The x-apple.systempreferences deep link lands System Settings on the
right pane, so the install click is the only manual step left.

Assisted-by: GLM 5.2 via pi

diff --git a/Rakefile b/Rakefile
index 4154d3f..053ad80 100644
--- a/Rakefile
+++ b/Rakefile
@@ -33,9 +33,10 @@ file "carddav.mobileconfig" => "lib/pro_tacts/profile.rb" do |task|
 end
 
 namespace :profile do
-  desc "Stage the configuration profile for install; approve it in System Settings → Profiles"
+  desc "Stage the configuration profile and open Settings → Profiles; click Install there"
   task install: "carddav.mobileconfig" do |task|
     sh "open", task.prerequisites.first
+    sh "open", "x-apple.systempreferences:com.apple.preferences.configurationprofiles"
   end
 
   desc "Remove the configuration profile (sudo); if the CLI refuses, remove it in System Settings → Profiles"
diff --git a/docs/macos-contacts.md b/docs/macos-contacts.md
index ebc8235..a65cc1c 100644
--- a/docs/macos-contacts.md
+++ b/docs/macos-contacts.md
@@ -27,12 +27,13 @@ refusing a redirect) that never reach the server at all.
 ## The account setup path
 
 The fastest path is a configuration profile: `rake profile:install` (with
-`PRO_TACTS_HOSTNAME` set) renders `carddav.mobileconfig` and opens it —
-the profiles CLI no longer supports installs, so the profile lands in
-System Settings → Profiles as pending until you click Install. That click
-is the whole manual step. `rake profile:remove` still tries
-`sudo profiles remove`; if the CLI refuses that too, remove it in the same
-Settings pane.
+`PRO_TACTS_HOSTNAME` set) renders `carddav.mobileconfig`, opens it, and
+opens System Settings on the Profiles pane (via the
+`x-apple.systempreferences:` deep link) — the profiles CLI no longer
+supports installs, so the profile lands there as pending until you click
+Install. That click is the whole manual step. `rake profile:remove` still
+tries `sudo profiles remove`; if the CLI refuses that too, remove it in the
+same Settings pane.
 
 The profile carries the hostname, fixed dev credentials, and SSL —
 `CardDAVPrincipalURL` is deliberately omitted so the
@@ -104,6 +105,17 @@ property on the address book collection. Without it, the client completes
 discovery and then never requests a single vCard, which presents as an
 account that connects successfully and stays empty.
 
+## The collection must claim to be an address book
+
+Discovery is not the only gate. After it, the client sends a `Depth: 1`
+`PROPFIND` against the address book asking a long list of properties
+(`resourcetype`, `supported-report-set`, `sync-token`, quotas, push — see
+fixture `09-propfind-addressbook-bootstrap`). If the answer carries `getctag`
+and `sync-token` but the collection's `resourcetype` does not include
+`card:addressbook`, the client retries the `PROPFIND` once and then stops —
+no `REPORT`, no card requests, an empty account. Verified by minimization
+rounds 1–2 on 2026-08-17.
+
 ## One address book per account
 
 Through at least macOS 10.10, Contacts binds one address book per account