dual-run: `1` (requires `AQ_FLEET=1` + `AQ_FLEET_ROUTE=0`) queries the coordinator in parallel and records divergence, **never acting on it** |
 | `AQ_FLEET_SHADOW_FACTORY_ID` | `<factory>-shadow` | isolated id used for the read-only shadow claim (never the real factory id) |
 | `AQ_FLEET_SHADOW_LOG` | `.state/fleet-shadow.log` | structured shadow-divergence log (`ts⇥localJob⇥coordJob⇥verdict`) |
@@ -455,6 +471,7 @@ reversible path to validate the fleet coordinator against the proven single-host
 | `AQ_FLEET=0` | **Pure offline.** Zero coordinator calls (including shadow). Offline git-queue path is byte-for-byte unchanged. |
 | `AQ_FLEET_ROUTE=1` (default) | **route_via_service** — the coordinator is *authoritative* for claim/assignment (today's P2-S3 behavior). |
 | `AQ_FLEET_ROUTE=0` | **Local inbox authoritative** — the coordinator is *not* used to source work (the pre-cutover state). |
+| `AQ_FLEET_AUTOSHIP=1` | **Autonomous ship.** On a passing local verify, advance the coordinator job `testing → shipped` (closing the `testing → shipped` gap). Default `0` reports `testing` and leaves the job for the human review gate / `ship` operator action. |
 | `AQ_FLEET_SHADOW=1` | **Shadow / dual-run** (requires `AQ_FLEET=1` **and** `AQ_FLEET_ROUTE=0`): run the offline path as authoritative **and** query the coordinator in parallel, recording divergence **without acting on it**. |
 
 **Precedence.** Shadow is only meaningful when `ROUTE=0`. If both `AQ_FLEET_ROUTE=1`