1 files changed, 24 insertions, 3 deletions

diff --git a/web/README.md b/web/README.md
index 81346fd..3e81468 100644
--- a/web/README.md
+++ b/web/README.md
@@ -13,6 +13,7 @@ web/
   releases.php   shared scanner and hash cache
   install.sh     stable Linux installer
   install.ps1    stable Windows installer
+  play/          browser app, served at /play/
   bin/gui/       apps, served at /bin/gui/...
   bin/client/    terminal clients
   bin/server/    servers
@@ -20,6 +21,26 @@ web/
 
 Serve `web/` as the document root. Binaries in `bin/` are gitignored.
 
+## Browser app
+
+`play/` is a static vanilla TypeScript app. It talks to the WebSocket gateway
+in `webd/`, not to the game server: the browser sends `Command` JSON and renders
+`View` JSON, and the gateway owns the upstream TLS connection and the pinned
+server key. nginx serves `/play/` and proxies `/ws` to `127.0.0.1:8890`.
+
+Build it before publishing:
+
+```sh
+cd web/play
+npm ci
+npm run build      # writes app.js
+cd ../..
+```
+
+Commit the generated `app.js`; the site then needs no Node at deploy time.
+`npm run typecheck` checks the sources. The gateway has its own deployment
+notes in `webd/README.md`; it is not part of the player download.
+
 ## Naming
 
 The page only lists files that match the release pattern; anything else in
@@ -132,9 +153,9 @@ Then open <http://127.0.0.1:8899/>.
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
 half-written binary, then fetches the live page and every artifact it lists —
 GUI apps, installers, terminal clients and servers — and compares the
-downloaded bytes with the local SHA-256. `--verify-only` skips the
-upload and only checks the live site. Old versions are left on the server;
-prune them by hand.
+downloaded bytes with the local SHA-256. It also fetches `/play/`, `app.js` and
+`style.css`. `--verify-only` skips the upload and only checks the live site.
+Old versions are left on the server; prune them by hand.
 
 A local directory works as a target, which is how the verification itself is
 tested: