diff --git a/GITHUB-CLOUDFLARE-SETUP.txt b/GITHUB-CLOUDFLARE-SETUP.txt
index 5f051d4..9f52f65 100644
--- a/GITHUB-CLOUDFLARE-SETUP.txt
+++ b/GITHUB-CLOUDFLARE-SETUP.txt
@@ -1,19 +1,35 @@
-CATERIUM - GITHUB -> CLOUDFLARE AUTODEPLOY
+CATERIUM - CLOUDFLARE FALLBACK DEPLOYMENT
+
+PRIMARY PRODUCTION:
+https://app.caterium.ru
+Timeweb Cloud App Platform
+Branch: production
+Publish directory: public
 
 Repository:
 https://github.com/pavlov346346-source/caterium-app
 
-Existing Worker:
+Fallback Worker:
 ancient-sound-04ab
 
-1. Run PUSH-TO-GITHUB.bat.
-2. Complete GitHub browser login if Git Credential Manager asks.
-3. In Cloudflare: Workers & Pages -> ancient-sound-04ab -> Settings -> Builds -> Connect.
-4. Choose GitHub and repository pavlov346346-source/caterium-app.
-5. Production branch: main
-6. Root directory: /
-7. Build command: npm run check:deploy
-8. Deploy command: npx wrangler deploy
-9. Save and deploy.
+Cloudflare is a backup target only. Do not treat it as the primary production host.
 
-After this, each push to main that passes the Cloudflare build checks deploys to the same Worker.
+Recommended fallback Git configuration:
+1. Workers & Pages -> ancient-sound-04ab -> Settings -> Builds -> Connect.
+2. Choose GitHub and repository pavlov346346-source/caterium-app.
+3. Branch: production
+4. Root directory: /
+5. Build command: npm run check:deploy
+6. Deploy command: npx wrangler deploy
+7. Save.
+
+The production branch is promoted automatically only after Caterium QA succeeds on main, so the fallback should follow production rather than main.
+
+Manual fallback deployment from a verified checkout:
+npm ci
+npm audit --audit-level=high
+npm run check:deploy
+npm run test:e2e
+npm run deploy:cloudflare-backup
+
+Do not decommission the fallback Worker until Timeweb/DNS/SSL and real-user production checks are complete.
diff --git a/README.md b/README.md
index 6c173b3..9adfc9d 100644
--- a/README.md
+++ b/README.md
@@ -3,23 +3,44 @@
 Caterium catering SaaS frontend with Supabase backend.
 
 ## Production
-Current Cloudflare Worker: `ancient-sound-04ab`
 
-Cloudflare publishes **only `public/`**. SQL, Edge Functions, tests and documentation are not web-accessible.
+Primary production URL: `https://app.caterium.ru`
+
+Production frontend is hosted on Timeweb Cloud App Platform:
+- repository: `pavlov346346-source/caterium-app`
+- branch: `production`
+- publish directory: `public`
+- auto deploy: enabled for `production`
+
+`main` is the integration branch. GitHub Actions runs the full Caterium QA workflow for each push to `main`. Only a successful QA run may promote the verified commit to `production`.
+
+The Cloudflare Worker `ancient-sound-04ab` is retained only as a fallback. It is not the primary production target and must not replace the Timeweb deployment unless an intentional fallback procedure is being used.
 
 ## Deploy checks
+
 ```bash
-npm install
+npm ci
+npm audit --audit-level=high
 npm run check:deploy
 npm run test:e2e
 ```
 
-## Cloudflare Git deployment
-- Build command: `npm run check:deploy`
-- Deploy command: `npx wrangler deploy`
-- Production branch: `main`
-- Root directory: `/`
+The QA workflow performs these checks automatically. High/critical npm audit findings block promotion.
+
+## Cloudflare fallback
+
+Use Cloudflare only as a backup deployment target. Manual fallback deployment is available as:
+
+```bash
+npm run deploy:cloudflare-backup
+```
+
+When configuring Git-based Cloudflare fallback deployment, use the verified `production` branch rather than `main` so the fallback receives the same QA-approved commit as Timeweb.
 
 ## Backend
+
 Supabase Edge Functions are versioned under `supabase/functions/`.
 SQL migration/history files live under `ops/sql/`.
+Database DDL changes should be applied as migrations and kept in repository history.
+
+See `TIMEWEB-APP-PLATFORM.md` for the production hosting checklist.
diff --git a/package.json b/package.json
index f26e9fa..d540335 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "check:deploy": "npm run check:syntax && npm run test:static && npm run check:release",
     "test:e2e": "playwright test --config=tests/playwright.config.mjs",
     "test": "npm run check:deploy",
-    "deploy": "wrangler deploy"
+    "deploy:cloudflare-backup": "wrangler deploy"
   },
   "devDependencies": {
     "@playwright/test": "^1.51.0",