README: the core is complete

README.md

@@ -63,10 +63,26 @@ crafter-build test --target=aarch64-alpine-linux-musl
 
 ## Status
 
-Early. The core is being ported one wire format at a time out of the research
-harness that first made the sensor work (`utilities/fpta.c` in the fp6 repo),
-each piece landing with tests before the next starts. `Fingerprintd:Sfs` — the
-gpfile frame — is done. The daemon itself does not run yet.
+**The core is complete; the daemon does not run yet.** Everything was ported
+out of the research harness that first made the sensor work (`utilities/fpta.c`
+in the fp6 repo), one module at a time, each landing with its tests before the
+next started.
+
+| module | what it holds |
+|---|---|
+| `:Sfs` | the gpfile frame — the read/write offset split, the `O_TRUNC` guard, root mapping, path-traversal rejection |
+| `:Rpmb` | request/reply framing, the bytes-transferred out-parameter, JEDEC result codes, chunking, the one-time-programmable key guard |
+| `:Ta` | command surface, the 740-byte event context, capture flags, SAVE_DATA masks, enrol/auth payloads, the error table, the verdict rule |
+| `:Engine` | baseline calibration, touch edges, enrolment progress, and the accounting |
+| `:Store` | the finger name map |
+
+Every constant that was recovered by reverse-engineering carries where it came
+from, and the tests are written to fail if it is undone rather than to restate
+it. Several replay real captures: two SFS containers off the phone, and three
+recorded authentication runs.
+
+Next is the I/O shell — the TEE session, the sensor rail, the RPMB device and
+the bus — which is the first part that cannot be validated without hardware.
 
 The working reference enrols a finger, keeps it across a reboot, and matches it
 with zero false accepts; the port exists to turn that into a service rather