--- a/hg-web/README.md	Tue Aug 04 02:44:06 2026 -0700
+++ b/hg-web/README.md	Tue Aug 04 04:16:45 2026 -0700
@@ -193,10 +193,12 @@
 ```
 
 This starts `hg serve` on `127.0.0.1:4444` and `hg_web_server` on port `6970`.
-Stopping the Bazel target stops both child processes.
+The `hg serve` process comes from `//third_party/mercurial:runtime` and points at
+the current workspace. Stopping the Bazel target stops both child processes.
 
-The bundle contains `hg_web_server` and `hg-web/src/`, including generated
-`page.js`, markdown WASM, highlight.js, styles, and image assets.
+The bundle contains `hg_web_server`, `hg-web/run_hg_web`, a pinned pure-Python
+Mercurial runtime, and `hg-web/src/`, including generated `page.js`, markdown
+WASM, highlight.js, styles, and image assets.
 
 ## Deployment contract
 
@@ -205,17 +207,52 @@
 ```text
 nginx
   -> hg_web_server.service
-     -> /opt/hg_web_server_bundle_active/hg_web_server
-     -> working directory: /opt/hg_web_server_bundle_active
-  -> hg serve service on 127.0.0.1:4444
+     -> /opt/hg_web_server/active/hg-web/run_hg_web
+        -> bundled Mercurial 7.2.3 serves
+           /opt/hg_web_server/repository on 127.0.0.1:4444
+        -> hg_web_server serves the forge on 127.0.0.1:6970
 ```
 
-`deploy.sh` builds an optimized bundle into a revisioned release directory,
-atomically repoints `/opt/hg_web_server_bundle_active`, restarts
-`hg_web_server.service`, and checks `http://127.0.0.1:6970/`. A failed restart
-or health check restores the previous release and restarts it. The service,
-release root, active path, health URL, user, and group can be overridden with
-environment variables.
+`deploy.sh` follows the same new/active bundle swap as the personal site. It
+builds the optimized bundle and maintains a canonical repository outside the
+release directories. The first deploy creates it with a locking-aware local
+clone. Later deploys create a Mercurial bundle from the workspace and pull that
+bundle into the persistent repository, preserving any commits pushed directly
+to production. The script verifies the repository, installs the systemd unit,
+swaps the active directory, restarts the combined service, and checks
+`http://127.0.0.1:6970/`. A failed restart restores the previous active
+directory.
+
+There is no separate production `hg serve` service and no dependency on the
+host's `hg` command. The pinned Mercurial wheel requires CPython 3.11. The
+systemd unit uses `KillMode=control-group`, so both the Mercurial and C child
+processes stop together.
+
+On its first run, deploy also installs `/etc/nginx/sites-available/hg-web` when
+Nginx uses Debian-style `sites-available`/`sites-enabled` directories. Existing
+site files are left untouched.
+
+```bash
+NGINX_SERVER_NAME=zenbu.babocoder.com bazel run //hg-web:deploy
+```
+
+The checked-in template listens on origin HTTP port 80, which works when TLS is
+terminated upstream. For direct origin TLS, provide a complete certificate-aware
+template:
+
+```bash
+NGINX_SITE_TEMPLATE=/etc/nginx/templates/hg-web-tls.conf \
+  bazel run //hg-web:deploy
+```
+
+Set `MANAGE_NGINX=false` to leave Nginx untouched. `NGINX_SITE_NAME`,
+`NGINX_SITE_AVAILABLE`, and `NGINX_SITE_ENABLED` can override the destination
+names and paths. `DEPLOY_ROOT` controls the validated deployment root;
+`REPOSITORY_PATH` can override the persistent canonical repository within it.
+
+Pushes are disabled by default. `HG_ALLOW_PUSH=true` enables unauthenticated
+pushes in the internal `hg serve`; only use it when `/repo` is protected by
+Nginx authentication or another trusted access layer.
 
 ## Publishing