diff --git a/.Rbuildignore b/.Rbuildignore
index 8989c62f..be5ec06c 100644
--- a/.Rbuildignore
+++ b/.Rbuildignore
@@ -24,3 +24,7 @@
 ^\.jules(/.*)?$
 ^\.trivyignore\.yaml$
 ^trivy\.yaml$
+^\.semgrepignore$
+^test_dummy\.R$
+^test_validation\.R$
+^\.markdownlint\.json$
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..5d55efc4
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,57 @@
+# Restores PR-head CodeQL coverage for this repo.
+#
+# History: commit 83ecc6e (PR #118, "ci: remove local governance workflows
+# duplicated by central required workflows") deleted the previous local
+# .github/workflows/codeql.yml on the assumption that the org-wide required
+# workflow ruleset (ContextualWisdomLab, ruleset id 18156473) already runs
+# ContextualWisdomLab/.github's central codeql-pr.yml against every PR here.
+#
+# That assumption was verified FALSE on 2026-09-02: ruleset 18156473 does not
+# actually include codeql-pr.yml, so this repo has had zero CodeQL coverage on
+# pull requests since #118 merged. This file is an interim, repo-local safety
+# net until an org admin adds codeql-pr.yml to ruleset 18156473 (tracked
+# separately — out of scope for a repo-level change). Remove this file once
+# that ruleset fix is confirmed live.
+#
+# Language: "actions" only, verified against this repo's own file extensions
+# (no first-party Python/JS-TS/Java-Kotlin source; the ~980 .c/.h/.hpp files
+# under packrat/lib/ are vendored R package dependencies, not repo-authored
+# code) and against the CodeQL analyses this repo has actually produced
+# historically (always /language:actions, never anything else).
+name: CodeQL
+
+on:
+  pull_request:
+    branches: ["master"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (actions)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          category: "/language:actions"
diff --git a/.jules/bolt.md b/.jules/bolt.md
index 7d3c603f..172782e4 100644
--- a/.jules/bolt.md
+++ b/.jules/bolt.md
@@ -16,3 +16,6 @@
 ## 2025-02-12 - R 언어에서 반복적인 mirt 모델 생성 시 불필요한 데이터프레임 부분집합 추출 최적화
 **Learning:** R에서 데이터프레임의 특정 열을 추출하는 작업(`df[cols]`)은 O(N)의 메모리 복사를 수반합니다. `autoFIPC`에서 `mirt` 모델의 파라미터를 설정하거나 호출하는 과정 중에 `newformXDataK[colnames(newFormModel@Data$data)]` 코드가 반복해서 사용되었고, 심지어 `ncol()`을 위해 단순히 개수를 구할 때도 사용되어 불필요한 메모리 할당과 오버헤드를 초래했습니다.
 **Action:** 조건문이나 반복문 내부에서 불필요하게 데이터프레임 부분집합 연산이 반복되지 않도록 외부에서 한 번만 `linkedFormData <- newformXDataK[colnames(newFormModel@Data$data)]`로 캐싱(caching)한 뒤, `ncol(linkedFormData)`와 `data = linkedFormData` 형태로 재사용하여 메모리 복사와 O(N) 오버헤드를 방지해야 합니다.
+## 2024-07-13 - R 언어에서 na.omit 대신 sum(!is.na())를 사용한 고유값 카운트 병목 최적화
+**Learning:** R에서 결측치가 아닌 고유값의 개수를 셀 때 `length(stats::na.omit(unique(x)))`를 사용하면 `stats::na.omit` 호출로 인해 메서드 디스패치 및 `na.action` 속성 할당 등의 오버헤드가 발생하여 성능이 저하됩니다. 루프 내부에서 사용할 경우 이러한 오버헤드가 누적됩니다.
+**Action:** `sum(!is.na(unique(x)))`와 같이 논리 인덱싱과 벡터화된 덧셈을 사용하여 결측치가 아닌 고유값의 개수를 계산함으로써, 불필요한 속성 할당 및 메서드 디스패치 오버헤드를 제거하고 성능을 향상시켜야 합니다.
diff --git a/.markdownlint.json b/.markdownlint.json
new file mode 100644
index 00000000..3a010db9
--- /dev/null
+++ b/.markdownlint.json
@@ -0,0 +1,7 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD022": false,
+  "MD024": false,
+  "MD041": false
+}
diff --git a/R/aFIPC.R b/R/aFIPC.R
index 62546519..c8bdc58a 100644
--- a/R/aFIPC.R
+++ b/R/aFIPC.R
@@ -770,8 +770,8 @@ autoFIPC <-
       if (
         !is.na(newFormItemName) &&
         !is.na(oldFormItemName) &&
-          (length(stats::na.omit(unique(newFormModel@Data$data[, newFormItemName]))) ==
-            length(stats::na.omit(unique(oldFormModel@Data$data[, oldFormItemName]))))
+          (sum(!is.na(unique(newFormModel@Data$data[, newFormItemName]))) ==
+            sum(!is.na(unique(oldFormModel@Data$data[, oldFormItemName]))))
       ) {
         message(
           'applying ',