diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 242c33f..db4db65 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `972d562f8c7e4b9bba896477879a598fffcf6cb3`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `2c0a6c36d1a4303d927a453d98462924183c126d`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 626ec00..0add48e 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "972d562f8c7e4b9bba896477879a598fffcf6cb3",
+  "sourceRevision": "2c0a6c36d1a4303d927a453d98462924183c126d",
   "files": [
     {
       "path": ".gitattributes",
@@ -64,8 +64,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "cf1559c01c61e69d98d2de9554f042d7e940245bfbb7dc58924576c1009b0aab",
-      "bytes": 5699
+      "sha256": "1e801325bd4edc53573600a0678284d1a776490db99333a5868f083242e69531",
+      "bytes": 6555
     },
     {
       "path": "SECURITY.md",
diff --git a/README.md b/README.md
index 6ece235..76ace49 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,12 @@ ForgeFlow is a Windows desktop application for teams that use Git, Gitea and sel
 
 *The captures use example repositories and demo state; they are not a live infrastructure dashboard.*
 
+### Inspect repository policy
+
+![Git Validator with demo policy findings](docs/screenshots/git-validator.png)
+
+*The demo Git Validator separates findings and recommendations from deployment revision evidence. A policy score is not a runtime health check.*
+
 ## Key capabilities
 
 | Area | What ForgeFlow helps you do |
@@ -71,6 +77,15 @@ For server-pull deployments, the host fetches the **exact approved commit** with
 
 Start with the [setup guide](docs/SETUP_GUIDE.md), [deployment setup](docs/DEPLOYMENT_SETUP.md), [SSH and Unraid deployment](docs/SSH_UNRAID_DEPLOYMENT.md), and [migration example](docs/DEPLOYMENT_MIGRATION_EXAMPLE.md). Keep runtime data and credentials outside Git. The [diagnostics guide](docs/DIAGNOSTICS.md) explains safe support bundles.
 
+## Your first repository session
+
+1. Configure the Gitea account and select a local checkout you are authorized to manage.
+2. Review the branch, working-tree changes and remote state before staging a commit.
+3. Inspect the proposed diff, commit deliberately and verify the push result.
+4. Configure a deployment target only when you need deployment; review its exact revision and confirmation before starting it.
+
+Repository state, CI validation, deployment acceptance and runtime verification are separate evidence. A completed push is not proof that the application is running the same revision.
+
 ## Develop and verify
 
 ```powershell