diff --git a/docs/convention-drift-2026-03-23.md b/docs/convention-drift-2026-03-23.md
new file mode 100644
index 0000000..ea80f2a
--- /dev/null
+++ b/docs/convention-drift-2026-03-23.md
@@ -0,0 +1,74 @@
+# Convention Drift Audit
+
+Date: 2026-03-23
+
+## Scope
+
+- `CODEX.md` was not present anywhere under `/workspace` on 2026-03-23.
+- This audit used `CLAUDE.md` as the available convention source.
+- The `stdlib→core.*` bucket is interpreted here as explicit stdlib wording and non-`dappco.re/go/core/*` path references that still look pre-migration.
+
+## Missing SPDX Headers
+
+- `CLAUDE.md:1`
+- `errors.go:1`
+- `errors_test.go:1`
+- `log.go:1`
+- `log_test.go:1`
+- `docs/index.md:1`
+- `docs/development.md:1`
+- `docs/architecture.md:1`
+
+## stdlib→core.* Drift
+
+- `CLAUDE.md:33` still describes `Is`, `As`, and `Join` as `stdlib wrappers`.
+- `log.go:107` still references `core/go-io` rather than a `dappco.re/go/core/*` path.
+- `docs/index.md:8` still uses the old module path `forge.lthn.ai/core/go-log`.
+- `docs/index.md:18` still imports `forge.lthn.ai/core/go-log`.
+- `docs/index.md:81` still describes runtime dependencies as `Go standard library only`.
+- `docs/index.md:86` still references `core/go-io`.
+- `docs/index.md:92` still lists the module path as `forge.lthn.ai/core/go-log`.
+- `docs/index.md:95` still says `iter.Seq` comes from `the standard library`.
+- `docs/development.md:10` still says `iter.Seq` comes from `the standard library`.
+- `docs/development.md:126` still says `prefer the standard library`.
+- `docs/architecture.md:217` still references `core/go-io`.
+
+## UK English Drift
+
+- `errors.go:264` uses `Initialize()` in an example comment.
+- `log_test.go:179` uses `unauthorized access`.
+- `log_test.go:185` asserts on `unauthorized access`.
+- `errors_test.go:309` uses `initialization failed`.
+
+## Missing Tests
+
+- `errors.go:186` has no test for the `AllOps` early-stop path when the iterator consumer returns `false`.
+- `log.go:289` has no test coverage for `Username()` falling back to `USER`.
+- `log.go:292` has no test coverage for `Username()` falling back to `USERNAME` after `USER` is empty.
+
+Coverage note: `go test -coverprofile=cover.out ./...` reports `97.7%` statement coverage; these are the only uncovered code paths in the current package.
+
+## Missing Usage-Example Comments
+
+Interpretation: public entry points without an inline `Example:` block in their doc comment, especially where peer APIs in `errors.go` already include examples.
+
+- `log.go:71` `RotationOptions`
+- `log.go:94` `Options`
+- `log.go:108` `RotationWriterFactory`
+- `log.go:111` `New`
+- `log.go:157` `(*Logger).SetRedactKeys`
+- `log.go:276` `(*Logger).Security`
+- `log.go:284` `Username`
+- `log.go:300` `Default`
+- `log.go:305` `SetDefault`
+- `errors.go:107` `Is`
+- `errors.go:113` `As`
+- `errors.go:119` `NewError`
+- `errors.go:125` `Join`
+- `errors.go:133` `Op`
+- `errors.go:143` `ErrCode`
+- `errors.go:153` `Message`
+- `errors.go:166` `Root`
+- `errors.go:181` `AllOps`
+- `errors.go:198` `StackTrace`
+- `errors.go:207` `FormatStackTrace`