diff --git a/NEXT_STEPS.md b/NEXT_STEPS.md
index 39553deb..bd790da3 100644
--- a/NEXT_STEPS.md
+++ b/NEXT_STEPS.md
@@ -1,9 +1,10 @@
 # Next Steps - php-firebird
 
-**Last Updated**: 2026-04-20 (v11.0.0 RELEASED 2026-04-09; v11.0.1 hotfixes in flight)
+**Last Updated**: 2026-07-01 (v11.0.1 QA hardening complete; 203 tests pass, 0 warnings)
 
-> **Status**: v11.0.0 shipped (tag `v11.0.0`, commit `ff84b3a`). CI is green across all pipelines.
-> v11.0.1 hotfix release prep is tracked in `specs/spec-v11.0.1-hotfixes.md` (#218-#222).
+> **Status**: v11.0.0 shipped (tag `v11.0.0`, commit `ff84b3a`). v11.0.1 QA audit bugs all closed
+> (16 PRs merged, compiler warnings 25→0, memory safety fixes across blob/transaction/service layers).
+> Remaining open work tracked in GitHub issues.
 
 ## Immediate (v10.6.x)
 
@@ -65,3 +66,31 @@ v11.0.0 tagged and released on 2026-04-09. Full work log archived in git history
 
 Release published live: https://github.com/satwareAG/php-firebird/releases/tag/v10.6.2
 Issue #213 closed. All pipelines (Linux/macOS/Windows/Stubs/Coverage/Sanitizers) completed successfully.
+
+---
+
+## Forward Roadmap (v11.x+)
+
+### v11.1.0 - Quality and Security Hardening (in progress)
+
+All QA audit bugs closed. Remaining items in milestone:
+
+- [ ] #233 - Complete M3 migration: `fbird_batch_create` returns `Firebird\BatchHandle` (last RETVAL_RES)
+
+### v12.0.0 - OOP API Completion
+
+- [ ] #252 - Typed return annotations for all 163 procedural arginfos and 9 OOP method arginfos
+- [ ] #250 - Implement `Firebird\Event` class methods (Phase H completion)
+- [ ] #244 - Expand OOP API test coverage from 13% to >50%
+- [ ] #245 - Add `--CLEAN--` sections to all state-modifying tests (164 files)
+- [ ] #246 - Update 12 test files from `is_resource()` to `instanceof Firebird\*` dual-bridge
+- [ ] #249 - OOP-aware helper functions in `tests/common.inc`
+
+### Backlog (unscheduled)
+
+- [ ] #257 - Windows builds missing DLLs for some PHP versions
+- [ ] #258 - `php_pdo_unregister_driver` undefined symbol on Rocky Linux (#150 regression)
+- [ ] L1 - Add LTO for release builds (`-flto=auto`)
+- [ ] M6 - Create fuzz dictionary for Firebird SQL
+- [ ] M8 - Replace pointer smuggling in `IBG(status[])` with proper output parameter
+- [ ] macOS precompiled universal binary builds
diff --git a/docs/CRITICAL_ANALYSIS_2026.md b/docs/CRITICAL_ANALYSIS_2026.md
index ebb9b122..693fb680 100644
--- a/docs/CRITICAL_ANALYSIS_2026.md
+++ b/docs/CRITICAL_ANALYSIS_2026.md
@@ -1,5 +1,9 @@
 # php-firebird Critical Analysis - March 2026
 
+> **Update 2026-07-01**: 18 of 24 recommendations shipped in v11.0.0-v11.0.1.
+> Remaining: L1 (LTO), H6 (--CLEAN-- sweep, tracked in #245), M6 (fuzz dictionary),
+> M8 (pointer smuggling audit). See checkboxes below for per-item status.
+
 Post-v10.3.6 comprehensive review against 2026 best practices for PHP extension
 development, C/C++ Linux development, and cross-platform distribution.
 
@@ -428,46 +432,46 @@ is a good distribution pattern.
 
 ### Phase 1: Security (v10.3.7 - Immediate)
 
-- [ ] **C1**: Fix SQL injection in `fbird_create_database()` - escape quotes
-- [ ] **C2**: Fix SPB buffer overflow in `Firebird\Service::__construct()` - bounds check
-- [ ] **M10**: Replace `create_sql[4096]` with `spprintf` dynamic allocation
-- [ ] **H5**: Update CONTRIBUTING.md (wrong repo URL, wrong PHP/FB versions)
-- [ ] **M7**: Fix config.m4 PHP version check (8.1 -> 8.2)
+- [x] **C1**: Fix SQL injection in `fbird_create_database()` - escape quotes
+- [x] **C2**: Fix SPB buffer overflow in `Firebird\Service::__construct()` - bounds check
+- [x] **M10**: Replace `create_sql[4096]` with `spprintf` dynamic allocation
+- [x] **H5**: Update CONTRIBUTING.md (wrong repo URL, wrong PHP/FB versions)
+- [x] **M7**: Fix config.m4 PHP version check (8.1 -> 8.2)
 
 ### Phase 2: Supply Chain (v10.4.0 - Next Minor)
 
-- [ ] **H1**: Add artifact signing (`gh attestation generate`) to release workflows
-- [ ] **H2**: Add SBOM generation (`syft`) to release workflows
-- [ ] **H3**: Add `.github/dependabot.yml` for action updates
-- [ ] **M4**: Automate version stamp sync in stubs during release
+- [x] **H1**: Add artifact signing (`gh attestation generate`) to release workflows
+- [x] **H2**: Add SBOM generation (`syft`) to release workflows
+- [x] **H3**: Add `.github/dependabot.yml` for action updates
+- [x] **M4**: Automate version stamp sync in stubs during release
 
 ### Phase 3: Build Hardening (v10.4.x)
 
-- [ ] **H4**: Add `-Wall -Wextra -D_FORTIFY_SOURCE=2 -fstack-protector-strong`
-- [ ] **M1**: Pin C standard to `-std=gnu17`
+- [x] **H4**: Add `-Wall -Wextra -D_FORTIFY_SOURCE=2 -fstack-protector-strong`
+- [x] **M1**: Pin C standard to `-std=gnu17`
 - [ ] **M8**: Replace pointer smuggling with proper output parameter
 - [ ] **L1**: Add LTO for release builds (`-flto=auto`)
 
 ### Phase 4: Testing (v10.5.0)
 
-- [ ] **H6**: Add `--CLEAN--` sections to all .phpt tests (start with coverage + PDO)
-- [ ] **M5**: Add TSan job for ZTS builds
+- [ ] **H6**: Add `--CLEAN--` sections to all .phpt tests (start with coverage + PDO) - tracked in #245
+- [x] **M5**: Add TSan job for ZTS builds
 - [ ] **M6**: Create fuzz dictionary for Firebird SQL
-- [ ] **M11**: Add macOS CI job (build-only)
+- [x] **M11**: Add macOS CI job (build-only)
 
 ### Phase 5: Platform Expansion (v10.6.0 or v11.0)
 
-- [ ] **H7**: Add ARM64 Linux precompiled builds
-- [ ] Add Alpine/musl-libc builds
+- [x] **H7**: Add ARM64 Linux precompiled builds
+- [x] Add Alpine/musl-libc builds
 - [ ] Add macOS precompiled builds (universal binary)
 
 ### Phase 6: Modernization (v11.0 - Next Major)
 
-- [ ] **M2**: Migrate all 84 arginfo declarations to typed variants
-- [ ] **M3**: Begin resource-to-object migration for Layer 1
-- [ ] **M12**: Replace `call_user_function()` in OOP layer with direct C calls
-- [ ] **L3**: Remove dead `FB_API_VER < 30` code paths
-- [ ] **L2**: Remove `gds32_ms` fallback from config.w32
+- [x] **M2**: Migrate all 84 arginfo declarations to typed variants
+- [x] **M3**: Begin resource-to-object migration for Layer 1
+- [x] **M12**: Replace `call_user_function()` in OOP layer with direct C calls
+- [x] **L3**: Remove dead `FB_API_VER < 30` code paths
+- [x] **L2**: Remove `gds32_ms` fallback from config.w32
 
 ---
 
diff --git a/docs/VERSIONING_STRATEGY.md b/docs/VERSIONING_STRATEGY.md
index 215c2d24..ace07792 100644
--- a/docs/VERSIONING_STRATEGY.md
+++ b/docs/VERSIONING_STRATEGY.md
@@ -397,7 +397,7 @@ fi
 3. Remove manual version from `php_firebird.h` (keep fallbacks)
 4. Enforce via pre-commit hooks
 
-**Status:** Planned  
+**Status:** Implemented (v11.0.0)
 **Target:** v11.0 (CI version-consistency check, pre-commit enforcement)
 
 ### Phase 3: Automation Excellence