修复

RELEASE.md

@@ -7,6 +7,8 @@ Adminive intentionally uses two dependency modes:
 - Source-tree build/test mode: nlohmann/json 3.12.0, magic_enum 0.9.8, and cpp-httplib 0.48.0 use pinned bundled headers under `backend/service/third_party/include`.
 - Installed-package mode: adapter components use external CMake packages. The bundled headers are not installed into the consumer's generic include namespace.
 
+Structive may be checked out under `third_party/Structive` for a standalone Adminive source tree or maintained as a sibling checkout selected by `ADMINIVE_STRUCTIVE_SOURCE_DIR`. The source archive always stages the selected Structive release files under `third_party/Structive`, without copying repository history or verification output into either working tree.
+
 Installed component dependencies are:
 
 | Adminive component | External dependency |
@@ -43,5 +45,6 @@ python scripts/verify.py --real-drogon
 4. Run sanitizer gates supported by the compiler.
 5. Run `python scripts/verify.py --real-drogon` on a release environment with real Drogon packages.
 6. If frontend code changed, run frontend unit, production build, Chromium E2E, and Edge E2E on Windows.
-7. Verify the installed prefix contains Adminive headers and release/license metadata but not bundled nlohmann/json, magic_enum, or cpp-httplib headers.
-8. Generate the source archive without build output and with China Standard Time timestamps.
+7. Run `npm --prefix frontend audit --omit=dev`; eliminate direct and critical findings where a compatible fix exists, and document unfixed upstream exposure instead of using an unverified forced major upgrade.
+8. Verify the installed prefix contains Adminive headers and release/license metadata but not bundled nlohmann/json, magic_enum, or cpp-httplib headers.
+9. Generate the source archive without build output and with China Standard Time timestamps.