- CodeQL code-scanning fully remediated (0 open / 7 fixed): polynomial-redos #5, prototype-polluting-assignment #6/#7
- TOML: quoted-table detectors replaced with linear scanners (isQuotedManagedTableHeader, isTomlTableHeader, parseTomlManagedAssignment)
- JSON: serverPath fail-closed on __proto__/constructor/prototype + allowlist guard
- docs: SECURITY v6.4.4 notes, CHANGELOG [6.4.4], 7-README v6.4.4 entries, badge 6.4.4
- tests: npm test green (389/389 floor intact), tsc clean, npm audit 0 vulnerabilities