diff --git a/docs/operations.md b/docs/operations.md
index 9668c3b..3dfc488 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -35,6 +35,25 @@ curl -s https://vibescrobble.com/release.txt
 tofu -chdir=infra output -raw release_sha
 ```
 
+## Check a deploy
+
+`scripts/verify-deploy.sh` compares the site after a deploy with a baseline
+taken before it. Run `before` ahead of `scripts/deploy.sh`, and `after` once
+it exits, with the same AWS credentials:
+
+```sh
+scripts/verify-deploy.sh before
+scripts/deploy.sh <commit>
+scripts/verify-deploy.sh after --sha <commit>
+```
+
+`after` exits non-zero and names each check that failed. Its header lists
+the checks and the flag for each threshold. A day or week burn that fell is
+not a failure when that account's scrobbles aged out of the window between
+the two runs. The warning baseline covers only the running containers' logs,
+so a deploy that restarted them shortly before leaves it thin. Nothing it
+does writes; it reads the logs over SSM through `scripts/ssm-run.py`.
+
 ## Roll back
 
 A rollback is a deploy of an earlier commit.