README and STATUS.json are current (roadmap WS-U task 3): Deploy now says production deploys with sudo ovhost deploy coupons (unit, port, env file, rollback) and keeps the first-install steps; Security points to SECURITY.md; Capabilities links the grants Coupons uses elsewhere; Depends on names the pins package.json has (publishing v0.4.0, contracts v0.53.0, shared v1.22.0, sdk v0.12.0). STATUS.json gains contracts, features, the current package list and updated 2026-09-28.

ddiff --git a/README.md b/README.md
iindex 3be77d4..d95cf16 100644
---- a/README.md
++++ b/README.md
@@@ -291,11 +291,15 @@ openvibe-contracts v0.25.0 from the proposals in `docs/capabilities-proposal/` a
  `docs/service-manifest-proposal.json`. Install scopes (`coupons.lookup`, `coupons.report`) are
  Coupons-local and aren't capabilities.
  
++What Coupons calls elsewhere, and with which grant, is under
++[Grants the Network must hold](#grants-the-network-must-hold).
++
  ## Depends on
  
--- **Packages** (all pinned by release tarball): `openvibe-publishing` v0.2.1 (seo gate, ssr,
--  index-hooks), `openvibe-contracts` v0.33.0, `openvibe-shared` v1.5.1 (chrome, app icon, footer,
--  legal, release, metrics, ready, seo), `openvibe-sdk` v0.5.0 (events outbox, service tokens).
++- **Packages** (all pinned by release tarball): `openvibe-publishing` v0.4.0 (seo gate, ssr,
++  index-hooks), `openvibe-contracts` v0.53.0, `openvibe-shared` v1.22.0 (chrome, app icon, footer,
++  legal, release, metrics, ready, seo), `openvibe-sdk` v0.12.0 (events outbox, service tokens,
++  per-actor limits).
  - **OpenVibe.Network:**
    - SSO: an OAuth client `coupons` with redirect `https://openvibe.coupons/auth/callback`
      (registered in production).
@@@ -338,6 +342,8 @@ Each grant is `[client, capability, audience]`:
  
  ## Security and threat review
  
++Reporting a vulnerability: [SECURITY.md](SECURITY.md).
++
  - **Identity:**
    - Only verified Network JWTs (offline RS256 against JWKS), service tokens for audience
      `openvibe.coupons`, and `cpx_` install tokens.
@@@ -415,6 +421,15 @@ fnm exec --using=22.22.1 npm run dev       # http://localhost:4850 (set OV_OAUTH
  
  ## Deploy (for the lead)
  
++Production deploys with `sudo ovhost deploy coupons` on the host (strategy `git-checkout`: fetch,
++fast-forward `/opt/openvibe.coupons`, install on a lockfile change, restart, wait for `/api/ready`).
++The unit is `openvibe-coupons.service` on `127.0.0.1:4850`, the env file `/etc/openvibe/coupons.env`.
++Rollback: ovhost puts the previous sha back by itself when `/api/ready` does not answer 2xx after the
++restart; afterwards `sudo ovhost rollback coupons --to <sha>`. Nothing blocks a rollback: the schema
++code only adds tables and columns.
++
++First install (done once; kept for a rebuild):
++
  1. **Network:**
     - Create the service principal and OAuth client `coupons` (`server/setup/service-principal.js`),
       and put the secret in the env file.
ddiff --git a/STATUS.json b/STATUS.json
iindex 66123c3..b2386e1 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -7,20 +7,9 @@
    "runtime": "node 22, express 4, better-sqlite3 11",
    "port": 4850,
    "domain": "openvibe.coupons",
--  "packages": [
--    "openvibe-publishing v0.2.1",
--    "openvibe-contracts v0.33.0",
--    "openvibe-shared v1.5.1",
--    "openvibe-sdk v0.5.0"
--  ],
--  "capabilities": [
--    "coupons.coupon.submit",
--    "coupons.report.create",
--    "coupons.merchant.resolve",
--    "coupons.coupon.lookup",
--    "coupons.status.update",
--    "coupons.merchant.manage"
--  ],
++  "contracts": "openvibe-contracts v0.53.0",
++  "packages": ["openvibe-publishing v0.4.0", "openvibe-contracts v0.53.0", "openvibe-shared v1.22.0", "openvibe-sdk v0.12.0"],
++  "capabilities": ["coupons.coupon.submit", "coupons.report.create", "coupons.merchant.resolve", "coupons.coupon.lookup", "coupons.status.update", "coupons.merchant.manage"],
    "installScopes": ["coupons.lookup", "coupons.report"],
    "capabilitiesRegistered": true,
    "serviceManifestRegistered": true,
@@@ -28,7 +17,18 @@
    "notifications": "watches are recorded; no notification is sent: OpenVibe.Network has no notification consumer yet",
    "client": "OpenVibers/OpenVibe.Extensions browser/ (not published to any store; the Coupons API it calls is not public yet)",
    "deployed": true,
--  "deployment": "openvibe-ovh, unit openvibe-coupons, 127.0.0.1:4850 loopback only (release 54df411; the later 9b9549e changes only the repo's nginx reference file); /api/ready 200 with every check ok; Network OAuth client coupons and its grants exist; production database holds 0 coupons. Deployed internally, not launched: openvibe.coupons still serves the OpenVibe.Sites placeholder until a person verifies a coupons source's terms and enables it in Sources",
++  "deployment": "Deployed with `sudo ovhost deploy coupons`: unit openvibe-coupons, 127.0.0.1:4850 loopback only; Network OAuth client coupons and its grants exist; on 2026-09-23 /api/ready answered 200 and the production database held 0 coupons. Deployed internally, not launched: openvibe.coupons still serves the OpenVibe.Sites placeholder until a person verifies a coupons source's terms and enables it in Sources",
    "placeholderInSites": true,
--  "updated": "2026-09-23"
++  "updated": "2026-09-28",
++  "features": [
++    "merchants with normalized domain rules (public-suffix subset, path rules)",
++    "codes with restrictions, known or unknown expiry and evidence",
++    "validity reports by people, one per person per day, with confidence and decay",
++    "expired codes leave API, pages, feeds, sitemaps and Search at the instant of expiry",
++    "server-rendered pages useful without JavaScript",
++    "/api/v1 by capability and browser-helper install tokens",
++    "OpenVibe.Sources coupons import with holds",
++    "SDK outbox events and Search index documents",
++    "per-actor limits (openvibe-sdk/limits)"
++  ]
  }