The contributor instructions say what the manifest does

CONTRIBUTING.md

@@ -149,15 +149,18 @@ whether these decks open.
 ## What a change has to pass
 
 ```
-composer validate
+composer validate --strict
 vendor/bin/pest
 XDEBUG_MODE=coverage vendor/bin/pest --coverage --min=100
 sh tools/phpstan.sh
 php examples/build.php
 ```
 
-`composer validate` is run **without** `--strict` on purpose: the manifest pins a commit of
-PHPPresentation's `master` branch rather than a tag, and `--strict` refuses that.
+`composer validate` is run **with** `--strict`: the manifest requires `phpoffice/phppresentation`
+at `~1.2.0`, a range of tags, and `--strict` passes there. The fixes this library needs are not
+in that release, so they come from a patch the library applies to the installed package — the
+[README](README.md#installation) says what a project has to allow for the patch to land, and the
+[suite's own site](https://markdown-office.github.io/suite/) says the same.
 
 Coverage is 100% and PHPStan is level 9. Neither a baseline nor an `ignoreErrors` entry nor a
 suppression comment: a finding is fixed or left red with a reason. The analyser is fetched by

tests/Unit/dead-code.php

@@ -248,6 +248,11 @@ function pagesWithClaim(string $claim): array
     'a directive nobody acts on is passed over' => 'an unknown directive is ignored',
     'a directive nobody reads is drawn as the words the deck wrote it' => 'draws a directive it does not read',
     'a v-click marker closing a list item is honoured' => 'a marker closing a list item',
+    // The pin and the strictness, as claims rather than as syntax: the history in
+    // `CHANGELOG.md` has to be able to say that the manifest once pinned a commit, so a
+    // phrase naming the old pin would fire on the history rather than on a wrong page.
+    'the manifest pins a commit of PHPPresentation master' => 'pins a commit of',
+    'the contributor instructions say validate runs without strict' => '`composer validate` is run **without**',
     // The old spellings, as claims rather than as syntax: `CHANGELOG.md` has to be able to
     // name what a deck used to be written in, so a phrase that only says "<!-- v-click"
     // would fire on the history that documents the change rather than on a wrong page.