docs: update service READMEs for refactor progress and stale phase references

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

admin-compliance/README.md

@@ -5,7 +5,7 @@ Next.js 15 dashboard for BreakPilot Compliance — SDK module UI, company profil
 **Port:** `3007` (container: `bp-compliance-admin`)
 **Stack:** Next.js 15 App Router, React 18, TailwindCSS, TypeScript strict.
 
-## Architecture (target — Phase 3)
+## Architecture (Phase 3 — in progress)
 
 ```
 app/
@@ -40,12 +40,14 @@ npx tsc --noEmit              # Type-check
 npx next lint
 ```
 
-## Known debt (Phase 3 targets)
+## Known debt
 
-- `app/sdk/company-profile/page.tsx` (3017 LOC), `tom-generator/controls/loader.ts` (2521), `lib/sdk/types.ts` (2511), `app/sdk/loeschfristen/page.tsx` (2322), `app/sdk/dsb-portal/page.tsx` (2068) — all must be split.
-- 0 test files for 182 monolithic pages. Phase 3 adds Playwright smoke + Vitest unit coverage.
+- `lib/sdk/types.ts` has been split: it is now a barrel re-export to `lib/sdk/types/` (12 domain files: enums, company-profile, sdk-steps, and others).
+- `lib/sdk/tom-generator/controls/loader.ts` has been split: it is now a barrel re-export to `categories/` (8 category files).
+- Phase 3 refactoring is ongoing — several large page files remain and are being addressed incrementally.
+- **0 test files** for the page layer. Adding Playwright smoke + Vitest unit coverage is ongoing Phase 3 work.
 
 ## Don't touch
 
 - Backend API paths without updating `backend-compliance/` in the same change.
-- `lib/sdk/types.ts` in large contiguous chunks — it's being domain-split.
+- `lib/sdk/types/` barrel re-exports — add new types to the appropriate domain file, not back into the root.

ai-compliance-sdk/README.md

@@ -5,21 +5,30 @@ Go/Gin service providing AI-Act compliance analysis: iACE impact assessments, UC
 **Port:** `8090` → exposed `8093` (container: `bp-compliance-ai-sdk`)
 **Stack:** Go 1.24, Gin, pgx, Postgres.
 
-## Architecture (target — Phase 2)
+## Architecture
+
+Clean-arch refactor is complete:
 
 ```
-cmd/server/main.go          # Thin entrypoint (<50 LOC)
+cmd/server/main.go              # Thin entrypoint, 7 LOC — wiring in internal/app/
 internal/
-├── app/                    # Wiring + lifecycle
-├── domain/<aggregate>/     # Types, interfaces, errors
-├── service/<aggregate>/    # Business logic
-├── repository/postgres/    # Repo implementations
-├── transport/http/         # Gin handlers + middleware + router
-└── platform/               # DB pool, logger, config, httperr
+├── app/
+│   ├── app.go                  # Server initialization + lifecycle
+│   └── routes.go               # Route registration
+├── api/handlers/               # 8 sub-resource handler files:
+│   │                           #   iace_handler_projects, hazards, mitigations,
+│   │                           #   techfile, monitoring, refdata, rag, components
+├── iace/                       # Store split into 7 files:
+│   │                           #   store_projects, components, hazards,
+│   │                           #   hazard_library, mitigations, evidence, audit
+│   └── hazard_library/         # Split into 10 category files
+└── ...
 ```
 
 See `../AGENTS.go.md` for the full convention.
 
+**Linting (Phase 5):** `.golangci.yml` added — run `golangci-lint run --timeout 5m ./...`.
+
 ## Run locally
 
 ```bash
@@ -40,7 +49,7 @@ Co-located `*_test.go`, table-driven. Repo layer uses testcontainers-go (or the
 
 ## Public API surface
 
-Handlers under `internal/api/handlers/` (Phase 2 moves to `internal/transport/http/handler/`). Health at `GET /health`. iACE, UCCA, training, academy, portfolio, escalation, audit, rag, whistleblower, workshop subresources. Every route is a contract.
+Handlers under `internal/api/handlers/` (8 sub-resource files). Health at `GET /health`. iACE, UCCA, training, academy, portfolio, escalation, audit, rag, whistleblower, workshop subresources. Every route is a contract.
 
 ## Environment
 

backend-compliance/README.md

@@ -5,7 +5,7 @@ Python/FastAPI service implementing the DSGVO compliance API: DSR, DSFA, consent
 **Port:** `8002` (container: `bp-compliance-backend`)
 **Stack:** Python 3.12, FastAPI, SQLAlchemy 2.x, Alembic, Keycloak auth.
 
-## Architecture (target — Phase 1)
+## Architecture
 
 ```
 compliance/
@@ -17,6 +17,8 @@ compliance/
 └── db/models/      # SQLAlchemy ORM, one module per aggregate
 ```
 
+The service follows this layered target structure but not all files are fully refactored yet. Phase 1 backlog is tracked in `.claude/rules/loc-exceptions.txt` (27 backend-compliance files currently excepted).
+
 See `../AGENTS.python.md` for the full convention and `../.claude/rules/architecture.md` for the non-negotiable rules.
 
 ## Run locally

breakpilot-compliance-sdk/README.md

@@ -24,13 +24,13 @@ Follow `../AGENTS.typescript.md`. No framework-specific code in `core/`.
 ```bash
 npm install
 npm run build     # per-workspace build
-npm test          # Vitest (Phase 4 adds coverage — currently 0 tests)
+npm test          # Vitest (currently 0 tests)
 ```
 
-## Known debt (Phase 4)
+## Known debt
 
-- `packages/vanilla/src/embed.ts` (611), `packages/react/src/provider.tsx` (539), `packages/core/src/client.ts` (521), `packages/react/src/hooks.ts` (474) — split.
-- **Zero test coverage.** Priority Phase 4 target.
+- Several files across `packages/vanilla/src/`, `packages/react/src/`, and `packages/core/src/` exceed the LOC budget and are candidates for splitting as refactoring continues.
+- **Zero test coverage.** Adding Vitest coverage is a priority backlog item.
 
 ## Don't touch
 

compliance-tts-service/README.md

@@ -23,7 +23,7 @@ uvicorn main:app --reload --port 8095
 
 ## Tests
 
-0 test files today. Phase 4 adds unit tests for the synthesis pipeline (mocked Piper + FFmpeg) and the S3 client.
+0 test files today. Adding unit tests for the synthesis pipeline (mocked Piper + FFmpeg) and the S3 client is still in the backlog queue.
 
 ## Architecture
 

developer-portal/README.md

@@ -23,4 +23,4 @@ Follow `../AGENTS.typescript.md`. MD/MDX content should live in a data directory
 
 ## Known debt
 
-- `app/development/docs/page.tsx` (891), `app/development/byoeh/page.tsx` (769), and others > 300 LOC — split in Phase 4.
+- Several page files under `app/development/` exceed the 300 LOC soft target and are candidates for splitting as refactoring continues.

dsms-gateway/README.md

@@ -5,18 +5,19 @@ Python/FastAPI gateway to the IPFS-backed document archival store. Upload, retri
 **Port:** `8082` (container: `bp-compliance-dsms-gateway`)
 **Stack:** Python 3.11, FastAPI, IPFS (Kubo via `dsms-node`).
 
-## Architecture (target — Phase 4)
+## Architecture
 
-`main.py` (467 LOC) will split into:
+Phase 4 refactor is complete. `main.py` is now a thin 41-LOC entry point:
 
 ```
-dsms_gateway/
-├── main.py          # FastAPI app factory, <50 LOC
-├── routers/         # /documents, /legal-documents, /verify, /node
-├── ipfs/            # IPFS client wrapper
-├── services/        # Business logic (archive, verify)
-├── schemas/         # Pydantic models
-└── config.py
+dsms-gateway/
+├── main.py              # FastAPI app factory, 41 LOC
+├── routers/
+│   ├── documents.py     # /documents, /legal-documents, /verify routes
+│   └── node.py          # /node routes
+├── models.py            # Pydantic models
+├── dependencies.py      # Shared FastAPI dependencies
+└── config.py            # Settings
 ```
 
 See `../AGENTS.python.md`.
@@ -36,7 +37,7 @@ uvicorn main:app --reload --port 8082
 pytest test_main.py -v
 ```
 
-Note: the existing test file is larger than the implementation — good coverage already. Phase 4 splits both into matching module pairs.
+27/27 tests pass. Test coverage matches the current module structure.
 
 ## Public API surface