Publish curated DevRunbook source from 6c816f19fca10d6aed986e1e2c2ae8df9b1654b7

CURRENT_STATE.md

@@ -729,3 +729,23 @@ account or production data was changed to manufacture a green browser result.
   `git diff --check` passes and Gitleaks found no secret across 207 commits.
   Final Node 24, PostgreSQL, security and audit authority remains the managed
   Gitea run for the final candidate commit.
+
+## Publication maintenance — 2026-10-01
+
+- Scope: refined the English canonical/public README and patched Next.js
+  16.3.3 to 16.3.6 after the protected publication audit reported
+  GHSA-vcvr-r3jv-pc5j. The manifest and lockfile changes are limited to Next.js
+  and its matching environment/compiler packages and peer references.
+- Local evidence: Windows with Node 24.18.1 and pnpm 10.33.0 passed frozen
+  installation, runtime preflight, `pnpm verify`, all 681 executed tests,
+  14 workspace builds, 11 security tests and both Python specification checks.
+  All 28 golden prompts remain unchanged. The production audit has zero high
+  and zero critical findings; three existing moderate findings remain.
+- Limits: 32 database integration tests were skipped by the ordinary local
+  unit invocation. Fresh PostgreSQL integration validation remains mandatory
+  in exact-head Linux CI before protected merge. No browser interaction,
+  production deployment, schema, migration or configuration was changed.
+- Detailed finding, applicability and evidence:
+  [dependency patch record](docs/SECURITY_DEPENDENCY_PATCH_20261001.md).
+- Product milestone state is unchanged. Publication must continue through
+  protected merge, automatic curated export and manifest verification.