diff --git a/docs/INSTALLER.md b/docs/INSTALLER.md
index f413ea9..43e17ac 100644
--- a/docs/INSTALLER.md
+++ b/docs/INSTALLER.md
@@ -3,33 +3,32 @@
 ## What it does
 
 One linear flow, forward-only (every No skips ahead, nothing loops back):
-confirm → copy `evict.elf` + `orbisrpc.bin` to `/data/GoldHEN/bin/elf/`
-(mkdir -p + byte-count + FNV hash read-back) → pre-saved config with token
-(skips entry when valid) → done. Read-only status screen available via decline.
+confirm → kill old daemon → copy `evict.elf` + `orbisrpc.bin` to
+`/data/payloads/` (mkdir -p + byte-count + FNV hash read-back) →
+pre-saved config with token (skips entry when valid) → done.
+Read-only status screen available via decline.
 
 There is no WiFi check. The installer runs sandboxed, so its socket probe
 measures the app's network stack, not the payload's — and a FAILED line
 reads like a verdict on Discord itself. The daemon reports real reachability
 in its own log once started.
 
-The installer never boots anything. Starting the daemon is GoldHEN's
-payload menu — pick `evict.elf` first (removes old orbisrpc instance),
-then pick `orbisrpc.bin`. No loopback ports, no injection, no boot proof
-to go wrong.
+The installer never boots anything. Starting the daemon is Payload Guest's
+`/data/payloads/` directory — pick `evict.elf` first (removes old orbisrpc
+instance), then pick `orbisrpc.bin`. No loopback ports, no injection, no
+boot proof to go wrong.
 
 ## Install flow
 
 ```
-confirm → copy evict.elf to /data/GoldHEN/bin/elf/evict.elf
-        → copy orbisrpc.bin to /data/GoldHEN/bin/elf/orbisrpc.bin
+confirm → SIGTERM/SIGKILL old daemon via daemon.lock
+        → copy evict.elf to /data/payloads/evict.elf
+        → copy orbisrpc.bin to /data/payloads/orbisrpc.bin
         → save config.json with Discord token
         → (token entry skipped if already valid)
         → done
 ```
 
-The user then launches `evict.elf` first from GoldHEN's payload menu
-(to evict any running orbisrpc), then launches `orbisrpc.bin`.
-
 ## Navigation law
 
 No branch ever returns to start. Cancel/skip always moves forward. The only
@@ -56,9 +55,9 @@ button on No, which inverts the whole wizard.
 
 ## Auto-start
 
-GoldHEN PayLoader AutoRun (2.4b18.10+): enable it for `orbisrpc` once and
-the daemon starts on every jailbreak. The queue is menu-managed; the
-installer shows where, it can't write the queue itself.
+Payload Guest AutoRun: enable it for `orbisrpc` once and the daemon
+starts on every jailbreak. The queue is menu-managed; the installer
+shows where, it can't write the queue itself.
 
 ## Building
 
diff --git a/installer/Makefile b/installer/Makefile
index 5ff1fed..372dee9 100644
--- a/installer/Makefile
+++ b/installer/Makefile
@@ -1,5 +1,6 @@
 # orbisRPC Setup installer (OpenOrbis app).
-# Flow: daemon payload -> token -> done. GoldHEN launches the payload.
+# Flow: daemon payload -> evict old -> token -> done.
+# Payload Guest reads /data/payloads/ on this console.
 TITLE       := orbisRPC Setup
 VERSION     := 1.0.0
 TITLE_ID    := ORPC00001
diff --git a/installer/installer.c b/installer/installer.c
index ab2853e..26d15dd 100644
--- a/installer/installer.c
+++ b/installer/installer.c
@@ -3,9 +3,8 @@
  * One confirm up front; everything after flows forward.
  *
  * Payload placement is the whole job: one copy of orbisrpc.bin into
- * /data/GoldHEN/bin/elf. GoldHEN's payload launcher reads
- * this directory; never this app - an installer that also
- * injects fails in GoldHEN's eyes. */
+ * /data/payloads. Payload Guest reads this directory;
+ * the installer copies here; never this app. */
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -28,8 +27,8 @@
 #define EVICT_ELF "/app0/assets/evict.elf"
 #define INST_DIR "/data/orbisRPC"
 #define INST_LOG "/data/orbisRPC/install.log"
-#define PAYLOAD_BIN "/data/GoldHEN/bin/elf/orbisrpc.bin"
-#define EVICT_BIN "/data/GoldHEN/bin/elf/evict.elf"
+#define PAYLOAD_BIN "/data/payloads/orbisrpc.bin"
+#define EVICT_BIN "/data/payloads/evict.elf"
 
 /* Stage log: every copy step records errno + sizes to a file we can read
  * back over FTP. The dialog alone can't say WHICH stage failed. */
@@ -224,7 +223,7 @@ static int step_files(void){
     int ok = -1;
     int evict_ok = -1;
     mkdir(INST_DIR, 0777);
-    mkdirs("/data/GoldHEN/bin/elf");
+    mkdirs("/data/payloads");
     /* Evict any running orbisRPC daemon before copying new payload.
      * Read PID from daemon.lock and send SIGTERM then SIGKILL. */
     {
@@ -276,13 +275,14 @@ static int step_files(void){
     snprintf(report, sizeof report,
              "Daemon payload:\n%s : %s%s%s%s\n\n"
              "Evict payload:\n%s : %s%s%s%s\n\n"
-             "Start it from the payload launcher (/data/GoldHEN/bin/elf)\n"
+             "Start it from the payload launcher (/data/payloads)\n"
              "and pick orbisrpc.",
              PAYLOAD_BIN, ok == 0 ? "OK" : "denied",
              ok == 0 ? "" : " [stage ", ok == 0 ? "" : g_stage, ok == 0 ? "" : "]",
              EVICT_BIN, evict_ok == 0 ? "OK" : "denied",
              evict_ok == 0 ? "" : " [stage ", evict_ok == 0 ? "" : g_stage, evict_ok == 0 ? "" : "]");
     ui_ok(report);
+    ui_ok(report);
     if(ok != 0){
         ui_ok("Install failed: could not write the payload.\n\nStopping here.");
         return -1;
@@ -394,7 +394,7 @@ int main(void){
     ilogv("post-token", 0, 0);
     ui_ok("Setup " SETUP_VERSION " complete.\n\n"
             "evict.elf removed the old daemon.\n"
-            "Both payloads are in /data/GoldHEN/bin/elf.\n"
+            "Both payloads are in /data/payloads.\n"
             "Launch orbisrpc from the payload launcher.");
     finish(0);
 }