docs: the production line says what Reglyze's production shows

CHANGELOG.md

@@ -7,6 +7,14 @@ is `0`, minor versions may carry breaking changes — they are called out here.
 
 ## [Unreleased]
 
+### Corrected
+- The production line (README, vejas.dev, launch kit) claimed two production
+  customers collecting NIS2 supplier-compliance evidence across eight EU
+  countries. Checked in Reglyze's production on 2026-10-15: the collection cell
+  has run there since August, with Microsoft 365 and EDR collectors mapped to
+  four national laws (IT, PT, HR, PL), and no customer has connected a source
+  yet. The line now says that.
+
 ## [0.3.6] — 2026-10-14
 
 ### Added

README.md

@@ -13,9 +13,11 @@ run by the Varpulis CEP engine, embedded as a library
 Vėjas is the old Baltic god of the wind. Wind moves things without anyone
 drawing the route.
 
-**Status: young, but real** — two production customers so far, collecting NIS2
-supplier-compliance evidence across eight EU countries today. Interfaces still
-move fast. Start here: **[the documentation](https://vejas.dev/docs/)** ·
+**Status: young.** Vejas is the evidence-collection engine of Reglyze (NIS2
+compliance) and has run in its production since August 2026: Microsoft 365 and
+EDR (SentinelOne, CrowdStrike) collectors, mapped to the national laws of Italy,
+Portugal, Croatia and Poland. No customer has connected a source yet.
+Interfaces still move fast. Start here: **[the documentation](https://vejas.dev/docs/)** ·
 [COOKBOOK](docs/COOKBOOK.md) · [VISION](docs/VISION.md) ·
 [ARCHITECTURE](docs/ARCHITECTURE.md) · [ROADMAP](docs/ROADMAP.md) ·
 [ADRs](docs/adr/). The bet, long-form:

docs/launch/distribution-kit.md

@@ -2,8 +2,8 @@
 
 Positioning: **the agent writes, under provable governance.** Honest about the
 AI-authored code — it's the thesis, not a caveat to hide. Lead with the 5-minute
-result; numbers as proof, not as hook. Reglyze/NIS2 is the real production proof —
-use it.
+result; numbers as proof, not as hook. Reglyze/NIS2 is a real deployment, but no
+customer has connected a source yet (checked 2026-10-15): do not present it as usage.
 
 Channels deliberately skipped:
 - **r/rust** — an AI-co-authored repo is a dealbreaker there.
@@ -53,8 +53,9 @@ Title alternates (kept for reference):
 > persisted, cluster promote 60ms lossless. Twenty-one connector recipes admitted
 > by CI (MQTT/RabbitMQ against real brokers; IBM MQ, Kafka).
 >
-> Early — two production customers so far — but real: a compliance tool collects
-> NIS2 supplier-compliance evidence across eight EU countries on it today.
+> Young: it has run since August 2026 as the evidence-collection engine of a NIS2
+> compliance tool (Microsoft 365 and EDR, four national laws). No customer has
+> connected a source yet.
 >
 > Full disclosure: most of this code was written by AI agents, reviewed and
 > arbitrated by me across ~30 recorded decisions (ADRs). That's not a caveat — it's

site/index.html

@@ -412,12 +412,13 @@ <h2>Deliberately boring architecture.</h2>
     <h2>Young, but not a demo.</h2>
     <div class="proof">
       <div class="proofcard">
-        <h3>In production today</h3>
-        <p>Early — two production customers so far — but real: it collects NIS2
-        supplier-compliance evidence across eight EU countries today.
-        Outbound-only collectors, remote-piloted through a closed command
-        allowlist, secrets unreadable even by the operator.</p>
-        <p class="m">Microsoft Graph · EDR · leaf-node control plane</p>
+        <h3>Deployed with Reglyze</h3>
+        <p>The evidence-collection engine of Reglyze (NIS2 compliance), in its
+        production since August 2026: Microsoft 365 and EDR collectors, mapped
+        to the national laws of Italy, Portugal, Croatia and Poland. Secrets
+        stay unreadable even by the operator. No customer has connected a
+        source yet.</p>
+        <p class="m">Microsoft Graph · SentinelOne · CrowdStrike</p>
       </div>
       <div class="proofcard">
         <h3>SAP ⇄ Salesforce, both ways, streaming</h3>