diff --git a/STANDALONE-AUDIT.md b/STANDALONE-AUDIT.md
index 662949a..b3bdd23 100644
--- a/STANDALONE-AUDIT.md
+++ b/STANDALONE-AUDIT.md
@@ -11,24 +11,28 @@ Link, Host Link, system-auth, or gateway internals.
 
 The SDK package surface is standalone enough for the current authoring proof:
 
-- A fresh consumer installs the SDK CLI as a package-manager dependency.
-- `matrix init` creates a fresh author package.
-- `matrix add actor` creates an actor importing `@open-matrix/core`.
-- `matrix configure` writes package-local `.matrix` credentials/config.
-- `matrix run` starts the actor directly.
-- `matrix invoke` calls the actor through the SDK CLI.
-- The generated package can be packed, installed into a separate consumer, run,
-  and invoked again.
+- A fresh consumer can install `@open-matrix/sdk` and `@open-matrix/cli` from an
+  npm-compatible registry.
+- `matrix broker setup` installs a project-local `nats-server` binary for demos.
+- `matrix broker start` starts that local broker without a HiveCast account or
+  preinstalled Matrix binary.
+- `matrix actor run <entry> --check-op <op>` starts a direct actor and calls it
+  through the Matrix runtime/transport path.
+- Actor handlers are validated before broker connection: `accepts.echo` must be
+  implemented as `onEcho(payload)`, not `echo(payload)`.
 
-The proof script also checks that generated author-package files do not contain
-legacy monorepo paths or upper-layer package dependencies.
+The fresh Docker proof checks that the package-manager install path has no
+Matrix/HiveCast preinstall dependency and that bad actor handlers fail loudly
+instead of timing out.
 
 Checked-in demos now cover the same boundary in user-facing form:
 
-- `pnpm demo:standalone` runs `examples/standalone-greeter` without provider
+- `pnpm demo:standalone` runs `demos/standalone-greeter` without provider
   credentials.
-- `pnpm demo:hivecast-login` validates a user-supplied HiveCast API key and
-  writes package-local SDK config/credentials in a temporary demo home.
+- `demos/fresh-server-actor` shows a server-side actor using HiveCast-exchanged
+  broker credentials.
+- `demos/fresh-web-page` shows a browser actor/web page using HiveCast-exchanged
+  broker credentials.
 
 ## Cleanup Completed
 
@@ -37,11 +41,11 @@ Checked-in demos now cover the same boundary in user-facing form:
 - Core package README and metadata use `@open-matrix/*` names and this repo URL.
 - Browser host strings describe generic managed HTTP/broker surfaces instead of
   HiveCast-specific local/dev URLs.
-- CLI contracts describe standalone SDK boundaries and optional managed-host
-  integration without naming product-only packages as part of the SDK.
-- The SDK CLI UAT proof no longer defaults to a HiveCast binary or
-  `dev.hivecast.ai`; managed-host proof requires explicit
-  `MATRIX_SDK_RUNTIME_HOST_BIN`.
+- CLI docs describe standalone SDK boundaries and optional provider-managed
+  broker credential files without naming product-only packages as part of the
+  SDK.
+- The SDK CLI proof no longer defaults to a HiveCast binary, `dev.hivecast.ai`,
+  Host Service, or Device Link.
 - The internal theme manifest uses `@open-matrix/theme`.
 
 ## Intentional Guard Strings