diff --git a/README.md b/README.md
index be83ea6..d4ec621 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ The control panel runs on `127.0.0.1`. OpenCode remains responsible for provider
 
 The running app is authoritative for model names, availability, pricing evidence, and role eligibility.
 
-> **Release status:** the source repository is public at [BitL8-ByteShort/opencode-model-control](https://github.com/BitL8-ByteShort/opencode-model-control). Version `0.1.2` is distributed as a versioned package artifact in its public Git tag; publication to the npm registry is not yet claimed.
+> **Release status:** Version `0.1.2` is available from [npm](https://www.npmjs.com/package/opencode-model-control/v/0.1.2) and as the exact tested package attached to [GitHub Release v0.1.2](https://github.com/BitL8-ByteShort/opencode-model-control/releases/tag/v0.1.2). The [source repository](https://github.com/BitL8-ByteShort/opencode-model-control) is public.
 
 ## What it does
 
@@ -43,14 +43,14 @@ The panel can open without OpenCode, but it cannot discover the user's current m
 
 ## Install
 
-Install the pinned public release package directly from GitHub:
+Install the verified public npm release:
 
 ```sh
-npm install --global https://raw.githubusercontent.com/BitL8-ByteShort/opencode-model-control/v0.1.2/packages/opencode-model-control-0.1.2.tgz
+npm install --global opencode-model-control@0.1.2
 opencode-model-control
 ```
 
-The first command installs the exact prebuilt release artifact and its runtime dependencies. The second command starts the local panel and opens it in the default browser.
+The first command installs the tested `0.1.2` release and its runtime dependencies. The second command starts the local panel and opens it in the default browser.
 
 Then:
 
@@ -83,16 +83,16 @@ The connector writes absolute Node and package CLI paths, so a source checkout d
 
 `npm start` opens the panel in the default browser. Use `npm start -- --no-open` to suppress browser launch, or set `OMC_PORT` to another unprivileged local port.
 
-### Optional npm-registry distribution
+### Direct GitHub release artifact
 
-If a future release is independently verified on the npm registry, the shorter global command will be:
+To install the same tested tarball directly from GitHub:
 
 ```sh
-npm install --global opencode-model-control
+npm install --global https://github.com/BitL8-ByteShort/opencode-model-control/releases/download/v0.1.2/opencode-model-control-0.1.2.tgz
 opencode-model-control
 ```
 
-Until this README links to that registry artifact, use the pinned GitHub command above. Maintainers should follow the [release checklist](docs/releasing.md) before claiming an npm publication.
+Its SHA-256 is `b8ac329f72fd351159e4f1c86a739bdc7005b96b8d4a7f793580edd5929d5aee`; the package record is in [packages/README.md](packages/README.md).
 
 ## What “Update available models” means
 
diff --git a/docs/support-matrix.md b/docs/support-matrix.md
index 7f0eb7f..806f61d 100644
--- a/docs/support-matrix.md
+++ b/docs/support-matrix.md
@@ -5,8 +5,8 @@ This matrix separates implemented behavior from compatibility that still needs l
 | Surface | Status | Boundary |
 | --- | --- | --- |
 | Node.js `^20.19.0` or `>=22.12.0` | Supported by package contract | `npm run verify` is the release gate. |
-| Canonical public repository | Supported | Public source: `https://github.com/BitL8-ByteShort/opencode-model-control`; a versioned package artifact stored in the immutable release tag is the initial distribution channel. |
-| npm registry package | Not yet published | Package metadata and an unclaimed registry name are not publication evidence. Use the pinned GitHub tag until a registry artifact is linked from the README. |
+| Canonical public repository | Supported | Public source: `https://github.com/BitL8-ByteShort/opencode-model-control`; releases include tagged source and a checksum-recorded package artifact. |
+| npm registry package | Published; `0.1.2` clean-install verified on macOS | Exact public version: [`opencode-model-control@0.1.2`](https://www.npmjs.com/package/opencode-model-control/v/0.1.2). Registry integrity matches the tested tarball; Linux acceptance remains separate. |
 | OpenCode 1.18.x custom agents | Targeted | Managed config uses the 1.18.x `agent` and local MCP surfaces. |
 | OpenCode 1.18.22 on macOS | Parser, discovery, connect, MCP handshake, and disconnect tested | Isolated acceptance does not invoke a model or prove a provider session. |
 | Later OpenCode configuration majors | Unverified | Schema or agent semantics may change; support requires explicit tests. |
diff --git a/packages/README.md b/packages/README.md
index a972486..af8da29 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -1,6 +1,6 @@
 # Release packages
 
-This directory temporarily carries verified package artifacts until the npm registry distribution is configured and independently accepted.
+This directory carries checksum-recorded copies of verified public release packages. npm is the default install channel after registry verification; these tarballs remain available for version-pinned direct installation and independent checksum comparison.
 
 Each tarball is produced with `npm pack` only after the full release gate passes. Its filename, version, and SHA-256 digest are recorded here so users can verify a direct download before installation.