Improve Gateway fingerprints and header/body coverage

README.md

@@ -49,6 +49,17 @@ Use `--simulation-only` to refuse execution and URL fetching. The supplied HTTP
 this mode and does not depend on an execution guest or relay. The loopback viewer service
 disables external public-IP discovery. These services create no backups.
 
+Gateway fingerprints include the canonical Citrix Gateway title, NSC_ cookie and original image assets.
+English/German language JSON and gzip endpoints carry the default 14.1-29.63 persona's build timestamp
+1723114781, as catalogued by [Fox-IT](https://github.com/fox-it/citrix-netscaler-triage).
+Translations are synthetic subsets, not original firmware files. If changing HONEYPOT_VERSION, also
+set HONEYPOT_ASSET_MTIME to that firmware's documented timestamp; metadata matching does not prove
+full firmware emulation. Gzip assets are returned with Content-Encoding and Last-Modified.
+Authentication XML includes credential requirements and a postback route; it grants no real access.
+`request_indicators` hunts header/body log markers and encoding hints without claiming a confirmed CVE.
+Bodies are inspected up to64KiB for these hints; complete accepted bodies remain captured independently.
+Run `python3 test_profile.py` for passive identification, gzip decoding/metadata, XML and capture checks.
+
 The NITRO simulator supports login/logout cookies, configuration and statistics resource routes,
 named reads, fake POST/PUT/DELETE operations, enable/disable/rename acknowledgements, bindings,
 `attrs`, literal `filter`/`args`, counts and pagination. Its catalog recognizes 1,493 configuration