Align the doctor, state doc and bug template with the 24.22.1 pin, and credit the author

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -40,7 +40,7 @@ body:
     attributes:
       label: OS, Node version, browser
       description: Include the versions you can find. Write "unknown" for anything unavailable.
-      placeholder: "Windows 11, Node 24.14.0, Chrome 151"
+      placeholder: "Windows 11, Node 24.22.1, Chrome 151"
     validations:
       required: true
   - type: input

CONTRIBUTING.md

@@ -4,9 +4,9 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int
 
 ## Getting set up
 
-Use Node.js 24.14.x or 26.x (also enforced by `package.json`). Prefer 24.22.1 or
-later: earlier releases lack the October 21, 2026 security fixes, including
-CVE-2026-111497 (a Brotli decoder flaw that can lead to remote code execution).
+Use Node.js 24 (24.14.0 or later) or 26.x (also enforced by `package.json`).
+Prefer 24.22.1 or later: earlier releases lack the October 21, 2026 security
+fixes, including CVE-2026-111497 (a Brotli decoder flaw).
 
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git

changelog.d/1458-node-24-22-1-security-release.md

@@ -1,3 +1,3 @@
 - The Docker image and CI now pin Node 24.22.1, the first 24.x release with
-  the October 21, 2026 security fixes, including CVE-2026-111497 (a Brotli
-  decoder flaw that can lead to remote code execution) (anobjectn, #1458).
+  the October 21, 2026 security fixes, including CVE-2026-111497 in the Brotli
+  decoder (Luis Ortiz, @anobjectn, #1458).

docs/CURRENT-STATE.md

@@ -3433,7 +3433,8 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with
 >   style-switch persistence state. Browser/GPU performance comparison remains
 >   operator-side; the final accounting records only comparable population
 >   reductions and deterministic Node allocation/solve measurements. Those
->   allocation gates are calibrated on Node.js 24.14.x; `package.json` permits
+>   allocation gates were calibrated on Node.js 24.14.x and run in CI on the
+>   pinned Node.js 24.22.1 with the same ceilings; `package.json` permits
 >   supported product runtimes on Node 24 or 26, while the allocation runner
 >   separately enforces Node 24 for these two calibrated probes. Each probe
 >   compiles synchronously and discards explicit-GC
@@ -6180,7 +6181,7 @@ The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28,
 source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA
 uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous
 executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain
-24.14.x and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with
+Node 24 (24.14.0 or later) and 26.x; the Docker image and CI pin 24.22.1, the first 24.x release with
 the October 21, 2026 Node.js security fixes (including CVE-2026-111497). Use
 `npm ci` to reproduce the checked-in dependency tree.
 

scripts/setup-doctor.mjs

@@ -57,7 +57,7 @@ export function classifyNodeVersion(version = process.versions.node) {
   // NEWER than this release has verified is a warning, never a refusal: a
   // future Node must not brick a no-terminal install with advice its user
   // cannot follow. Too-old stays an error above — old runtimes genuinely fail.
-  return { level: 'warn', summary: 'newer than this release has verified; Node 24.14.x or 26.x is the tested path' };
+  return { level: 'warn', summary: 'newer than this release has verified; Node 24.22.x or 26.x is the tested path' };
 }
 
 /** Verify that every direct package declared by this checkout is present. */