diff --git a/README.md b/README.md
index f819d40..4c5c5f4 100644
--- a/README.md
+++ b/README.md
@@ -114,13 +114,11 @@ traversal, backslashes, control characters, and percent-encoded path segments.
 Generated output paths must stay within the current working directory.
 Screenshots append a timestamp to the requested filename and report the actual
 path written, so repeated captures do not reuse cache-prone filenames.
-Captures reject non-JPEG/PNG responses and detected framing or decoding errors.
-JPEG scan completion and restart order are checked before saving.
-Captures accept up to 64 MiB of compressed data and 8,847,360 pixels (including
-3840×2160 UHD and 4096×2160 DCI 4K); JPEG decoding has a 256 MiB memory limit.
-PNG width and height are each limited to 8192 to bound decoder row allocations;
-decompression is bounded by the declared pixel dimensions. Original image
-bytes are preserved. Detected image errors use the normal capture retry path.
+Captures are decoded and checked before saving, then written as the original
+bytes. Limits: 64 MiB compressed, 8,847,360 pixels (4096×2160 DCI 4K fits),
+8192 px per PNG side, and 256 MiB of JPEG decoder memory. Non-JPEG/PNG
+responses, framing or decoding errors, and images over a limit go through the
+normal capture retry path and fail if they persist.
 
 ## Library Use
 
diff --git a/docs/DISTRIBUTION.md b/docs/DISTRIBUTION.md
index b3aa313..eca5eb7 100644
--- a/docs/DISTRIBUTION.md
+++ b/docs/DISTRIBUTION.md
@@ -9,9 +9,9 @@ Merges to `main` are considered publishable. The CI workflow runs:
 1. `verify` on pull requests and `main` pushes.
 2. semantic-release on `main` after `verify` passes.
 
-semantic-release analyzes conventional commits, publishes to npm, creates GitHub Releases, and writes release metadata when needed.
+semantic-release analyzes Conventional Commits; a releasable commit publishes to npm, creates a GitHub Release, and commits the released `package.json` version back to `main` with `[skip ci]`.
 
-The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](../.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch.
+The release job calls the [shared frontend release workflow](https://github.com/putdotio/.github) from `putdotio/.github`, pinned to a tagged commit; the semantic-release action and plugin pins live there. [`scan.yml`](https://github.com/putdotio/rokit/blob/main/.github/workflows/scan.yml) calls the shared frontend scan workflow from the same repository: Gitleaks, TruffleHog, Actionlint, and Zizmor on pull requests, weekly, and on manual dispatch.
 
 ## Release Credentials
 
@@ -30,11 +30,11 @@ Release writes use the `putio-releaser` installation token. The default `GITHUB_
 
 ## Package Contents
 
-The npm package includes `dist`, `README.md`, `docs`, `examples`, `skills`,
-`AGENTS.md`, `CONTRIBUTING.md`, and `SECURITY.md`. The docs, consumer skill, and
-generic live probe are included so agents consuming the package can inspect
-distribution, security, and generic Roku proof mechanics without cloning extra
-private context.
+`files` in [`package.json`](../package.json)
+lists what the npm package ships. It carries the docs, consumer skill, and
+generic live probe so agents consuming the package can inspect distribution,
+security, and Roku proof mechanics without cloning the repository. Packaged docs
+link files outside the tarball by absolute GitHub URL.
 
 The published dependencies pin Effect, platform-node, and platform-node-shared to
 the same prerelease. Keep those pins aligned: a consumer does not inherit this
@@ -58,7 +58,7 @@ gh release list --repo putdotio/rokit --limit 5
 npm view @putdotio/rokit version
 ```
 
-Live Roku behavior is not required for npm release. Real-device checks are local/manual because they require a developer-enabled Roku:
+Releases do not need a Roku. Real-device checks stay local because they require a developer-enabled device:
 
 ```bash
 ROKIT_TARGET=<roku-ip> pnpm live:smoke
diff --git a/skills/rokit/references/live-proof.md b/skills/rokit/references/live-proof.md
index 06fc244..a60f5ca 100644
--- a/skills/rokit/references/live-proof.md
+++ b/skills/rokit/references/live-proof.md
@@ -13,8 +13,8 @@ rokit describe proof
 ```
 
 Use `README.md` for the public command overview. Use the one-command form to
-keep context small when you already know the command family. Use `src/cli.ts`
-when command behavior and docs disagree.
+keep context small when you already know the command family. When the docs and
+`rokit describe` disagree, trust `describe`.
 
 ## Quick Reads