diff --git a/.mokogitea/workflows/pr-check.yml b/.mokogitea/workflows/pr-check.yml
index c834bf5f8b..21676fabcf 100644
--- a/.mokogitea/workflows/pr-check.yml
+++ b/.mokogitea/workflows/pr-check.yml
@@ -47,15 +47,15 @@ jobs:
               fi
               ;;
             fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ]; then
+              if [ "$BASE" != "main" ] && [ "$BASE" != "dev" ]; then
                 ALLOWED=false
-                REASON="Fix branches must target 'dev', not '${BASE}'"
+                REASON="Fix branches must target 'main' or 'dev', not '${BASE}'"
               fi
               ;;
             patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+              if [ "$BASE" != "main" ] && [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
                 ALLOWED=false
-                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+                REASON="Patch branches must target 'main', 'dev', or 'rc', not '${BASE}'"
               fi
               ;;
             hotfix/*)
@@ -86,10 +86,11 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
             echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`main\` or \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`patch/*\` → \`main\`, \`dev\`, or \`rc\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc\` → \`main\`" >> $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
@@ -146,12 +147,21 @@ jobs:
 
       - name: Detect platform
         id: platform
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
         run: |
-          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          # Query metadata API for platform (manifest.xml is deprecated)
+          PLATFORM=""
+          if [ -n "$MOKOGITEA_TOKEN" ]; then
+            PLATFORM=$(curl -sf -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+              "${MOKOGITEA_URL}/api/v1/repos/${REPO}/metadata" 2>/dev/null \
+              | sed -n 's/.*"platform"\s*:\s*"\([^"]*\)".*/\1/p' | head -1) || true
+          fi
           [ -z "$PLATFORM" ] && PLATFORM="generic"
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Detected platform: $PLATFORM"
 
       - name: Setup PHP
         if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13d1a98dd2..de077a3c4a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,6 +56,7 @@
 - Cherry-pick upstream v1.26.4: walk git log context error handling — regression fix (#38185)
 
 ### Fixed
+- PR check: platform detection now queries metadata API instead of removed manifest.xml
 - Cherry-pick upstream v1.26.2: handle empty pull request files view to allow reviews (#37783)
 - Cherry-pick upstream v1.26.2: fix "run as root" check with snap container detection (#37622)
 - Cherry-pick upstream: ack re-sent UpdateLog finalize idempotently (#37885)
diff --git a/README.md b/README.md
index 8e887760d8..511693e5cf 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # MokoGitea
 
-Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org metadata, CI standardization, and project board API.
+Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, secret scanning, org metadata, CI standardization, and project board API.
 
 ![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square)
 
@@ -11,8 +11,12 @@ Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org
 - **Wiki System** -- wikilinks, categories, backlinks, template transclusion, revision diffs, rename redirects, folder ACL, enhanced ToC, print view, ZIP export ([details](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/standards/Wiki-Features))
 - **DLID Licensing** -- license management, entitlements, domain activations, ed25519-signed downloads
 - **API Token Scope Editing** -- edit token scopes via API (PATCH) or web UI after creation
-- **Issue Statuses** -- custom workflow statuses per org with required baseline protection
+- **Issue Statuses** -- custom workflow statuses per org with required baseline protection, presets, cross-org migration
+- **Cascade Merge** -- auto-create PRs to downstream branches after merge with configurable rules per repo
+- **Secret Scanning** -- built-in pre-receive hook secret blocking with REST API for alerts, config, and on-demand scans
+- **Default Org Teams** -- auto-create Developers, Reviewers, and CI/CD teams on org creation
 - **Org Metadata** -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
+- **Branch Protection** -- delete allowlist for protected branches (per-user/team/deploy-key)
 - **Project Board API** -- REST endpoints for project columns and cards
 - **CI Infrastructure** -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
 - **Dev Deploy Gate** -- builds deploy to dev environment first, production checks dev health