diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d3d829..5db1505 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.9] - 2026-07-21
+
+### Fixed
+
+- Narrowed README evidence and outcome wording to the recorded co-change mechanism, without implying a documented production incident or a guaranteed Codex revision.
+- Clarified local extension rendering and saved receipts versus explicit provider-backed advisory review across the root README, extension metadata, extension README, and Getting Started walkthrough.
+
 ## [0.1.8] - 2026-07-21
 
 ### Fixed
diff --git a/README.md b/README.md
index 482a0ff..7c9b5a5 100644
--- a/README.md
+++ b/README.md
@@ -25,9 +25,9 @@
 | | |
 | --- | --- |
 | Task | Update the checkout route |
-| Recorded evidence | The route and its webhook partner share a co-change history — an incident and a revert, not an import |
+| Recorded evidence | The route and its webhook partner share a repeated co-change history, including a rounding change and its later revert—not an import. |
 | An incomplete patch | The hook denies it, citing the specific evidence and the omitted partner |
-| Outcome | Codex revises the changeset before the edit lands |
+| Outcome | The incomplete patch does not land; Codex receives the evidence and must account for the recorded partner before retrying. |
 
 ## Installation
 
@@ -85,7 +85,7 @@ Let the installer handle the `code` CLI, idempotency, and the reload prompt for
 npx @workspacejson/codex-mcp install --with-extension
 ```
 
-This installs the `workspace-json.workspacejson-codex-decorations` extension: Explorer decorations on fragile files, a **current-change** view, a synchronized status item, and receipt-backed advisory review — all read from your local `.agents/workspace.json`, with no network calls and no telemetry.
+This installs the `workspace-json.workspacejson-codex-decorations` extension: Explorer decorations on fragile files, a **current-change** view, a synchronized status item, and saved review receipts. The decorations, current-change view, status item, and saved review receipts read local workspace data with no telemetry. Running a new advisory review is a separate explicit action that sends only the supplied diff to the configured provider.
 
 The installer targets **VS Code Stable** only. If the `code` CLI isn't on your PATH it reports `UNAVAILABLE` with a one-line fix and leaves your MCP/hook install untouched — it never silently targets Insiders, Cursor, a remote, or a container. To aim it at a different editor's CLI deliberately, set `WORKSPACEJSON_CODE_CLI` (e.g. `cursor`) and rerun.
 
diff --git a/extension/README.md b/extension/README.md
index fe8bd03..ac0e476 100644
--- a/extension/README.md
+++ b/extension/README.md
@@ -22,7 +22,14 @@ The whole point of the surface is a distinction you can see in one hover:
 
 The rules said no. An independent model looked and found no additional blocker. **The block holds anyway.** Judgment and enforcement are separate planes: an advisory review can add signal, but it never lifts a deterministic decision, and `PASS` is scope-bounded — never a safety certification.
 
-Everything is read from your local `.agents/workspace.json`. **No network calls. No telemetry.**
+Explorer decorations, the current-change view, the status item, and saved
+review receipts are read locally from `.agents/workspace.json`, with no
+telemetry.
+
+Running **Run Advisory Review** is a separate explicit action. It sends only
+the supplied diff to the configured OpenAI or OpenRouter provider and stores
+the resulting attributed receipt locally. Deterministic enforcement does not
+require an API key and does not transmit repository contents.
 
 ## Install
 
diff --git a/extension/package-lock.json b/extension/package-lock.json
index 4fb52eb..a58e32a 100644
--- a/extension/package-lock.json
+++ b/extension/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "workspacejson-codex-decorations",
-  "version": "0.0.1",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "workspacejson-codex-decorations",
-      "version": "0.0.1",
+      "version": "0.1.5",
       "license": "Apache-2.0",
       "devDependencies": {
         "@types/node": "^22.0.0",
diff --git a/extension/package.json b/extension/package.json
index c6f3dcc..142f596 100644
--- a/extension/package.json
+++ b/extension/package.json
@@ -1,8 +1,8 @@
 {
   "name": "workspacejson-codex-decorations",
   "displayName": "workspace.json — Codex change intelligence",
-  "description": "Surfaces recorded fragility, co-change partners, and receipt-backed advisory review for the file you are changing — Explorer decorations, a current-change view, and a status item, all read from your local .agents/workspace.json. No telemetry, no network.",
-  "version": "0.1.2",
+  "description": "Surfaces local workspace.json fragility, co-change partners, and saved advisory-review receipts in VS Code. No telemetry. Running a new advisory review is an explicit action that sends only the supplied diff to the configured provider.",
+  "version": "0.1.5",
   "publisher": "workspace-json",
   "license": "Apache-2.0",
   "engines": {
@@ -217,7 +217,7 @@
           {
             "id": "review",
             "title": "Run an independent advisory review",
-            "description": "GPT-5.6 reviews a bounded evidence bundle in a separate read-only session. Its result is advisory — it can surface additional risks or gaps, but it never overrides deterministic enforcement.\n[Run Advisory Review](command:workspacejson.runReview)",
+            "description": "GPT-5.6 reviews the supplied diff in a separate read-only session. Running this command explicitly sends only that diff to the configured OpenAI or OpenRouter provider and stores an attributed receipt locally. The result is advisory: it can surface additional risks or gaps, but it never overrides deterministic enforcement.\n[Run Advisory Review](command:workspacejson.runReview)",
             "media": {
               "image": "assets/walkthrough/review.svg",
               "altText": "Deterministic decision DENY beside advisory result PASS within reviewed scope."
diff --git a/package-lock.json b/package-lock.json
index 6167355..ec35001 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@workspacejson/codex-mcp",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@workspacejson/codex-mcp",
-      "version": "0.1.8",
+      "version": "0.1.9",
       "license": "Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.20.0",
diff --git a/package.json b/package.json
index 3fcdeaa..fe6a660 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@workspacejson/codex-mcp",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "MCP server that surfaces workspace.json fragility and co-change intelligence to OpenAI Codex before it edits code.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/src/index.ts b/src/index.ts
index 5ead151..83709ad 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -5,7 +5,7 @@ import { isVerifyEnabled } from "./config.js";
 import { SERVER_INSTRUCTIONS } from "./constants.js";
 import { registerWorkspaceTools } from "./tools/workspace.js";
 
-const VERSION = "0.1.8";
+const VERSION = "0.1.9";
 
 function buildServer(): McpServer {
   const server = new McpServer(