Full drift sweep: sync wiki with schema/constants complete, ai started, security fixes Home.md/Architecture-Overview.md/Known-Gaps.md all still said 3 of 40 packages had real source (schema newly started at 3/16, types blocked on 3 cross-package deps) -- now reflects schema and constants both complete (closing 2 of 3 blockers), ai in progress (the last one). Known-Gaps.md: removed the vitest-4.1.10-unverified bullet (confirmed 2026-08-26 via two real passing test suites) and added the three security/bug fixes this page never caught up on -- all 41 Dependabot alerts, the CLA gate, and a real SQL injection found in sqlite.ts. Yarn-Migration.md: same vitest correction, marked resolved.
Flag milestones, fix stale deploy-production.mjs claim, sync manifest count - Flag isolated-vm fix, CodeQL fix, catalog correction, and the deploy-production.mjs non-destructive fix as milestones (matching todo.md's 🏁 convention) - Add the CodeQL fix entirely - it was missing from Known-Gaps.md's "Real bugs found and fixed" section - Fix a real staleness bug: CI-and-Docker.md and Yarn-Migration.md both still described deploy-production.mjs as "destructive to the root install" - that was corrected months ago (runs in a disposable git worktree now, todo.md commit 29bec2a) but the wiki never caught up - Home.md: sync the Package Manifests link description to 43 files, matching this morning's correction to that page itself
Correct the record: Yarn does have a native catalog feature
Document isolated-vm fix: real V8-API incompatibility, not a toolchain issue
Add wiki: architecture, Yarn migration, package manifests, CI/Docker, known gaps