docs: reconcile milestone acceptance and propose catalog core design

README.md

@@ -3,11 +3,18 @@
 MeshVault is a self-hosted 3D model library being built as a Docker service.
 It catalogs logical models containing STL parts, images and supplementary documents.
 
-**Status:** M1 development stack is up. A four-service Docker Compose stack serves
-a Slim 4 landing page with Tailwind CSS, configuration/logging, and cross-platform
-task wrappers. There is no catalog application, database schema or migration runner
-yet. See [the development stack setup](docker/README.md) for first-run instructions.
-Do not deploy this as a production service.
+**Status:** The development stack, Phinx database migrations, and initial CLI import
+engine are implemented. Imports have scanning, STL validation, streaming hashes,
+verified copying, durable jobs, and repository integration. PostgreSQL-specific
+integration tests exercise production migrations and two-session locking.
+
+This is not yet a usable catalog application or a completed import workflow. The
+HTTP surface is a landing page; explicit grouping confirmation, complete crash/retry
+recovery, catalog editing, and browse/search screens remain unfinished. M2/M3 issue
+acceptance is partial, not implied by the existence of schema or engine code.
+See [the acceptance review](docs/project-status.md),
+[the development stack setup](docker/README.md), and
+[PostgreSQL testing](docs/postgres-tests.md). Do not deploy as a production service.
 
 ## Planned MVP
 
@@ -91,8 +98,8 @@ required. The generated `public/build/app.css` is served statically by nginx.
 string values; supported keys, defaults and validation rules are in `.env.example`.
 Native PHP does not read `.env`: export the variables through your shell/process
 manager, then pass `getenv()` to the factory after requiring `vendor/autoload.php`.
-Compose environment injection/startup validation will be wired in Task3. Validate as
-the actual runtime user, not root. The library never creates or chmods library roots.
+Compose injects the environment and the PHP entrypoint validates configuration as
+the runtime user before starting FPM. The library never creates or chmods library roots.
 
 Readonly properties: `environment`, `libraryPath`, `dbHost`, `dbPort`, `dbName`,
 `dbUser`, `dbPassword`, `logLevel`. Configuration JSON/debug/serialization is redacted;
@@ -104,7 +111,7 @@ This is not a general-purpose sanitizer for arbitrary caller-supplied secrets.
 newline-delimited JSON to stdout at the configured level. `forJob($logger, $jobId)`
 returns an independent scope; its `job_id` takes precedence over caller context,
 while other context is retained. Re-scoping replaces the job ID; the base logger
-and other jobs are unchanged. FPM forwarding remains a Task3 verification gate.
+and other jobs are unchanged. FPM forwarding was exercised during M1 runtime validation.
 
 ## License