docs: polish README structure and control-plane notes

README.md

@@ -15,6 +15,15 @@ What is already in place:
 - browser UI on `/`
 - live audio ingestion via stdin or HTTP stream input
 
+Current engineering focus:
+- deterministic runtime behavior
+- fault handling / recovery
+- observability and runtime telemetry
+- hardware-validated signal quality
+
+For the active runtime-hardening track, see:
+- `docs/pro-runtime-hardening-workboard.md`
+
 ## Signal path
 
 ```text
@@ -162,13 +171,16 @@ If the README is too high-level for the exact CLI surface, check:
 
 Base URL: `http://{listenAddress}` (default typically `127.0.0.1:8088`)
 
+Security note:
+- keep the control plane bound locally unless you intentionally place it behind a trusted and hardened access layer
+
 ### Main endpoints
 
 ```text
 GET  /              browser UI
 GET  /healthz       health check
 GET  /status        current config/status snapshot
-GET  /runtime       live engine/driver/audio telemetry
+GET  /runtime       live engine / driver / audio telemetry
 GET  /config        full config
 POST /config        patch config / live updates
 GET  /dry-run       synthetic frame summary
@@ -291,7 +303,7 @@ examples/
 
 ## Planning / workboard
 
-For the current pro-runtime-hardening track, see:
+For the current runtime-hardening / professionalization track, see:
 - `docs/pro-runtime-hardening-workboard.md`
 
 This is the living workboard for:
@@ -309,6 +321,7 @@ Additional project docs:
 - `docs/README.md`
 - `docs/API.md`
 - `docs/DSP-CHAIN.md`
+- `docs/NOTES.md`
 
 ## Legal note