diff --git a/README.md b/README.md
index 4643a57..42fc2af 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,9 @@ flowchart LR
 
 | Document | What it covers |
 | --- | --- |
+| [Deploy on a new VM (standalone)](docs/deployment/standalone-vm.md) | Step-by-step install on a fresh Linux VM without any PlusClouds service: build, configure, bootstrap, TLS, backups, upgrades |
+| [Usage guide](docs/usage-guide.md) | Monitor websites, servers, network gear and sensors; alerts, webhooks, incidents, metrics |
+| [API guide](docs/api/README.md) | Authentication, errors, pagination, every endpoint, push ingest and webhook event formats |
 | [Design document](docs/monitoring%20server%20design.md) | The full system design: targets, architecture, data model, alerting, API, security, roadmap |
 | [Feature specs](docs/features/README.md) | One spec per sub-feature, with MVP scope, behavior and acceptance criteria |
 | [Architecture decision records](docs/adr/README.md) | Infrastructure and technology decisions, each with options considered and consequences |
diff --git a/deploy/compose/mqtt-cert-hook.sh b/deploy/compose/mqtt-cert-hook.sh
index 0affab7..df264e2 100755
--- a/deploy/compose/mqtt-cert-hook.sh
+++ b/deploy/compose/mqtt-cert-hook.sh
@@ -3,11 +3,15 @@
 # by the container's user (uid 65532). The broker picks up a changed
 # certificate within a minute, without a restart.
 #
-# Once, as root, from deploy/compose:
-#   certbot certonly --standalone -d mqtt.plusclouds.com     # or your DNS plugin
-#   ./mqtt-cert-hook.sh mqtt.plusclouds.com
-# On every renewal:
-#   certbot renew --deploy-hook "/path/to/deploy/compose/mqtt-cert-hook.sh mqtt.plusclouds.com"
+# Once, as root, with the reverse proxy serving /.well-known/acme-challenge/
+# for the name from /var/www/letsencrypt (not --standalone: it needs port 80
+# and fails, or stops the proxy, on renewal):
+#   certbot certonly --webroot -w /var/www/letsencrypt -d mqtt.plusclouds.com \
+#     --deploy-hook "sh /path/to/deploy/compose/mqtt-cert-hook.sh mqtt.plusclouds.com"
+#   sh /path/to/deploy/compose/mqtt-cert-hook.sh mqtt.plusclouds.com
+# certbot's timer then renews and runs the hook by itself. Pass the hook with
+# --deploy-hook as above, not in /etc/letsencrypt/renewal-hooks/deploy/: the
+# script finds ./tls next to itself and needs the certificate name.
 set -eu
 name=${1:?usage: mqtt-cert-hook.sh <certificate name>}
 dir=$(cd "$(dirname "$0")" && pwd)/tls
diff --git a/internal/engine/evaluate.go b/internal/engine/evaluate.go
index c9f6068..43bc1e5 100644
--- a/internal/engine/evaluate.go
+++ b/internal/engine/evaluate.go
@@ -213,7 +213,6 @@ func Evaluate(cfg Config, prev State, in Input) Outcome {
 				if ws.Hits >= threshold.WhoopsyRelearn*max(w.Window, w.Consecutive) && len(ws.Outliers) >= w.Window {
 					ws.Values, ws.Outliers = ws.Outliers, nil
 					ws.Hits, ws.Band = 0, nil
-					outside = false
 				}
 			} else {
 				ws.Outliers = nil