diff --git a/.gitea/tests/test_rc_acceptance_policy.py b/.gitea/tests/test_rc_acceptance_policy.py
index 1aca4ff..a463174 100644
--- a/.gitea/tests/test_rc_acceptance_policy.py
+++ b/.gitea/tests/test_rc_acceptance_policy.py
@@ -107,7 +107,7 @@ class RcAcceptancePolicyTests(unittest.TestCase):
             "sentencepiece==0.2.2",
             "sentence-transformers==6.0.1",
             "transformers==5.16.1",
-            "urllib3==2.7.0",
+            "urllib3==2.8.0",
         ):
             self.assertIn(dependency, self.runtime_pyproject)
         self.assertNotIn("'filelock==3.20.3'", self.runtime_dockerfile)
diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 25d75ea..5bc0022 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,5 +1,5 @@
 # Curated public source export
 
-Generated from private canonical revision `990401737f96c8d46a9f7b0d84994516cadcb6a0`.
+Generated from private canonical revision `f3a9c1baac428adb5969ebb5c87a6ec1aab97504`.
 
 This parentless candidate excludes private operational history and uses synthetic example identifiers.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 0ad3f93..81a7003 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "990401737f96c8d46a9f7b0d84994516cadcb6a0",
+  "sourceRevision": "f3a9c1baac428adb5969ebb5c87a6ec1aab97504",
   "sourceRepository": "https://git.example.com/example/modelforge",
   "files": [
     {
@@ -31,7 +31,7 @@
     {
       "path": ".gitea/tests/test_rc_acceptance_policy.py",
       "bytes": 20587,
-      "sha256": "f429a897dd7c583c954222178533b592d5559647d040ff5c21d97128e9fde1f8"
+      "sha256": "e12172de847e62369cad9af6bb0620e2350f456f33c43dfda1e2b92c13444ec6"
     },
     {
       "path": ".gitea/tests/test_rc_isolation_preflight.py",
@@ -1726,7 +1726,7 @@
     {
       "path": "config/security/pip-audit-toolchain.lock",
       "bytes": 3239,
-      "sha256": "1e0dbd2142ff0bcbc7e36f4e6586e0979f251f6849d92eedcdccc1c07fe15258"
+      "sha256": "f13fb15feea50890f70e291b34653ff1ae118a6a1c9f3a296bef082ddbab65b1"
     },
     {
       "path": "CONTRIBUTING.md",
@@ -3570,8 +3570,8 @@
     },
     {
       "path": "README.md",
-      "bytes": 7383,
-      "sha256": "4c59c74659ade42f194b16ec8d9db7849e12e42c4cc29729af3b90657c104f94"
+      "bytes": 8154,
+      "sha256": "113a198c36138458fcd0ad2e07274f90b2c3de6d7b3dc3c22dbd5c6d02f20441"
     },
     {
       "path": "runtime-worker/Dockerfile",
@@ -3581,7 +3581,7 @@
     {
       "path": "runtime-worker/pyproject.toml",
       "bytes": 2319,
-      "sha256": "4eb4ff6b1568d46e66b6f4b4dfdd18a7d2aecae2c612689ab777b4d5c931b581"
+      "sha256": "d680b58e07e2a4d8aad193627110a1ddc7d08592b9de6f5571ef87b5ef537de4"
     },
     {
       "path": "runtime-worker/src/modelforge_runtime_worker/__init__.py",
diff --git a/README.md b/README.md
index 2c8ebcb..d6fed01 100644
--- a/README.md
+++ b/README.md
@@ -134,6 +134,17 @@ docs/             User, architecture, operations and security documentation
 scripts/          Preflight, bootstrap, release and recovery tools
 ```
 
+## Diagnose readiness before invoking a model
+
+| Symptom | Check first |
+| --- | --- |
+| Console opens but a capability is unavailable | Approved artifact revision, capability binding and runtime readiness. |
+| A node is visible but cannot host the model | Hardware inventory, placement requirements and available capacity. |
+| Invocation is denied | Caller credentials and the granted capability scope. |
+| A replacement model is not promoted | Required validation evidence and the promotion/canary decision. |
+
+Keep a working revision available for rollback. A downloaded weight file, a registered node or an accessible console alone does not establish a qualified serving route. Check the model's own license and resource requirements before acquiring its artifacts.
+
 ## Development
 
 Each component keeps its own pinned dependencies and tests. The protected-branch validation installs
diff --git a/config/security/pip-audit-toolchain.lock b/config/security/pip-audit-toolchain.lock
index 2e5ee71..8d1a675 100644
--- a/config/security/pip-audit-toolchain.lock
+++ b/config/security/pip-audit-toolchain.lock
@@ -31,4 +31,4 @@ sortedcontainers==2.4.0 --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897
 tomli==2.4.1 --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5
 tomli-w==1.2.0 --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90
 typing-extensions==4.16.0 --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
-urllib3==2.7.0 --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+urllib3==2.8.0 --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3
diff --git a/runtime-worker/pyproject.toml b/runtime-worker/pyproject.toml
index 086b050..637b372 100644
--- a/runtime-worker/pyproject.toml
+++ b/runtime-worker/pyproject.toml
@@ -42,7 +42,7 @@ inference = [
   "setuptools==84.0.0",
   "soupsieve==2.9.2",
   "transformers==5.16.1",
-  "urllib3==2.7.0",
+  "urllib3==2.8.0",
   "wheel==0.48.0",
 ]
 dev = [