diff --git a/deploy/README.md b/deploy/README.md
index 00feac8b..e91fcc56 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -87,13 +87,23 @@ OPENAI_API_KEY=<server-secret>
 # LLM_API_KEY=<server-secret>
 # LLM_MODEL=provider-model-id
 
-# Optional VedAstro official upstream; local fallback remains available:
-VEDASTRO_API_ENDPOINT=...
-VEDASTRO_API_KEY=...
+# Required VedAstro server-side upstream for chart creation and rectification:
+VEDASTRO_GATEWAY_MODE=official_first
+VEDASTRO_API_ENDPOINT=https://api.vedastro.org/api
+VEDASTRO_ENABLE_NETWORK=1
+VEDASTRO_TIMEOUT_SECONDS=20
+VEDASTRO_API_KEY=<server-secret>
 ```
 
 Never commit `.env.production`, `SUPABASE_SERVICE_ROLE_KEY`, model keys, user JWTs, SSH private keys or passwords. `NEXT_PUBLIC_SUPABASE_ANON_KEY` is intentionally public; authorization is enforced by Supabase RLS and server-side checks.
 
+After changing VedAstro variables, restart the API and verify the configuration without printing credentials:
+```bash
+docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build api
+docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec api python3 scripts/diagnose_vedastro_mode.py
+```
+The report must show `mode: official_extended` and `network_enabled: true`. A missing raw response remains an upstream response boundary, not a successful external verification.
+
 ## Connect and inspect
 
 ```bash
diff --git a/tests/test_vedastro_runtime_mode_diagnostics.py b/tests/test_vedastro_runtime_mode_diagnostics.py
index 514a24ab..7dff6b02 100644
--- a/tests/test_vedastro_runtime_mode_diagnostics.py
+++ b/tests/test_vedastro_runtime_mode_diagnostics.py
@@ -37,7 +37,7 @@ def test_vedastro_diagnostics_reports_fast_fallback_mode_without_endpoint() -> N
     assert "VEDASTRO_API_ENDPOINT" in report["missing"]
     assert "missing_endpoint" in report["readiness_blockers"]
     assert "network_disabled" in report["readiness_blockers"]
-    assert "timeout_too_low" in report["readiness_blockers"]
+    assert "timeout_too_low" not in report["readiness_blockers"]
     assert report["expected_fallback_status"] == "official_snapshot_budget_exhausted_or_endpoint_blocked"
     assert "VEDASTRO_API_ENDPOINT" in report["official_closure_plan"]["required_env"]
     assert report["official_closure_plan"]["raw_response_acceptance"] == "vedastro_official.raw_response must be present before claiming official cloud closure."