diff --git a/deploy/README.md b/deploy/README.md
index e2ae741..388f973 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -3,9 +3,10 @@
 This replaces the `news-backend` service (from `../news_triage`) in place: same
 host, same vhost, same ntfy topic.
 
-## 1. Compose
+## 1. Compose — APPLIED 2026-09-08
 
-Replace the `news-backend` block in `~/compose.yml`:
+The `news-backend` block in `~/compose.yml` now reads (snapshot of the previous
+file: `~/compose.yml.pre-news-v2`):
 
 ```yaml
   news-backend:
@@ -47,7 +48,16 @@ Replace the `news-backend` block in `~/compose.yml`:
       start_period: 20s
 ```
 
-Copy `profile/*.toml` to `~/config/news2/`. A bind-mounted config edit needs
+The image is tagged `localhost/news-py:latest` rather than reusing
+`git.rcjohnstone.com/connor/news:latest`, so the Rust image stays on disk as the
+rollback path; the old database at `./data/news/db` is likewise untouched.
+Rolling back is a two-line edit plus `podman-compose up -d news-backend`.
+
+Config lives in `~/config/news2/` (copied from `profile/*.toml`).
+
+The `caddy` service still bind-mounts `./data/news/web:/srv/news:ro`, which is
+now unused since the Caddyfile no longer serves a static SPA. Harmless; remove
+it whenever the compose file is next touched. A bind-mounted config edit needs
 `sudo podman restart news-backend`; `podman-compose up -d` will not restart a
 container when only a mounted file changed. An **environment** change does need
 the full `up -d`.
@@ -106,11 +116,13 @@ that populated it should be disabled:
 sudo systemctl disable --now news-update.timer
 ```
 
-**Current state:** the vhost is public and correctly gated, but `news-backend`
-is still the old Rust service, which no longer has its SPA served by Caddy. So
-`https://news.rcjohnstone.com/` is a 404 behind the login until the compose
-service is switched to this image. Notifications from the old service are
-unaffected.
+**Verified after the swap**, from the public internet rather than the LAN:
+
+| request | result | meaning |
+|---|---|---|
+| `GET /` | 403 (Authelia) | browser paths are gated |
+| `POST /api/feedback/.../bogus` | `{"error":"bad signature"}` | reaches the app, unauthenticated, and rejects a forgery |
+| `POST /api/feedback/.../<valid HMAC>` | `{"ok":true}` and a row in `feedback` | **the loop that never once worked in v0.2** |
 
 ## 3. Scheduling