diff --git a/.claude/skills/running-tend/SKILL.md b/.claude/skills/running-tend/SKILL.md
index 11e7df23..d0b256ba 100644
--- a/.claude/skills/running-tend/SKILL.md
+++ b/.claude/skills/running-tend/SKILL.md
@@ -170,7 +170,36 @@ A stale `claude` binary resolves `--model opus`/`sonnet` to a superseded alias
 target, so drift silently downgrades the model. Skim the claude-code CHANGELOG
 between the two versions for anything touching the agent paths (first-run
 onboarding, `--model` alias resolution, headless `-p` result events, Stop-hook
-behavior) and note it in the PR.
+behavior, slash-command or `Skill`-tool handling) and note it in the PR.
+
+One of those paths has to be checked against the binary, not the CHANGELOG.
+Every generated Claude prompt carries a bare `/code-review` token
+(`code_review_notice` in `generator/src/tend/config.py`) to trip the `Skill`
+tool's `disable-model-invocation` waiver, and the scan reading it lives in the
+binary. `test_default_prompt_unlocks_code_review` pins only our side of that
+contract, so if the scan moves, nothing fails — every run just loses its second
+pass. Confirm both halves in the version being pinned and report them in the PR:
+
+```bash
+V=<version being pinned>
+curl -fsSL "https://downloads.claude.ai/claude-code-releases/$V/linux-x64/claude" -o "/tmp/claude-$V"
+# Scan regex: whitespace on both sides of a token built from the invoked
+# skill's name, which the Skill tool passes in at runtime.
+grep -aoE '\(\?<!\\\\S\)/\$\{[^}]+\}\(\?=\$\|\\\\s\)' "/tmp/claude-$V"
+# Every binding of the name, with enough context to tell which is which.
+grep -aoE '.{90}"code-review".{40}' "/tmp/claude-$V"
+```
+
+The second grep prints several hits and only one is the half that matters: the
+bundled-skill name list, a run of `var` assignments with `dataviz` and
+`code-walkthrough` as neighbors. A `CODE_REVIEW_WORKFLOW_NAME` hit names the
+built-in code-review *workflow* instead — a skill-side rename need not move it,
+so reading that one as the answer reports "still fine" on exactly the failure
+this check exists to catch. Empty output from either grep means the shape
+moved; read the surrounding code before concluding the waiver still fires. That
+URL is the path the install actually takes — `claude.ai/install.sh` redirects
+to the same release bucket — so a version resolving on npm but not there fails
+the install.
 
 `mitmproxy_version` pins the process that holds the real PAT and model
 credential, so a security fix there matters here. Check anything security- or