--- a/hg-web/README.md	Sun Aug 02 08:34:54 2026 -0700
+++ b/hg-web/README.md	Sun Aug 02 09:01:24 2026 -0700
@@ -111,6 +111,13 @@
   -> ApiGetGraph
   -> GET hg-serve/graph/<revision>?...
   -> React rows + custom pencil/panda canvas
+
+graph row selection
+  -> /changeset/<revision>
+  -> GET /api/changeset/<revision>
+  -> ApiGetChangeset
+  -> GET hg-serve/json-rev/<revision>
+  -> changeset metadata + rendered diff
 ```
 
 ### Mercurial clone, pull, and push
@@ -129,11 +136,14 @@
 | --- | --- | --- | --- |
 | `GET` | `/` | `GetReactHome` | Application shell |
 | `GET` | `/directories` | `GetReactHome` | Legacy application-shell route |
+| `GET` | `/directory` | `GetReactHome` | Repository browser application route |
 | `GET` | `/graph` | `GetReactHome` | Commit graph application route |
+| `GET` | `/changeset/:changeset_id` | `GetReactHome` | Changeset application route |
 | `GET` | `/api/repo/list` | `ApiListDirectory` | Directory listing JSON |
 | `GET` | `/api/repo/file` | `ApiGetFile` | Raw tracked file |
-| `GET` | `/api/repo/readme` | `ApiGetReadme` | Alias of the raw-file handler |
+| `GET` | `/api/repo/readme` | `ApiGetReadme` | Directory README content |
 | `GET` | `/api/graph/:graph_id` | `ApiGetGraph` | Mercurial graph JSON |
+| `GET` | `/api/changeset/:changeset_id` | `ApiGetChangeset` | Changeset metadata and diff JSON |
 | `GET`, `POST` | `/repo` | `StreamHgWireProtocol` | Mercurial wire protocol |
 
 ## Frontend ownership
@@ -159,6 +169,8 @@
 ```bash
 bazel build //hg-web:hg_web_server
 bazel build //hg-web:hg_web_server_bundle
+bazel test //markdown_converter/tests:markdown_to_html_test
+bazel test //seobeo/tests:all
 ```
 
 Run the Mercurial backend:
@@ -189,9 +201,12 @@
   -> hg serve service on 127.0.0.1:4444
 ```
 
-`deploy.sh` currently builds an optimized bundle, copies it to `/opt`, swaps
-the active directory, changes ownership to `hg_web_server:zenbu_team`, and
-restarts `hg_web_server.service`.
+`deploy.sh` builds an optimized bundle into a revisioned release directory,
+atomically repoints `/opt/hg_web_server_bundle_active`, restarts
+`hg_web_server.service`, and checks `http://127.0.0.1:6970/`. A failed restart
+or health check restores the previous release and restarts it. The service,
+release root, active path, health URL, user, and group can be overridden with
+environment variables.
 
 ## Forge capability tree
 
@@ -202,7 +217,7 @@
 │   ├── Syntax highlighting                    available
 │   ├── README rendering                       available
 │   ├── Commit graph                           available
-│   ├── Changeset detail and diff              planned
+│   ├── Changeset detail and diff              available
 │   ├── Branches, bookmarks, and tags          planned
 │   ├── File history and blame                 planned
 │   └── Search                                 planned
@@ -218,7 +233,7 @@
     ├── Live logs and job status API           planned
     ├── Forge status and log screens           planned
     ├── Artifact retention                     planned
-    └── Atomic deploy, health check, rollback  planned
+    └── Atomic deploy, health check, rollback  available
 ```
 
 ## Automation data flow
@@ -245,12 +260,10 @@
 
 ## Safe extension order
 
-1. Harden proxy errors, path validation, response headers, and timeouts.
-2. Add changeset detail and diff APIs, then wire graph clicks to those screens.
-3. Make deployment atomic with health checks and rollback.
-4. Add the hook, SQLite queue, single runner, and retained logs.
-5. Add run/status/log pages using the existing custom UI.
-6. Add authentication and authorization before accepting public pushes or
+1. Add branches, bookmarks, tags, file history, blame, and search.
+2. Add the hook, SQLite queue, single runner, and retained logs.
+3. Add run/status/log pages using the existing custom UI.
+4. Add authentication and authorization before accepting public pushes or
    user-defined automation.
 
 ## Invariants