--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@
 
 The interface targets 320–600 CSS-pixel portrait widths and short landscape. It includes safe-area/cutout handling, 48 CSS-pixel minimum controls, visible focus, modal focus lifecycle, logical headings, restrained live regions, 200% text support, Android large-text resilience and reduced-motion alternatives. Android Back closes overlays before route navigation and avoids history loops.
 
-Headless Chromium provides deterministic Android-oriented evidence. Physical Android Chrome, Samsung Internet, TalkBack, live LiteSpeed and live Together provider acceptance remain explicitly external checks until run on the target environment.
+The packaged interface includes Android-oriented layout, safe-area, focus and reduced-motion safeguards. Browser automation was not completed in the packaging environment. Physical Android Chrome, Samsung Internet, TalkBack, live LiteSpeed and live Together provider acceptance remain explicitly external checks until run on the target environment.
 
 ## 9. Direct installation
 
@@ -112,31 +112,23 @@
 
 ## 10. Source and verification
 
-This is a deployment-only release. The matching React source repository, package files, lockfile, feature-lock files, automated test suites and deterministic build scripts are not included and cannot be reconstructed from this package.
+This is a server-direct-deploy release. The matching React source repository, package files, lockfile, feature-lock files, automated test suites and deterministic build scripts are not included and cannot be reconstructed from this package.
 
-The supplied historical verification report is retained in `../documentation/VERIFICATION_REPORT.txt`, but its original source-level claims must be reproduced from the matching complete-source release before production approval. V2.2.1 validation performed directly on this package is recorded in the timestamped `CHANGES_hhmmddmmyyyy.txt` file and `../documentation/RELEASE_HARDENING_REPORT_22072026125600.txt`.
+The source-level claims from earlier development reports must be reproduced from the matching complete-source release before production approval. Validation performed directly on deployable packages is recorded in the timestamped `CHANGES_hhmmddmmyyyy.txt` reports at this archive root. Those reports distinguish completed checks from live-host, provider, browser and physical-device checks that were not run.
 
-## 11. Documentation set
+## 11. Direct-deploy package layout
 
-- `../documentation/DOCUMENTATION_INDEX_22072026124256.md`
-- `../documentation/INSTALLATION_AND_ACCEPTANCE_GUIDE_22072026124256.md`
-- `../documentation/USER_GUIDE_22072026124256.md`
-- `../documentation/ADMIN_OPERATIONS_GUIDE_22072026124256.md`
-- `../documentation/RELEASE_NOTES_22072026124256.md`
-- `../documentation/ROUTE_TO_UI_MATRIX.md`
+This archive is intentionally flat: `.htaccess`, `index.html`, `index.php`, `assets/`, `server/`, `storage/` and the remaining application files are at the ZIP root. Extract the archive directly into the intended HTTPS web directory. There is no `app/` wrapper to copy from and no public `documentation/` directory.
 
-The documented distribution bundle keeps the deployable application under `app/` and the human-readable documentation under `documentation/`. Upload only the contents of `app/` to the public web root.
+A separate app-and-documentation distribution may contain operator and user guides outside the deployable application tree. Those companion documents are not included in this server-direct-deploy archive and are not required at runtime.
 
-## 12. Release evidence
+## 12. Included release evidence
 
-Included evidence:
+- `DEPLOYMENT_MANIFEST.json` — final deployment-file sizes and SHA-256 hashes.
+- `sbom.cdx.json` — CycloneDX file inventory and third-party component metadata.
+- `THIRD_PARTY_NOTICES_22072026125600.txt` — retained licence notices.
+- `CHANGES_hhmmddmmyyyy.txt` — timestamped unified diffs and evidence-based verification results. These files are blocked from HTTP access by `.htaccess`.
 
-- `../documentation/FEATURE_AND_FUNCTION_MAP.txt`
-- `../documentation/VERIFICATION_REPORT.txt` — historical supplied evidence, explicitly not a production approval.
-- `../documentation/UI_UX_REMEDIATION_REPORT.txt`
-- `../documentation/RELEASE_HARDENING_REPORT_22072026125600.txt`
-- `CHANGES_hhmmddmmyyyy.txt` — actual timestamped task diff and verification results.
-
-Not included in this deployment bundle: the feature lock, source repository, package lockfile, automated tests, source build evidence, screenshots and handover-controller outputs referenced by the original V2.2.0 documentation.
+Not included: the feature lock, source repository, package lockfile, automated test suites, source build evidence, screenshots, historical companion reports and physical-device evidence.
 
 Verification classifications are `Passed`, `Failed`, `Not run` or `Not applicable`. Missing tools, source files, external systems and physical devices are never represented as a pass.
--- a/sbom.cdx.json
+++ b/sbom.cdx.json
@@ -4,7 +4,7 @@
   "serialNumber": "urn:uuid:1cfe87b5-295e-4657-bdb0-d9cb74dea671",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-22T13:33:35Z",
+    "timestamp": "2026-07-22T15:39:32Z",
     "component": {
       "type": "application",
       "name": "GLMChat",
@@ -50,7 +50,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "033f1b24cd2f0ad288a8a1ac7e24ec375d6b41fc1af7145a61d77a54be8f3e10"
+          "content": "5fad274136768c3a4ac045f5d9558b058d0eb8920cedfa48c69d6529ed254408"
         }
       ],
       "properties": [
--- a/DEPLOYMENT_MANIFEST.json
+++ b/DEPLOYMENT_MANIFEST.json
@@ -7,8 +7,8 @@
       "size": 4484
     },
     "README.md": {
-      "sha256": "033f1b24cd2f0ad288a8a1ac7e24ec375d6b41fc1af7145a61d77a54be8f3e10",
-      "size": 10706
+      "sha256": "5fad274136768c3a4ac045f5d9558b058d0eb8920cedfa48c69d6529ed254408",
+      "size": 10807
     },
     "THIRD_PARTY_NOTICES_22072026125600.txt": {
       "sha256": "b246d42f66d4020d6371f52080557dacd6fbd9ae08c9940a3074c0b71b535a04",
@@ -87,7 +87,7 @@
       "size": 534
     },
     "sbom.cdx.json": {
-      "sha256": "5d198709520a7ae7ca4428e53306a3a12c2ac84e9f7bb86fc38ccd3c4e312c34",
+      "sha256": "ccab7e961b4e517f64e3e2c8db52612fdcd7f930b777daa5ad913d5d995b7523",
       "size": 34930
     },
     "server/.htaccess": {
# TASK VERIFICATION
# Requested task: Set up a suitable local environment, continue autonomous verification, correct the server-direct-deploy documentation mismatch, and prepare an updated extraction-ready package.
# Scope matched: Yes
# Build: Not run
# Type-check: Not run
# Lint: Passed
# Automated tests: Not run
# Targeted checks: Passed
# PWA checks: Passed
# Feature loss detected: No
# Data loss detected: No
# Structural changes detected: No
# Regressions detected: No
# Unrelated changes reverted: Validation-created storage/logs and storage/projects directories and app.log were removed; original storage permissions were restored before packaging.
# Checks not run: The source build, source-level type-check and original automated suites were unavailable because this is a deployment-only bundle without package files, source or tests. The successful PHP/SQLite/cURL/ZIP backend path could not run because the container lacks sqlite3, curl, mbstring and zip PHP extensions. Live LiteSpeed, Together text/vision/tools/TTS, browser automation and physical Android/TalkBack checks were not run.
# Validation notes: The untouched archive baseline was captured before changes. Only README.md, sbom.cdx.json and DEPLOYMENT_MANIFEST.json changed; all runtime source, routes, migrations, service-worker files, assets, configuration and storage schema remained byte-for-byte unchanged. PHP syntax passed for 44 files and JavaScript syntax passed for 7 files. A further 281 structural, manifest, SBOM, HTML, PWA, offline-security, route-coverage, secret-scan and SQLite checks passed. All 13 migrations passed fresh install, repeated migration 013 and 12-to-13 upgrade integrity and foreign-key checks. Apache-compatible root and nested-subdirectory acceptance passed for shell/history routes, protected-path denials, cache headers and controlled API preflight. Insecure HTTP was rejected with 403. /api/status returned the expected secret-free 503 ENVIRONMENT_INVALID response listing only the four unavailable PHP extensions.
