diff --git a/README.md b/README.md
index 77a6056..1fea2d3 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,9 @@
-# CitrixPot — NetScaler / Citrix ADC Gateway honeypot (CVE-2019-19781, CVE-2026-88771, CVE-2026-88772)
+# CitrixPot — NetScaler / Citrix ADC Gateway honeypot
 
 A self-hosted, dependency-free **Citrix NetScaler / Citrix ADC / Citrix Gateway honeypot** for
 defensive **threat intelligence**. It impersonates the NetScaler Gateway login and the
-documented log-poisoning command-injection path, records everything attackers send, and — in
-simulation mode — **never executes attacker commands**. It is a decoy for catching Citrix
+documented log-poisoning command-injection path, records requests that reach its bounded
+collector, and — in simulation mode — **never executes attacker commands**. It is a decoy for catching Citrix
 exploit attempts, not a real appliance and not a vulnerability scanner.
 
 > **Keywords:** Citrix ADC honeypot, NetScaler Gateway honeypot, Citrix command injection,
@@ -113,19 +113,87 @@ Checks: `python3 test_nitro.py`, `python3 test_capture.py`, `python3 test_honeyp
 `python3 test_safety.py`. Optional execution tools described below are incompatible with
 `--simulation-only` and are not used by the supplied HTTP service.
 
-- Serves a realistic **NetScaler Gateway / Citrix ADC login** (German AAA page) at `/`,
-  `/vpn/index.html`, `/vpn/tmindex.html`, `/logon/LogonPoint/*`, `/menu/neo/`, with the
-  `rdx`/`CTXS` scripts and favicon fingerprint that scanners look for.
-- Implements the **published log-to-command injection** trigger and records every candidate;
-  extracted commands are answered with **simulated** output.
-- Stores **every request, header, body and response** as evidence, plus **every uploaded
-  payload** byte-for-byte.
-- Optionally **downloads payload URLs** found in attacker commands (HTTP(S) GET only) and stores
-  them as inert assets. Nothing is ever piped or executed.
-- Includes a **local, read-only analyst web UI** with paged full-text search and raw payload
-  hex/text view.
-- Can optionally run commands in a **disposable, network-restricted guest** for real payload
-  behaviour (off by default; never on a public listener).
+### Supported intake vectors
+
+“Captured” means evidence is retained within the limits below. It does not mean a real
+vulnerability exists, a payload executes, or a CVE is conclusively identified.
+
+| Input surface | Capture and analysis capability |
+| --- | --- |
+| HTTP methods and request targets | GET, HEAD, POST, PUT, DELETE, OPTIONS and other parsed method names; original URI/query and HTTP version. Unknown routes still accept body capture before returning404. Method support in simulated APIs is narrower. |
+| Headers and cookies | Raw header pairs, including duplicates that reach the collector, User-Agent, Cookie, custom headers and proxy evidence aliases. Crash-log markers, encoding hints and headers over8KiB produce private hunt labels. |
+| URL/query probes | Traversal/encoded traversal, appliance-configuration paths, management paths and SAML query fields. Original URI is retained independently of decoded indicators. |
+| URL-encoded forms | Original body plus decoded field pairs, login/password submissions and SAML envelopes. Fields can feed the bounded textual command simulator. |
+| Multipart forms/uploads | Original multipart body, individual field/file bytes, submitted filename, field name, MIME type and parser defects. Filenames are metadata, never host paths. |
+| JSON/API payloads | Original JSON bytes; NITRO systemfile.filecontent additionally becomes a base64-decoded file artifact. Other JSON is captured even if not recognized by the simulator. |
+| Binary/raw uploads | Exact accepted body bytes regardless of executable format or extension; content-addressed inert storage. No malware execution or unpacking. |
+| Chunked requests | Accepted chunked bodies are decoded for body artifacts; consumed origin framing and accepted trailers remain separate evidence. Proxy framing may differ from the client connection. |
+| SAML POST/Redirect bindings | SAMLRequest/SAMLResponse base64 artifacts from forms and queries, plus bounded raw-DEFLATE expansion for query bindings. Invalid encodings/limits are recorded; no XML parsing or authentication. |
+| Malformed/interrupted requests | Rejection/interruption events and consumed partial wire bytes where available. Unread bytes and requests rejected at the edge cannot be recovered. |
+| Outbound-command intent | Recognized network-tool commands in the textual simulator are recorded as outbound attempts; strict capture-only mode makes no connection or download. |
+
+### Simulated endpoints and behavior
+
+| Surface | Supported response behavior |
+| --- | --- |
+| Gateway login pages | `/`, `/vpn/`, `/vpn/index.html`, `/vpn/tmindex.html`, `/logon/LogonPoint/index.html`, `/logon/LogonPoint/tmindex.html`, `/logon/LogonPoint/custom.html`, `/menu/neo/`. German login UI, canonical Citrix Gateway title, NSC_ cookie and Gateway-shaped response headers. |
+| Gateway static fingerprints | Explicit rdx/CTXS JavaScript routes, login.js/init.js, original favicon/logo/background assets and AccessGateway.ico alias. Only routes in STATIC are supported; arbitrary files under these directories return404. |
+| Language/version fingerprints | English/German JSON and `.json.gz` under `/vpn/js/rdx/core/lang/` and `/vpn/js/rdx/core/lang-ext/`; gzip filename, build timestamp, Content-Encoding and Last-Modified. Synthetic translation subset with the default14.1-29.63 metadata. |
+| Authentication XML | `/nf/auth/*` returns credential requirements, state context and local postback. This is a repeated login challenge, not LDAP, SAML, MFA or successful real authentication. |
+| NITRO authentication | `/nitro/v1/config/login` and logout with synthetic session tokens. Resource access accepts a matching fake token, nonempty X-NITRO-USER/X-NITRO-PASS, or a Basic authorization prefix. These are decoy rules, not real user/account validation. |
+| NITRO resources | `/nitro/v1/config/<resource>[/<name>]` and `/nitro/v1/stat/<resource>[/<name>]`;1,493 config and176 statistics names in [nitro-resources.json](nitro-resources.json). Common system/network/Gateway/AAA/SSL/LB/binding records are populated; other recognized resources return empty collections or generic counters. |
+| NITRO operations | Config reads, fake POST/PUT/DELETE, enable/disable/rename, inert administrative-action acknowledgements, attrs, literal filter/args, counts, pagesize and pageno. Unknown resources, invalid input, unsupported methods and unauthenticated access return simulator errors. |
+| Textual command simulation | Approximate log-poisoning marker extraction from URI, headers and decoded form fields. Bounded shell-like grammar supports id, whoami, uname, pwd, cd, cat, ls, echo, selected printf formats, touch, rm and simple redirects in per-source memory. mkdir/true/colon are acknowledgements; unsupported commands are recorded. No real shell or filesystem access. |
+| Private/uploaded paths | The supplied public service uses --hide-guest-files: evidence, source, viewer and uploaded files are not served by the honeypot. Unknown `.env`, PHP, GraphQL and other application paths return404 while incoming requests remain captured. |
+
+### CVE/vector coverage status
+
+This matrix describes collection and simulation coverage, not an exploit implementation or
+a guarantee of detecting every variant. Generic indicators must be corroborated manually.
+
+| Advisory/vector | Current coverage |
+| --- | --- |
+| CVE-2019-19781 | Conservative Gateway/vpns path labels and raw traversal-request capture; no vulnerable template engine or actual traversal. |
+| CVE-2026-88771 | HTTP header/form/URI capture, crash-log markers, approximate textual command extraction and inert responses. No real log-to-shell execution or full multi-stage chain emulation. |
+| CVE-2026-19490 | Gateway/AAA and SAML-envelope intake; no real authentication-bypass reproduction or dedicated definitive CVE signature. |
+| CVE-2026-88779 | SAML original/decoded evidence with bounded inflation; no SAML SP/IdP engine, memory-overflow reproduction or dedicated definitive CVE signature. |
+| CVE-2026-88773 /88774 /88775 | Generic HTTP framing, URL and size-related evidence where it reaches the collector. No NetScaler request-smuggling, policy engine or memory-corruption emulation. |
+| CVE-2026-88772 | DTLS/UDP collection is not implemented or active; HTTP follow-up requests can still be captured. |
+| CVE-2026-19489 /88776 /88777 /88778 | SIP ALG, Oracle/non-HTTP protocol and TCP sequence-number behavior are not emulated. |
+| Other Citrix vectors, including CitrixBleed | HTTP requests can be retained, but unlisted vectors have no promised dedicated detector or vulnerable response simulation. No real memory or session-secret disclosure. |
+
+Advisory references: [CTX697096](https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htm),
+[CTX696939](https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html),
+[CTX697174](https://support.citrix.com/external/article?articleNumber=CTX697174).
+
+### Evidence, attribution and operations
+
+- JSONL schema-v2 events link requests, responses, uploads, indicators and simulated actions
+  by request_id/session, timestamp and peer metadata. SHA256 artifacts are deduplicated,
+  stored0600 under a0700 directory and committed with fsync/atomic rename.
+- Trusted-hop PROXYv1 and forwarded-header handling retain effective client identity and
+  proxy provenance; untrusted identity headers are ignored. The original visitor's TCP source
+  port is not recovered through HTTP proxies.
+- Private auth_attempt events count per-source attempts in a300-second window;
+  brute_force_suspected begins at10 attempts. No public lockout, alert or response change.
+- Loopback read-only viewer supports paging, event/source filters, multi-term search,
+  escaped text/hex inspection and artifact download. Public evidence routes stay unavailable.
+- Ordinary service crashes restart after5seconds; evidence failures set STOP/exit78.
+  No automatic evidence deletion, backups or remote telemetry are added.
+
+| Bound | Default/current implementation |
+| --- | --- |
+| Accepted request body |16MiB; received header names/values capped at32KiB after HTTP parsing. Earlier parser/proxy limits also apply. |
+| Concurrent requests |8 |
+| Form/query decoding |64KiB and128 fields; multipart processing stops after128 visited MIME parts. |
+| Indicator body inspection / SAML inflation |First64KiB / maximum64KiB; larger accepted bodies remain raw evidence. |
+| Per-source sessions |128 sessions, one-hour inactivity TTL; in-memory state resets on restart and NAT may merge users. |
+| Fake config / simulated files |64KiB serialized config state;64 virtual files,8,192 text characters each;16 pending commands per session and32 parsed command groups per simulation. |
+| Storage |Configurable evidence quota; fails closed at quota or storage errors rather than silently dropping evidence. |
+
+Legacy VM-execution and URL-fetch tools remain in the repository for separate lab use.
+They are incompatible with --simulation-only, disabled in the supplied public service,
+and are not part of the supported capture-only capability set above.
 
 ## Architecture