diff --git a/.claude/skills/release/SKILL.md b/.claude/skills/release/SKILL.md
index 91fcdbf7..e262b41b 100644
--- a/.claude/skills/release/SKILL.md
+++ b/.claude/skills/release/SKILL.md
@@ -146,8 +146,13 @@ Read `README.md` and check if any new user-facing features from this release nee
 2. **MCP tools table** — if new MCP tools were added, add them to the AI integration section
 3. **Feature descriptions** — if a major new capability was added (new analysis type, new output format, etc.), add it to the relevant section
 4. **Roadmap section** — if a phase status changed, update the roadmap summary at the bottom
-5. **Version references** — only update version-specific references (e.g., install commands). Historical milestone markers like "Complete (v3.0.0)" should stay as-is
-6. If nothing user-facing changed (pure refactors, bug fixes, internal improvements), no README update is needed
+5. **Roadmap ordering cross-check** — verify the README roadmap list matches `docs/roadmap/ROADMAP.md` in **phase order, phase names, and phase count**. ROADMAP.md is the source of truth. Specifically:
+   - Extract the phase sequence from both files
+   - If any phases are reordered, missing, renamed, or merged in README relative to ROADMAP.md, fix README to match
+   - Completed phases should keep their historical version markers (e.g., "Complete (v3.0.0)")
+   - This check runs every release, not only when phase status changes — drift accumulates silently
+6. **Version references** — only update version-specific references (e.g., install commands). Historical milestone markers like "Complete (v3.0.0)" should stay as-is
+7. If nothing user-facing changed (pure refactors, bug fixes, internal improvements), no README update is needed — **but still run the roadmap ordering cross-check (item 5)**
 
 ## Step 7: Verify package-lock.json
 
diff --git a/README.md b/README.md
index 6d5a0390..28d2679e 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
   <a href="https://www.npmjs.com/package/@optave/codegraph"><img src="https://img.shields.io/npm/v/@optave/codegraph?style=flat-square&logo=npm&logoColor=white&label=npm" alt="npm version" /></a>
   <a href="https://github.com/optave/codegraph/blob/main/LICENSE"><img src="https://img.shields.io/github/license/optave/codegraph?style=flat-square&logo=opensourceinitiative&logoColor=white" alt="Apache-2.0 License" /></a>
   <a href="https://github.com/optave/codegraph/actions"><img src="https://img.shields.io/github/actions/workflow/status/optave/codegraph/codegraph-impact.yml?style=flat-square&logo=githubactions&logoColor=white&label=CI" alt="CI" /></a>
-  <img src="https://img.shields.io/badge/node-%3E%3D20-339933?style=flat-square&logo=node.js&logoColor=white" alt="Node >= 20" />
+  <img src="https://img.shields.io/badge/node-%3E%3D22.6-339933?style=flat-square&logo=node.js&logoColor=white" alt="Node >= 22.6" />
 </p>
 
 <p align="center">
@@ -773,12 +773,13 @@ See **[ROADMAP.md](docs/roadmap/ROADMAP.md)** for the full development roadmap a
 6. ~~**Resolution Accuracy**~~ — **Complete** (v3.3.1) — type inference, receiver type tracking, dead role sub-categories, resolution benchmarks, `package.json` exports, monorepo workspace resolution
 7. ~~**TypeScript Migration**~~ — **Complete** (v3.4.0) — all 271 source files migrated from JS to TS, zero `.js` remaining
 8. **Native Analysis Acceleration** — **In Progress** (7 of 8 complete) — JS-only build phases moved to Rust, sub-100ms 1-file rebuilds remaining
-9. **Runtime & Extensibility** — event-driven pipeline, plugin system, query caching, pagination
-10. **Intelligent Embeddings** — LLM-generated descriptions, enhanced embeddings, module summaries
-11. **Natural Language Queries** — `codegraph ask` command, conversational sessions
-12. **Expanded Language Support** — 8 new languages (11 → 19)
-13. **GitHub Integration & CI** — reusable GitHub Action, LLM-enhanced PR review, SARIF output
-14. **Visualization & Advanced** — web UI, dead code detection, monorepo, agentic search
+9. **Expanded Language Support** — 8 new languages (11 → 19)
+10. **Runtime & Extensibility** — event-driven pipeline, plugin system, query caching, pagination
+11. **Quality, Security & Technical Debt** — supply-chain security (SBOM, SLSA), CI coverage gates, timer cleanup, tech debt kill list
+12. **Intelligent Embeddings** — LLM-generated descriptions, enhanced embeddings, module summaries
+13. **Natural Language Queries** — `codegraph ask` command, conversational sessions
+14. **GitHub Integration & CI** — reusable GitHub Action, LLM-enhanced PR review, SARIF output
+15. **Advanced Features** — dead code detection, monorepo support, agentic search
 
 ## 🤝 Contributing