diff --git a/docs/validation/1.0.0-readiness.md b/docs/validation/1.0.0-readiness.md
index 14c45b5..5023f0a 100644
--- a/docs/validation/1.0.0-readiness.md
+++ b/docs/validation/1.0.0-readiness.md
@@ -1,6 +1,6 @@
 # 1.0.0 Readiness Evidence
 
-Status: Partial release — GitHub channel released; npm channel blocked on registry credentials
+Status: Released (GitHub and npm channels, 2026-09-18)
 
 ## Candidate
 - Commit: `docs/v1-release-readiness` head at authoring; the release candidate is finalized at the C6 version-bump commit — re-verify before release
@@ -57,7 +57,7 @@ Finding-count changes vs 0.8.1 stem from the corrected semantics (implicit block
 - Release commit: `2ea1cd4` (merge of PR #183); lightweight tag `1.0.0` pushed from that commit.
 - Release workflow run 35307337997: success — tag/main ancestry verified, full gates re-run, installed-package smoke on Node 24 and Node 18, GitHub release created with attestation.
 - GitHub release `1.0.0` verified: `main.js` (sha256 `0ed332cf…f7a13`), `manifest.json` (`382a750c…4f1b6e`, version 1.0.0), `styles.css` (`98c3fd82…72443`) — identical to the locally verified candidate hashes.
-- npm channel: Blocked — no registry credentials in the release session (`npm whoami` → 401). Publish-ready tarball built from the release commit and smoke-verified: `/tmp/vi-npm-staging/vault-inspector-1.0.0.tgz` (sha256 `f7ad58c2…f1faa`). Publish with `npm publish /tmp/vi-npm-staging/vault-inspector-1.0.0.tgz --access public`, then verify with `npm view vault-inspector@1.0.0 version` and a registry-install smoke run.
+- npm channel: Released by the repository owner from the release-commit tarball (npm `dist.shasum` `bef33b88807ca4ea42311d6bb998731190a8ffda` matches the locally smoke-verified candidate). Verified from the registry: `npm view vault-inspector@1.0.0 version` → `1.0.0`, and a registry-downloaded tarball passed the full installed-CLI smoke (`Installed CLI smoke passed on v24.16.0`).
 
 ## Release decision
 All required gates have evidence: automated gates (S0, A, B) pass, native acceptance was completed and confirmed by the repository owner on 2026-09-18, and the owner explicitly authorized the 1.0.0 release. Follow-up fix for Unicode URL boundaries (#184) is included in the release candidate; release gates were re-run on the rebased candidate.