CLAUDE.md: document make stamp page-integrity workflow

CLAUDE.md

@@ -119,3 +119,22 @@ Handshake frame: `[0x5A 0x42 0x01 baud_lo baud_hi xor_cksum]` — 6 bytes at 50
 - stereo (channels=2) required for Battle Toads — open web/index.html, click 'start audio'
 - userland only — survives without root
 - **Operation Voyeur**: all terminal output is public — never pass secrets through these channels unencrypted. The web page does ECDH key exchange + AES-256-GCM before TX.
+
+### Web page integrity stamping
+
+Each deployed page (`web/chat.html`, `web/zebra-audio.html`, `web/how-it-works.html`)
+carries a footer with the build date + its own MD5 + SHA-256. **Run `make stamp`
+before deploying any page change** — it sets today's date and recomputes the
+hashes (`web/stamp.js`).
+
+- A file can't hold its own hash, so the hashes are computed with the two hash
+  fields **zeroed**, then written back (same length). Self-consistent and
+  idempotent: re-running `make stamp` gives identical hashes unless the content
+  changed.
+- The stamp is **static HTML written at build time** — no JavaScript computes or
+  injects it in the browser. `stamp.js` is build tooling, never loaded by a page.
+- **Verify a served page**: blank the md5 field to 32 zeros and the sha256 field
+  to 64 zeros, then re-hash with `sha256sum`/`md5sum` — must match the footer.
+- **Deploy flow**: edit `web/*.html` → `make stamp` → commit here → copy the
+  page(s) into `~/git/www.unturf.com/zebra-report/` (`chat.html` → `index.html`,
+  others same name) → commit + push there.