README and STATUS.json are current (roadmap WS-U task 3): the README, which had no sections, now has Purpose (the existing overview), Owns, Does not own, Depends on, Capabilities (none), Tests and build (what npm test proves), Security (SECURITY.md, static pages, vhost headers, honest labels) and Deploy (sudo ovhost deploy sites --restart, as before, plus rollback and the absence of a unit, port or env file). It says the placeholders run this repository's pinned OpenVibe Frame from dist/_shared/, not files from openvibe.network (changed in 32464ec). STATUS.json is new, in the shape of Search's: stage stable (the manifest's), the 16 domains, no contracts pin, deployed, features, updated 2026-09-28. npm test passes.

ddiff --git a/README.md b/README.md
iindex a0e4e93..b39fa86 100644
---- a/README.md
++++ b/README.md
@@@ -1,5 +1,7 @@
  # OpenVibe.Sites
  
++## Purpose
++
  Static front pages for the OpenVibe domains that are not public applications yet. As of
  2026-09-24 (`sites.json`; production ran `18166b1` when this was written): `openvibe.news`,
  `.reviews`, `.tips`, `.vip`, `.trade`, `.host`, `.deals`, `.coupons`, `openre.stream`, and `auth`,
@@@ -13,8 +15,37 @@ CORS-open `/api/v1/registry/health`.
  `openvibe.codes`, `openvibe.wiki`, `openvibe.blog`, `openvibe.chat` (2026-09-24), `events.openvibe.network` and
  `billing.openvibe.network` have left for their own services. One catalog (`sites.json`), one template
  (`build.js`), real pages: what the site will be, what to use on the network meanwhile, the whole
--network, sign-in — with the shared navbar, footer and theme loader from openvibe.network, full
--SEO (canonical, Open Graph, Twitter, JSON-LD, robots, sitemap, manifest).
++network, sign-in — with the OpenVibe Frame (navbar, footer, theme loader) from this repository's
++pinned openvibe-shared, copied into `dist/_shared/` and served at `/shared/` on every placeholder, so a
++page keeps its frame while Network is down; full SEO (canonical, Open Graph, Twitter, JSON-LD, robots,
++sitemap, manifest).
++
++## Owns
++
++- the catalog `sites.json`, the template `build.js` and the generated `dist/<domain>/` pages
++  (checked in), with a `404.html` and a `release.json` per domain
++- the nginx vhosts `deploy/nginx/<domain>.conf` for those domains
++- `facts.json`, the committed snapshot of each repository's `STATUS.json` and Network's registry exposure
++
++## Does not own
++
++- any product: a domain leaves the catalog when its own service launches on it
++- the facts themselves (each repository's `STATUS.json`, Network's registry), the Frame (OpenVibe.Shared)
++- certificates (certbot on the host) and DNS (Cloudflare)
++
++## Depends on
++
++- `openvibe-shared` v1.23.0 (the Frame files, SEO helpers), pinned by release tarball
++- the sibling checkouts' `STATUS.json` and Network's `/api/v1/registry/services` (only when refreshing
++  `facts.json`); in the browser, the status page reads Network's CORS-open `/api/v1/registry/health`
++- OpenVibe.Host (`ovhost deploy sites`, strategy `static-build`) and nginx on the host
++
++## Capabilities
++
++None: Sites implements no capability, holds no grant and calls no service with a token. The pages load
++only their own files, and the status notice reads Network's public health endpoint in the browser.
++
++## Tests and build
  
  ```
  npm ci                   # openvibe-shared: the pinned OpenVibe.Shared release (package.json)
@@@ -32,10 +63,25 @@ subdomain of a live service says it is not routed yet; only a repository with no
  "charter only". The build reads the committed snapshot, so it is reproducible; `npm test` fails
  locally when a sibling's `STATUS.json` stage or code flag no longer matches it.
  
++`npm test` runs `test/build.test.js` (dist is current; every label matches `facts.json`; no shared file
++comes from openvibe.network and each `/shared` URL carries its file's hash; a live service's domain is
++never also a placeholder; 404 pages) and `test/deploy-wrapper.test.js` (the deploy wrapper and its
++fallback, against a fake ovhost and a temp checkout).
++
  Every domain also gets a `404.html`: its vhost answers any path that is not a file in
  `dist/<domain>/` with status 404 and that page (`try_files … =404` + `error_page 404 /404.html`),
  never the front page.
  
++## Security
++
++Reporting a vulnerability: [SECURITY.md](SECURITY.md). The pages are static: no server code, no
++forms and no secrets (the Frame's navbar asks Network for the visitor's session, as on every site). Every vhost sets `X-Content-Type-Options`,
++`X-Frame-Options`, `Referrer-Policy` and HSTS (repeated in each location that adds headers), and answers
++unknown paths with 404. Placeholders are `noindex` where they are notices and never claim a product is
++live (`test/build.test.js` holds labels to `facts.json`).
++
++## Deploy
++
  Deploy (host): the repo lives at `/opt/openvibe.sites`. `sudo deploy/scripts/deploy.sh` runs
  `ovhost deploy sites --restart` (OpenVibe.Host, strategy `static-build`; `DRY_RUN=1` for the plan). ovhost
  pulls first, as the checkout owner, so a stale checkout never installs old vhosts: it restores the tracked
@@@ -50,5 +96,9 @@ and `https://<domain>` as the origin, once per release, so open tabs check `/rel
  elsewhere. When ovhost is missing, too old or does not deploy Sites with that strategy, the wrapper pulls
  and runs `deploy/scripts/deploy-legacy.sh`, the previous script, unchanged (`OVHOST_LEGACY=1` forces it).
  
++Rollback: there is no ready URL, so nothing is automatic; `sudo ovhost rollback sites --to <sha>` rebuilds
++that commit and installs its vhosts behind `nginx -t`. There is no env file, unit or port: nginx serves
++`dist/` directly.
++
  When a domain becomes a real app, delete it from `sites.json`, remove its vhost, and point the
  domain's nginx block at the new service — nothing else references it.
ddiff --git a/STATUS.json b/STATUS.json
nnew file mode 100644
iindex 0000000..2753ba0
---- /dev/null
++++ b/STATUS.json
@@@ -0,0 +1,36 @@
++{
++  "repository": "OpenVibers/OpenVibe.Sites",
++  "stage": "stable",
++  "code": true,
++  "kind": "static site generator",
++  "domains": [
++    "openvibe.news",
++    "openvibe.reviews",
++    "openvibe.tips",
++    "openvibe.vip",
++    "openvibe.trade",
++    "openvibe.host",
++    "openvibe.deals",
++    "openvibe.coupons",
++    "openre.stream",
++    "auth.openvibe.network",
++    "api.openvibe.network",
++    "admin.openvibe.network",
++    "themes.openvibe.network",
++    "ai.openvibe.network",
++    "realtime.openvibe.network (closed notice)",
++    "status.openvibe.network (status notice)"
++  ],
++  "contracts": "none: package.json pins no openvibe-contracts (openvibe-shared v1.23.0 only)",
++  "deployed": true,
++  "deployment": "Deployed with `sudo ovhost deploy sites --restart` (OpenVibe.Host strategy static-build since the 2026-09-27 cutover): /opt/openvibe.sites, nginx serves dist/<domain>/ through deploy/nginx/<domain>.conf; no unit, no port, no env file",
++  "features": [
++    "one catalog and one template for every placeholder and notice page",
++    "labels built from facts.json (each repository's STATUS.json and Network's registry), never a hand-kept list",
++    "the pinned OpenVibe Frame served from dist/_shared/",
++    "full SEO: canonical, Open Graph, Twitter, JSON-LD, robots, sitemap, manifest",
++    "404 pages and generated nginx vhosts",
++    "a release.json per domain and host.release.published on deploy"
++  ],
++  "updated": "2026-09-28"
++}