diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9623d07..054f46e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,24 @@ All notable changes to this repository. Dates are UTC.
 Open problems and known blockers are tracked separately in
 [`PROBLEMS.md`](./PROBLEMS.md), using the same date sections.
 
+## [2026-09-11]
+
+### Added
+- **PR #187** — deliverables: added `deliverables/product-crud/` — a full-stack
+  Products CRUD reference implementation. Backend is Express + Prisma + Zod in
+  five layers (Zod schema → service → controller → routes → mount) with
+  pagination, case-insensitive search across `name`/`sku`/`description`, and a
+  central error handler returning one shape for `BAD_REQUEST` / `NOT_FOUND` /
+  `CONFLICT`. Frontend is Vite + React + TanStack Query, with page, search and
+  sort carried in the query key so each page and search term caches separately,
+  and `placeholderData: keepPreviousData` so paging dims the table instead of
+  flashing a full loading state. 30 tests, no database needed.
+  Also ships `docker-compose.yml` (Postgres with a `pg_isready` healthcheck so
+  `db:up` can migrate safely), a 30-row idempotent seed script spread across all
+  three statuses and deliberately larger than the default page size, and a
+  three-stage production `Dockerfile` whose entrypoint applies the Prisma schema
+  before starting.
+
 ## [2026-09-10]
 
 ### Added
@@ -20,6 +38,9 @@ Open problems and known blockers are tracked separately in
 - **PR #181** — docs: added `PROBLEMS.md` as the companion to this file, tracking open issues and blockers in the same date sections.
 - **PR #182** — tasks: closed `TASK-20260910-005` (→ `done/`) with its Completion summary citing both `CHANGELOG.md` and `PROBLEMS.md` P-004. Also corrected two stale records: `TASK-20260910-004` was renamed to match its id and its validation table filled with measured numbers, and `TASK-20260910-003` gained a re-check showing its fix is still not on remote.
 - **PR #183** — docs: recorded PR #180–#182 here, added `PROBLEMS.md` P-007 (new-crystalcastle CI reads a `requirements.txt` that does not exist at the root) and P-008 (the `example-task.md` naming bug), and opened `TASK-20260910-006` to own P-007.
+- **PR #184** — docs: recorded PR #183 in this changelog.
+- **PR #185** — deliverables: added `deliverables/fastapi-obsidian-backend/` — a FastAPI backend for the Obsidian knowledge workflow with six routers (`skills`, `programs`, `billing`, `tools`, `users`, `security`), opt-in encryption at rest, bundled `data/skills/` markdown, and a pinned `requirements.txt`.
+- **Commit `de284dc`** (direct, not a PR) — chore: added a root `package.json` for Node tooling (`vercel`, `eslint`/`prettier`, `jest`, `semantic-release`). The same commit carried ~800 files that had accumulated untracked in the working tree — dashboard `.txt` and `.csv` exports, notebook HTML dumps, stray top-level `.py`/`.yml` fragments, and a `.zip`. Flagged in `README.md` under repository health; it has not been reviewed or pruned.
 
 ### Fixed
 - **Issue #63 closed** — the `pure-agent-dev` implementation merged to `main` via PR #169 (squash `590b8615`); the issue was closed by the PR's `Closes #63` reference. No `.github/workflows/` files were touched, so the merge was not blocked by the App's `workflows` restriction.
diff --git a/README.md b/README.md
index 936fe92..c960938 100644
--- a/README.md
+++ b/README.md
@@ -12,8 +12,9 @@ An opinionated FastAPI monorepo/boilerplate used by ZyntroAI as the foundation f
 | `app/` | FastAPI application core (`main.py`, routers under `api/`, core config, services) |
 | `graphql_api/` | GraphQL service layer (Strawberry) |
 | `main.py` | OAuth2 PKCE API entrypoint (`/auth`, `/callback`, `/health`) |
+| `frontend/` | React + Vite + TypeScript frontend (own `package.json`, `Dockerfile`, `tsconfig.json`) |
 | `skills/` | Reusable AI-agent skill definitions (e.g. `fetching`, `changelog-auto-update`, `credential-management`) |
-| `deliverables/` | Self-contained feature suites, each with its own README, tests, and CI (e.g. `pure-agent-dev`, `cwe1321-protection-suite`, `onspace-ai`, `firecrawl-fastapi`, `manus-client`, `notebooklm-access-suite`, `agent-security-suite`, `azure-cli-2026`, `agent-skill-template`, …) |
+| `deliverables/` | Self-contained feature suites, each with its own README, tests, and CI (e.g. `pure-agent-dev`, `cwe1321-protection-suite`, `onspace-ai`, `firecrawl-fastapi`, `manus-client`, `notebooklm-access-suite`, `agent-security-suite`, `azure-cli-2026`, `agent-skill-template`, `product-crud`, `fastapi-obsidian-backend`, …) |
 | `docs/` | Reference & knowledge documentation (GraphQL, FireCrawl, Google Chat, GitHub Actions, incident drills) |
 | `helm/` | Helm charts (OAuth app) |
 | `k8s/` | Kubernetes manifests |
@@ -32,6 +33,8 @@ uvicorn main:app --reload
 
 - API docs: `http://localhost:8000/docs`
 - Health: `http://localhost:8000/health`
+- The React frontend in `frontend/` runs separately (`npm install && npm run dev`).
+- Every suite under `deliverables/` is self-contained: see its own README. Several ship a `docker-compose.yml` and a seed script, so a fresh clone is one command from a running stack (e.g. `deliverables/product-crud/`).
 
 ## Stack
 
@@ -46,6 +49,8 @@ uvicorn main:app --reload
 - Secret scanning, coverage, and a test suite run in CI.
 - **CI status:** jobs currently fail at the *Set up job* step because the org's SHA-pin policy rejects workflows that reference actions by mutable tag (e.g. `actions/checkout@v4`). A PR's own tests passing locally does not turn its checks green. Fixing this needs write access to `.github/workflows/`, which the automation App does not have — see the 2026-09-08 notes in `CHANGELOG.md`.
 - External-service failures fail open (graceful degradation).
+- **Root Node tooling is declared but not wired up.** `package.json` lists `vercel`, `eslint`/`prettier`, `jest` and `semantic-release`, but there is no lockfile at the root, no `eslint.config.*` (so `npm run lint` fails against ESLint 10, which requires the flat config file), and `scripts.vite` holds a version range where a command belongs. With no lockfile the root dependency tree has also never been scanned for advisories. Treat this as present but unverified rather than as a working build path.
+- **The repository root carries a large volume of unreviewed files** (~800, added in `de284dc`): dashboard exports, notebook HTML dumps, loose scripts and archives mixed in with the source tree. It has not been pruned or classified.
 - Secrets live only in environment / CI secrets — never in source.
 - See `SECURITY.md` (reporting), `CONTRIBUTING.md` (PRs), `RELEASE.md` (releases).