diff --git a/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md b/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
index f3da97963..a4096773a 100644
--- a/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
+++ b/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-release-management/skills/announce-draft/site-bump.md b/plugins/magpie-release-management/skills/announce-draft/site-bump.md
index 99ac41a8b..5cf048d61 100644
--- a/plugins/magpie-release-management/skills/announce-draft/site-bump.md
+++ b/plugins/magpie-release-management/skills/announce-draft/site-bump.md
@@ -70,8 +70,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md b/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md
index 7b3f84449..322c4969c 100644
--- a/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md
+++ b/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md
@@ -56,8 +56,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-release-management/skills/prepare/automated-signing.md b/plugins/magpie-release-management/skills/prepare/automated-signing.md
index 97971def6..49871c64d 100644
--- a/plugins/magpie-release-management/skills/prepare/automated-signing.md
+++ b/plugins/magpie-release-management/skills/prepare/automated-signing.md
@@ -95,8 +95,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-release-management/skills/prepare/post.md b/plugins/magpie-release-management/skills/prepare/post.md
index dc093d397..99866dc4f 100644
--- a/plugins/magpie-release-management/skills/prepare/post.md
+++ b/plugins/magpie-release-management/skills/prepare/post.md
@@ -63,8 +63,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-release-management/skills/prepare/prep.md b/plugins/magpie-release-management/skills/prepare/prep.md
index b11213cbb..aad2a557c 100644
--- a/plugins/magpie-release-management/skills/prepare/prep.md
+++ b/plugins/magpie-release-management/skills/prepare/prep.md
@@ -134,8 +134,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md b/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
index c8a83f4b6..22ca046e1 100644
--- a/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
+++ b/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py b/plugins/magpie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py
index 7acc513f6..6f6fd113a 100644
--- a/plugins/magpie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py
+++ b/plugins/magpie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py
@@ -59,6 +59,8 @@ def _patterns(names: Sequence[str], short: Sequence[str], prefixes: Sequence[str
     for name in short:
         leading.append(rf"^[ \t]*{re.escape(name)}{_VERSION}[ \t]*{_MARK}[ \t]*")
         trailing.append(rf"[ \t]*\({re.escape(name)}{_VERSION}\)\.?[ \t]*$")
+        # The version is required: a bare short name may be a real noun in the title.
+        trailing.append(rf"[ \t]+in[ \t]+{re.escape(name)}[ \t]+v?\d+(?:\.\d+)*(?:\.x)?[ \t]*\.?$")
     # Reporter attribution belongs in the credits field; kept end-anchored because
     # the pattern is loose enough to eat a substantive clause mid-title.
     trailing.append(r"[ \t]*\([\w.][\w. -]*[ \t]+follow-up\)\.?[ \t]*$")
diff --git a/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
index 83ba0fe29..c4cfb906d 100644
--- a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
+++ b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
@@ -20,7 +20,7 @@ argument-hint: "[pr-number] [repo:owner/name]"
 capability: capability:intake
 surface_hash: sha256:26be912ca52168e5
 license: Apache-2.0
-measured_tokens: 6431
+measured_tokens: 6441
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -324,7 +324,7 @@ Step 7e's tool writes the `<details>` envelope and creates the rollup with its m
 ## Step 6 — User confirmation
 
 This skill has no upstream clone and runs in the tracker checkout.
-Review the PR with `--target pr:<number> --repo <upstream>` and an empty temporary directory as `--repo-dir` — never the tracker checkout, which the tool refuses.
+Review the PR with `--target pr:<number> --repo <upstream>` and an export of the PR's head as `--repo-dir`, made as the review procedure below describes — never the tracker checkout, which the tool refuses.
 
 **Adversarial review by other models.** Run it now, per [pre-pr-adversarial-review.md](pre-pr-adversarial-review.md).
 
diff --git a/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security/skills/issue-sync/signals-to-actions.md b/plugins/magpie-security/skills/issue-sync/signals-to-actions.md
index 5f3ce10b1..19d38c43f 100644
--- a/plugins/magpie-security/skills/issue-sync/signals-to-actions.md
+++ b/plugins/magpie-security/skills/issue-sync/signals-to-actions.md
@@ -543,7 +543,7 @@ Group them by category:
   Re-read [`status-rollup.md` — The rollup comment shape](../../../../tools/github/status-rollup.md#the-rollup-comment-shape)
   before posting, and do not indent entries for "readability".
 
-- **Remediation-developer fill-fields, release-manager hand-off and publication-ready comments** — read [`release-manager-comments.md`](release-manager-comments.md) before proposing anything when this pass proposes `pr created` → `pr merged` or `pr merged` → `fix released`, when it proposes populating the *Public advisory URL* body field, or when the tracker already carries a `remediation-developer-fill-fields`, `release-manager-handoff` or `release-manager-publication-ready` marker comment.
+- **Remediation-developer fill-fields, release-manager hand-off and publication-ready comments** — read [`release-manager-comments.md`](release-manager-comments.md) before proposing anything when this pass proposes `pr created` → `pr merged`, on any open tracker labelled `pr merged` or `fix released`, even when a gate blocks the next label, when it proposes populating the *Public advisory URL* body field, or when the tracker already carries a `remediation-developer-fill-fields`, `release-manager-handoff` or `release-manager-publication-ready` marker comment.
 
 - **Advisory-records update and security-pages reminder comment** — on a closed-`announced` tracker from the Step 1g scan, read [`post-advisory-records.md`](post-advisory-records.md) before proposing anything.
 
diff --git a/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security/skills/model-verify/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/model-verify/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/model-verify/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/model-verify/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-security/skills/submit-to-oss-scan/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/submit-to-oss-scan/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-security/skills/submit-to-oss-scan/pre-pr-adversarial-review.md
+++ b/plugins/magpie-security/skills/submit-to-oss-scan/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-setup/skills/override-upstream/pre-pr-adversarial-review.md b/plugins/magpie-setup/skills/override-upstream/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-setup/skills/override-upstream/pre-pr-adversarial-review.md
+++ b/plugins/magpie-setup/skills/override-upstream/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/plugins/magpie-setup/skills/upstream-fix/pre-pr-adversarial-review.md b/plugins/magpie-setup/skills/upstream-fix/pre-pr-adversarial-review.md
index 382479e22..8c612ce64 100644
--- a/plugins/magpie-setup/skills/upstream-fix/pre-pr-adversarial-review.md
+++ b/plugins/magpie-setup/skills/upstream-fix/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/tools/adversarial-review/README.md b/tools/adversarial-review/README.md
index 6f6bf5cc0..196931f57 100644
--- a/tools/adversarial-review/README.md
+++ b/tools/adversarial-review/README.md
@@ -71,6 +71,7 @@ Findings are reviewer output and therefore untrusted: a finding that reads like
 The diff, the files it touches, and the PR title and body as they will be posted — nothing else, by construction: no option or parameter accepts any other context.
 Reviewers can read files with their read-only tools, and that is the residual risk: the prompt is bounded, what a reviewer chooses to read is not.
 
+- When `--repo-dir` is empty, the report carries a warning: reviewers given only the diff cannot read the code around it, so no findings there is not a clean review.
 - When `--repo-dir` is the project's private tracker, `run` refuses (exit 2). Pass `--allow-tracker-checkout` only when the tracker's own code is what is under review; the report then still says so in `warnings`.
 - `claude` and `copilot` confine file reads to their working directory (plus the brief's temporary directory for `copilot`).
   `antigravity` does too while `allowNonWorkspaceAccess` stays at its default `false` in `~/.gemini/antigravity-cli/settings.json`.
diff --git a/tools/adversarial-review/src/adversarial_review/cli.py b/tools/adversarial-review/src/adversarial_review/cli.py
index 89c06b86e..1cbe72261 100644
--- a/tools/adversarial-review/src/adversarial_review/cli.py
+++ b/tools/adversarial-review/src/adversarial_review/cli.py
@@ -234,10 +234,16 @@ def cmd_run(args: argparse.Namespace, env: Mapping[str, str]) -> int:
     if tracker and not args.allow_tracker_checkout:
         return _usage(
             f"refusing to run: {tracker}. Run it from a checkout of the code under review — "
-            "for --target pr:<N> with no such checkout, an empty temporary directory — or pass "
-            "--allow-tracker-checkout when the tracker's own code is what is under review"
+            "for --target pr:<N> with no such checkout, an export of the PR's head in a temporary "
+            "directory — or pass --allow-tracker-checkout when the tracker's own code is what is under review"
         )
     warnings = [w for w in (tracker,) if w]
+    if repo_dir.is_dir() and not any(repo_dir.iterdir()):
+        warnings.append(
+            "--repo-dir is empty: the reviewers can read only the diff, title and body, not the code "
+            "around it, so no findings here is not a clean review; export the code under review "
+            "into --repo-dir and run again"
+        )
     if inp.truncated:
         warnings.append("the diff was truncated before it reached the reviewers")
     if not requested:
diff --git a/tools/adversarial-review/tests/test_cli.py b/tools/adversarial-review/tests/test_cli.py
index debc66ce5..a670dd754 100644
--- a/tools/adversarial-review/tests/test_cli.py
+++ b/tools/adversarial-review/tests/test_cli.py
@@ -232,6 +232,39 @@ def test_truncated_diff_is_flagged_in_the_report(stub_bin, tmp_path, capsys):
     assert report["reviewers"][0]["status"] == "ok"
 
 
+@pytest.mark.parametrize("empty", [True, False])
+def test_an_empty_repo_dir_is_flagged_in_the_report(stub_bin, tmp_path, capsys, empty):
+    bin_dir, make = stub_bin
+    make(
+        "codex",
+        "import json, sys\na = sys.argv\nopen(a[a.index('-o') + 1], 'w').write(json.dumps({'findings': []}))\n",
+    )
+    repo_dir = tmp_path / "repo"
+    repo_dir.mkdir()
+    if not empty:
+        (repo_dir / "app.py").write_text("x = 1\n", encoding="utf-8")
+    diff = tmp_path / "change.diff"
+    diff.write_text("diff --git a/x b/x\n+x\n", encoding="utf-8")
+    code = main(
+        [
+            "run",
+            "--reviewers",
+            "codex",
+            "--target",
+            f"diff:{diff}",
+            "--project-root",
+            str(tmp_path),
+            "--repo-dir",
+            str(repo_dir),
+        ],
+        env={"PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}"},
+    )
+    report = json.loads(capsys.readouterr().out)
+    assert code == 0
+    assert any("--repo-dir is empty" in w for w in report["warnings"]) is empty
+    assert report["reviewers"][0]["status"] == "ok"
+
+
 def test_unrunnable_git_is_a_usage_error_not_a_traceback(stub_bin, git_repo, tmp_path, capsys):
     bin_dir, _ = stub_bin
     broken = bin_dir / "git"
diff --git a/tools/dev/blocks/pre-pr-adversarial-review.md b/tools/dev/blocks/pre-pr-adversarial-review.md
index 96c04ddb8..e7ae55bf8 100644
--- a/tools/dev/blocks/pre-pr-adversarial-review.md
+++ b/tools/dev/blocks/pre-pr-adversarial-review.md
@@ -34,8 +34,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.
diff --git a/tools/security-management/src/security_management/cve_allocate/title.py b/tools/security-management/src/security_management/cve_allocate/title.py
index 7acc513f6..6f6fd113a 100644
--- a/tools/security-management/src/security_management/cve_allocate/title.py
+++ b/tools/security-management/src/security_management/cve_allocate/title.py
@@ -59,6 +59,8 @@ def _patterns(names: Sequence[str], short: Sequence[str], prefixes: Sequence[str
     for name in short:
         leading.append(rf"^[ \t]*{re.escape(name)}{_VERSION}[ \t]*{_MARK}[ \t]*")
         trailing.append(rf"[ \t]*\({re.escape(name)}{_VERSION}\)\.?[ \t]*$")
+        # The version is required: a bare short name may be a real noun in the title.
+        trailing.append(rf"[ \t]+in[ \t]+{re.escape(name)}[ \t]+v?\d+(?:\.\d+)*(?:\.x)?[ \t]*\.?$")
     # Reporter attribution belongs in the credits field; kept end-anchored because
     # the pattern is loose enough to eat a substantive clause mid-title.
     trailing.append(r"[ \t]*\([\w.][\w. -]*[ \t]+follow-up\)\.?[ \t]*$")
diff --git a/tools/security-management/tests/test_issue_sync_rules.py b/tools/security-management/tests/test_issue_sync_rules.py
index 32ea4aac1..e745836c9 100644
--- a/tools/security-management/tests/test_issue_sync_rules.py
+++ b/tools/security-management/tests/test_issue_sync_rules.py
@@ -480,6 +480,7 @@ def test_a_failed_state_fetch_posts_nothing_on_the_hand_off_front(capsys, tmp_pa
     [
         "Stored XSS in the task instance notes view in Apache Airflow 2.10.5",
         "Stored XSS in the task instance notes view (Airflow 2.10.5)",
+        "Stored XSS in the task instance notes view in Airflow 2.10.5",
     ],
 )
 def test_a_version_noise_suffix_fails_the_title_gate(capsys, tmp_path, title):
@@ -487,6 +488,12 @@ def test_a_version_noise_suffix_fails_the_title_gate(capsys, tmp_path, title):
     assert (out["action"], out["gate_failed"]) == ("block", "title_strip_cascade")
 
 
+def test_a_short_name_with_no_version_stays_in_the_title(capsys, tmp_path):
+    title = "Stored XSS in the task instance notes view in Airflow"
+    out = decide(capsys, tmp_path, record=record(title=title), session="expired")
+    assert out["action"] == "hand-off"
+
+
 def test_a_malformed_cve_id_never_reaches_a_command(capsys, tmp_path):
     code, out = run(
         capsys, tmp_path, "push-decision", {"regenerated": True, "cve_id": "CVE-2026-1; rm -rf ~", **NAMES}
diff --git a/tools/skill-evals/README.md b/tools/skill-evals/README.md
index 2264d0b57..d8f4ad943 100644
--- a/tools/skill-evals/README.md
+++ b/tools/skill-evals/README.md
@@ -21,7 +21,7 @@ Suites are currently implemented for:
 - **security-issue-triage** — 23 cases across 7 suites (2, 2.5, 2.6, 3, 4, 6, item-failure-budget); Steps 1, 5 and 7 and the Step 6 bare-name scrub are decided and pytest-tested in `tools/security-management`
 - **security-issue-deduplicate** — 3 cases across 1 step (3, the merge inputs); Steps 1, 2, 3 (the merged body), 4, 5 and 6 are decided and pytest-tested in `tools/security-management`
 - **security-cve-allocate** — 4 cases across 1 step (4, the reporter draft); Steps 1, 2, 3, 4 (proposal and rollup), 5 and 7 are decided and pytest-tested in `tools/security-management`
-- **security-issue-sync**: 60 cases across 11 steps (1d, 1f, 2a, 2b, 2c, 5b judged gates, handoff-delegate, pointer-routing, pointer-routing-gather, D0 dashboard ASF-only gate, D4 dashboard proposals); bulk selection and pre-flight, the buckets, Steps 3 and 6, the Guardrails check, the security CC, the drafting backend, the GHSA tier and the Step 5b flow are decided and pytest-tested in `tools/security-management`
+- **security-issue-sync**: 62 cases across 11 steps (1d, 1f, 2a, 2b, 2c, 5b judged gates, handoff-delegate, pointer-routing, pointer-routing-gather, D0 dashboard ASF-only gate, D4 dashboard proposals); bulk selection and pre-flight, the buckets, Steps 3 and 6, the Guardrails check, the security CC, the drafting backend, the GHSA tier and the Step 5b flow are decided and pytest-tested in `tools/security-management`
 - **security-issue-fix** — 37 cases across 9 steps (2, 3, 5b, 5d, 5g, 7, Subversion steps 8 and 9, and pointer-routing); the flow choice, 5a, 5c, 5e, 5f, 6 and 11 are decided and pytest-tested in `tools/security-management`
 - **security-issue-invalidate** — 7 cases across 2 steps (3, 4); Steps 2, 5a, 5b, 5d, 5e, 5f and 7 are decided and pytest-tested in `tools/security-management`
 - **security-issue-import-from-md** — 7 cases across 4 steps (1, 2, 4, 6); the Step 1 parser and Step 2 keyword clean are pytest-tested in `tools/security-management`
diff --git a/tools/skill-evals/evals/security-issue-sync/README.md b/tools/skill-evals/evals/security-issue-sync/README.md
index 9aeffde8c..6f425e52b 100644
--- a/tools/skill-evals/evals/security-issue-sync/README.md
+++ b/tools/skill-evals/evals/security-issue-sync/README.md
@@ -19,7 +19,7 @@ Steps 0 (pre-flight), 1a–1c and 1e (data gathering), 1g (cve.org API check), 4
 | D0 | Dashboard mode is ASF-only | 3 | An ASF project proceeds; an `independent` project and an unset (`TODO`) organization stop without asking for a dashboard session |
 | D4 | Dashboard-mode proposals | 3 | A dashboard-triage finding beside an untracked report; two findings for the ASF Security team; an untriaged case that may be a standing label |
 | Hand-off delegate | Next-step hand-off honouring a project delegate (pre-flight `step-13`) | 4 | Triage delegated (`replace`) named and invoked through `security-issue-triage`, CVE allocation delegated (`after`), a delegate for an unrelated skill (not named), and `--no-overrides` (ignored) |
-| Pointer routing | `signals-to-actions.md` alone, no sibling text | 8 | The agent finds `release-manager-comments.md` and `post-advisory-records.md` from the pointers alone, including from an existing marker comment with no transition, and opens neither on a routine pass; the output spec names no file, so removing a pointer fails the case |
+| Pointer routing | `signals-to-actions.md` alone, no sibling text | 10 | The agent finds `release-manager-comments.md` and `post-advisory-records.md` from the pointers alone, including from an existing marker comment with no transition and on a tracker whose next label is blocked, and opens neither on a routine pass; the output spec names no file, so removing a pointer fails the case |
 | Pointer routing (gather) | Step 1 alone, no sibling text | 7 | The agent finds `cve-record-comments.md`, `closed-tracker-check.md` and `release-vote-detection.md` from their conditions alone, and opens none for an open tracker with no CVE or a closed one without `announced`; the output spec names no file, so removing a pointer fails the case |
 
 ## Hard rules exercised
diff --git a/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/expected.json b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/expected.json
new file mode 100644
index 000000000..e6ffacf61
--- /dev/null
+++ b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/expected.json
@@ -0,0 +1 @@
+{"files_to_open": ["release-manager-comments.md"]}
diff --git a/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/report.md b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/report.md
new file mode 100644
index 000000000..52d92ec58
--- /dev/null
+++ b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-10-fix-released-no-handoff/report.md
@@ -0,0 +1,5 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+An open tracker labelled `fix released`.
+This pass proposes no label change, the CVE record is `REVIEW`, and no comment carries an `apache-magpie` marker.
diff --git a/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/expected.json b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/expected.json
new file mode 100644
index 000000000..e6ffacf61
--- /dev/null
+++ b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/expected.json
@@ -0,0 +1 @@
+{"files_to_open": ["release-manager-comments.md"]}
diff --git a/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/report.md b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/report.md
new file mode 100644
index 000000000..18ee5d82d
--- /dev/null
+++ b/tools/skill-evals/evals/security-issue-sync/pointer-routing/fixtures/case-9-release-shipped-record-draft/report.md
@@ -0,0 +1,6 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+An open tracker labelled `pr merged`.
+The release carrying the fix has shipped, but the CVE record is still `DRAFT` because *Severity* is empty, so the `fix released` label cannot be flipped.
+No comment carries an `apache-magpie` marker.
diff --git a/tools/spec-loop/specs/adversarial-review.md b/tools/spec-loop/specs/adversarial-review.md
index 31a1488c3..07c671143 100644
--- a/tools/spec-loop/specs/adversarial-review.md
+++ b/tools/spec-loop/specs/adversarial-review.md
@@ -219,9 +219,11 @@ before the PR is created, through one shared block.
   plugin skips with one line.
   A `security`-family skill runs whenever at least one reviewer is listed,
   whatever `mode` says; any other skill runs only on `mode: on-pr-create`.
-  `--repo-dir` is never the tracker (an empty temporary directory for
-  `pr:<N>` with no checkout), and a change that is not a committed local
-  branch is reviewed as a diff file.
+  `--repo-dir` is never the tracker (an export of the PR's head in a
+  temporary directory for `pr:<N>` with no checkout), and a change that is
+  not a committed local branch is reviewed as a diff file.
+  An empty `--repo-dir` adds a report warning, because reviewers given only
+  the diff cannot read the code around it, so no findings is not a clean review.
   The findings are shown as untrusted, advisory data, never block the flow,
   and add nothing to a step's structured output; a finding the human wants
   fixed sends the flow back to the fix, the skill's own checks, and a fresh