diff --git a/README.md b/README.md
index 7085197..81bd501 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,12 @@
 # DetLab-DAC
 
-Documentation-first detection engineering platform for writing, comparing, and publishing a single detection across multiple rule and query languages.
+Active supporting detection-engineering workbench for turning investigation findings and telemetry gaps into reviewable detections across multiple rule and query languages.
 
 ![DetLab homepage](docs/assets/screenshots/detlab-home.png)
 
 ## Project summary
 
-DetLab-DAC packages detection engineering as a **documentation-first workflow**. Instead of starting with one platform query and losing the rest of the context, the project centers a canonical detection brief and maps it to multiple implementations.
+DetLab-DAC packages detection engineering as a **documentation-first workflow**. It supports investigation and lab work by converting observed behaviors, investigation findings, and telemetry gaps into canonical detection briefs that can be reviewed and mapped to multiple implementations.
 
 The repo currently combines:
 - detection content in-repo
@@ -47,6 +47,7 @@ DetLab-DAC keeps those pieces together in one detection brief.
 ## What this is
 
 - a documentation-first detection engineering repository
+- an active supporting workbench that converts investigation findings and telemetry gaps into reviewable detection content
 - a canonical-detection authoring workflow
 - a multi-language comparison surface for the same detection idea
 - a place to store telemetry assumptions, ATT&CK mapping, triage guidance, and validation notes alongside the rule logic
@@ -55,13 +56,14 @@ DetLab-DAC keeps those pieces together in one detection brief.
 
 - not a SIEM product
 - not a generic threat-hunting platform
-- not an IR case management system
+- not a DFIR case-management or evidence-tracking system
+- not a forensic acquisition, evidence-preservation, or evidence-retention platform
 - not a lab automation suite
 - not a guarantee that every detection is production-validated in every environment
 
 ## Current status
 
-**Active early-stage project.**
+**Active early-stage supporting detection-engineering workbench.** It complements investigation workflows; it does not replace DFIR case, acquisition, or evidence systems.
 
 What is confirmed in the repository today:
 - a Next.js web frontend under `web/`
@@ -119,8 +121,8 @@ web/                         Next.js frontend and workbench
 
 ## Tech stack
 
-- Next.js 14
-- React 18
+- Next.js 16
+- React 19
 - TypeScript
 - Node built-in test runner (`node --test`)
 - Markdown/YAML-based detection artifacts
diff --git a/ROADMAP.md b/ROADMAP.md
index ff46bc0..8b6bd65 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,7 @@
 # Roadmap
 
+DetLab-DAC remains an active supporting detection-engineering workbench: its roadmap focuses on converting investigation findings and telemetry gaps into reviewable detections, not on building DFIR case management, forensic acquisition, or evidence storage capabilities.
+
 ## Near term
 
 - keep the detection lane narrow and well-documented