diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 235c358..df787d1 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -24,9 +24,10 @@ touch the template (e.g. docs-only).
 <!--
 CI (.github/workflows/ci.yml) runs scripts/check_docs.py on every PR and
 mechanically checks the first two Doc sync boxes above, plus relative links
-between the repo's own docs. It catches doc drift, not behavior. There is no
-automated behavioral test suite, so describe how you validated the change —
-see CLAUDE.md's "Testing changes" section (running /create-dev-loop against
-a real repo and checking the generated skill compiles, MODE=update behaves
-correctly, etc.).
+between the repo's own docs. It then runs tests/test_check_docs.py, the unit
+tests for that script — add cases there if you changed its logic. CI catches
+doc drift, not the template's behavior. There is no automated behavioral test
+suite, so describe how you validated the change — see CLAUDE.md's "Testing
+changes" section (running /create-dev-loop against a real repo and checking
+the generated skill compiles, MODE=update behaves correctly, etc.).
 -->
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a02e6cf..68b456c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -54,9 +54,12 @@ contributors:
    on your PR and mechanically checks two of the rules above — every
    `{{placeholder}}` has a substitution-table row, and README's Step list
    stays 1:1 with `create-dev-loop.md` — plus local relative-link checks. It
-   catches doc drift, not behavior. There is no automated behavioral test
-   suite; the real test for behavior is running `/create-dev-loop` against a
-   real repository and confirming:
+   also runs `tests/test_check_docs.py`, fixture-based unit tests of
+   `scripts/check_docs.py` itself, so a silently-broken check can't read as
+   "0 errors → pass"; add cases there when you change that script's logic.
+   CI catches doc drift, not the template's behavior. There is no automated
+   behavioral test suite; the real test for behavior is running
+   `/create-dev-loop` against a real repository and confirming:
    - the generated skill file compiles (no unresolved `{{placeholders}}`
      remain)
    - the slash command link resolves correctly
diff --git a/README.md b/README.md
index 8645e12..3f23c22 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # create-dev-loop
 
-[![CI](https://github.com/dmccoystephenson/create-dev-loop/actions/workflows/ci.yml/badge.svg)](https://github.com/dmccoystephenson/create-dev-loop/actions/workflows/ci.yml)
+[![CI](https://github.com/Stephenson-Software/create-dev-loop/actions/workflows/ci.yml/badge.svg)](https://github.com/Stephenson-Software/create-dev-loop/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE.md)
 
 A Claude Code skill that generates a **tailored autonomous dev loop** for any git repository — one slash command away from continuous, repo-aware development.
@@ -84,7 +84,7 @@ Each generated `<slug>-dev-loop` skill encodes:
 A generated skill is invoked interactively, one repo at a time, as
 `/<slug>-dev-loop`. To run them unattended across a whole fleet of repos —
 on a schedule, with safety gating and a merge allow-list — see
-[`gardener`](https://github.com/dmccoystephenson/gardener), this project's
+[`gardener`](https://github.com/Stephenson-Software/gardener), this project's
 open-source companion. `gardener tend` dispatches a repo's generated skill
 headlessly and bootstraps one via `/create-dev-loop` if the repo doesn't
 have one yet; `gardener overnight` does that across an opt-in list of repos
diff --git a/RESEARCH.md b/RESEARCH.md
index 9ba3a66..12d21eb 100644
--- a/RESEARCH.md
+++ b/RESEARCH.md
@@ -16,7 +16,7 @@ This document records the empirical findings that inform the design of `create-d
 - **First-party sources** (Anthropic, OpenAI, vendor research with numbers) count as evidence but must be flagged as first-party so readers can weight them appropriately.
 - **Confidence levels**: `high` = replicated across multiple independent studies; `medium` = one well-cited study, plausible; `low` = single paper, contested, or inferred from adjacent literature.
 
-Last reviewed: 2026-07-29.
+Last reviewed: 2026-08-04.
 
 ---
 
diff --git a/SECURITY.md b/SECURITY.md
index b702473..453b631 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -31,8 +31,10 @@ identity, its reviewer, or its branch prefix. Step 4 also derives from it:
 - **The shell commands the generated skill runs.** `COMPILE_CMD`,
   `TEST_CMD`, `LINT_CMD`, and `EXTERNAL_SIGNAL_CMD` are taken from the
   target repo's build files and CI workflows, and the generated skill
-  executes them verbatim — in its Phase 3 build-verification step and its
-  Phase 4 external-signal anchor.
+  executes them verbatim — in its Phase 3 build-verification step, its
+  Phase 4 external-signal anchor, and its Phase 8 post-rebase re-check.
+  `REVALIDATE_INSTRUCTION`, derived from the same sources, points Phase 6
+  at that same check after every review fix.
 - **Which paths are exempt from autonomous merge.** `DO_NOT_AUTO_MERGE`
   adds to the paths the generated skill refuses to merge without a human.
   It can only widen that list — a universal baseline (`.github/workflows/*`,