1 files changed, 26 insertions, 2 deletions

diff --git a/web/README.md b/web/README.md
index 5de180d..a82c492 100644
--- a/web/README.md
+++ b/web/README.md
@@ -58,10 +58,34 @@ php -S 127.0.0.1:8899 -t web
 
 Then open <http://127.0.0.1:8899/>.
 
+## Deploying
+
+```sh
+./scripts/publish.sh
+./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
+```
+
+`deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
+half-written binary, then fetches the live page and every artifact it lists and
+compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+upload and only checks the live site. Old versions are left on the server;
+prune them by hand.
+
+A local directory works as a target, which is how the verification itself is
+tested:
+
+```sh
+php -S 127.0.0.1:8899 -t /srv/staging
+./scripts/deploy.sh /srv/staging http://127.0.0.1:8899/
+```
+
 ## Notes
 
-- Hashes are computed per request with `hash_file()`. That is fine for a
-  handful of builds; add an mtime-keyed cache if the directory grows.
+- Hashes are cached in a JSON file keyed on size and mtime, so a file is only
+  read once until it changes. The cache lives in the system temp directory by
+  default because the web root is often not writable by the PHP user; set
+  `ZAGAN_HASH_CACHE` to put it elsewhere. If the cache cannot be written, the
+  page simply hashes every request.
 - The page lists every build it finds, newest version first, so old releases
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as