Say the folder dialogue is the portal, and what the Flatpak has not proved

distribution.md §4, outstanding.md's FR-PLAT-LIN-3 entry, the Flatpak
manifest's comment and the README all said a library was chosen by
typing a path and that nothing in the tree called the FileChooser
portal. Since 6683c14 every folder the desktop asks for is chosen
through rfd's xdg-portal backend, so those sentences were false.

What they now say instead is narrower than "it works in the sandbox":
no Flatpak has been built here, so whether the portal's path opens a
library, holds across a restart and takes a sidecar is unobserved, and
volumes() still cannot see a host card. The chooser also landed in ui/
rather than behind the dr-plat seam distribution.md had proposed, and
both documents say so. FR-PLAT-LIN-3 gets a status note to the same
effect.

README.md

@@ -64,7 +64,7 @@ texture directly — no readback between the GPU and the screen.
 | Arch Linux | [`packaging/PKGBUILD`](packaging/PKGBUILD) — `makepkg -si` | Built from every release |
 | Android | The APK from each CI run, or `./docker/android/package.sh --install` | Runs on a tablet; F-Droid not yet submitted |
 | Windows | `DarkRoom-<version>-x86_64-setup.exe`, cross-built by CI ([windows.md](docs/dev/windows.md)) | Verified under Wine only; unsigned |
-| Flatpak | [`packaging/flatpak/`](packaging/flatpak/) | Manifest in tree; choosing a library does not yet work in the sandbox |
+| Flatpak | [`packaging/flatpak/`](packaging/flatpak/) | Manifest in tree; folders are chosen through the portal, but no Flatpak has been built to prove it |
 
 Or build it. Git LFS is required for the model weights, and the toolchain
 pins itself to 1.92.0:
@@ -95,10 +95,11 @@ the rest are written down rather than merely absent.
 survey culling, AI denoise, tiled rendering, HDR merge and
 focus stacking, importing a Lightroom or darktable catalog, translations
 beyond the launch screen, most of the Android platform integration beyond
-running, and the Flatpak's library chooser. The performance targets are half
-verified: the per-commit benchmark suite §8 requires exists for everything
-that does not need a frame — the catalog, the scan, the thumbnails — and
-not yet for the render path, so a regression there fails nothing.
+running, and a Flatpak actually built and run in its sandbox. The
+performance targets are half verified: the per-commit benchmark suite §8
+requires exists for everything that does not need a frame — the catalog,
+the scan, the thumbnails — and not yet for the render path, so a regression
+there fails nothing.
 [outstanding.md](docs/dev/outstanding.md) is the list, with the reasoning for
 each.