From 73770ce9d048095f99160681c5ee44946cdd105c Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 26 Sep 2026 11:51:09 -0400
Subject: [PATCH 01/16] chore(repo-sweep): seed hygiene sweep

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYihoan7ULtdu32i34NaTq

From 5ef303f372a7fa3bfc55b98008b56cad2b05d9eb Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 26 Sep 2026 13:11:23 -0400
Subject: [PATCH 02/16] refactor: simplify local CI scripts and repin
 ci-workflows to v0.29.1

Repo-wide batch-simplify sweep (code and docs tiers). Each group was
checked by a separate verifier that tried to find a behavior change.

- .cursor/install.sh: one install_release helper for the six tarball
  installers and one ensure check for pinned versions. typos 1.50.1 and
  editorconfig-checker 3.11.2 now match the ci-workflows v0.29.1
  defaults (SHA256s confirmed against the downloaded assets).
- .cursor/check.sh: one run_lane runner. lane_eol now fails when git
  diff, mktemp, rev-parse or cp fails instead of reporting a clean
  index, and the script exits 1 outside a git checkout instead of
  passing lanes with nothing to check.
- .github/workflows/ci.yml: every ci-workflows ref moved from v0.27.1
  to v0.29.1; only comments changed in the actions this repo calls.
- .github/scripts/pr-section-drift.mjs: tidied; exit codes, output and
  exports unchanged. Two duplicate tests merged (25 tests).
- .gitignore: dropped a line the .claude/*.local.* glob already covered.
- SECURITY.md, PULL_REQUEST_TEMPLATE.md: current GitHub docs URLs and
  the renamed "Security and quality" tab.
- Em dashes removed from every file this repo owns.

Scope decisions:
- Which groups to run: code groups and the docs tier, all on Opus.
- Tool versions: match the latest ci-workflows release (v0.29.1);
  versions past its defaults belong in ci-workflows.
- Pre-existing lane_eol false pass: fix in this step.
- ai-slop.json list-idiom history sentence: remove.
- export PATH in check.sh: remove (no effect when PATH is exported).
- Em dashes: remove from every repo-owned file; synced files change
  upstream in standards.
- pr-body-contract.md sync status missing from README: left for a later
  docs step.

Playbook: hygiene
Playbook-Step: code-tidying:batch-simplify@0.23.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYihoan7ULtdu32i34NaTq
---
 .claude/ai-slop.json                      |   2 +-
 .cursor/check.sh                          | 144 +++++++--------------
 .cursor/install.sh                        | 151 +++++++++-------------
 .github/PULL_REQUEST_TEMPLATE.md          |   2 +-
 .github/dependabot.yml                    |   4 +-
 .github/scripts/pr-section-drift.mjs      |  74 ++++-------
 .github/scripts/pr-section-drift.test.mjs |   6 +-
 .github/workflows/ci.yml                  |  58 ++++-----
 .gitignore                                |  34 ++---
 .work-item-tracker.json                   |   2 +-
 SECURITY.md                               |   4 +-
 11 files changed, 181 insertions(+), 300 deletions(-)

diff --git a/.claude/ai-slop.json b/.claude/ai-slop.json
index 34087a1..8c6e65c 100644
--- a/.claude/ai-slop.json
+++ b/.claude/ai-slop.json
@@ -1,5 +1,5 @@
 {
   "excluded_paths": [],
   "em_dash_allowed_paths": [],
-  "_comment": "Only text this repository does not own may be excluded here, and nothing currently qualifies. CODE_OF_CONDUCT.md is adapted from Contributor Covenant v2.1 under CC BY 4.0 and is maintained as this organization's own policy, so it is audited and edited like every other file. .claude/rules/pr-body-contract.md is sync-managed from melodic-software/standards; it stays in scope so findings there are reported and filed upstream, never edited here. The em-dash rule is zero-tolerance and runs on every file: the former '- **Term** — definition' list idiom was rewritten to '- **Term**: definition' rather than exempted. Before adding a path to either list, name whose text it is and why it cannot be changed here."
+  "_comment": "Only text this repository does not own may be excluded here, and nothing currently qualifies. CODE_OF_CONDUCT.md is adapted from Contributor Covenant v2.1 under CC BY 4.0 and is maintained as this organization's own policy, so it is audited and edited like every other file. .claude/rules/pr-body-contract.md is sync-managed from melodic-software/standards; it stays in scope so findings there are filed upstream, never edited here. The em-dash rule is zero-tolerance on every file. Before adding a path to either list, name whose text it is and why it cannot be changed here."
 }
diff --git a/.cursor/check.sh b/.cursor/check.sh
index 19ae2a1..c0a6f61 100755
--- a/.cursor/check.sh
+++ b/.cursor/check.sh
@@ -11,21 +11,25 @@
 # when any lane fails.
 set -uo pipefail
 
-cd -- "$(git rev-parse --show-toplevel 2>/dev/null || echo .)" || exit 1
+top="$(git rev-parse --show-toplevel)" && cd -- "$top" || exit 1
 
 # Fall back onto a per-user bin in case install.sh placed tools there.
 case ":$PATH:" in
   *":$HOME/.local/bin:"*) ;;
   *) PATH="$HOME/.local/bin:$PATH" ;;
 esac
-export PATH
 
 PASSED=()
 FAILED=()
 
-record() {
-  local name="$1" rc="$2"
-  if [[ "$rc" -eq 0 ]]; then
+heading() { printf '\n\033[1m── %s ──\033[0m\n' "$1" >&2; }
+
+# run_lane <name> <cmd...>: run one lane under a heading and record its verdict.
+run_lane() {
+  local name="$1"
+  shift
+  heading "$name"
+  if "$@"; then
     PASSED+=("$name")
     printf '\033[32m✓ %s\033[0m\n' "$name" >&2
   else
@@ -34,18 +38,26 @@ record() {
   fi
 }
 
-heading() { printf '\n\033[1m── %s ──\033[0m\n' "$1" >&2; }
-
 # --- Lanes with multi-step logic --------------------------------------------
 
+# typos skips hidden paths unless they are named. The synced _typos.toml
+# cannot set ignore-hidden = false; CI's typos job has the same follow-up.
+# Skip index entries that are gone from the worktree: an unstaged deletion is
+# still listed, and typos exits 64 when an explicit path is missing.
+lane_typos() {
+  local hidden=() path
+  while IFS= read -r -d '' path; do
+    [[ "$path" == .* && -f "$path" ]] && hidden+=("$path")
+  done < <(git ls-files -z)
+  typos --config _typos.toml . "${hidden[@]}"
+}
+
 lane_jsonschema() {
   local rc=0 forms=() f
   check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml || rc=1
   check-jsonschema --builtin-schema vendor.github-workflows .github/workflows/*.yml || rc=1
   for f in .github/ISSUE_TEMPLATE/*.yml .github/ISSUE_TEMPLATE/*.yaml; do
-    [[ -e "$f" ]] || continue
-    [[ "$(basename -- "$f")" == config.yml ]] && continue
-    forms+=("$f")
+    [[ -e "$f" && "$(basename -- "$f")" != config.yml ]] && forms+=("$f")
   done
   if [[ ${#forms[@]} -eq 0 ]]; then
     # Match ci.yml's roster step: an empty set is a failed derivation, not a
@@ -82,39 +94,27 @@ lane_shellcheck() {
 # there, leaving the caller's index and working tree untouched. CI itself
 # runs on a clean checkout, so this extra isolation is local-only.
 lane_eol() {
-  local tmp tmpindex tmpwt gitdir before after drift rc=0
-  gitdir="$(git rev-parse --absolute-git-dir)"
-  tmp="$(mktemp -d)"
-  tmpindex="$tmp/index"
-  tmpwt="$tmp/wt"
-  mkdir -p "$tmpwt"
-  cp -- "$(git rev-parse --git-path index)" "$tmpindex"
-  before="$(GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmpindex" git write-tree)" || {
-    rm -rf "$tmp"
-    return 1
-  }
-  GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmpindex" GIT_WORK_TREE="$tmpwt" git checkout-index --all || {
-    rm -rf "$tmp"
-    return 1
-  }
-  GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmpindex" GIT_WORK_TREE="$tmpwt" git add --renormalize -- . || {
-    rm -rf "$tmp"
-    return 1
-  }
-  after="$(GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmpindex" git write-tree)" || {
-    rm -rf "$tmp"
-    return 1
-  }
+  local tmp gitdir before after drift rc=0
+  tmp="$(mktemp -d)" || return 1
+  gitdir="$(git rev-parse --absolute-git-dir)" &&
+    mkdir -p "$tmp/wt" &&
+    cp -- "$(git rev-parse --git-path index)" "$tmp/index" &&
+    before="$(GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmp/index" git write-tree)" &&
+    GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmp/index" GIT_WORK_TREE="$tmp/wt" git checkout-index --all &&
+    GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmp/index" GIT_WORK_TREE="$tmp/wt" git add --renormalize -- . &&
+    after="$(GIT_DIR="$gitdir" GIT_INDEX_FILE="$tmp/index" git write-tree)" || rc=1
   rm -rf "$tmp"
-  drift="$(git diff --name-only "$before" "$after")"
-  if [[ -z "$drift" ]]; then
-    echo "index EOL clean"
-  else
+  [[ "$rc" -eq 0 ]] || return 1
+  if ! drift="$(git diff --name-only "$before" "$after")"; then
+    echo "eol-renormalize: git diff failed; cannot tell whether the index has EOL drift" >&2
+    return 1
+  fi
+  if [[ -n "$drift" ]]; then
     echo "EOL drift (fix: git add --renormalize . && git commit):" >&2
     printf '%s\n' "$drift" >&2
-    rc=1
+    return 1
   fi
-  return "$rc"
+  echo "index EOL clean"
 }
 
 lane_pr_section_drift() {
@@ -126,65 +126,21 @@ lane_pr_section_drift() {
 
 # --- Run every lane ---------------------------------------------------------
 
-heading markdown
-markdownlint-cli2 --config .markdownlint-cli2.jsonc "**/*.md"
-record markdown "$?"
-
-heading typos
-# typos skips hidden paths unless they are named. The synced _typos.toml
-# cannot set ignore-hidden = false; CI's typos job has the same follow-up.
-# Skip index entries that are gone from the worktree: an unstaged deletion is
-# still listed, and typos exits 64 when an explicit path is missing.
-hidden=()
-while IFS= read -r -d '' path; do
-  case "$path" in
-    .*)
-      if [[ -f "$path" ]]; then
-        hidden+=("$path")
-      fi
-      ;;
-    *) ;;
-  esac
-done < <(git ls-files -z)
-typos --config _typos.toml . "${hidden[@]}"
-record typos "$?"
-
-heading editorconfig
-ec -config .editorconfig-checker.json
-record editorconfig "$?"
-
-heading gitleaks
-gitleaks dir --config .gitleaks.toml --no-banner .
-record gitleaks "$?"
-
-heading links
-lychee --offline --no-progress --config lychee.toml \
+run_lane markdown markdownlint-cli2 --config .markdownlint-cli2.jsonc "**/*.md"
+run_lane typos lane_typos
+run_lane editorconfig ec -config .editorconfig-checker.json
+run_lane gitleaks gitleaks dir --config .gitleaks.toml --no-banner .
+run_lane links lychee --offline --no-progress --config lychee.toml \
   "**/*.md" ".claude/**/*.md" ".github/**/*.md"
-record links "$?"
-
-heading actionlint
-actionlint -color
-record actionlint "$?"
-
-heading jsonschema
-lane_jsonschema
-record jsonschema "$?"
-
-heading shellcheck
-lane_shellcheck
-record shellcheck "$?"
-
-heading eol-renormalize
-lane_eol
-record eol-renormalize "$?"
-
-heading pr-section-drift
-lane_pr_section_drift
-record pr-section-drift "$?"
+run_lane actionlint actionlint -color
+run_lane jsonschema lane_jsonschema
+run_lane shellcheck lane_shellcheck
+run_lane eol-renormalize lane_eol
+run_lane pr-section-drift lane_pr_section_drift
 
 # --- Summary ----------------------------------------------------------------
 
-printf '\n\033[1m── ci-status ──\033[0m\n' >&2
+heading ci-status
 printf 'passed: %d   failed: %d\n' "${#PASSED[@]}" "${#FAILED[@]}" >&2
 if [[ ${#FAILED[@]} -gt 0 ]]; then
   printf 'failing lanes: %s\n' "${FAILED[*]}" >&2
diff --git a/.cursor/install.sh b/.cursor/install.sh
index 926b396..34e8105 100755
--- a/.cursor/install.sh
+++ b/.cursor/install.sh
@@ -4,7 +4,7 @@
 # This repo ships only community-health files, so its "build" is the same
 # lint/hygiene suite CI runs (see .github/workflows/ci.yml). That suite is a set
 # of standalone tools; this script installs each one pinned to the exact version
-# the CI composite actions use (melodic-software/ci-workflows v0.17.2), so a
+# the CI composite actions use (melodic-software/ci-workflows v0.29.1), so a
 # local run of .cursor/check.sh reproduces CI verdicts byte for byte.
 #
 # Idempotent and safe to re-run: every tool is skipped when the pinned version
@@ -12,12 +12,12 @@
 # SHA-256 the CI action pins before it is trusted (fail closed).
 set -euo pipefail
 
-# --- Pins (authority: melodic-software/ci-workflows v0.17.2 action defaults) --
+# --- Pins (authority: melodic-software/ci-workflows v0.29.1 action defaults) --
 MARKDOWNLINT_VERSION="0.23.2"
-TYPOS_VERSION="1.49.0"
-TYPOS_SHA256="48bd2d58e02ce713b8c0f1aa239e68ee4f7d8c551013135806e6aed3938d9e10"
-EC_VERSION="3.11.1"
-EC_SHA256="5a37922963248451e88149251e49f6ae08f69717a3918202a51fe9945e19691e"
+TYPOS_VERSION="1.50.1"
+TYPOS_SHA256="edf0545109aee6a22751d04ddecb97c45be47d3aa0409564fb895eeeace91b1e"
+EC_VERSION="3.11.2"
+EC_SHA256="bc815e5b3b1891a0ee9e1242fe3475312655f8b0f4c4a79510be0a009294571a"
 GITLEAKS_VERSION="8.30.1"
 GITLEAKS_SHA256="551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
 LYCHEE_VERSION="0.24.2"
@@ -53,7 +53,7 @@ trap 'rm -rf "$WORK"' EXIT
 
 log() { printf 'install: %s\n' "$*" >&2; }
 
-# verify_sha <file> <sha256> — abort the whole install on mismatch. A hygiene
+# verify_sha <file> <sha256>: abort the whole install on mismatch. A hygiene
 # toolchain that silently installed an unverified binary is worse than a hard
 # failure the operator can see and re-run.
 verify_sha() {
@@ -72,100 +72,71 @@ install_bin() {
   log "installed $name -> $BIN_DIR/$name"
 }
 
-install_typos() {
-  local cur
-  cur="$(typos --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$TYPOS_VERSION"* ]]; then
-    log "typos $TYPOS_VERSION present; skipping"
-    return 0
+# ensure <label> <version> <installer> <version-cmd...>: run <installer> unless
+# <version-cmd> already reports the pinned version.
+ensure() {
+  local label="$1" want="$2" installer="$3" cur
+  shift 3
+  cur="$("$@" 2>/dev/null || true)"
+  if [[ "$cur" == *"$want"* ]]; then
+    log "$label $want present; skipping"
+  else
+    "$installer"
   fi
-  local url="https://github.com/crate-ci/typos/releases/download/v${TYPOS_VERSION}/typos-v${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/typos.tgz" "$url"
-  verify_sha "$WORK/typos.tgz" "$TYPOS_SHA256"
-  tar -xzf "$WORK/typos.tgz" -C "$WORK" ./typos
-  install_bin "$WORK/typos" typos
+}
+
+# install_release <name> <sha256> <url> <extracted-path> <tar-member-args...>:
+# download a release tarball, verify it, extract the member, and install
+# $WORK/<extracted-path> as <name>.
+install_release() {
+  local name="$1" sha="$2" url="$3" extracted="$4"
+  shift 4
+  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/$name.tgz" "$url"
+  verify_sha "$WORK/$name.tgz" "$sha"
+  tar -xzf "$WORK/$name.tgz" -C "$WORK" "$@"
+  install_bin "$WORK/$extracted" "$name"
+}
+
+install_typos() {
+  install_release typos "$TYPOS_SHA256" \
+    "https://github.com/crate-ci/typos/releases/download/v${TYPOS_VERSION}/typos-v${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+    typos ./typos
 }
 
 install_ec() {
-  local cur
-  cur="$(ec --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$EC_VERSION"* ]]; then
-    log "editorconfig-checker $EC_VERSION present; skipping"
-    return 0
-  fi
-  local url="https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v${EC_VERSION}/ec-linux-amd64.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/ec.tgz" "$url"
-  verify_sha "$WORK/ec.tgz" "$EC_SHA256"
-  tar -xzf "$WORK/ec.tgz" -C "$WORK" bin/ec-linux-amd64
-  install_bin "$WORK/bin/ec-linux-amd64" ec
+  install_release ec "$EC_SHA256" \
+    "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v${EC_VERSION}/ec-linux-amd64.tar.gz" \
+    bin/ec-linux-amd64 bin/ec-linux-amd64
 }
 
 install_gitleaks() {
-  local cur
-  cur="$(gitleaks version 2>/dev/null || true)"
-  if [[ "$cur" == *"$GITLEAKS_VERSION"* ]]; then
-    log "gitleaks $GITLEAKS_VERSION present; skipping"
-    return 0
-  fi
-  local url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/gitleaks.tgz" "$url"
-  verify_sha "$WORK/gitleaks.tgz" "$GITLEAKS_SHA256"
-  tar -xzf "$WORK/gitleaks.tgz" -C "$WORK" gitleaks
-  install_bin "$WORK/gitleaks" gitleaks
+  install_release gitleaks "$GITLEAKS_SHA256" \
+    "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+    gitleaks gitleaks
 }
 
 install_lychee() {
-  local cur
-  cur="$(lychee --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$LYCHEE_VERSION"* ]]; then
-    log "lychee $LYCHEE_VERSION present; skipping"
-    return 0
-  fi
-  local url="https://github.com/lycheeverse/lychee/releases/download/lychee-v${LYCHEE_VERSION}/lychee-x86_64-unknown-linux-gnu.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/lychee.tgz" "$url"
-  verify_sha "$WORK/lychee.tgz" "$LYCHEE_SHA256"
-  tar -xzf "$WORK/lychee.tgz" -C "$WORK" --strip-components=1 lychee-x86_64-unknown-linux-gnu/lychee
-  install_bin "$WORK/lychee" lychee
+  install_release lychee "$LYCHEE_SHA256" \
+    "https://github.com/lycheeverse/lychee/releases/download/lychee-v${LYCHEE_VERSION}/lychee-x86_64-unknown-linux-gnu.tar.gz" \
+    lychee --strip-components=1 lychee-x86_64-unknown-linux-gnu/lychee
 }
 
 install_actionlint() {
-  local cur
-  cur="$(actionlint --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$ACTIONLINT_VERSION"* ]]; then
-    log "actionlint $ACTIONLINT_VERSION present; skipping"
-    return 0
-  fi
-  local url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/actionlint.tgz" "$url"
-  verify_sha "$WORK/actionlint.tgz" "$ACTIONLINT_SHA256"
-  tar -xzf "$WORK/actionlint.tgz" -C "$WORK" actionlint
-  install_bin "$WORK/actionlint" actionlint
+  install_release actionlint "$ACTIONLINT_SHA256" \
+    "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
+    actionlint actionlint
 }
 
 install_shellcheck() {
-  local cur
-  cur="$(shellcheck --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$SHELLCHECK_VERSION"* ]]; then
-    log "shellcheck $SHELLCHECK_VERSION present; skipping"
-    return 0
-  fi
-  local url="https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.gz"
-  curl -fsSL --proto '=https' --retry 3 --retry-delay 3 -o "$WORK/sc.tgz" "$url"
-  verify_sha "$WORK/sc.tgz" "$SHELLCHECK_SHA256"
-  tar -xzf "$WORK/sc.tgz" -C "$WORK" "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
-  install_bin "$WORK/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" shellcheck
+  install_release shellcheck "$SHELLCHECK_SHA256" \
+    "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.gz" \
+    "shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
 }
 
 # markdownlint-cli2 ships as an npm package; install it into the same prefix so
 # the `markdownlint-cli2` launcher lands on PATH. Node is provided by the base
 # image / cloud bootstrap.
 install_markdownlint() {
-  local cur
-  cur="$(markdownlint-cli2 --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$MARKDOWNLINT_VERSION"* ]]; then
-    log "markdownlint-cli2 $MARKDOWNLINT_VERSION present; skipping"
-    return 0
-  fi
   if ! command -v npm >/dev/null 2>&1; then
     log "npm not found; cannot install markdownlint-cli2"
     exit 1
@@ -182,12 +153,6 @@ install_markdownlint() {
 # check-jsonschema is a Python tool; install it into a dedicated venv and expose
 # only its launcher on PATH so it never perturbs the system interpreter.
 install_check_jsonschema() {
-  local cur
-  cur="$(check-jsonschema --version 2>/dev/null || true)"
-  if [[ "$cur" == *"$CHECK_JSONSCHEMA_VERSION"* ]]; then
-    log "check-jsonschema $CHECK_JSONSCHEMA_VERSION present; skipping"
-    return 0
-  fi
   if ! command -v python3 >/dev/null 2>&1; then
     log "python3 not found; cannot install check-jsonschema"
     exit 1
@@ -211,12 +176,12 @@ install_check_jsonschema() {
 }
 
 log "installing pinned hygiene toolchain into $BIN_DIR"
-install_typos
-install_ec
-install_gitleaks
-install_lychee
-install_actionlint
-install_shellcheck
-install_markdownlint
-install_check_jsonschema
+ensure typos "$TYPOS_VERSION" install_typos typos --version
+ensure editorconfig-checker "$EC_VERSION" install_ec ec --version
+ensure gitleaks "$GITLEAKS_VERSION" install_gitleaks gitleaks version
+ensure lychee "$LYCHEE_VERSION" install_lychee lychee --version
+ensure actionlint "$ACTIONLINT_VERSION" install_actionlint actionlint --version
+ensure shellcheck "$SHELLCHECK_VERSION" install_shellcheck shellcheck --version
+ensure markdownlint-cli2 "$MARKDOWNLINT_VERSION" install_markdownlint markdownlint-cli2 --version
+ensure check-jsonschema "$CHECK_JSONSCHEMA_VERSION" install_check_jsonschema check-jsonschema --version
 log "toolchain ready"
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 55008f0..0737c67 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -4,7 +4,7 @@ Closes #
 Complete the `Closes #` line above with the issue number to auto-close it on
 merge, one closing keyword per issue (cross-repo:
 `Closes <owner>/<repo>#<issue-number>`). Supported keywords are GitHub's:
-https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue
+https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue
 
 If this PR closes no issue (an orphan PR: drift sweep, hotfix, refactor),
 replace that line with the no-issue escape and its reason, as plain text:
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 67b83ce..e3b8faa 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -22,6 +22,8 @@ updates:
       github-actions:
         patterns:
           - '*'
-    # Reusable bumps to an unreviewed SHA fail the Runner policy contract fleet-wide; composites move by hand in the convergence pass so the fleet stays on one ci-workflows SHA; see melodic-software/github-iac#378 Phase 6b-ii item L.
+    # ci-workflows composites move by hand so the fleet stays on one
+    # ci-workflows SHA; a bump to an unreviewed SHA fails the Runner policy
+    # contract fleet-wide. See melodic-software/github-iac#378.
     ignore:
       - dependency-name: "melodic-software/ci-workflows/*"
diff --git a/.github/scripts/pr-section-drift.mjs b/.github/scripts/pr-section-drift.mjs
index 34ac933..0f6ea3b 100644
--- a/.github/scripts/pr-section-drift.mjs
+++ b/.github/scripts/pr-section-drift.mjs
@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // Local complement to standards' fleet lockstep (ADR-0008): this repository's
-// two PR-body declarations — `.github/PULL_REQUEST_TEMPLATE.md` headings and
-// `.claude/source-control.md`'s `pr_body_required_sections` — are unchecked
+// two PR-body declarations (`.github/PULL_REQUEST_TEMPLATE.md` headings and
+// `.claude/source-control.md`'s `pr_body_required_sections`) are unchecked
 // mirrors of the section list the `pr-contract` composite enforces. ADR-0008
 // fleet-checks the template and the pin from standards CI *after* merge; it
 // deliberately does not check this repository's source-control key. This lane
@@ -23,7 +23,7 @@
 
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import process from "node:process";
+import { setTimeout as sleep } from "node:timers/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 const CALLER_PATH = ".github/workflows/ci.yml";
@@ -38,17 +38,11 @@ const CALLER_PIN_RE =
 const SECTION_REPORT_RE = /section_report\("([^"]+)"\)/g;
 
 export class DriftError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DriftError";
-  }
+  name = "DriftError";
 }
 
 export class FetchError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "FetchError";
-  }
+  name = "FetchError";
 }
 
 export function sourceOfTruth(sha) {
@@ -56,8 +50,7 @@ export function sourceOfTruth(sha) {
 }
 
 export function parseCallerPin(callerText, location = CALLER_PATH) {
-  const shas = [...callerText.matchAll(CALLER_PIN_RE)].map((match) => match[1]);
-  const unique = [...new Set(shas)];
+  const unique = [...new Set([...callerText.matchAll(CALLER_PIN_RE)].map((match) => match[1]))];
   if (unique.length === 0) {
     throw new DriftError(`${location}: no 40-hex pr-contract@ pin found on a uses: line`);
   }
@@ -67,7 +60,6 @@ export function parseCallerPin(callerText, location = CALLER_PATH) {
   return unique[0];
 }
 
-// Same regex as standards lockstep-drift.mjs parseCompositeSections.
 export function parseGateSections(runShText, location) {
   const names = [...runShText.matchAll(SECTION_REPORT_RE)].map((match) => match[1]);
   if (names.length === 0) {
@@ -92,12 +84,7 @@ export function parseTemplateHeadings(markdownText) {
 
 export function parseSourceControlSections(markdownText, location = SOURCE_CONTROL_PATH) {
   const lines = markdownText.split(/\r?\n/);
-  const starts = [];
-  for (let index = 0; index < lines.length; index += 1) {
-    if (lines[index].trim() === `## ${SOURCE_CONTROL_HEADING}`) {
-      starts.push(index);
-    }
-  }
+  const starts = lines.flatMap((line, index) => (line.trim() === `## ${SOURCE_CONTROL_HEADING}` ? [index] : []));
   if (starts.length === 0) {
     throw new DriftError(`${location}: no ## ${SOURCE_CONTROL_HEADING} section found`);
   }
@@ -105,8 +92,7 @@ export function parseSourceControlSections(markdownText, location = SOURCE_CONTR
     throw new DriftError(`${location}: ## ${SOURCE_CONTROL_HEADING} appears more than once`);
   }
   const names = [];
-  for (let index = starts[0] + 1; index < lines.length; index += 1) {
-    const line = lines[index];
+  for (const line of lines.slice(starts[0] + 1)) {
     if (line.startsWith("## ")) {
       break;
     }
@@ -130,18 +116,13 @@ function listsEqual(left, right) {
 }
 
 export function collectDrift(contract, templateHeadings, sourceControlSections, sha) {
-  const errors = [];
-  if (!listsEqual(templateHeadings, contract)) {
-    errors.push(
-      `drift: ${TEMPLATE_PATH} ## headings ${formatList(templateHeadings)} != ${sourceOfTruth(sha)} ${formatList(contract)}`,
-    );
-  }
-  if (!listsEqual(sourceControlSections, contract)) {
-    errors.push(
-      `drift: ${SOURCE_CONTROL_PATH} ${SOURCE_CONTROL_HEADING} ${formatList(sourceControlSections)} != ${sourceOfTruth(sha)} ${formatList(contract)}`,
-    );
-  }
-  return errors;
+  const expected = `${sourceOfTruth(sha)} ${formatList(contract)}`;
+  return [
+    [`${TEMPLATE_PATH} ## headings`, templateHeadings],
+    [`${SOURCE_CONTROL_PATH} ${SOURCE_CONTROL_HEADING}`, sourceControlSections],
+  ]
+    .filter(([, names]) => !listsEqual(names, contract))
+    .map(([label, names]) => `drift: ${label} ${formatList(names)} != ${expected}`);
 }
 
 export function contentsUrl(sha) {
@@ -165,11 +146,9 @@ export async function fetchGateSource(sha, fetchImpl = fetch, { backoffMs } = {}
     } catch (error) {
       lastError = error;
     }
-    if (attempt < 3) {
-      const delay = backoffMs === undefined ? attempt * 2000 : backoffMs;
-      if (delay > 0) {
-        await new Promise((resolve) => setTimeout(resolve, delay));
-      }
+    const delay = backoffMs === undefined ? attempt * 2000 : backoffMs;
+    if (attempt < 3 && delay > 0) {
+      await sleep(delay);
     }
   }
   throw new FetchError(`fetch-error: ${url}: ${lastError.message}`);
@@ -192,23 +171,18 @@ function emitErrors(messages) {
 }
 
 export async function runLiveCheck(repoRoot, fetchImpl = fetch) {
-  const callerText = await readFile(path.join(repoRoot, CALLER_PATH), "utf8");
-  const sha = parseCallerPin(callerText);
-  const runShText = await fetchGateSource(sha, fetchImpl);
-  const contract = parseGateSections(runShText, sourceOfTruth(sha));
-  const templateHeadings = parseTemplateHeadings(
-    await readFile(path.join(repoRoot, TEMPLATE_PATH), "utf8"),
-  );
-  const sourceControlSections = parseSourceControlSections(
-    await readFile(path.join(repoRoot, SOURCE_CONTROL_PATH), "utf8"),
-  );
+  const read = (relativePath) => readFile(path.join(repoRoot, relativePath), "utf8");
+  const sha = parseCallerPin(await read(CALLER_PATH));
+  const contract = parseGateSections(await fetchGateSource(sha, fetchImpl), sourceOfTruth(sha));
+  const templateHeadings = parseTemplateHeadings(await read(TEMPLATE_PATH));
+  const sourceControlSections = parseSourceControlSections(await read(SOURCE_CONTROL_PATH));
   return { sha, contract, errors: collectDrift(contract, templateHeadings, sourceControlSections, sha) };
 }
 
 const invokedDirectly = import.meta.url === pathToFileURL(process.argv[1] ?? "").href;
 
 if (invokedDirectly) {
-  const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+  const repoRoot = fileURLToPath(new URL("../..", import.meta.url));
   try {
     const { sha, contract, errors } = await runLiveCheck(repoRoot);
     if (errors.length > 0) {
diff --git a/.github/scripts/pr-section-drift.test.mjs b/.github/scripts/pr-section-drift.test.mjs
index 4393def..472e27f 100644
--- a/.github/scripts/pr-section-drift.test.mjs
+++ b/.github/scripts/pr-section-drift.test.mjs
@@ -94,7 +94,7 @@ describe("parseCallerPin", () => {
 });
 
 describe("parseGateSections", () => {
-  it("parses a run.sh fixture shaped like the real awk END block", () => {
+  it("parses the quoted calls and ignores the unquoted function definition", () => {
     assert.deepEqual(parseGateSections(runSh("Alpha", "Beta", "Gamma"), "fixture"), [
       "Alpha",
       "Beta",
@@ -102,10 +102,6 @@ describe("parseGateSections", () => {
     ]);
   });
 
-  it("ignores the unquoted function definition", () => {
-    assert.deepEqual(parseGateSections(runSh("Alpha"), "fixture"), ["Alpha"]);
-  });
-
   it("fails loud when no section_report call is present", () => {
     assert.throws(
       () => parseGateSections("END {\n  exit 0\n}\n", "fixture"),
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ab87cc7..e1f1464 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,9 +17,9 @@ on:
     #
     # An `edited` event carrying `changes.base` is a BASE-BRANCH change: the
     # merge commit the lanes test changes with it, so that runs in full. A fork
-    # pull request is never contract-only — its token is read-only on
+    # pull request is never contract-only (its token is read-only on
     # `pull_request` whatever `permissions:` requests, so it cannot record lane
-    # state — and runs the full workflow on every event exactly as before.
+    # state) and runs the full workflow on every event exactly as before.
     types: [opened, synchronize, reopened, edited, labeled, unlabeled]
 
 permissions:
@@ -77,11 +77,11 @@ concurrency:
 # Adding a lane: a new job gates merges once its name appears in the `ci-status`
 # job's `needs:` list. Its `results:` input is derived from that list and needs
 # no edit. Adding the job without the `needs:` entry leaves it running but
-# ignored — `ci-status` stays green while it fails. `pr-section-drift` is the
+# ignored: `ci-status` stays green while it fails. `pr-section-drift` is the
 # one lane that is a local script rather than a remote action: it fetches the
 # `run.sh` of the pinned `pr-contract` composite and compares this repository's
 # two PR-body mirrors to the sections that gate reports (issue #58). A fetch
-# failure is red, never a skip — the same posture as standards'
+# failure is red, never a skip, the same posture as standards'
 # `pr-convention-lockstep`.
 jobs:
   markdown:
@@ -94,7 +94,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint Markdown
-        uses: melodic-software/ci-workflows/.github/actions/markdown@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/markdown@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           config: .markdownlint-cli2.jsonc
 
@@ -108,7 +108,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Spell-check
-        uses: melodic-software/ci-workflows/.github/actions/typos@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/typos@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           config: _typos.toml
       - name: Spell-check hidden tracked paths
@@ -147,7 +147,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check editorconfig conformance
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           config: .editorconfig-checker.json
 
@@ -161,7 +161,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan for secrets
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           config: .gitleaks.toml
 
@@ -175,13 +175,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Check links and anchors (offline)
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           config: lychee.toml
           # The action's default `**/*.md` skips hidden directories, so Markdown
-          # under `.claude/` and `.github/` went unchecked — verified against the
+          # under `.claude/` and `.github/` went unchecked (verified against the
           # pinned lychee 0.24.2, where the default glob resolves 7 of this
-          # repo's 9 Markdown files. Dot-prefixed globs are listed explicitly
+          # repo's 9 Markdown files). Dot-prefixed globs are listed explicitly
           # rather than adding `--hidden` because this action exposes no
           # arbitrary-args input; the default glob is repeated, not replaced.
           globs: >-
@@ -199,7 +199,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint workflows
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
 
   jsonschema:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
@@ -211,17 +211,17 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate dependabot.yml
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           builtin-schema: vendor.dependabot
           files: .github/dependabot.yml
       - name: Validate workflows
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           builtin-schema: vendor.github-workflows
           files: .github/workflows/*.yml
       # Derived from the directory rather than restating it, for the same reason
-      # `ci-status` derives its lane list — a hand-listed roster let a newly
+      # `ci-status` derives its lane list: a hand-listed roster let a newly
       # added issue form go unvalidated with this lane still green, and nothing
       # caught the omission. Unlike `ci-status` this cannot be an expression:
       # Actions expressions have no filesystem access, so the roster is built in
@@ -240,7 +240,7 @@ jobs:
             fi
             # The consuming action word-splits and re-globs whatever it receives,
             # so a name carrying whitespace or a glob metacharacter would be
-            # mangled — and a bracket/star/question pattern that matches nothing
+            # mangled, and a bracket/star/question pattern that matches nothing
             # is dropped outright, leaving that form unvalidated with this step
             # still green. Refusing the name keeps that silent, which is the
             # failure mode deriving this list exists to remove.
@@ -256,28 +256,28 @@ jobs:
           fi
           echo "files=${forms[*]}" >> "$GITHUB_OUTPUT"
       - name: Validate issue forms
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           builtin-schema: vendor.github-issue-forms
           files: ${{ steps.issue-forms.outputs.files }}
       - name: Validate issue-template chooser config
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           builtin-schema: vendor.github-issue-config
           files: .github/ISSUE_TEMPLATE/config.yml
       # No vendored builtin covers Claude Code settings, so this validates
       # against the same schemastore URL the file itself declares in `$schema`.
       # Unlike every other lane this reaches an unpinned remote schema, so a
-      # breaking schemastore change reddens the lane without this repo changing
-      # — swap to a builtin if one ever ships.
+      # breaking schemastore change reddens the lane without this repo changing;
+      # swap to a builtin if one ever ships.
       - name: Validate Claude Code settings
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           schemafile: https://json.schemastore.org/claude-code-settings.json
           files: .claude/settings.json
 
-  # The SessionStart bootstrap is this lane's only input — discovery is tracked
-  # *.sh/*.bash files — and it arrives by standards sync already written against
+  # The SessionStart bootstrap is this lane's only input (discovery is tracked
+  # *.sh/*.bash files), and it arrives by standards sync already written against
   # the canonical .shellcheckrc (it carries `disable=` directives and cites
   # check-set-e-suppressed/SC2310). Nothing was checking that until this lane.
   # The `jsonschema` job's roster step is shell too, but an embedded `run:` block
@@ -293,7 +293,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint shell scripts
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           rcfile: .shellcheckrc
 
@@ -307,14 +307,14 @@ jobs:
         with:
           persist-credentials: false
       - name: Check index-level EOL drift
-        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
 
   # Compares `.github/PULL_REQUEST_TEMPLATE.md` headings and
   # `.claude/source-control.md`'s `pr_body_required_sections` to the
   # `section_report` calls inside the SHA-pinned `pr-contract` composite's
   # `run.sh` (issue #58). The comparison target is that pin's bytes, not a
   # third hardcoded copy of the four names. Fetches over the network; a fetch
-  # failure is red, never a skip — same posture as standards'
+  # failure is red, never a skip, same posture as standards'
   # `pr-convention-lockstep` (ADR-0008).
   pr-section-drift:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
@@ -351,7 +351,7 @@ jobs:
       statuses: write
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-contract@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/pr-contract@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           token: ${{ github.token }}
       - name: Aggregate lane results
@@ -359,10 +359,10 @@ jobs:
         # aggregation: the job still fails on the contract step's exit code, and
         # the `ci-lanes` status is on the SHA for the next contract-only run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/ci-status@4610c31e92eb1c4b24981e2f200ac87bdb2a1753 # v0.27.1
+        uses: melodic-software/ci-workflows/.github/actions/ci-status@0d3e6a6f3851cf678f82fa9a8a17f10faa909ac9 # v0.29.1
         with:
           # Derived from `needs:` rather than restating it. Hand-listing the
-          # results let a lane be dropped from this input alone — still gated via
+          # results let a lane be dropped from this input alone: still gated via
           # `needs:`, but its verdict withheld from the aggregator, so the check
           # went green on that lane's failure with no linter to catch it. `join`
           # over the `needs.*` object filter yields the whitespace-separated form
diff --git a/.gitignore b/.gitignore
index 4ddf730..4313e9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,5 @@
 # Owned by this repository. Git has no include mechanism, so there is no shared
-# .gitignore to inherit from — each repo maintains its own. Sections below cover
+# .gitignore to inherit from; each repo maintains its own. Sections below cover
 # OS/editor noise plus tooling that may run against this checkout locally, even
 # where this repo carries no such source of its own.
 
@@ -15,40 +15,28 @@ Thumbs.db
 # Claude Code worktrees (per-checkout; PR worktree workflow)
 .claude/worktrees/
 
-# Claude Code local settings — the cloud bootstrap script (.claude/cloud-bootstrap.sh)
-# installs plugins at local scope, so this file carries per-machine plugin enablement. Claude Code also
-# ignores it globally, but that is a user-level file this repo cannot assume.
-.claude/settings.local.json
-
-# Layered-config personal overlays. Plugins that ship a tracked team config layer
-# also resolve an optional per-operator overlay beside it — a per-machine deviation
-# from team policy that is never committed. The .claude/ glob is the form the
-# source-control plugin prescribes (reference/config-resolution.md, "Consumer
-# .gitignore"); the work-items tracker overlay sits at the repo root instead, so it
-# needs its own line. The glob also covers overlays of surfaces added later.
+# Per-operator overlays, never committed: .claude/settings.local.json (per-machine
+# plugin enablement written by .claude/cloud-bootstrap.sh) and the layered-config
+# overlays beside tracked team layers. The .claude/ glob is the form the
+# source-control plugin prescribes; the work-items tracker overlay sits at the
+# repo root, so it needs its own line.
 .claude/*.local.*
 .work-item-tracker.local.json
 
-# Exception: cloud-bootstrap.local.sh is a repo-owned, team-shared extension
-# point, not a per-operator overlay — .claude/cloud-bootstrap.sh documents it as
-# "a repo enriches through its own .claude/cloud-bootstrap.local.sh" and invokes
-# it directly. It matches the glob above by name only, so it is re-included:
-# ignoring it would silently drop a tracked file that cloud sessions depend on.
+# Exception: .claude/cloud-bootstrap.local.sh is a team-shared extension point
+# that .claude/cloud-bootstrap.sh invokes, not a per-operator overlay.
 !.claude/cloud-bootstrap.local.sh
 
-# Claude Code observability telemetry — per-checkout JSONL written by the
-# observability plugin. Previously ignored only via .git/info/exclude, which is
-# per-clone and does not travel, so a fresh checkout showed a dirty tree as soon
-# as the plugin wrote to it.
+# Claude Code observability telemetry (per-checkout JSONL)
 .claude/observability/
 
 # Node
 node_modules/
 
-# Lefthook — per-developer override config and local-only scripts dir
+# Lefthook: per-developer override config and local-only scripts dir
 lefthook-local.yml
 .lefthook-local/
 
-# .NET — build output
+# .NET build output
 bin/
 obj/
diff --git a/.work-item-tracker.json b/.work-item-tracker.json
index da4929a..8ffed16 100644
--- a/.work-item-tracker.json
+++ b/.work-item-tracker.json
@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
   "provider": "github",
-  "docs": "Work-item tracker binding — see the work-items plugin's tools/work-item-tracker/CONTRACT.md (Setup)",
+  "docs": "Work-item tracker binding; see the work-items plugin's tools/work-item-tracker/CONTRACT.md (Setup)",
   "config": { "lease_ttl_hours": 24 }
 }
diff --git a/SECURITY.md b/SECURITY.md
index 6e91f66..cd79980 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,9 +6,9 @@ A specific repository may override this org-wide default with its own `SECURITY.
 
 Please do **not** report security vulnerabilities through public GitHub issues, discussions, or pull requests.
 
-Report them privately through GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability):
+Report them privately through GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/report-privately):
 
-1. Open the **Security** tab of the affected repository.
+1. Open the **Security and quality** tab of the affected repository.
 2. Click **Report a vulnerability** and complete the advisory form.
 
 If private reporting is not available for a repository, email **<security@melodicsoftware.com>** instead.

From f1af78e46d3ea3d81f6e78a2aa4bbc2ffe8baccd Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 26 Sep 2026 13:37:16 -0400
Subject: [PATCH 03/16] chore(ci): drop history and ticket residue from ci.yml
 comments

Removes out-of-context residue from comments in ci.yml: two bare
"(issue #58)" back-references, the "exactly as before" and "the value
this repo has always used" history asides, and "no longer queues"
reworded to present tense. Comment-only, certified COMMENT-ONLY by the
dissolve-comments change-shape proof.

Scope decisions:
- Fix the residue in ci.yml (lines 23, 46-47, 50, 83, 315)?: yes, via
  dissolve-comments on ci.yml only (CI workflow HARD exclusion lifted by
  explicit user approval)
- Keep the (ADR-0008) reference?: yes, a durable decision record, not a
  ticket
- Residue in .claude/cloud-bootstrap.sh and managed-files-guard.yml?:
  skipped, both are synced from standards; fix upstream

Playbook: hygiene
Playbook-Step: code-tidying:audit-comment-residue@0.23.2
Playbook-Step: code-tidying:dissolve-comments@0.23.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYihoan7ULtdu32i34NaTq
---
 .github/workflows/ci.yml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e1f1464..9c2a46b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ on:
     # merge commit the lanes test changes with it, so that runs in full. A fork
     # pull request is never contract-only (its token is read-only on
     # `pull_request` whatever `permissions:` requests, so it cannot record lane
-    # state) and runs the full workflow on every event exactly as before.
+    # state) and runs the full workflow on every event.
     types: [opened, synchronize, reopened, edited, labeled, unlabeled]
 
 permissions:
@@ -43,11 +43,10 @@ permissions:
 # Full branch: `<workflow>-<pr number || run_id>` with cancel-in-progress true,
 # so a `synchronize` still cancels the run it supersedes. Keying PRs on the
 # number (not head_ref) keeps fork PRs that share a branch name from cancelling
-# each other's required runs. The push fallback stays `github.run_id`, the value
-# this repo has always used: every push lands in its own group, so a push run is
-# alone there and has nothing to cancel.
+# each other's required runs. The push fallback is `github.run_id`: every push
+# lands in its own group, so a push run is alone there and has nothing to cancel.
 #
-# The cost of the branch: a contract-only run no longer queues behind the full
+# The cost of the branch: a contract-only run does not queue behind the full
 # run whose `ci-lanes` status it carries forward, so the two race. The
 # `ci-status` composite closes that with a bounded wait on EARLIER incomplete
 # runs on the same head SHA; see `carry-forward-wait-seconds` on the job below.
@@ -80,7 +79,7 @@ concurrency:
 # ignored: `ci-status` stays green while it fails. `pr-section-drift` is the
 # one lane that is a local script rather than a remote action: it fetches the
 # `run.sh` of the pinned `pr-contract` composite and compares this repository's
-# two PR-body mirrors to the sections that gate reports (issue #58). A fetch
+# two PR-body mirrors to the sections that gate reports. A fetch
 # failure is red, never a skip, the same posture as standards'
 # `pr-convention-lockstep`.
 jobs:
@@ -312,7 +311,7 @@ jobs:
   # Compares `.github/PULL_REQUEST_TEMPLATE.md` headings and
   # `.claude/source-control.md`'s `pr_body_required_sections` to the
   # `section_report` calls inside the SHA-pinned `pr-contract` composite's
-  # `run.sh` (issue #58). The comparison target is that pin's bytes, not a
+  # `run.sh`. The comparison target is that pin's bytes, not a
   # third hardcoded copy of the four names. Fetches over the network; a fetch
   # failure is red, never a skip, same posture as standards'
   # `pr-convention-lockstep` (ADR-0008).

From 5fc82afc6420708a1ed68cb75311a8522894b36c Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 26 Sep 2026 15:06:11 -0400
Subject: [PATCH 04/16] refactor: apply structure-only tidyings across scripts
 and docs

Runs the tidy lanes over the shell tooling, the pr-section-drift
script, and the tracked markdown. Every change reorders or restructures
without changing behavior or meaning:

- pr-section-drift.mjs: name the retry count FETCH_ATTEMPTS, move
  CONTRACT_FOOTER up with the module constants, and drop export from
  contentsUrl and runLiveCheck, which nothing imports.
- pr-section-drift.test.mjs: match the source-of-truth text with
  includes() instead of a hand-escaped RegExp.
- .cursor/check.sh: drop a history sentence; .cursor/install.sh: point
  the header at the Pins block instead of repeating the pin.
- SUPPORT.md: put the override paragraph under the title, as the other
  policy files do.
- PULL_REQUEST_TEMPLATE.md: move the advisory-linkage sentences into
  the linkage paragraph.
- README.md: state the pr-contract step before the pr-section-drift
  lane that refers to it; make the Dependabot pin-comment rule its own
  bullet.
- CONTRIBUTING.md: split step 4's title and ci-status rules into a
  sub-list.

Verified: node --test (25/25), live pr-section-drift run, shellcheck,
markdownlint-cli2, and .cursor/check.sh (editorconfig lane skipped
locally for a missing ec binary; npx editorconfig-checker clean).

Scope decisions:
- Which lanes?: all of them (shell-tooling, docs-prose, and an ad hoc
  lane for .github/scripts/*.mjs), one dry-run subagent per lane
- Which findings to apply?: the 11 recommended; skipped the ${SHA}
  rewrite at test line 201 (the only hardcoded-string check), the shfmt
  case-arm outdent (no shfmt CI lane), deleting README's closing
  org-wide reminder (may be a deliberate warning), and the CLAUDE.md
  github-iac shortening (a later instruction step covers CLAUDE.md)
- Ship the org-wide SUPPORT.md, PR template, and CONTRIBUTING.md
  reorders in this sweep?: yes, reorder only
- .claude/cloud-bootstrap.sh, .claude/rules/pr-body-contract.md,
  CODE_OF_CONDUCT.md?: excluded, synced from standards or verbatim
  Contributor Covenant

Playbook: hygiene
Playbook-Step: code-tidying:tidy@0.23.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EYihoan7ULtdu32i34NaTq
---
 .cursor/check.sh                          |  3 +--
 .cursor/install.sh                        |  2 +-
 .github/PULL_REQUEST_TEMPLATE.md          | 10 +++++-----
 .github/scripts/pr-section-drift.mjs      | 18 +++++++++---------
 .github/scripts/pr-section-drift.test.mjs |  2 +-
 CONTRIBUTING.md                           |  4 +++-
 README.md                                 | 15 ++++++++-------
 SUPPORT.md                                |  4 ++--
 8 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/.cursor/check.sh b/.cursor/check.sh
index c0a6f61..9d4348a 100755
--- a/.cursor/check.sh
+++ b/.cursor/check.sh
@@ -61,8 +61,7 @@ lane_jsonschema() {
   done
   if [[ ${#forms[@]} -eq 0 ]]; then
     # Match ci.yml's roster step: an empty set is a failed derivation, not a
-    # skipped validation. Skipping here let a deleted-forms change pass locally
-    # while CI went red.
+    # skipped validation.
     echo "No issue forms (*.yml/*.yaml other than config.yml) found under .github/ISSUE_TEMPLATE/." >&2
     return 1
   fi
diff --git a/.cursor/install.sh b/.cursor/install.sh
index 34e8105..b5322d5 100755
--- a/.cursor/install.sh
+++ b/.cursor/install.sh
@@ -4,7 +4,7 @@
 # This repo ships only community-health files, so its "build" is the same
 # lint/hygiene suite CI runs (see .github/workflows/ci.yml). That suite is a set
 # of standalone tools; this script installs each one pinned to the exact version
-# the CI composite actions use (melodic-software/ci-workflows v0.29.1), so a
+# the CI composite actions use (see Pins below), so a
 # local run of .cursor/check.sh reproduces CI verdicts byte for byte.
 #
 # Idempotent and safe to re-run: every tool is skipped when the pinned version
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 0737c67..9f0c378 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -13,14 +13,14 @@ No related issue: <reason>
 
 The reason is required. Write the escape without backticks: the gate masks
 inline code spans before matching, so a backticked escape is invisible to it
-and the PR draws the advisory `needs-issue-linkage` label anyway.
+and the PR draws the advisory `needs-issue-linkage` label anyway. The linkage
+rule is advisory: the `pr-contract` step inside `ci-status` leaves a comment and
+the `needs-issue-linkage` label instead of failing. That step's output reports
+the exact rule it applied and is authoritative over this comment.
 
 Every `##` section below must be filled with real content. HTML comments like
 this one are stripped before validation, so an untouched template is reported
-as missing every section rather than passing vacuously. The linkage rule is
-advisory: the `pr-contract` step inside `ci-status` leaves a comment and the
-`needs-issue-linkage` label instead of failing. That step's output reports the
-exact rule it applied and is authoritative over this comment.
+as missing every section rather than passing vacuously.
 -->
 
 ## Summary
diff --git a/.github/scripts/pr-section-drift.mjs b/.github/scripts/pr-section-drift.mjs
index 0f6ea3b..5ade267 100644
--- a/.github/scripts/pr-section-drift.mjs
+++ b/.github/scripts/pr-section-drift.mjs
@@ -32,6 +32,11 @@ const SOURCE_CONTROL_PATH = ".claude/source-control.md";
 const UPSTREAM_REPO = "melodic-software/ci-workflows";
 const UPSTREAM_GATE = ".github/actions/pr-contract/run.sh";
 const SOURCE_CONTROL_HEADING = "pr_body_required_sections";
+const FETCH_ATTEMPTS = 3;
+const CONTRACT_FOOTER =
+  "The pinned composite is the enforcement authority; the fleet convention record is " +
+  "melodic-software/standards components/pr-convention-policy/policy.json (ADR-0008). " +
+  "Change the contract there and bump the pin, then update both local files in the same PR.";
 
 const CALLER_PIN_RE =
   /uses:\s*melodic-software\/ci-workflows\/\.github\/actions\/pr-contract@([0-9a-f]{40})/g;
@@ -125,7 +130,7 @@ export function collectDrift(contract, templateHeadings, sourceControlSections,
     .map(([label, names]) => `drift: ${label} ${formatList(names)} != ${expected}`);
 }
 
-export function contentsUrl(sha) {
+function contentsUrl(sha) {
   return `https://api.github.com/repos/${UPSTREAM_REPO}/contents/${UPSTREAM_GATE}?ref=${sha}`;
 }
 
@@ -136,7 +141,7 @@ export async function fetchGateSource(sha, fetchImpl = fetch, { backoffMs } = {}
     headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
   }
   let lastError;
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
+  for (let attempt = 1; attempt <= FETCH_ATTEMPTS; attempt += 1) {
     try {
       const response = await fetchImpl(url, { headers });
       if (response.ok) {
@@ -147,18 +152,13 @@ export async function fetchGateSource(sha, fetchImpl = fetch, { backoffMs } = {}
       lastError = error;
     }
     const delay = backoffMs === undefined ? attempt * 2000 : backoffMs;
-    if (attempt < 3 && delay > 0) {
+    if (attempt < FETCH_ATTEMPTS && delay > 0) {
       await sleep(delay);
     }
   }
   throw new FetchError(`fetch-error: ${url}: ${lastError.message}`);
 }
 
-const CONTRACT_FOOTER =
-  "The pinned composite is the enforcement authority; the fleet convention record is " +
-  "melodic-software/standards components/pr-convention-policy/policy.json (ADR-0008). " +
-  "Change the contract there and bump the pin, then update both local files in the same PR.";
-
 function emitErrors(messages) {
   for (const message of messages) {
     const fileMatch = message.match(/^drift: (\S+)/);
@@ -170,7 +170,7 @@ function emitErrors(messages) {
   console.error(CONTRACT_FOOTER);
 }
 
-export async function runLiveCheck(repoRoot, fetchImpl = fetch) {
+async function runLiveCheck(repoRoot, fetchImpl = fetch) {
   const read = (relativePath) => readFile(path.join(repoRoot, relativePath), "utf8");
   const sha = parseCallerPin(await read(CALLER_PATH));
   const contract = parseGateSections(await fetchGateSource(sha, fetchImpl), sourceOfTruth(sha));
diff --git a/.github/scripts/pr-section-drift.test.mjs b/.github/scripts/pr-section-drift.test.mjs
index 472e27f..0070111 100644
--- a/.github/scripts/pr-section-drift.test.mjs
+++ b/.github/scripts/pr-section-drift.test.mjs
@@ -168,7 +168,7 @@ describe("collectDrift", () => {
     const errors = collectDrift(contract, ["Alpha"], ["Alpha", "Beta"], SHA);
     assert.equal(errors.length, 1);
     assert.match(errors[0], /PULL_REQUEST_TEMPLATE\.md ## headings \[Alpha\]/);
-    assert.match(errors[0], new RegExp(`${sourceOfTruth(SHA).replaceAll(".", "\\.")} \\[Alpha, Beta\\]`));
+    assert.ok(errors[0].includes(`${sourceOfTruth(SHA)} [Alpha, Beta]`));
   });
 
   it("reports an extra template heading", () => {
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 787ca9c..91198e8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -15,7 +15,9 @@ A specific repository may override this org-wide default with its own `CONTRIBUT
 1. Branch from the default branch, naming it `<type>/<short-description>` (for example, `feat/add-widget`) per the org's [branch-naming convention](https://github.com/melodic-software/standards/blob/main/conventions/engineering/naming.md#branch-names-type-prefix-then-a-behavior-naming-slug). A repository may gate the pattern locally, but no check enforces it by default, so treat it as a convention rather than a requirement.
 2. Make your change, with tests where applicable.
 3. Ensure the project builds and its checks pass locally.
-4. Open a pull request, fill out the template, and link the related issue. Title it using [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) with one of the standard types, in the form `<type>[optional scope]: <description>`, for example `feat(api): add pagination`. The title becomes the squash-merge commit subject on the default branch. Where the repository enforces this, the `ci-status` check reports on your pull request and must pass before merge.
+4. Open a pull request, fill out the template, and link the related issue.
+   - Title it using [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) with one of the standard types, in the form `<type>[optional scope]: <description>`, for example `feat(api): add pagination`. The title becomes the squash-merge commit subject on the default branch.
+   - Where the repository enforces this, the `ci-status` check reports on your pull request and must pass before merge.
 5. Address review feedback. Pull requests are squash-merged once every review thread is resolved and any required checks pass.
 
 ## Reporting security issues
diff --git a/README.md b/README.md
index dd06049..26bfe31 100644
--- a/README.md
+++ b/README.md
@@ -29,18 +29,19 @@ link lane for the same reason.
   `ci.yml` runs the SHA-pinned lint and hygiene lanes from
   [`ci-workflows`](https://github.com/melodic-software/ci-workflows) and
   aggregates them into the single `ci-status` check the org ruleset requires.
+  The pull-request contract itself (Conventional Commits title, `do-not-merge`
+  label, issue linkage) is the `pr-contract` step inside the `ci-status` job,
+  so there are no separate caller workflows for it.
   The `pr-section-drift` lane is a local script (`.github/scripts/pr-section-drift.mjs`
   and its tests) that compares `.github/PULL_REQUEST_TEMPLATE.md` and
   `.claude/source-control.md` against the `pr-contract` composite at the
   SHA `.github/workflows/ci.yml` pins.
-  The pull-request contract itself (Conventional Commits title, `do-not-merge`
-  label, issue linkage) is the `pr-contract` step inside the `ci-status` job,
-  so there are no separate caller workflows for it.
   `.github/dependabot.yml` keeps the SHA-pinned composite actions
-  current. Give every composite-action pin a
-  `# vX.Y.Z` tag comment. Standards' pin-comment convention also permits a
-  short-sha-and-date fallback, but Dependabot reads the current version out of
-  that comment, so the fallback form leaves an action silently un-updated.
+  current.
+  - Give every composite-action pin a `# vX.Y.Z` tag comment. Standards'
+    pin-comment convention also permits a short-sha-and-date fallback, but
+    Dependabot reads the current version out of that comment, so the fallback
+    form leaves an action silently un-updated.
 - **Quality configs**: the root dotfiles the CI lanes run against.
   `.editorconfig`, `.gitattributes`, `.markdownlint-cli2.jsonc`, `_typos.toml`,
   `.gitleaks.toml`, `lychee.toml`, and `.editorconfig-checker.json` are synced
diff --git a/SUPPORT.md b/SUPPORT.md
index 2a3296d..6583e44 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -1,9 +1,9 @@
 # Support
 
+A specific repository may override this org-wide default with its own `SUPPORT.md` or README documenting additional support channels; where it does, that file takes precedence.
+
 Need help with a melodic-software project?
 
 - **Bugs, feature requests, and tasks**: open an issue using the issue templates.
 - **Security issues**: see [SECURITY.md](SECURITY.md); do not report them publicly.
 - **Anything else**: email **<support@melodicsoftware.com>**.
-
-A specific repository may override this org-wide default with its own `SUPPORT.md` or README documenting additional support channels; where it does, that file takes precedence.

From 56809ef361ab67449702442fe3cc2e381037bf17 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 11:28:37 -0400
Subject: [PATCH 05/16] docs: correct drifted claims in README, CLAUDE.md, and
 ci.yml comments

A codebase-health audit of the documentation and configuration
dimensions checked every factual claim against the repo and the pinned
ci-workflows actions. Five claims had drifted:

- README.md: Dependabot keeps actions/checkout current, not the
  ci-workflows composites, which dependabot.yml ignores and which move
  by hand; the pin-comment rule now covers every action pin.
- README.md: the inventory claims to cover every tracked file but
  omitted .claude/rules/pr-body-contract.md and .claude/ai-slop.json.
- ci.yml shellcheck comment: .shellcheckrc carries enable= directives,
  not disable= ones.
- ci.yml lychee comment: drop the "7 of 9 Markdown files" count, which
  went stale as files were added.
- CLAUDE.md: the lane-wiring rule sits in ci.yml's header comment above
  jobs:, not beside the ci-status job.

Verified: markdownlint-cli2 on README.md and CLAUDE.md, actionlint,
and .cursor/check.sh lanes (markdown and editorconfig red only on
untracked .work/ scratch and a missing local ec binary).

Scope decisions:
- Which findings to fix?: all five confirmed findings
- Dependabot wording?: Dependabot keeps actions/checkout current;
  ci-workflows pins move by hand; pin-comment bullet retargeted to
  every action pin
- Stale Markdown count in the lychee comment?: drop the counts rather
  than update them
- Needs-review items (PR template reason requirement,
  recurring-schedule.json schema, synced cloud-bootstrap header) and
  codebase-health:setup persist?: skipped

Playbook: hygiene
Playbook-Step: codebase-health:audit@0.10.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .github/workflows/ci.yml | 5 ++---
 CLAUDE.md                | 4 ++--
 README.md                | 9 ++++++---
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c2a46b..65ea9ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -179,8 +179,7 @@ jobs:
           config: lychee.toml
           # The action's default `**/*.md` skips hidden directories, so Markdown
           # under `.claude/` and `.github/` went unchecked (verified against the
-          # pinned lychee 0.24.2, where the default glob resolves 7 of this
-          # repo's 9 Markdown files). Dot-prefixed globs are listed explicitly
+          # pinned lychee 0.24.2). Dot-prefixed globs are listed explicitly
           # rather than adding `--hidden` because this action exposes no
           # arbitrary-args input; the default glob is repeated, not replaced.
           globs: >-
@@ -277,7 +276,7 @@ jobs:
 
   # The SessionStart bootstrap is this lane's only input (discovery is tracked
   # *.sh/*.bash files), and it arrives by standards sync already written against
-  # the canonical .shellcheckrc (it carries `disable=` directives and cites
+  # the canonical .shellcheckrc (it carries `enable=` directives and cites
   # check-set-e-suppressed/SC2310). Nothing was checking that until this lane.
   # The `jsonschema` job's roster step is shell too, but an embedded `run:` block
   # is not a file this discovery sees; the `actionlint` lane covers it instead,
diff --git a/CLAUDE.md b/CLAUDE.md
index 9b4984a..09bacd0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -26,8 +26,8 @@ where it does. Go there when a change fits none of the files already in this rep
 
 ## Adding or renaming a CI lane
 
-The wiring rule sits in `.github/workflows/ci.yml`'s header comment, beside the
-`ci-status` job it governs. The lane is done when that job's `needs:` roster names it and
+The wiring rule sits in `.github/workflows/ci.yml`'s header comment, above `jobs:`.
+The lane is done when that job's `needs:` roster names it and
 a PR run shows `ci-status` waiting on it.
 
 ## Opening a PR here
diff --git a/README.md b/README.md
index 26bfe31..03049b3 100644
--- a/README.md
+++ b/README.md
@@ -36,9 +36,9 @@ link lane for the same reason.
   and its tests) that compares `.github/PULL_REQUEST_TEMPLATE.md` and
   `.claude/source-control.md` against the `pr-contract` composite at the
   SHA `.github/workflows/ci.yml` pins.
-  `.github/dependabot.yml` keeps the SHA-pinned composite actions
-  current.
-  - Give every composite-action pin a `# vX.Y.Z` tag comment. Standards'
+  `.github/dependabot.yml` keeps `actions/checkout` current; the `ci-workflows`
+  pins move by hand (see its `ignore` block).
+  - Give every action pin a `# vX.Y.Z` tag comment. Standards'
     pin-comment convention also permits a short-sha-and-date fallback, but
     Dependabot reads the current version out of that comment, so the fallback
     form leaves an action silently un-updated.
@@ -65,6 +65,9 @@ link lane for the same reason.
   `.github/recurring-schedule.json` holds its recurring-work schedule.
   `.claude/source-control.md` and `.work-item-tracker.json` each resolve an
   optional gitignored `*.local.*` overlay for per-operator deviations.
+  `.claude/rules/pr-body-contract.md`, synced from `standards`, states the
+  pull-request body contract; `.claude/ai-slop.json` configures the AI-writing
+  audit for this repository.
   `CLAUDE.md` is the agent-loaded entry point: it routes to this file rather
   than restating it, and carries only what no other file states.
 - **Cloud Agent environment**: `.cursor/environment.json` is the repo-managed

From 8d73b6dcf3e4b1810605a91d49882a30030e09d4 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 13:51:15 -0400
Subject: [PATCH 06/16] ci: make pr-section-drift advisory and drop the empty
 recurring schedule

An overengineering audit of the enforcement surface found two
mechanisms whose carry cost outruns what they protect, plus two
drifted claims:

- ci.yml: pr-section-drift leaves the ci-status needs: roster. It is a
  network-dependent lane that text-parses another repo's run.sh, yet
  the PR-body contract it guards is advisory, and it has had 0 failures
  since landing. It still runs and reports; re-adding it to needs:
  restores the gate. Header and job comments say so.
- .github/recurring-schedule.json: deleted. It has held an empty items
  list since it was added; README no longer mentions it.
- ci.yml shellcheck comment: the bootstrap is not the lane's only
  input; the .cursor/ scripts are discovered too.
- README.md: .claude/settings.json enables no plugins (enabledPlugins
  is empty on purpose), so drop that claim.

Verified: actionlint on ci.yml, markdownlint-cli2 on README.md.

Scope decisions:
- pr-section-drift?: make advisory (drop from needs:), not delete
- recurring-schedule.json?: delete it and its README mention
- ci.yml cleanups?: fix the wrong shellcheck comment only; skip the
  YAML-anchor dedupe of the 10 repeated job if: predicates
- .cursor/check.sh?: keep
- README enabledPlugins claim?: fix
- .shellcheckrc sync, GitGuardian overlap, org apps, rulesets, plugin
  hooks, and other out-of-repo findings?: left in the findings artifact,
  no action this step

Playbook: hygiene
Playbook-Step: overengineering:audit@0.4.13
Playbook-Step: overengineering:realign@0.4.13
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .github/recurring-schedule.json |  3 ---
 .github/workflows/ci.yml        | 22 +++++++++++-----------
 README.md                       |  6 ++----
 3 files changed, 13 insertions(+), 18 deletions(-)
 delete mode 100644 .github/recurring-schedule.json

diff --git a/.github/recurring-schedule.json b/.github/recurring-schedule.json
deleted file mode 100644
index 2feb210..0000000
--- a/.github/recurring-schedule.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "items": []
-}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 65ea9ac..ab53f27 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,11 +77,11 @@ concurrency:
 # job's `needs:` list. Its `results:` input is derived from that list and needs
 # no edit. Adding the job without the `needs:` entry leaves it running but
 # ignored: `ci-status` stays green while it fails. `pr-section-drift` is the
-# one lane that is a local script rather than a remote action: it fetches the
-# `run.sh` of the pinned `pr-contract` composite and compares this repository's
-# two PR-body mirrors to the sections that gate reports. A fetch
-# failure is red, never a skip, the same posture as standards'
-# `pr-convention-lockstep`.
+# one lane that is a local script rather than a remote action, and the one lane
+# deliberately left out of `needs:`: it reports drift but does not gate, because
+# the PR-body contract it guards is itself advisory. It fetches the `run.sh` of
+# the pinned `pr-contract` composite and compares this repository's two PR-body
+# mirrors to the sections that gate reports.
 jobs:
   markdown:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
@@ -274,10 +274,10 @@ jobs:
           schemafile: https://json.schemastore.org/claude-code-settings.json
           files: .claude/settings.json
 
-  # The SessionStart bootstrap is this lane's only input (discovery is tracked
-  # *.sh/*.bash files), and it arrives by standards sync already written against
-  # the canonical .shellcheckrc (it carries `enable=` directives and cites
-  # check-set-e-suppressed/SC2310). Nothing was checking that until this lane.
+  # Discovery is tracked *.sh/*.bash files: the SessionStart bootstrap, which
+  # arrives by standards sync already written against the canonical .shellcheckrc
+  # (it carries `enable=` directives and cites check-set-e-suppressed/SC2310),
+  # and the `.cursor/` environment scripts.
   # The `jsonschema` job's roster step is shell too, but an embedded `run:` block
   # is not a file this discovery sees; the `actionlint` lane covers it instead,
   # via its own bundled ShellCheck, which does not read .shellcheckrc.
@@ -313,7 +313,7 @@ jobs:
   # `run.sh`. The comparison target is that pin's bytes, not a
   # third hardcoded copy of the four names. Fetches over the network; a fetch
   # failure is red, never a skip, same posture as standards'
-  # `pr-convention-lockstep` (ADR-0008).
+  # `pr-convention-lockstep` (ADR-0008). Advisory: not in `ci-status` `needs:`.
   pr-section-drift:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
     runs-on: ubuntu-latest
@@ -332,7 +332,7 @@ jobs:
 
   ci-status:
     if: always()
-    needs: [markdown, typos, editorconfig, gitleaks, links, actionlint, jsonschema, shellcheck, eol-renormalize, pr-section-drift]
+    needs: [markdown, typos, editorconfig, gitleaks, links, actionlint, jsonschema, shellcheck, eol-renormalize]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
diff --git a/README.md b/README.md
index 03049b3..cf8fd78 100644
--- a/README.md
+++ b/README.md
@@ -55,14 +55,12 @@ link lane for the same reason.
   Adopting the component upstream is the durable fix; until then the copy drifts
   silently.
 - **Agent config**: `.claude/settings.json` declares the `melodic-software`
-  plugin marketplace, the plugins enabled for this project, and the SessionStart
-  hook that runs `.claude/cloud-bootstrap.sh`, itself synced from
+  plugin marketplace and the SessionStart hook that runs `.claude/cloud-bootstrap.sh`, itself synced from
   [`standards`](https://github.com/melodic-software/standards)
   and extended per-repo by an optional `.claude/cloud-bootstrap.local.sh`.
   `.claude/source-control.md` is the tracked team layer of the source-control
   convention (commit and PR-title pattern, required PR-body sections, merge
-  lane); `.work-item-tracker.json` binds the work-items tracker provider and
-  `.github/recurring-schedule.json` holds its recurring-work schedule.
+  lane); `.work-item-tracker.json` binds the work-items tracker provider.
   `.claude/source-control.md` and `.work-item-tracker.json` each resolve an
   optional gitignored `*.local.*` overlay for per-operator deviations.
   `.claude/rules/pr-body-contract.md`, synced from `standards`, states the

From 579617a7b19d424c2db152f58bb1bb3a0f5c81e6 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 14:33:09 -0400
Subject: [PATCH 07/16] chore(claude): deny reads of secret-shaped files in
 project settings

Adds the audit baseline's seven secret-file Read denies to
.claude/settings.json so cloud sessions, which do not load the
operator's user-scope settings, carry them too. A Read deny covers the
built-in file tools and the Bash file commands Claude Code recognizes,
not a subprocess that opens the path itself.

Scope decisions:
- Secret-file Read denies: add all seven to this repo's project
  settings.
- git push ask rule: not added. An ask rule prompts even in auto mode
  and is denied in dontAsk mode, which would stall autonomous lanes
  that push and open PRs. No audit-pass suppression record written;
  the warning recurs on later audits.
- Force-push and reset --hard denies: not added here; user-scope
  denies and the guardrails hook already block them.
- Scope: this repo only; no standards issue for an org-wide rollout.
- Dropped as out of scope (user or machine scope):
  skipWorkflowUsageWarning, allow-completeness rows, plugin cache
  divergence, new-upstream plugin rows (enabledPlugins stays {} by
  design).

Playbook: hygiene
Playbook-Step: claude-config:audit@0.48.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .claude/settings.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.claude/settings.json b/.claude/settings.json
index 06e5e85..cc578d7 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -10,6 +10,17 @@
     }
   },
   "enabledPlugins": {},
+  "permissions": {
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)",
+      "Read(./.claude/settings.local.json)",
+      "Read(**/*.key)",
+      "Read(**/*.pem)",
+      "Read(**/id_rsa)"
+    ]
+  },
   "hooks": {
     "SessionStart": [
       {

From 4e27d19b6b5c9a9f29126b0d6c0cebe6a32dece5 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 15:09:55 -0400
Subject: [PATCH 08/16] docs(claude): name ci-status as the job whose needs:
 gates a lane

"That job" had no antecedent, and pr-section-drift is deliberately
left out of ci-status's needs:, so the rule applies to gating lanes.

Scope decisions:
- Apply the CLAUDE.md:30 wording fix (outside the catalog, a
  repo-scope rewrite): yes.
- Leave the duplicated "ci-status is the single required check" line
  to the claude-memory step: yes.

Playbook: hygiene
Playbook-Step: claude-config:audit-instructions@0.48.2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 CLAUDE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 09bacd0..76ea1d2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ where it does. Go there when a change fits none of the files already in this rep
 ## Adding or renaming a CI lane
 
 The wiring rule sits in `.github/workflows/ci.yml`'s header comment, above `jobs:`.
-The lane is done when that job's `needs:` roster names it and
+A gating lane is done when the `ci-status` job's `needs:` roster names it and
 a PR run shows `ci-status` waiting on it.
 
 ## Opening a PR here

From 10e1a5182486e5caef9592bbd689e5a3361403d2 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 15:52:02 -0400
Subject: [PATCH 09/16] docs(claude): name the local check command and drop
 lines the PR rule repeats

CLAUDE.md stated no way to verify a change. It now names
.cursor/check.sh, the local mirror of every CI lane. The "Opening a PR
here" section restated two facts that .claude/rules/pr-body-contract.md
already carries in every session; it keeps only the pointers.

Scope decisions:
- Add the missing check command (C9), an addition outside the step's delete-and-rewrite scope: yes, one line naming bash .cursor/check.sh.
- Cut the two CLAUDE.md sentences that restate .claude/rules/pr-body-contract.md (R1): yes, keep the pointers.

Playbook: hygiene
Playbook-Step: claude-memory:audit@0.13.3
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 CLAUDE.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 76ea1d2..770bb80 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,12 +30,14 @@ The wiring rule sits in `.github/workflows/ci.yml`'s header comment, above `jobs
 A gating lane is done when the `ci-status` job's `needs:` roster names it and
 a PR run shows `ci-status` waiting on it.
 
+## Checks
+
+`bash .cursor/check.sh` runs every CI lane locally, with the tools `.cursor/install.sh`
+pins, and exits non-zero when any lane fails.
+
 ## Opening a PR here
 
-`ci-status` is the single required check, and its `pr-contract` step runs the
-pull-request contract.
 [`.claude/rules/pr-body-contract.md`](.claude/rules/pr-body-contract.md) states the rule
 and what is gating versus advisory;
 [`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md) carries the layout
-and [`.claude/source-control.md`](.claude/source-control.md) the section list. The step's
-own output is authoritative on the accepted forms.
+and [`.claude/source-control.md`](.claude/source-control.md) the section list.

From 25f41ec47c680ecffcd4de24192a45daa858900e Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 27 Sep 2026 17:58:38 -0400
Subject: [PATCH 10/16] docs(readme): drop the hardcoded CI tool list from the
 Cursor environment entry

The sentence already names ci.yml as the source of the tool set, and
.cursor/install.sh owns the list; the inline copy goes stale whenever a
lane is added.

Scope decisions:
- Delete the tool-name parenthetical at README.md:75-76 (enum-list, Tier 1)?: yes

Playbook: hygiene
Playbook-Step: docs-hygiene:audit-noise@0.23.1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 README.md | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index cf8fd78..51d7951 100644
--- a/README.md
+++ b/README.md
@@ -71,11 +71,10 @@ link lane for the same reason.
 - **Cloud Agent environment**: `.cursor/environment.json` is the repo-managed
   [Cursor Cloud Agent](https://cursor.com/docs/cloud-agent/setup) config and the
   highest-precedence environment source. Its `install` runs `.cursor/install.sh`,
-  which installs the same lint/hygiene tools `.github/workflows/ci.yml` runs
-  (`markdownlint-cli2`, `typos`, `editorconfig-checker`, `gitleaks`, `lychee`,
-  `actionlint`, `check-jsonschema`, `shellcheck`), each pinned to the version the
-  SHA-pinned `ci-workflows` action uses, so `.cursor/check.sh` reproduces the CI
-  lanes, `pr-section-drift` included, and their `ci-status` aggregate locally.
+  which installs the same lint/hygiene tools `.github/workflows/ci.yml` runs,
+  each pinned to the version the SHA-pinned `ci-workflows` action uses, so
+  `.cursor/check.sh` reproduces the CI lanes, `pr-section-drift` included, and
+  their `ci-status` aggregate locally.
 
 The inventory above covers every tracked file, and no check enforces that. When
 a file is added or removed, update this section in the same change.

From 7c794eaf1ab9c20f02d356b2592977f20b7a4f4f Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:31:06 -0400
Subject: [PATCH 11/16] fix(check): report pr-section-drift as advisory,
 matching CI

ci.yml keeps pr-section-drift out of the ci-status needs: list, so a
drift report never fails CI. check.sh still counted it toward its
aggregate, so a local run failed where CI passed. The lane now runs and
prints its result without affecting the exit status.

The coupling pass found three couplings for a human to decide on:
check.sh copying the ci.yml lane list, install.sh restating the
ci-workflows tool pins, and the contract-only predicate repeated in
ci.yml. They stay in the local ledger and were not filed.

Scope decisions:
- Make pr-section-drift advisory in check.sh: yes
- Route the three routed couplings: record in the ledger only, no tracker items

Playbook: hygiene
Playbook-Step: coupling:reduce@0.2.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .cursor/check.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.cursor/check.sh b/.cursor/check.sh
index 9d4348a..6070ffb 100755
--- a/.cursor/check.sh
+++ b/.cursor/check.sh
@@ -8,7 +8,7 @@
 # (CONTRIBUTING step 3: "Ensure the project builds and its checks pass locally").
 #
 # Not set -e: lanes are collected, not short-circuited. Exit status is non-zero
-# when any lane fails.
+# when any gating lane fails.
 set -uo pipefail
 
 top="$(git rev-parse --show-toplevel)" && cd -- "$top" || exit 1
@@ -135,7 +135,10 @@ run_lane actionlint actionlint -color
 run_lane jsonschema lane_jsonschema
 run_lane shellcheck lane_shellcheck
 run_lane eol-renormalize lane_eol
-run_lane pr-section-drift lane_pr_section_drift
+
+# Advisory, as in CI: reported, never counted toward the ci-status verdict.
+heading pr-section-drift
+lane_pr_section_drift || printf '\033[33m! pr-section-drift (advisory)\033[0m\n' >&2
 
 # --- Summary ----------------------------------------------------------------
 

From 5ebec0e08292c45947fc0b371e38bf57f7f12f42 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 15:23:42 -0400
Subject: [PATCH 12/16] docs: tighten org-wide policy docs and README prose

The "a repository may override this default" sentence in
CONTRIBUTING, GOVERNANCE, SECURITY, and SUPPORT is now one clause,
each keeping its qualifier. CONTRIBUTING drops its thank-you opener
and tightens the branch-naming step and the PR-title bullet. README
merges the fallback and github-iac paragraphs and shortens the
.shellcheckrc exception. 1169 words become 1070; no decision, link,
or warning is dropped.

Scope decisions:
- Apply the proposed cuts to the override sentences, CONTRIBUTING, and README?: yes
- Keep or drop the CONTRIBUTING "Thanks" opener?: drop
- Reshape CODE_OF_CONDUCT.md, PULL_REQUEST_TEMPLATE.md, profile/README.md?: no; standard adopted text, gate-bound template, already concise

Playbook: hygiene
Playbook-Step: writing:be-concise@0.1.1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 CONTRIBUTING.md |  8 +++-----
 GOVERNANCE.md   |  2 +-
 README.md       | 25 +++++++++++--------------
 SECURITY.md     |  2 +-
 SUPPORT.md      |  2 +-
 5 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 91198e8..b926481 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,8 +1,6 @@
 # Contributing
 
-Thanks for your interest in contributing to a melodic-software project.
-
-A specific repository may override this org-wide default with its own `CONTRIBUTING.md` carrying project-specific details; where it does, that file takes precedence.
+A repository's own `CONTRIBUTING.md`, with project-specific details, overrides this org-wide default.
 
 ## Ground rules
 
@@ -12,11 +10,11 @@ A specific repository may override this org-wide default with its own `CONTRIBUT
 
 ## Workflow
 
-1. Branch from the default branch, naming it `<type>/<short-description>` (for example, `feat/add-widget`) per the org's [branch-naming convention](https://github.com/melodic-software/standards/blob/main/conventions/engineering/naming.md#branch-names-type-prefix-then-a-behavior-naming-slug). A repository may gate the pattern locally, but no check enforces it by default, so treat it as a convention rather than a requirement.
+1. Branch from the default branch as `<type>/<short-description>` (for example, `feat/add-widget`), per the org's [branch-naming convention](https://github.com/melodic-software/standards/blob/main/conventions/engineering/naming.md#branch-names-type-prefix-then-a-behavior-naming-slug). It is a convention, not a requirement: no check enforces it by default, though a repository may gate it locally.
 2. Make your change, with tests where applicable.
 3. Ensure the project builds and its checks pass locally.
 4. Open a pull request, fill out the template, and link the related issue.
-   - Title it using [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) with one of the standard types, in the form `<type>[optional scope]: <description>`, for example `feat(api): add pagination`. The title becomes the squash-merge commit subject on the default branch.
+   - Title it in [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) form with a standard type, `<type>[optional scope]: <description>`, for example `feat(api): add pagination`. The title becomes the squash-merge commit subject on the default branch.
    - Where the repository enforces this, the `ci-status` check reports on your pull request and must pass before merge.
 5. Address review feedback. Pull requests are squash-merged once every review thread is resolved and any required checks pass.
 
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index c25e575..dd0f0e8 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -1,6 +1,6 @@
 # Governance
 
-A specific repository may override this org-wide default with its own `GOVERNANCE.md` when its governance differs; where it does, that file takes precedence.
+A repository's own `GOVERNANCE.md` overrides this org-wide default when its governance differs.
 
 ## Roles
 
diff --git a/README.md b/README.md
index 51d7951..95af439 100644
--- a/README.md
+++ b/README.md
@@ -3,16 +3,14 @@
 Organization-wide community-health defaults for the
 [`melodic-software`](https://github.com/melodic-software) GitHub organization.
 
-GitHub falls back to the files in this special repository for any repository
-that does not provide its own, so they all inherit the same contribution and
-disclosure workflow without redefining it.
+GitHub falls back to these files for any repository without its own, so every
+repository inherits one contribution and disclosure workflow.
 
-These are the file-based governance defaults that GitHub's API cannot express.
-Everything the Pulumi GitHub provider *can* express is managed as
-infrastructure-as-code in the private `github-iac` repository, not here:
-repository settings, custom properties, rulesets, and labels. That name is
-deliberately not a link. The repository is private, so a link 404s for every
-reader outside the organization, and `lychee.toml` excludes it from the online
+They are the file-based governance defaults GitHub's API cannot express.
+Everything the Pulumi GitHub provider *can* express (repository settings, custom
+properties, rulesets, and labels) is infrastructure-as-code in the private
+`github-iac` repository. That name is deliberately not a link: it 404s for
+readers outside the organization, and `lychee.toml` excludes it from the online
 link lane for the same reason.
 
 ## What's here
@@ -49,11 +47,10 @@ link lane for the same reason.
   `.gitignore` is owned by this repository. Change a lint or hygiene rule in
   `standards` and let the sync land it here. An edit made directly to one of
   these files survives only until the next sync commit overwrites it.
-  `.shellcheckrc` is the exception. It is a byte-identical copy of the same
-  canonical file, but this repository is not on the `shellcheck` component's
-  managed list, so nothing syncs it and nothing overwrites a local edit either.
-  Adopting the component upstream is the durable fix; until then the copy drifts
-  silently.
+  `.shellcheckrc` is the exception: a byte-identical copy of the canonical file,
+  but this repository is not on the `shellcheck` component's managed list, so
+  nothing syncs or overwrites it. It drifts silently until the component is
+  adopted upstream.
 - **Agent config**: `.claude/settings.json` declares the `melodic-software`
   plugin marketplace and the SessionStart hook that runs `.claude/cloud-bootstrap.sh`, itself synced from
   [`standards`](https://github.com/melodic-software/standards)
diff --git a/SECURITY.md b/SECURITY.md
index cd79980..9515a94 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,6 +1,6 @@
 # Security Policy
 
-A specific repository may override this org-wide default with its own `SECURITY.md` documenting a different disclosure process; where it does, that file takes precedence.
+A repository's own `SECURITY.md` overrides this org-wide default when its disclosure process differs.
 
 ## Reporting a vulnerability
 
diff --git a/SUPPORT.md b/SUPPORT.md
index 6583e44..1bd027d 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -1,6 +1,6 @@
 # Support
 
-A specific repository may override this org-wide default with its own `SUPPORT.md` or README documenting additional support channels; where it does, that file takes precedence.
+A repository's own `SUPPORT.md` or README, listing additional support channels, overrides this org-wide default.
 
 Need help with a melodic-software project?
 

From 000ede8a51c19c4940aabc645b363504c91db0f9 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 15:47:19 -0400
Subject: [PATCH 13/16] docs: restore unconditional override in SECURITY and
 GOVERNANCE

The concision pass reworded the override sentence as "overrides this
default when its process differs", which reads as a condition on the
file's content. GitHub applies a repository's own file whenever it
exists, as the original "that file takes precedence" said.

Scope decisions:
- Fix the conditional override wording found in review?: yes, as a follow-up commit
- File issues against the skill or catalog?: no

Playbook: hygiene
Playbook-Step: writing:be-concise@0.1.1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 GOVERNANCE.md | 2 +-
 SECURITY.md   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index dd0f0e8..ca1f1d6 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -1,6 +1,6 @@
 # Governance
 
-A repository's own `GOVERNANCE.md` overrides this org-wide default when its governance differs.
+A repository with different governance can ship its own `GOVERNANCE.md`, which overrides this org-wide default.
 
 ## Roles
 
diff --git a/SECURITY.md b/SECURITY.md
index 9515a94..9b83c89 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,6 +1,6 @@
 # Security Policy
 
-A repository's own `SECURITY.md` overrides this org-wide default when its disclosure process differs.
+A repository with a different disclosure process can ship its own `SECURITY.md`, which overrides this org-wide default.
 
 ## Reporting a vulnerability
 

From df02ccdfb9796546712537a8e8ee9a06b22f7e35 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 19:08:57 -0400
Subject: [PATCH 14/16] fix(check): lint only tracked markdown in the local
 markdown lane

The markdown lane passed "**/*.md" to markdownlint-cli2, which also
matched gitignored scratch files under .work/ and failed locally on 870
issues that CI's clean checkout never sees. The lane now lints the
output of git ls-files '*.md', matching what CI checks.

Scope decisions:
- Markdown lane scans gitignored .work/: fix in check.sh; the synced .markdownlint-cli2.jsonc is left alone
- ec missing locally (mise installs it as editorconfig-checker): machine setup gap, check.sh unchanged

Playbook: hygiene
Playbook-Step: toolchain:lint@0.13.17
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .cursor/check.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.cursor/check.sh b/.cursor/check.sh
index 6070ffb..db6890a 100755
--- a/.cursor/check.sh
+++ b/.cursor/check.sh
@@ -116,6 +116,12 @@ lane_eol() {
   echo "index EOL clean"
 }
 
+# Tracked files only, as on CI's clean checkout; a "**/*.md" glob also lints
+# gitignored scratch files.
+lane_markdown() {
+  git ls-files -z -- '*.md' | xargs -0 markdownlint-cli2 --config .markdownlint-cli2.jsonc
+}
+
 lane_pr_section_drift() {
   local rc=0
   node --test .github/scripts/pr-section-drift.test.mjs || rc=1
@@ -125,7 +131,7 @@ lane_pr_section_drift() {
 
 # --- Run every lane ---------------------------------------------------------
 
-run_lane markdown markdownlint-cli2 --config .markdownlint-cli2.jsonc "**/*.md"
+run_lane markdown lane_markdown
 run_lane typos lane_typos
 run_lane editorconfig ec -config .editorconfig-checker.json
 run_lane gitleaks gitleaks dir --config .gitleaks.toml --no-banner .

From e9e70020ebdfd8c34745c5f414fd225eacec5d81 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:08:04 -0400
Subject: [PATCH 15/16] fix(check): check links in tracked markdown only

The links lane globbed "**/*.md", so lychee also scanned gitignored
scratch files under .work/. It now reads git ls-files '*.md', like the
markdown lane, which also covers .claude/ and .github/ without naming
them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 .cursor/check.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.cursor/check.sh b/.cursor/check.sh
index db6890a..c381e6e 100755
--- a/.cursor/check.sh
+++ b/.cursor/check.sh
@@ -122,6 +122,10 @@ lane_markdown() {
   git ls-files -z -- '*.md' | xargs -0 markdownlint-cli2 --config .markdownlint-cli2.jsonc
 }
 
+lane_links() {
+  git ls-files -z -- '*.md' | xargs -0 lychee --offline --no-progress --config lychee.toml
+}
+
 lane_pr_section_drift() {
   local rc=0
   node --test .github/scripts/pr-section-drift.test.mjs || rc=1
@@ -135,8 +139,7 @@ run_lane markdown lane_markdown
 run_lane typos lane_typos
 run_lane editorconfig ec -config .editorconfig-checker.json
 run_lane gitleaks gitleaks dir --config .gitleaks.toml --no-banner .
-run_lane links lychee --offline --no-progress --config lychee.toml \
-  "**/*.md" ".claude/**/*.md" ".github/**/*.md"
+run_lane links lane_links
 run_lane actionlint actionlint -color
 run_lane jsonschema lane_jsonschema
 run_lane shellcheck lane_shellcheck

From a0b83b9aa36fdad95ae3a41065dcbefb82ff5a10 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:36:18 -0400
Subject: [PATCH 16/16] docs: align check.sh and settings.json descriptions
 with behavior

CLAUDE.md and README.md said check.sh fails on any lane and counts
pr-section-drift toward ci-status. Since pr-section-drift became
advisory, check.sh exits non-zero only when a gating lane fails; both
files now say so. README.md also now notes that .claude/settings.json
denies Read on secret files.

Scope decisions:
- Fix all three verifier doc findings (CLAUDE.md:36, README.md:54, README.md:73)?: yes, all three
- Make check.sh fall back to editorconfig-checker when ec is absent?: no, install.sh installs it as ec; out of sweep scope

Playbook: hygiene
Playbook-Step: verification:confirm@0.6.9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S5b57FoPJkJMe1BDwhExiG
---
 CLAUDE.md | 2 +-
 README.md | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 770bb80..52feeeb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -33,7 +33,7 @@ a PR run shows `ci-status` waiting on it.
 ## Checks
 
 `bash .cursor/check.sh` runs every CI lane locally, with the tools `.cursor/install.sh`
-pins, and exits non-zero when any lane fails.
+pins, and exits non-zero when any gating lane fails.
 
 ## Opening a PR here
 
diff --git a/README.md b/README.md
index 95af439..820a7fa 100644
--- a/README.md
+++ b/README.md
@@ -55,6 +55,7 @@ link lane for the same reason.
   plugin marketplace and the SessionStart hook that runs `.claude/cloud-bootstrap.sh`, itself synced from
   [`standards`](https://github.com/melodic-software/standards)
   and extended per-repo by an optional `.claude/cloud-bootstrap.local.sh`.
+  It also denies Read on secret files (`.env*`, `secrets/`, keys).
   `.claude/source-control.md` is the tracked team layer of the source-control
   convention (commit and PR-title pattern, required PR-body sections, merge
   lane); `.work-item-tracker.json` binds the work-items tracker provider.
@@ -70,8 +71,8 @@ link lane for the same reason.
   highest-precedence environment source. Its `install` runs `.cursor/install.sh`,
   which installs the same lint/hygiene tools `.github/workflows/ci.yml` runs,
   each pinned to the version the SHA-pinned `ci-workflows` action uses, so
-  `.cursor/check.sh` reproduces the CI lanes, `pr-section-drift` included, and
-  their `ci-status` aggregate locally.
+  `.cursor/check.sh` reproduces the gating CI lanes and
+  their `ci-status` aggregate locally, plus the advisory `pr-section-drift`.
 
 The inventory above covers every tracked file, and no check enforces that. When
 a file is added or removed, update this section in the same change.