Sync README with current project state

Top summary still said Week 3+ was undone even though checkout/order
engine has its own finished section further down; "what's deliberately
not here yet" claimed no tests exist at all. Adds a Testing section and
corrects the Week 4/BooksRun/Ingram/CI status bullets to match reality.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg

README.md

@@ -5,11 +5,14 @@ pre-launch plan and the technical design doc (`bookstore-core` schema,
 interfaces, order state machine — the design doc is the source of truth for
 *why* this repo is laid out the way it is).
 
-Weeks 1–2 of the 5-week plan are done: environments, deploy pipeline, the
+Weeks 1–3 of the 5-week plan are done: environments, deploy pipeline, the
 WooCommerce/HPOS plugin scaffold, catalog schema, Gutenberg importer,
-pricing engine, and membership shipping all live under
-`wp-content/plugins/bookstore-core/includes/`. Checkout, the order state
-machine, and live supplier integrations are Week 3+.
+pricing engine, membership shipping, checkout, and the order state
+machine all live under `wp-content/plugins/bookstore-core/includes/`.
+Week 4 is narrowed in scope and partially done: a live BooksRun
+price/stock recheck runs at checkout, but BooksRun AutoBuy and Ingram are
+deliberately deferred past initial launch (see "What's deliberately not
+here yet" below).
 
 ## Layout
 
@@ -226,14 +229,43 @@ runs against the synthetic `gutenberg_test` supplier for now, deliberately
 built through the same Action Scheduler/locking path Week 4's real
 integration will reuse rather than restructure.
 
+## Testing
+
+```
+make test ENV=dev
+```
+
+Runs `bookstore-core`'s PHPUnit suite
+(`wp-content/plugins/bookstore-core/tests/`) against pure business
+logic — currently the 25% pricing formula (`Pricing\PricingEngine`) and
+the $25/$15 free-shipping thresholds (`Shipping\BSC_Free_Shipping`) —
+using Brain Monkey/Mockery to stub WordPress/WooCommerce rather than a
+full WP-integration bootstrap. First run installs dev dependencies via
+Composer inside the `wordpress` container; since the bind-mounted plugin
+directory is host-owned and `www-data` can't write into it, that install
+step runs as root and then chowns `vendor/`/`composer.lock` back to the
+host user (see the `test` target's comment in `Makefile`). Not yet
+covered: `Order\CheckoutRecheck` and the order state machine.
+
 ## What's deliberately not here yet
 
-- Live BooksRun/Ingram supplier adapters — Week 4, see the design doc.
-- Automated tests for the pricing/shipping-threshold/checkout-recheck
-  logic — called for by the design doc's launch gates, not yet written.
+- BooksRun AutoBuy and Ingram supplier adapters — deliberately deferred;
+  `SupplierOrderJob` still submits synthetic (`gutenberg_test`) orders
+  only. The BooksRun *price/stock recheck* itself is live (see "Checkout
+  + order engine" above) — it's just automated purchase submission and
+  Ingram entirely that aren't built.
+- The daily BooksRun FTP bulk-sync job's scheduling/dedup/batch-write
+  infrastructure is real (`Import\BooksRunOfferSync`), but actually
+  connecting to a live feed is a deliberate stub — no FTP access or
+  sample feed exists yet to build the parser against.
+- Automated tests for the checkout-recheck/order-state-machine logic —
+  the pricing formula and shipping thresholds now have tests (see
+  "Testing" above), but `Order\CheckoutRecheck` and the state machine
+  itself don't yet.
 - A real TLS-terminating public domain — Caddy will auto-provision certs
   once `SITE_DOMAIN` points at a real host with 80/443 reachable; until
   then `docker-compose.dev.yml` is the only one that works from
   `localhost`.
-- CI test/lint automation — nothing here runs tests yet because there's no
-  application code to test yet.
+- CI automation — `make test` runs the suite manually, but nothing wires
+  it into the deploy pipeline (`poll-deploy.sh`) yet, so a broken test
+  doesn't block a deploy.