diff --git a/stacks/phasefinal-web/cloudflare/README.md b/stacks/phasefinal-web/cloudflare/README.md
new file mode 100644
index 0000000..64cb8a0
--- /dev/null
+++ b/stacks/phasefinal-web/cloudflare/README.md
@@ -0,0 +1,50 @@
+# Cloudflare state for phasefinal.com
+
+Not applied by any script — recorded here so the edge configuration is
+reviewable and reproducible rather than living only in someone's dashboard.
+
+## DNS
+
+| name | type | value | proxied |
+|---|---|---|---|
+| `www.phasefinal.com` | A | `38.120.12.44` | yes |
+| `phasefinal.com` | A | `38.120.12.44` | yes |
+
+`38.120.12.44` is the Anaheim public IP, forwarded to ana-docker's Traefik.
+The apex 301s to `www` via a Traefik middleware, not a Cloudflare rule.
+
+## Cache ruleset
+
+`cache-ruleset.json` is the `http_request_cache_settings` phase entrypoint.
+Applied with:
+
+```bash
+TOK=$(secret get nh3-dev/.config/cloudflare/phasefinal-cache-token)
+curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE/rulesets/phases/http_request_cache_settings/entrypoint" \
+  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' \
+  --data @cache-ruleset.json
+```
+
+**Edge and browser TTL are both `respect_origin` on purpose.** Cache policy is
+declared once, in `../conf/nginx.conf`, which is in git — 300s on the document
+so a dictated edit goes live quickly, a year on the immutable assets. Setting a
+fixed edge TTL here would split that policy across two systems that then have to
+be kept in agreement by memory.
+
+## Zone settings
+
+- **Always Online: on.** This, not the cache TTL, is what actually keeps the
+  site reachable during an origin outage — Cloudflare serves a crawler-archived
+  copy. With a 300s document TTL, caching alone would only mask about five
+  minutes.
+- **Email Address Obfuscation: on** (Cloudflare's default). The contact block
+  depends on it — `inquiry@phasefinal.com` is written as a plain `mailto:` in
+  the markup and rewritten at the edge. Do not hand-obfuscate it in the HTML;
+  that interferes.
+
+## Token
+
+`nh3-dev/.config/cloudflare/phasefinal-cache-token` in the vault. Scoped to this
+zone. Note it is an **account-scoped** token, so `/user/tokens/verify` reports
+"Invalid API Token" while `/accounts/<id>/tokens/verify` reports `active` —
+check the account endpoint, not the user one.
diff --git a/stacks/phasefinal-web/cloudflare/cache-ruleset.json b/stacks/phasefinal-web/cloudflare/cache-ruleset.json
new file mode 100644
index 0000000..a38c4d8
--- /dev/null
+++ b/stacks/phasefinal-web/cloudflare/cache-ruleset.json
@@ -0,0 +1,14 @@
+{
+  "rules": [
+    {
+      "expression": "(http.host eq \"www.phasefinal.com\")",
+      "action": "set_cache_settings",
+      "action_parameters": {
+        "cache": true,
+        "edge_ttl":    { "mode": "respect_origin" },
+        "browser_ttl": { "mode": "respect_origin" }
+      },
+      "description": "PFI site: cache eligible, honour origin Cache-Control (policy lives in stacks/phasefinal-web/conf/nginx.conf)"
+    }
+  ]
+}