diff --git a/README.md b/README.md
index cac2843f67..1117e6f2ef 100644
--- a/README.md
+++ b/README.md
@@ -13,16 +13,37 @@ preserved upstream boundary.
 
 ## Current release
 
-The source tree prepares `v0.183.330`, a narrowly scoped imported-container
+The published release `v0.183.330` is a narrowly scoped imported-container
 name refresh. A ping's UUID/name hint is never written as the authoritative
 name: the Engine inspects the exact full Docker ID through its existing Agent
 contract, and performs a name-only compare-and-swap on an eligible existing
 native container. Managed service/stack names and lifecycle processing are
 unchanged. See the [330 release note](docs/releases/orchestration-engine-0.183.330.md).
-The focused offline checks have passed; a published WAR, consuming Server
-image, and real-host/browser name-refresh acceptance are still required.
+The official numeric [release](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.330)
+uses a signed annotated tag pointing to exact CI source
+`3f7320a8063a5471618be5b8be6a168f49559847`.
+[PR #68](https://github.com/PastureStack/orchestration-engine/pull/68) was normally
+squash-merged as `b76ddcc5c24a7683ffe05fba26707b71b3b313eb`; its tree is identical
+to the CI source, and the immutable release tag remains on the CI source.
+The exact WAR is `87,700,053` bytes with SHA-256
+`c01cbbfd63625fc09f39c5494775919aad6db22c92050b217b28b940b57e1de3`.
+[Build/security run `36966573025`](https://github.com/PastureStack/orchestration-engine/actions/runs/36966573025)
+passed 268 suites / 1,141 tests with zero failures, errors or skips, including
+19 native-name cases and six retained GenericObject cases. Artifact and
+build-image Critical/High findings are zero; the
+[CodeQL run `36966573050`](https://github.com/PastureStack/orchestration-engine/actions/runs/36966573050)
+retains four lower-severity findings, not an all-findings-zero claim.
+Six exact CI assets are published. Anonymous content readback checked the
+checksum, source revision and unit-test results; the public WAR was not
+downloaded again. The exact CI WAR completed isolated JDK `25.0.3` / H2 startup
+and exited 0, with no network, exposed ports or platform-data mounts. Consuming
+Server image, real MariaDB concurrency and real-host/browser name-refresh
+acceptance remain separate requirements; this does not establish the complete
+resource/role matrix.
+
+## Historical 0.183.329 release
 
-The current published release is `v0.183.329`. It closes a low-role GenericObject
+The previous published release is `v0.183.329`. It closes a low-role GenericObject
 read bypass for plugin capabilities in both v2-beta and the frozen v1 schemas.
 Readonly/restricted clients retain resource metadata; plugin configuration is
 read through its typed API. Owner/member/service storage remains unchanged.
diff --git a/docs/releases/orchestration-engine-0.183.330.md b/docs/releases/orchestration-engine-0.183.330.md
index 2f9f987ba5..4e9840e667 100644
--- a/docs/releases/orchestration-engine-0.183.330.md
+++ b/docs/releases/orchestration-engine-0.183.330.md
@@ -1,5 +1,39 @@
 # Orchestration Engine 0.183.330
 
+## Published artifact and evidence
+
+The official numeric [release `v0.183.330`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.330)
+is published with a signed annotated tag pointing to exact CI source
+`3f7320a8063a5471618be5b8be6a168f49559847`.
+[PR #68](https://github.com/PastureStack/orchestration-engine/pull/68) was normally
+squash-merged as `b76ddcc5c24a7683ffe05fba26707b71b3b313eb`; its tree is identical
+to the CI source. The immutable release tag was not moved to the squash commit.
+The exact `cattle.jar` WAR is `87,700,053` bytes with SHA-256
+`c01cbbfd63625fc09f39c5494775919aad6db22c92050b217b28b940b57e1de3`.
+
+All six exact CI assets are published: `cattle.jar`, `cattle.jar.sha256`,
+`cattle-cyclonedx.json`, `security-summary.txt`, `source-revision.txt` and
+`unit-test-results.json`. Anonymous content readback independently checked the
+checksum, source revision and unit-test results. The public WAR was not
+downloaded again; publication readback does not replace its exact CI artifact
+or Server consumption checks.
+
+[Build/security run `36966573025`](https://github.com/PastureStack/orchestration-engine/actions/runs/36966573025)
+passed 268 suites / 1,141 tests with zero failures, errors or skips, including
+all 19 native-name cases and six retained GenericObject cases. Packaged module
+version 330 and the unchanged readonly/restricted frozen role-schema hashes
+passed. Artifact and build-image Critical/High findings are zero. The
+[CodeQL run `36966573050`](https://github.com/PastureStack/orchestration-engine/actions/runs/36966573050)
+retains four lower-severity findings, with zero Critical/High findings; no
+all-findings-zero claim is made.
+
+The exact CI WAR completed standalone JDK `25.0.3` startup against isolated H2
+and exited 0, with no network, exposed ports or platform-data mounts. An initial
+test launch could not traverse its test-artifact directory after capabilities
+were dropped; that failed test receipt is retained, and no product permissions
+were changed. Component publication and isolated startup do not establish
+Server deployment, real MariaDB concurrency or real-host/browser acceptance.
+
 ## Imported container names
 
 Docker containers imported as independent native containers previously kept
@@ -34,11 +68,11 @@ includes exact-ID inspection, separate instances with the same hint, current
 inspect authority over delayed hints, idempotence, source binding, managed
 record exclusions, name-only/full-row CAS, and notification failures.
 
-The DAO uses MockConnection and the handler uses proxies in these tests.
-This is not proof of real MariaDB concurrency, a published artifact, an
-accepted Server deployment, or complete UI/resource/permission coverage.
-Normal release builds, packaged-artifact checks, and real-host/browser
-acceptance remain pending before this version is declared published.
+The DAO uses MockConnection and the handler uses proxies in these focused
+tests. The separate normal CI, packaged-artifact, publication and isolated-H2
+results are recorded above; mocks alone do not establish those results. Real
+MariaDB concurrency, consuming Server deployment, real-host/browser acceptance
+and complete UI/resource/permission coverage remain separate requirements.
 
 ## Compatibility and rollback