diff --git a/.codesearch/codesearch.db b/.codesearch/codesearch.db
index d9000f9..28ad0b5 100644
Binary files a/.codesearch/codesearch.db and b/.codesearch/codesearch.db differ
diff --git a/STATUS.md b/STATUS.md
index 6f72a12..bcfa032 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -153,13 +153,22 @@ Run: `go test -race -timeout 120s ./internal/... -count=1`
    `internal/localzone` were started but the agent ran out of budget;
    `internal/resolver` was not started at all.
 
-### Not started
+### Not started / incomplete deliverables
 
-- `Makefile`, `.gitignore`, `Dockerfile`, `deploy/k8s/`,
-  `.github/workflows/ci.yml` and a real `README.md` (it is still a 0-byte
-  file) were never written.
-- End-to-end verification of the freshly built console against the running
-  binary: the bundle compiles and embeds, but nobody has clicked through it.
+- **`README.md` is still a 0-byte file.** Everything else in the deploy set
+  exists (written in a parallel pass) and is tracked: `Makefile` (4 KB),
+  `Dockerfile`, `.gitignore`, `.github/workflows/ci.yml` (6 KB),
+  `deploy/config.example.yaml`, `deploy/local.example.zone`, `deploy/zones/`.
+  None of it has been *reviewed against the code* — the CI workflow and the
+  Makefile targets (`make web`, `make race`, `make image`) need a
+  `make -n`/dry-run pass, and every config key, port and CLI flag the docs
+  mention has to be checked against `internal/config` and `cmd/fancy-dns`.
+- **`deploy/k8s/` has only two of the seven expected manifests**
+  (`00-config.yaml`, `10-deployment.yaml`). Still missing: Service, PVC,
+  ServiceAccount + Secret (the API key), Ingress (needs
+  `proxy_buffering off` for the SSE log stream), namespace and kustomization.
+- End-to-end verification of the console against a running binary: the bundle
+  compiles and embeds, but nobody has clicked through the pages.
 - `internal/web/dist` is gitignored except `.gitkeep`, so a fresh clone cannot
   build the binary without running `npm ci && npm run build` first. Either CI
   builds the bundle before `go build`, or the ignore rule comes off.
@@ -194,12 +203,18 @@ failover, `Rebind` under `-race` — with a `dns.Server` fake on `127.0.0.1:0`),
 forms), `localzone` (delegation cut, closest-wildcard per RFC 1034 §4.3.3,
 NODATA vs NXDOMAIN), `config` (`Duration` parsing, `Validate`, the store hooks).
 
-### Step 4 — the frontend and deploy deliverables
+### Step 4 — review the deploy set and write the README
 
-Finish the console (pages exist; verify them in a browser against a running
-binary), then write `Makefile`, `Dockerfile`, `deploy/k8s/`, CI and the
-`README.md`. CI must run `npm ci && npm run build` before `go build`, because
-the Go build embeds `internal/web/dist`.
+The console pages exist and build; verify them in a browser against a running
+binary. Then read `Makefile`, `Dockerfile` and `.github/workflows/ci.yml`
+against the code and fix what does not match, add the missing k8s manifests
+(Service, PVC, ServiceAccount + Secret, Ingress with `proxy_buffering off` for
+`/api/logs/stream`, namespace, kustomization), and write `README.md` from the
+source: config reference, zone-file semantics, blocklist formats, API routes,
+the `trusted_proxies` / `metrics.protect` / `auth.mode` security caveats, and
+the limitations (no DNSSEC validation, no zone transfer, no dynamic update).
+CI must run `npm ci && npm run build` before `go build`, because the Go build
+embeds `internal/web/dist`.
 
 ## Design notes worth preserving