diff --git a/deploy/README.md b/deploy/README.md
index 25ba8ca..bc50f93 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -11,12 +11,22 @@ throughput, not approval to colocate Stream with Indigo.
 
 The previously deployed `e1926f3` image is historical evidence only. It was
 not the artifact covered by the earlier admission receipt and it failed during
-the experiment. Do not reuse its digest as a promotion candidate.
+the experiment. Do not reuse its digest as a promotion candidate. That gap —
+an image no receipt covered, with nothing to refuse it — is what
+`scripts/admit` now closes.
 
 ```sh
 just package        # ReleaseSafe x86_64-linux-gnu binary in zig-out/bin/
+just admit run      # clean tree -> every suite -> exact image -> one receipt
+just admit publish  # push that image, pin the receipt to its registry digest
+just admit verify sha256:...   # deployment gate; non-zero unless admitted
 ```
 
+Nothing may be deployed whose digest `just admit verify` does not accept. A
+receipt covers exactly one image digest, never a tag, and a suite recorded as
+`skipped` blocks admission just as a failure does — a partial run must never
+read as a full one. `just admission-contract` proves those refusals offline.
+
 ## required environment (docs/lessons-from-zlay.md #8, #9)
 - `MALLOC_ARENA_MAX=4` — the highest-leverage glibc RSS knob for
   thread-heavy services (per-thread arena fragmentation)
diff --git a/docs/semantic-parity.md b/docs/semantic-parity.md
index b90db4f..ba1217f 100644
--- a/docs/semantic-parity.md
+++ b/docs/semantic-parity.md
@@ -76,7 +76,7 @@ blockers remain. The detailed bootstrap audit is in
 | Inspect/version command surfaces | **partial** | `version`, sealed `inspect-segment`, active inspection, and representative `inspect-all` reports have fixtures and golden comparisons. | Inspection does not compensate for missing online status tabs, and the current audit did not rerun every golden against the current commit. |
 | Differential oracle | **blocked as an admission proof** | It provides useful event-log, final-state, restart, repair, and public-client coverage against a pinned upstream simulator. Focused production-boundary tests now prove per-repository writer-gated completion and same-disk reopen with a sibling held incomplete. | The oracle still needs an invariant-based process-kill world that scales this beyond a two-repository fixture; its old four-account `after_repo_complete` schedule could not detect a dispatch-scale replay defect. |
 | Strict power-loss oracle | **partial** | It exercises acknowledged-write reconstruction at named write/fsync/rename boundaries. Focused tests separately inject Store read failures for lifecycle phase, relay cursor, compaction watermark, and merge cursor; the merge restart guard also distinguishes source absence from filesystem failure. The completion reopen test proves completed-versus-interrupted repository classification around an unchanged listRepos cursor. | It does not yet inject missing manifest files during replay, long listRepos cursors, or storage loss specifically between archive fsync and the completion metadata commit. |
-| Exact artifact admission | **blocked** | Commit `4d163e8` had a recorded suite and immutable OCI digest. | The experiment deployed `e1926f3`, which included source and dependency changes after that receipt. No mechanism prevented deployment of a non-admitted digest. |
+| Exact artifact admission | **partial** | `scripts/admit` implements the procedure: `run` requires a clean worktree, runs every suite, builds the exact linux/amd64 image and writes one receipt recording the Stream/Zig/upstream-Jetstream/dependency revisions and dashboard checksum; `publish` pins that receipt to the pushed registry digest and refuses if the local image drifted; `verify` is the deployment gate. A receipt covers a digest, never a tag; a `skipped` suite blocks admission exactly like a failure, so a partial run cannot read as a full one. `tests/admission_contract.py` pins the refusals — unknown digest, unpublished receipt, another artifact's digest, skipped suite, failed suite. | The publish path has not been exercised end to end: no image has been pushed and no receipt carries a real registry digest yet, because publishing is an outward-facing action awaiting an actual promotion. Deployment tooling must also be wired to call `verify` before rollout; today the gate exists but nothing on the deploy side is forced through it. |
 
 ## Evidence that must not be overread