README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose (the opening sentence), Owns, Does not own, Depends on, Capabilities (the 20 capabilities in the manifest, where other services' grants are seeded, and the svc:network tokens Network signs for Events and AI), Acceptance (what the 74 test files cover) and Security (SECURITY.md, tokens, redirects, private data, CORS, secrets by name) sections; Deploying adds the unit, port, env file, rollback and the two schema blockers. STATUS.json is new, in the shape of Search's, updated 2026-09-28.

ddiff --git a/README.md b/README.md
iindex 280cddff..a5b5c29a 100644
---- a/README.md
++++ b/README.md
@@@ -1,5 +1,7 @@
  # OpenVibe.Network
  
++## Purpose
++
  Identity and account service for the OpenVibe network. Manages user accounts, OAuth2 authorization, theme preferences, notifications, email alerts, anonymous identities, the network-wide OpenCoins wallet, and internal APIs that connect all OpenVibe services together.
  
  **Part of the [OpenVibe](../ARCHITECTURE.md)** — `https://openvibe.network`
@@@ -25,6 +27,44 @@ Identity and account service for the OpenVibe network. Manages user accounts, OA
  
  ---
  
++## Owns
++
++- accounts, sessions, anonymous identities, canonical subjects (`usr_…`, `gst_…`) and account merges
++- OAuth2/OIDC (the network's token issuer and its signing key), service principals and their grants,
++  developer projects, apps, credentials, grants and quotas (ADR-014), mod principals
++- notifications and email, themes and theme preferences, user modules, platform blocks, the follow
++  graph (ADR-030), creator analytics (ADR-021), the OpenCoins wallet
++- the service registry (`/api/v1/registry/*`, `/.well-known/openvibe`), the status page, the network
++  changelog proxy, and the files at `/shared/*` (the pinned openvibe-shared release)
++
++## Does not own
++
++- money (OpenVibe.Billing), channel points and streams (OpenVibe.Live), each service's data (a user
++  module's namespace belongs to the service that owns it)
++- the contracts it serves (OpenVibe.Contracts) and the Frame's code (OpenVibe.Shared)
++
++## Depends on
++
++- `openvibe-contracts` v0.75.0 (registry manifests, capability checks), `openvibe-sdk` v0.12.0 (events,
++  per-actor limits), `openvibe-shared` v1.22.0, pinned by release tarball
++- OpenVibe.Events (Network's outbox relay; the events it consumes), OpenVibe.AI (the `network.site_copy`
++  workflow), OpenVibe.Blog (the changelog feed it proxies)
++- email (Resend), Discord and GitHub when their secrets are set ([Provider secrets](#provider-secrets))
++
++## Capabilities
++
++Implemented here (the service manifest's 20 `capabilities`, audience `openvibe.network`):
++`identity.subject.resolve`, `mods.grant.manage`, `network.account.deletion.confirm`,
++`network.account.export.contribute`, `network.analytics.creator.read`, `network.blocks.read`,
++`network.coins.credit|debit|transfer`, `network.follows.read|write`, `network.integration.github.read`,
++`network.modules.read|write`, `network.notifications.push`, `network.operator.alert`,
++`network.project.manage|read`, `network.staff.read` and `network.status.incident`. The grants other
++services hold are seeded in [server/identity/principals.js](server/identity/principals.js).
++
++Called elsewhere: Network is the issuer, so it signs its own `svc:network` tokens: `events.event.publish`
++(and `events.delivery.admin` for the admin Events views) at OpenVibe.Events, and `ai.run.create` /
++`ai.run.read` at OpenVibe.AI for the footer's site copy.
++
  ## Architecture
  
  ```
@@@ -96,6 +136,12 @@ restart, `/api/ready` polled, an automatic rollback if it does not come up, and
  prints `ovhost plan network`. When ovhost is missing, too old or does not manage Network, the wrapper runs
  `deploy/scripts/deploy-legacy.sh`, the previous script, unchanged (`OVHOST_LEGACY=1` forces it).
  
++The unit is `openvibe-network.service` (runs as `ubuntu` from `/opt/openvibe.network`) on
++`127.0.0.1:4000`, the env file `/etc/openvibe/network.env`. Rollback: automatic when `/api/ready` does not
++come up; afterwards `sudo ovhost rollback network --to <sha>`. Two blockers: `chrome_cache`/`chrome_hits`
++became `frame_cache`/`frame_hits` on 2026-09-24 (an older release starts with empty caches), and
++`tool_domains` was rebuilt once for the mirror role (an older release does not know mirror rows).
++
  ---
  
  ## TLS / Certbot Deploy Support
@@@ -661,6 +707,35 @@ Accessible to users with `role = 'admin'`. All endpoints under `/api/admin/`.
  
  ---
  
++## Acceptance
++
++`npm test` runs the 74 test files listed in `package.json` (temp databases, no network). They
++cover OAuth with PKCE, OIDC discovery, refresh-token rotation and reuse, SSO and FedCM, subjects,
++principals and grants, account merge, export and deletion, developer projects, export tokens and usage,
++user modules, blocks, follows and their authority switch, analytics privacy, the registry and its
++exposure, notifications and events, status and incidents, operator alerts, per-actor limits, and the
++security suites (`security-session`, `security-redirects`, `security-secrets`, `security-private`,
++`security-idor`, `security-ssrf`), plus the deploy wrapper.
++
++## Security
++
++Reporting a vulnerability: [SECURITY.md](SECURITY.md). The rules the code keeps:
++
++- **Tokens.** Network signs every token with its RS256 key (`JWT_PRIVATE_KEY` or `data/keys`); refresh
++  tokens are stored as SHA-256 and a reused one revokes its family; `token_valid_after` cutoffs are
++  published so services refuse older tokens; client secrets are stored hashed and shown once.
++- **Redirects.** Post-sign-in targets (`/login?return=`, `/sso/fanout?next=`) never run `javascript:`
++  URLs or leave for a host OpenVibe does not own (`test/security-redirects.test.js`); OAuth redirects
++  must be one of the client's registered URIs.
++- **Private data.** Analytics keep no personal data beyond a day's salted hash; account export and
++  deletion follow ADR-033; the internal routes take a capability-scoped service token or, while it is
++  retired route by route, `X-Internal-Key`.
++- **CORS.** Only discovery and the registry are open to any origin; every other route uses the
++  first-party allow-list.
++- **Secrets.** Provider secrets come from the environment first, never printed; `INTERNAL_API_KEY`,
++  `SETUP_TOKEN`, `ADMIN_PASSWORD`, `NETWORK_EVENTS_SECRET`, the webhook secrets and `GITHUB_TOKEN` live in
++  `/etc/openvibe/network.env` (0600), by name only.
++
  ## License
  
  Same as the parent [OpenVibe](../LICENSE) project.
ddiff --git a/STATUS.json b/STATUS.json
nnew file mode 100644
iindex 00000000..1dea029c
---- /dev/null
++++ b/STATUS.json
@@@ -0,0 +1,48 @@
++{
++  "repository": "OpenVibers/OpenVibe.Network",
++  "stage": "stable",
++  "code": true,
++  "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026)",
++  "runtime": "node 22, express, better-sqlite3",
++  "port": 4000,
++  "domain": "openvibe.network (with auth., api., admin., my. and themes.openvibe.network in its manifest)",
++  "contracts": "openvibe-contracts v0.75.0",
++  "capabilities": [
++    "identity.subject.resolve",
++    "mods.grant.manage",
++    "network.account.deletion.confirm",
++    "network.account.export.contribute",
++    "network.analytics.creator.read",
++    "network.blocks.read",
++    "network.coins.credit",
++    "network.coins.debit",
++    "network.coins.transfer",
++    "network.follows.read",
++    "network.follows.write",
++    "network.integration.github.read",
++    "network.modules.read",
++    "network.modules.write",
++    "network.notifications.push",
++    "network.operator.alert",
++    "network.project.manage",
++    "network.project.read",
++    "network.staff.read",
++    "network.status.incident"
++  ],
++  "capabilitiesRegistered": true,
++  "deployed": true,
++  "deployment": "Public at https://openvibe.network: deployed with `sudo ovhost deploy network --install-units` (deploy/scripts/deploy.sh is the wrapper), /opt/openvibe.network, unit openvibe-network on 127.0.0.1:4000, env /etc/openvibe/network.env.",
++  "features": [
++    "SSO identity provider: OAuth2 code flow with PKCE, OIDC, FedCM, rotating refresh tokens",
++    "canonical subjects, anonymous users, multi-account switching, account merge, export and deletion",
++    "service principals and grants; developer projects, apps, credentials, grants, quotas and usage",
++    "notifications (realtime through Events), email and web push",
++    "themes and preferences, user modules, platform blocks, follow graph, creator analytics",
++    "OpenCoins wallet",
++    "service registry, public discovery and the status page with incidents",
++    "operator alerts relay target and admin panel",
++    "serves /shared/* from its pinned openvibe-shared",
++    "per-actor limits (openvibe-sdk/limits)"
++  ],
++  "updated": "2026-09-28"
++}