diff --git a/web/README.md b/web/README.md
index b75b513..7a25a2b 100644
--- a/web/README.md
+++ b/web/README.md
@@ -54,3 +54,44 @@ Pointer Lock (embedded frames / smoke tests).
   fetch and **no COOP/COEP headers**.
 - Active physics bodies are capped and settled debris is despawned, so a long smashing
   session stays bounded (JS GC is the ceiling).
+
+## Deploy (public) — https://digalot.fyi/destroy/
+
+Live on the digalot.fyi VPS (`dealgod`), served exactly like `thriftgod`: a small
+`nginx:alpine` static container on the `dealgod_default` docker network, with a
+`location /destroy/` proxy in the shared reverse proxy. Zero build step — it's the raw
+`web/` folder. LANE5, 2026-07-14.
+
+**Update the live toy** (after committing changes to `web/`), from the monorepo on a
+tailnet machine with `root@dealgod` access:
+```sh
+rsync -az --delete --exclude '.DS_Store' web/ root@100.94.195.115:/opt/destroyulator/web/
+# static files are volume-mounted read-only, so no container restart is needed;
+# hard-refresh past the CF/browser cache. To force-cycle the container:
+ssh root@100.94.195.115 'docker restart destroyulator'
+```
+
+**How it was wired (one-time):**
+1. `rsync web/ → dealgod:/opt/destroyulator/web/`
+2. `docker run -d --name destroyulator --restart unless-stopped --network dealgod_default \`
+   `  -v /opt/destroyulator/web:/usr/share/nginx/html:ro nginx:alpine`
+3. Added to the `digalot.fyi` server block in `/opt/dealgod/nginx/dealgod-servers.conf`:
+   ```nginx
+   location = /destroy { return 301 /destroy/; }
+   location /destroy/ { proxy_pass http://destroyulator/; proxy_set_header Host $host;
+                        proxy_set_header X-Real-IP $remote_addr; proxy_read_timeout 60s; }
+   ```
+   then `docker exec dealgod-nginx nginx -t && docker exec dealgod-nginx nginx -s reload`.
+
+**Rollback (full teardown, no effect on other sites):**
+```sh
+ssh root@100.94.195.115 '
+  cp /opt/dealgod/nginx/dealgod-servers.conf.bak-lane5 /opt/dealgod/nginx/dealgod-servers.conf
+  docker exec dealgod-nginx nginx -s reload
+  docker rm -f destroyulator
+  rm -rf /opt/destroyulator'
+```
+
+The depot (`/3god`) is already hardened — writes require the tailnet-peer allowlist or the
+`3g` auth cookie, `/api/fetch` rejects `file://` + private/metadata hosts, reads stay
+public with CORS `*`. The toy only reads, and the `assets/` mirror covers a depot outage.