diff --git a/README.md b/README.md
index a751797..007dae3 100644
--- a/README.md
+++ b/README.md
@@ -23,19 +23,34 @@ Apple Watch  --HTTPS-->  gateway  --WebSocket-->  T3 Code server (one per enviro
 - `docs/` holds the design notes and the T3 Code protocol reference.
 - `mocks/` holds static UI mocks of the watch screens.
 
-## Auth
+## Running the gateway
 
-The gateway signs in to each T3 Code server with a scoped bearer session, limited to reading and
-driving threads:
+The gateway is one container with one SQLite file in `/data`. [`deploy/compose.yml`](deploy/compose.yml)
+is the stack on server-gib, and [`gateway/Containerfile`](gateway/Containerfile) builds the image.
+CI builds and deploys every push to `main` that touches `gateway/`.
+
+Operators use the `wristcode` CLI inside the container:
 
 ```sh
-t3 auth session issue \
-  --scope orchestration:read --scope orchestration:operate \
-  --ttl 30d --label "WristCode gateway" --token-only
+# Connect a T3 Code server. Make the one-time credential on that server first:
+t3 auth pairing create --scope orchestration:read --scope orchestration:operate --label "WristCode gateway"
+docker exec -it wristcode-gateway wristcode host add https://t3mac.gbrown.org <credential> --label "Mac mini"
+
+# Pair a watch: enter the printed code on the watch within 5 minutes.
+docker exec -it wristcode-gateway wristcode pair
+
+docker exec -it wristcode-gateway wristcode host list
+docker exec -it wristcode-gateway wristcode device list
+docker exec -it wristcode-gateway wristcode device revoke <id or name>
 ```
 
-The watch pairs with the gateway once by entering a short code, and keeps the device token it gets
-back in its Keychain.
+The gateway exchanges the credential for a 30 day T3 session limited to reading and driving
+threads, so the long-lived token never leaves the gateway. T3 sessions cannot be refreshed. A week
+before one expires, the watch gets a notification, and running `host add` again with a fresh
+credential renews it.
+
+For local development, run `bun --watch src/main.ts` in `gateway/` with `WRISTCODE_DB` pointing at
+a scratch file. Without APNs settings, pushes are logged instead of sent.
 
 ## License