diff --git a/.github/workflows/tend-ci-fix.yaml b/.github/workflows/tend-ci-fix.yaml
index 2cd9f8de..78d16006 100644
--- a/.github/workflows/tend-ci-fix.yaml
+++ b/.github/workflows/tend-ci-fix.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -109,7 +109,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-mention.yaml b/.github/workflows/tend-mention.yaml
index 5c0506af..0a7cdaaa 100644
--- a/.github/workflows/tend-mention.yaml
+++ b/.github/workflows/tend-mention.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -587,7 +587,7 @@ jobs:
           # the API record — the dispatch payload never carries one to spoof.
           EVENT_TS: ${{ github.event.comment.updated_at || needs.verify.outputs.ts || github.event.issue.updated_at }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-nightly.yaml b/.github/workflows/tend-nightly.yaml
index 0080fb60..aa97bbe9 100644
--- a/.github/workflows/tend-nightly.yaml
+++ b/.github/workflows/tend-nightly.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -100,7 +100,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-notifications.yaml b/.github/workflows/tend-notifications.yaml
index e0b877f6..33de30ec 100644
--- a/.github/workflows/tend-notifications.yaml
+++ b/.github/workflows/tend-notifications.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -295,7 +295,7 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: (steps.tend_enabled.outputs.enabled == 'true') && (steps.check.outputs.count != '0' || steps.check.outputs.conflict_count != '0' || github.event_name == 'workflow_dispatch')
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-review-runs.yaml b/.github/workflows/tend-review-runs.yaml
index 743a4b1b..48c05277 100644
--- a/.github/workflows/tend-review-runs.yaml
+++ b/.github/workflows/tend-review-runs.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -100,7 +100,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-review.yaml b/.github/workflows/tend-review.yaml
index 744ec4c4..e9630568 100644
--- a/.github/workflows/tend-review.yaml
+++ b/.github/workflows/tend-review.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -118,7 +118,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-triage.yaml b/.github/workflows/tend-triage.yaml
index ea528b61..2e381d3e 100644
--- a/.github/workflows/tend-triage.yaml
+++ b/.github/workflows/tend-triage.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -113,7 +113,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/.github/workflows/tend-weekly.yaml b/.github/workflows/tend-weekly.yaml
index 7152d6eb..bda05456 100644
--- a/.github/workflows/tend-weekly.yaml
+++ b/.github/workflows/tend-weekly.yaml
@@ -1,4 +1,4 @@
-# Generated by tend 0.2.6. Regenerate with: uvx tend@latest init
+# Generated by tend 0.2.7. Regenerate with: uvx tend@latest init
 #
 # Do not edit this file directly — it will be overwritten on regeneration.
 # To customize behavior, edit the relevant skill (for example,
@@ -100,7 +100,7 @@ jobs:
           fetch-tags: true
           token: ${{ secrets.TEND_BOT_TOKEN }}
 
-      - uses: max-sixty/tend/claude@0.2.6
+      - uses: max-sixty/tend/claude@0.2.7
         if: steps.tend_enabled.outputs.enabled == 'true'
         with:
           github_token: ${{ secrets.TEND_BOT_TOKEN }}
diff --git a/docs/specs/security-ci.rationale.md b/docs/specs/security-ci.rationale.md
index ce20f235..2be257b2 100644
--- a/docs/specs/security-ci.rationale.md
+++ b/docs/specs/security-ci.rationale.md
@@ -10,7 +10,7 @@
 
 **Why instruction files are a class of their own.** They are not read as data the way a diff is; Claude Code loads them as authoritative guidance, which is what makes a fork PR's copy of them a different class of input from the fork's code.
 
-**The `0.1.18` gap, reported from this audit and now fixed.** At the previously pinned `0.1.18` the revert list was a flat, root-relative `SENSITIVE` array naming `CLAUDE.md` but no `AGENTS.md` at all — and this repo keeps its instructions in `AGENTS.md` with `CLAUDE.md` as a one-line `@AGENTS.md` pointer, so the control reverted a pointer and left the content it pointed at attacker-controlled. The fix ([max-sixty/tend#1005](https://github.com/max-sixty/tend/pull/1005), merged 2026-08-22, released in `0.1.19` on 2026-08-26) replaces that list with pathspec globs — `':(glob)**/AGENTS.md'`, `':(glob)**/CLAUDE.md'`, `':(glob)**/.claude/**'` — which `restore-sensitive-config.sh` passes to `pin_to_base`, covering every depth rather than a hand-enumerated set of root paths. The checked-in workflows use `0.2.6` as inspected in September 2026; `0.1.19` remains the minimum security floor.
+**The `0.1.18` gap, reported from this audit and now fixed.** At the previously pinned `0.1.18` the revert list was a flat, root-relative `SENSITIVE` array naming `CLAUDE.md` but no `AGENTS.md` at all — and this repo keeps its instructions in `AGENTS.md` with `CLAUDE.md` as a one-line `@AGENTS.md` pointer, so the control reverted a pointer and left the content it pointed at attacker-controlled. The fix ([max-sixty/tend#1005](https://github.com/max-sixty/tend/pull/1005), merged 2026-08-22, released in `0.1.19` on 2026-08-26) replaces that list with pathspec globs — `':(glob)**/AGENTS.md'`, `':(glob)**/CLAUDE.md'`, `':(glob)**/.claude/**'` — which `restore-sensitive-config.sh` passes to `pin_to_base`, covering every depth rather than a hand-enumerated set of root paths. The checked-in workflows use `0.2.7` as inspected in September 2026; `0.1.19` remains the minimum security floor.
 
 **The local remedy if it ever regresses.** The nightly regen overwrites the *workflow*, not this repository's instruction files, so moving the instruction body into `CLAUDE.md` and dropping the pointer would close it with no upstream dependency, at the cost of the filename convention other agent harnesses read.