diff --git a/ansible/roles/cezen-nginx/tasks/main.yml b/ansible/roles/cezen-nginx/tasks/main.yml
index 1fca52d..4f82ddd 100644
--- a/ansible/roles/cezen-nginx/tasks/main.yml
+++ b/ansible/roles/cezen-nginx/tasks/main.yml
@@ -26,6 +26,8 @@
     rsync_opts:
       - "--exclude=.DS_Store"
       - "--exclude=*.sh"
+      - "--chown={{ cezen_user }}:www-data"
+      - "--chmod=D0755,F0644"
   notify: Reload nginx
 
 - name: Deploy Nginx site config
diff --git a/specs/001-enterprise-experience/evidence/server-phase1.md b/specs/001-enterprise-experience/evidence/server-phase1.md
index c87ce28..4f520d7 100644
--- a/specs/001-enterprise-experience/evidence/server-phase1.md
+++ b/specs/001-enterprise-experience/evidence/server-phase1.md
@@ -73,3 +73,32 @@ Post-reboot vLLM cold readiness occurred at approximately 144 seconds after boot
 **Not ready for customer shipment yet.** The corrected package is suitable for another clean Server
 installation validation and controlled pilot preparation. A new ISO must be built from the corrected
 revision and both Server and Workstation ISO paths must be tested before release consideration.
+
+## Corrected-package clean-host regression — 2026-07-13
+
+A second independent Vast.ai Ubuntu 22.04.5 VM was installed from the corrected local package:
+
+- RTX 3090 24 GB, NVIDIA driver 580.159.03 after upgrade/reboot;
+- 30 vCPU, 52.9 GB usable RAM, 126 GB root filesystem;
+- clean starter install recap: 88 ok, 63 changed, 0 failed, 3 ignored;
+- the ignored DCGM failure was caused by the required post-driver-upgrade reboot and passed afterward;
+- Grafana provisioning was retried after its startup race and the Prometheus datasource was added;
+- portal source permissions were normalized after clean-host validation exposed preserved macOS mode/UID values.
+
+Regression results:
+
+- 51 authenticated parameterless feature endpoints returned 200;
+- 3 unlicensed features correctly returned 403;
+- RBAC, user/session, API-key, guardrail, prompt, backup and restore cases passed;
+- short-document RAG ingest, embedding, semantic retrieval and cleanup passed;
+- vLLM Phi-3 OpenAI-compatible inference passed;
+- Grafana, Prometheus, DCGM and node-exporter endpoints returned 200;
+- audit report contained the expected test actions with zero recorded failures;
+- after a final reboot, all six system services and six containers recovered;
+- portal, backend, Ollama, ChromaDB, Grafana, Prometheus and DCGM returned 200;
+- the embedding model and backup archive persisted;
+- vLLM was ready by approximately 100 seconds after boot.
+
+This confirms the corrected software package on two Server-class cloud VMs. It does not change the
+remaining ISO boot, physical hardware, Workstation, manual accessibility, network-interruption,
+customer-pilot or release-approval gaps above.