# Changelog

## Score

- CAI 51 → 52 (+0.7)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 42 → 42 (+0.0)
- Architecture 86 → 88 (+2.1)
- Maturity 56 → 56 (+0.3)
- Readiness 56 → 56 (+0.7)
- Security 69 → 75 (+6.3)
- Performance 71 (new)

## Resolved (9)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: contradicts the code (docs/validity.md)
- Documentation: no installation or build instructions (README.md)
- Documentation: no installation or build instructions (docs/install.md)
- Documentation: no usage examples (README.md)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Hotspot: src/duration.js (src/duration.js)
- Off-boarding risk: anonymized user #1

## New (7)

- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (the committed lockfile resolved no direct production dependency)
- Documentation: hard to navigate (docs/tour.md)
- Documentation: no architecture or design documentation (docs/tour.md)
- Documentation: no architecture or design documentation (docs/upgrading.md)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1