From 4fb383217ed0418d54ffca6ee93124fe39d8b343 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20Fr=C3=A8rejean?= <erik@wedevelop.nl>
Date: Mon, 1 Jun 2026 08:22:43 +0200
Subject: [PATCH] docs: refresh README for shipped Doctrine + Symfony bundle

The README still described the package as core-only with Doctrine
persistence and the Symfony bundle yet to land. Both have shipped, so:

- replace the stale status note with the bundle's actual scope (ADR-0009)
- list the real Symfony 8 + Doctrine requirements
- add manual bundle registration and link docs/installation.md
- mention the read side (RecordReader) and SubjectLabeller wiring
---
 README.md | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 432c8d1..57b6baa 100644
--- a/README.md
+++ b/README.md
@@ -7,14 +7,17 @@ An audit record answers — durably and credibly — **who** did **what**, to **
 what later happens to the rest of the system. Records are immutable snapshots of a
 past fact: they survive deletion of the actor, the subject, and the producing code.
 
-> **Status:** this package currently ships the framework-free core (value objects,
-> the `AuditEvent` contract, the `Recorder` and its ports, the read contracts and
-> DTOs). Doctrine persistence and the Symfony bundle land in subsequent releases.
+The package ships as a Symfony bundle: a framework-free core (value objects, the
+`AuditEvent` contract, the `Recorder` and read ports) plus Doctrine persistence and
+Symfony runtime adapters, pre-wired by the bundle. The core stays free of Symfony and
+Doctrine ([ADR-0009](docs/adr/0009-symfony-bundle-packaging.md)).
 
 ## Requirements
 
 - PHP 8.5+
-- [`psr/clock`](https://packagist.org/packages/psr/clock), [`psr/log`](https://packagist.org/packages/psr/log)
+- Symfony 8.0 (`framework-bundle`, `security-core`, `translation`, and the components
+  pulled in transitively)
+- Doctrine (`dbal` ^4, `orm` ^3.6, `doctrine-bundle` ^3.2)
 
 ## Installation
 
@@ -22,6 +25,19 @@ past fact: they survive deletion of the actor, the subject, and the producing co
 composer require wedevelopnl/audit-log
 ```
 
+There is no Flex recipe; register the bundle manually in `config/bundles.php`:
+
+```php
+return [
+    // ...
+    WeDevelop\AuditLog\AuditLogBundle::class => ['all' => true],
+];
+```
+
+The bundle auto-registers its Doctrine DBAL types and the `AuditRecordEntity` mapping.
+See [docs/installation.md](docs/installation.md) for the migration, the recommended
+append-only database grant, and the services you must provide.
+
 ## Design
 
 Three responsibilities are deliberately separated:
@@ -31,6 +47,7 @@ Three responsibilities are deliberately separated:
 | Describe an act | `AuditEvent` | Pure data + phrasing. No clock, identity, or services. |
 | Capture the moment | `Recorder` | Resolves time, actor, origin, subject label; freezes everything. |
 | The durable read shape | `AuditRecord` | Immutable snapshot, interpretable without the producing code. |
+| Query the trail | `RecordReader` | Paginated, filterable reads (`AuditQuery` → `AuditPage`) for display. |
 
 The architecture derives from six governing properties — immutable, self-contained,
 faithful to the moment, attributable, intelligible, queryable. The rationale lives in
@@ -78,14 +95,18 @@ final readonly class UserRoleChanged extends AbstractAuditEvent
 }
 ```
 
-Record it through the `Recorder` — the single write seam. It captures the ambient
-strands of the moment (clock, acting principal, origin, subject label) and appends a
-frozen record:
+Record it through the `Recorder` — the single write seam, autowired by the bundle.
+It captures the ambient strands of the moment (clock, acting principal, origin,
+subject label) and appends a frozen record:
 
 ```php
 $recorder->record(new UserRoleChanged($userId, 'member', 'admin'));
 ```
 
+To attach human-readable subject labels, provide a `SubjectLabeller` (the default
+returns none); read the trail back through `RecordReader`. See
+[docs/installation.md](docs/installation.md) for wiring.
+
 Sensitive fields are recorded as changed **without** their values:
 
 ```php