diff --git a/blazor/PUBLISHING.md b/blazor/PUBLISHING.md
new file mode 100644
index 0000000..893d356
--- /dev/null
+++ b/blazor/PUBLISHING.md
@@ -0,0 +1,9 @@
+# Blazor publication and recovery
+
+The build-source pin includes the bounded NuGet download verifier and its 14 offline regression tests. Component runtime APIs and already-published package versions are unchanged.
+
+After upload, verification waits up to 720 seconds for public availability. It retries missing downloads, transient network failures, rate limits and selected server errors. Permanent errors and downloaded payload conflicts remain fatal. NUGET_VERIFY_TIMEOUT_SECONDS or --timeout-seconds overrides the budget; increase the publish job timeout when choosing a longer wait.
+
+If upload succeeds but verification times out, rerun only the failed **publish** job from the original Actions run. Reuse its validated artifacts; do not rebuild, replace an existing version, or disable verification. Matching existing packages skip duplicate upload, but their complete payload is still compared before release creation. Only NuGet's root repository signature is excluded, not assemblies, assets or the nuspec.
+
+Version.props versions NuGet independently of npm. Read [README.md](README.md) and [INTEGRATION.md](INTEGRATION.md) for build and hosting instructions.
diff --git a/blazor/runtime-source b/blazor/runtime-source
index 1c895b7..16a244c 160000
--- a/blazor/runtime-source
+++ b/blazor/runtime-source
@@ -1 +1 @@
-Subproject commit 1c895b7184451071e1c7131063249d2d9eb145b9
+Subproject commit 16a244c6ab8ac286b0a4a5bfd41b5645393680ef