diff --git a/components/pr-convention-policy/fixtures/lockstep/check-contract-run-literal-ref.sh.txt b/components/pr-convention-policy/fixtures/lockstep/check-contract-run-literal-ref.sh.txt
new file mode 100755
index 00000000..bcb23d13
--- /dev/null
+++ b/components/pr-convention-policy/fixtures/lockstep/check-contract-run-literal-ref.sh.txt
@@ -0,0 +1,630 @@
+#!/usr/bin/env bash
+# Single-run pull-request contract: title, do-not-merge label, issue linkage.
+#
+# One composite step, so a consumer needs exactly one required check
+# (`ci-status`). Every check reads the LIVE pull request from the API rather than the event
+# payload, so `edited`, `labeled` and `unlabeled` runs see current state.
+set -euo pipefail
+
+: "${REPOSITORY:?REPOSITORY is required}"
+: "${TYPES:?TYPES is required}"
+
+PR_NUMBER="${PR_NUMBER:-}"
+REQUIRE_SCOPE="${REQUIRE_SCOPE:-false}"
+DO_NOT_MERGE_LABEL="${DO_NOT_MERGE_LABEL:-do-not-merge}"
+EXEMPT_AUTHORS="${EXEMPT_AUTHORS:-}"
+LINKAGE_LABEL="${LINKAGE_LABEL:-needs-issue-linkage}"
+LINKAGE_MODE="${LINKAGE_MODE:-advisory}"
+
+# Stable HTML marker on the advisory comment: the upsert finds its own previous
+# comment by this string, so a re-run edits rather than posting a second one.
+LINKAGE_MARKER='<!-- pr-contract:linkage -->'
+
+scratch="$(mktemp -d)"
+trap 'rm -rf -- "$scratch"' EXIT
+gh_stdout="$scratch/gh-stdout"
+gh_stderr="$scratch/gh-stderr"
+
+emit_output() {
+  local name="$1" value="$2"
+  if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+    echo "${name}=${value}" >>"$GITHUB_OUTPUT"
+  fi
+}
+
+# Every annotation below quotes attacker-controlled text: the PR title, the PR
+# body, the author login. GitHub's documented escaping for workflow-command data
+# is `%` -> `%25`, CR -> `%0D`, LF -> `%0A`; without it a title carrying a
+# newline can close the annotation and inject a second workflow command.
+# `%` first, or the escapes introduced by the others get double-escaped.
+escape_annotation() {
+  local text="$1"
+  text="${text//'%'/%25}"
+  text="${text//$'\r'/%0D}"
+  text="${text//$'\n'/%0A}"
+  printf '%s' "$text"
+}
+
+# Every value below is interpolated into a `gh api` path. Validate before the
+# first call rather than trusting the caller's expression.
+require_pattern() {
+  local name="$1" value="$2" pattern="$3" shape="$4"
+  if [[ ! "$value" =~ $pattern ]]; then
+    echo "::error::pr-contract: ${name} must be ${shape}, got: $(escape_annotation "$value")"
+    exit 1
+  fi
+}
+
+# Percent-encode a label so it reaches the DELETE path as one segment. `@uri`
+# encodes UTF-8 bytes, so an emoji or non-ASCII label survives.
+# shellcheck disable=SC2329 # invoked from remove_linkage_label, itself reached through best_effort.
+url_encode() {
+  jq -rn --arg text "$1" '$text|@uri'
+}
+
+case "$LINKAGE_MODE" in
+advisory | enforce) ;;
+*)
+  echo "::error::pr-contract: linkage-mode must be 'advisory' or 'enforce', got: ${LINKAGE_MODE}"
+  exit 1
+  ;;
+esac
+
+case "$REQUIRE_SCOPE" in
+true | false) ;;
+*)
+  echo "::error::pr-contract: require-scope must be 'true' or 'false', got: ${REQUIRE_SCOPE}"
+  exit 1
+  ;;
+esac
+
+# Step 0 — no pull request in this event. The composite is a pull-request gate;
+# a push, schedule or workflow_dispatch run must report skipped, not fail.
+if [[ -z "${PR_NUMBER//[[:space:]]/}" ]]; then
+  echo '::notice::pr-contract: no pull request in this event; nothing to check'
+  emit_output title skipped
+  emit_output do-not-merge skipped
+  emit_output linkage skipped
+  exit 0
+fi
+
+# Only the two values that reach an API path unencoded. The labels are
+# deliberately NOT validated: GitHub labels may legally contain spaces and
+# colons (`do not merge`, `status: blocked`), and neither one is ever
+# interpolated raw — the blocking label is compared with `grep -qxF`, the
+# linkage label travels in a JSON body built by `jq --arg`, and the only path
+# it reaches is percent-encoded below.
+require_pattern repository "$REPOSITORY" '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$' 'OWNER/REPO'
+require_pattern pr-number "$PR_NUMBER" '^[0-9]+$' 'a positive integer'
+
+# gh_api <method> <path> [extra args...]
+# Captures stdout and stderr; sets GH_HTTP_STATUS from gh's "(HTTP nnn)" tail
+# when the call failed. Returns gh's exit status.
+GH_HTTP_STATUS=""
+gh_api() {
+  local method="$1" path="$2"
+  shift 2
+  local status=0
+  : >"$gh_stdout"
+  : >"$gh_stderr"
+  GH_HTTP_STATUS=""
+  # `set +e` around the call: a failed API read is classified by the caller,
+  # not aborted by errexit.
+  set +e
+  gh api -X "$method" "$path" "$@" >"$gh_stdout" 2>"$gh_stderr"
+  status=$?
+  set -e
+  if [[ "$status" -ne 0 ]]; then
+    GH_HTTP_STATUS="$(sed -n 's/.*(HTTP \([0-9][0-9]*\)).*/\1/p' "$gh_stderr" | head -n1)"
+  fi
+  return "$status"
+}
+
+# Best-effort write: a refused or missing write surfaces as a ::notice:: and
+# never changes the exit code. The advisory comment and label are convenience,
+# not the gate.
+best_effort() {
+  local description="$1"
+  shift
+  if "$@"; then
+    return 0
+  fi
+  local detail="${GH_HTTP_STATUS:-unknown}"
+  echo "::notice::pr-contract: ${description} was refused (HTTP ${detail}); continuing without it"
+  return 0
+}
+
+# ---------------------------------------------------------------------------
+# Step 1 — fetch the pull request once.
+# ---------------------------------------------------------------------------
+# shellcheck disable=SC2310 # gh_api handles its own errexit; the caller classifies the status.
+if ! gh_api GET "repos/${REPOSITORY}/pulls/${PR_NUMBER}"; then
+  cat "$gh_stderr" >&2
+  echo "::error::pr-contract: could not read repos/${REPOSITORY}/pulls/${PR_NUMBER} (HTTP ${GH_HTTP_STATUS:-unknown})"
+  exit 1
+fi
+pr_json="$scratch/pr.json"
+cp -- "$gh_stdout" "$pr_json"
+
+pr_title="$(jq -r '.title // ""' <"$pr_json")"
+pr_author="$(jq -r '.user.login // ""' <"$pr_json")"
+jq -r '.body // ""' <"$pr_json" >"$scratch/body.txt"
+jq -r '(.labels // []) | .[].name' <"$pr_json" >"$scratch/labels.txt"
+
+# ---------------------------------------------------------------------------
+# Step 2 — title against Conventional Commits with the caller's type list.
+# ---------------------------------------------------------------------------
+types_list="$(printf '%s' "$TYPES" | tr ',' '\n' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' | grep -v '^$' || true)"
+if [[ -z "$types_list" ]]; then
+  echo "::error::pr-contract: types is empty; list at least one allowed Conventional Commits type"
+  exit 1
+fi
+types_alternation="$(printf '%s' "$types_list" | paste -sd '|' -)"
+types_human="${types_alternation//|/, }"
+
+# `: +`, not `: `: the conventional-commits parser tolerates more than one space
+# after the colon.
+# shellcheck disable=SC2016 # the backticks are Markdown code spans in a message, not command substitution.
+if [[ "$REQUIRE_SCOPE" == true ]]; then
+  title_regex="^(${types_alternation})\([^)]+\)!?: +[^[:space:]]"
+  scope_hint='a scope is REQUIRED, e.g. `feat(api): add the widget endpoint`'
+else
+  title_regex="^(${types_alternation})(\([^)]+\))?!?: +[^[:space:]]"
+  scope_hint='an optional scope may follow the type, e.g. `feat(api): add the widget endpoint`'
+fi
+
+title_result=pass
+if [[ ! "$pr_title" =~ $title_regex ]]; then
+  title_result=fail
+  echo "::error::pr-contract: the PR title does not follow Conventional Commits: \"$(escape_annotation "$pr_title")\". Expected \"<type>: <subject>\" with a non-empty subject; allowed types: ${types_human}. ${scope_hint} A breaking change marks the type with \"!\"."
+fi
+
+# ---------------------------------------------------------------------------
+# Step 3 — do-not-merge label.
+# ---------------------------------------------------------------------------
+do_not_merge_result=pass
+if grep -qxF -- "$DO_NOT_MERGE_LABEL" "$scratch/labels.txt"; then
+  do_not_merge_result=fail
+  echo "::error::pr-contract: this PR carries the '${DO_NOT_MERGE_LABEL}' label; remove it to merge."
+fi
+
+# ---------------------------------------------------------------------------
+# Step 4 — issue linkage.
+#
+# The body must
+# carry a native closing keyword, an explicit non-closing `Refs:`/`Relates to:`
+# marker, or a no-issue opt-out, AND four non-empty contract sections. A negated
+# closing reference fails outright and is never excused by a valid marker
+# elsewhere, because GitHub's own parser is negation-blind and closes the issue
+# on merge regardless of the disclaimer.
+#
+# The analyzer masks rendered HTML comments, fenced and indented code blocks,
+# and inline code spans before matching, so a PR template's commented-out
+# example cannot satisfy the gate.
+# ---------------------------------------------------------------------------
+analyze_body() {
+  awk '
+# Whitespace includes newlines: section content is joined before trimming, so a
+# section holding only blank lines must trim to the empty string.
+function trim(s) {
+  sub(/^[ \t\r\n]+/, "", s)
+  sub(/[ \t\r\n]+$/, "", s)
+  return s
+}
+
+function run_length(s, ch,   n) {
+  n = 0
+  while (substr(s, n + 1, 1) == ch) n++
+  return n
+}
+
+# A backtick run of the same length later on this line closes an inline span.
+# The upstream implementation also scans following lines; a multi-line inline
+# span in a PR body is not a shape this gate needs to model.
+function has_closing_run(s, start, ticks,   col, stop) {
+  col = start
+  while (col <= length(s)) {
+    if (substr(s, col, 1) != "`") {
+      col++
+      continue
+    }
+    stop = col + 1
+    while (substr(s, stop, 1) == "`") stop++
+    if (stop - col == ticks) return 1
+    col = stop
+  }
+  return 0
+}
+
+function negation_trigger(line, keyword_index,   preceding, cut, i, ch, tail, count, words, first, word, lower) {
+  preceding = substr(line, 1, keyword_index - 1)
+  cut = 0
+  for (i = length(preceding); i >= 1; i--) {
+    ch = substr(preceding, i, 1)
+    if (ch == "." || ch == "!" || ch == "?" || ch == ";" || ch == ",") {
+      cut = i
+      break
+    }
+  }
+  tail = substr(preceding, cut + 1)
+  # U+2019 RIGHT SINGLE QUOTATION MARK, written as its UTF-8 bytes so the source
+  # of this action stays plain ASCII: normalize a typographic apostrophe to the
+  # straight one so "doesn<U+2019>t close #N" is detected like "doesn'"'"'t".
+  gsub("\342\200\231", "'"'"'", tail)
+  count = 0
+  while (match(tail, /[A-Za-z][A-Za-z'"'"']*/)) {
+    count++
+    words[count] = substr(tail, RSTART, RLENGTH)
+    tail = substr(tail, RSTART + RLENGTH)
+  }
+  first = (count > 5) ? count - 4 : 1
+  for (i = first; i <= count; i++) {
+    word = words[i]
+    lower = tolower(word)
+    # Correlative "not only ... but" is affirmative, not a disclaimer.
+    if (lower == "not" && i < count && tolower(words[i + 1]) == "only") continue
+    if (lower == "not" || lower == "never" || lower == "no" || lower == "without" ||
+        lower == "deliberately" || lower == "intentionally") return word
+    if (tolower(substr(word, length(word) - 2)) == "n'"'"'t") return word
+  }
+  return ""
+}
+
+function scan_line(line,   indent, rest, lower, offset, chunk, start, len, before, after, text, trigger) {
+  indent = 0
+  while (substr(line, indent + 1, 1) == " ") indent++
+  if (indent <= 3) {
+    rest = tolower(substr(line, indent + 1))
+    if (rest ~ /^(refs|relates[ \t]+to):[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+[ \t]*$/) {
+      has_non_closing = 1
+    }
+  }
+  lower = tolower(line)
+  offset = 0
+  while (1) {
+    chunk = substr(lower, offset + 1)
+    if (!match(chunk, /(close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)[ \t]*:?[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+/)) break
+    start = offset + RSTART
+    len = RLENGTH
+    offset = start + len - 1
+    before = (start > 1) ? substr(lower, start - 1, 1) : ""
+    after = substr(lower, start + len, 1)
+    # Word-boundary equivalent of the upstream /\b...\b/ anchors.
+    if (before ~ /[a-z0-9_]/) continue
+    if (after ~ /[a-z0-9_]/) continue
+    text = substr(line, start, len)
+    trigger = negation_trigger(line, start)
+    if (trigger != "") {
+      if (!(text in negated_trigger)) {
+        negated_count++
+        negated_order[negated_count] = text
+        negated_trigger[text] = trigger
+      }
+    } else {
+      has_closing = 1
+    }
+  }
+}
+
+function section_report(name,   i, trimmed, start, hashes, next_char, tail, content) {
+  start = 0
+  for (i = 1; i <= line_count; i++) {
+    trimmed = tolower(trim(masked[i]))
+    if (trimmed ~ ("^##[ \t]+" tolower(name) "$")) {
+      start = i
+      break
+    }
+  }
+  if (start == 0) {
+    print "section-missing\t" name
+    return
+  }
+  content = ""
+  for (i = start + 1; i <= line_count; i++) {
+    trimmed = trim(masked[i])
+    hashes = run_length(trimmed, "#")
+    if (hashes >= 1 && hashes <= 6) {
+      next_char = substr(trimmed, hashes + 1, 1)
+      tail = trim(substr(trimmed, hashes + 1))
+      # Only a heading at the same or higher level ends the section, so a
+      # nested subsection counts as this section content.
+      if ((next_char == " " || next_char == "\t") && tail != "" && hashes <= 2) break
+    }
+    content = content masked[i] "\n"
+  }
+  if (trim(content) == "") print "section-empty\t" name
+}
+
+BEGIN {
+  line_count = 0
+  comment_open = 0
+  inline_ticks = 0
+  fence_char = ""
+  fence_len = 0
+  has_closing = 0
+  has_non_closing = 0
+  negated_count = 0
+}
+
+{
+  line = $0
+  sub(/\r$/, "", line)
+
+  if (!comment_open && inline_ticks == 0) {
+    indent = 0
+    while (substr(line, indent + 1, 1) == " ") indent++
+    rest = substr(line, indent + 1)
+    marker_char = substr(rest, 1, 1)
+    marker_run = 0
+    if (marker_char == "`" || marker_char == "~") marker_run = run_length(rest, marker_char)
+    is_marker = (indent <= 3 && marker_run >= 3)
+    info = is_marker ? substr(rest, marker_run + 1) : ""
+
+    if (fence_char != "") {
+      masked[++line_count] = ""
+      if (is_marker && marker_char == fence_char && marker_run >= fence_len && info ~ /^[ \t]*$/) {
+        fence_char = ""
+        fence_len = 0
+      }
+      next
+    }
+    if (is_marker && !(marker_char == "`" && index(info, "`") > 0)) {
+      fence_char = marker_char
+      fence_len = marker_run
+      masked[++line_count] = ""
+      next
+    }
+    if (substr(line, 1, 4) == "    " || substr(line, 1, 1) == "\t") {
+      masked[++line_count] = ""
+      next
+    }
+  }
+
+  rendered = ""
+  index_position = 1
+  line_length = length(line)
+  while (index_position <= line_length) {
+    if (comment_open) {
+      close_at = index(substr(line, index_position), "-->")
+      if (close_at == 0) {
+        index_position = line_length + 1
+        continue
+      }
+      comment_open = 0
+      index_position = index_position + close_at - 1 + 3
+      continue
+    }
+    character = substr(line, index_position, 1)
+    if (character == "`") {
+      stop = index_position + 1
+      while (substr(line, stop, 1) == "`") stop++
+      ticks = stop - index_position
+      was_inline = (inline_ticks != 0)
+      if (!was_inline && has_closing_run(line, stop, ticks)) {
+        inline_ticks = ticks
+      } else if (inline_ticks == ticks) {
+        inline_ticks = 0
+      }
+      if (!was_inline && inline_ticks == 0) rendered = rendered substr(line, index_position, stop - index_position)
+      index_position = stop
+      continue
+    }
+    if (inline_ticks == 0 && substr(line, index_position, 4) == "<!--") {
+      comment_open = 1
+      index_position += 4
+      continue
+    }
+    if (inline_ticks == 0) rendered = rendered character
+    index_position++
+  }
+  masked[++line_count] = rendered
+}
+
+END {
+  section_report("Summary")
+  section_report("Fix")
+  section_report("Verification")
+  section_report("Related")
+
+  body = ""
+  for (i = 1; i <= line_count; i++) {
+    scan_line(masked[i])
+    body = body masked[i] "\n"
+  }
+  for (i = 1; i <= negated_count; i++) {
+    print "negated\t" negated_order[i] "\t" negated_trigger[negated_order[i]]
+  }
+  if (has_closing) print "closing"
+  if (has_non_closing) print "non-closing"
+  if (tolower(body) ~ /(^|[^a-z0-9_])no (linked|related) issue([^a-z0-9_]|$)/) print "no-issue"
+}
+'
+}
+
+section_guidance() {
+  case "$1" in
+  Summary) echo 'Describe what this PR changes and why, in a sentence or two.' ;;
+  Fix) echo 'State the concrete change and how it addresses the problem.' ;;
+  Verification) echo 'Record concrete evidence the change works (commands, gates, output).' ;;
+  Related) echo 'List related PRs, ADRs, or decision-log entries this PR does not close.' ;;
+  *) echo 'Fill this section in.' ;;
+  esac
+}
+
+linkage_result=pass
+linkage_errors=()
+
+is_exempt_author=false
+if [[ -n "${EXEMPT_AUTHORS//[[:space:]]/}" && -n "$pr_author" ]]; then
+  while IFS= read -r candidate; do
+    candidate="${candidate#"${candidate%%[![:space:]]*}"}"
+    candidate="${candidate%"${candidate##*[![:space:]]}"}"
+    [[ -n "$candidate" ]] || continue
+    # Exact-login equality only, never a `*[bot]` pattern, so an unknown future
+    # bot is not silently skipped on this gate.
+    if [[ "$candidate" == "$pr_author" ]]; then
+      is_exempt_author=true
+      break
+    fi
+    # `printf '%s\n'` (not '%s'): without the trailing newline `read` drops the
+    # last list entry, which silently un-exempts the final author.
+  done < <(printf '%s\n' "$EXEMPT_AUTHORS" | tr ',' '\n')
+fi
+
+if [[ "$is_exempt_author" == true ]]; then
+  linkage_result=exempt
+  echo "::notice::pr-contract: PR author \"$(escape_annotation "$pr_author")\" matches an exempt-authors entry; skipping the issue-linkage check."
+else
+  analysis="$scratch/analysis.txt"
+  analyze_body <"$scratch/body.txt" >"$analysis"
+
+  while IFS=$'\t' read -r kind name _rest; do
+    case "$kind" in
+    section-missing)
+      linkage_errors+=("Missing a \"## ${name}\" section. $(section_guidance "$name")")
+      ;;
+    section-empty)
+      linkage_errors+=("The \"## ${name}\" section is empty.")
+      ;;
+    *) ;;
+    esac
+  done <"$analysis"
+
+  negated_quoted=""
+  while IFS=$'\t' read -r kind text trigger; do
+    [[ "$kind" == negated ]] || continue
+    if [[ -n "$negated_quoted" ]]; then
+      negated_quoted+=", "
+    fi
+    negated_quoted+="\"${text}\" (trigger \"${trigger}\")"
+  done <"$analysis"
+
+  if [[ -n "$negated_quoted" ]]; then
+    linkage_errors+=("Negated closing reference (${negated_quoted}). GitHub's linkage parser ignores the surrounding words, so this still registers a closing reference and still auto-closes the issue when this PR merges. Remove the closing keyword and use \"Refs: #N\" (or \"Relates to: #N\") on its own line instead.")
+  fi
+
+  if ! grep -qx 'closing' "$analysis" &&
+    ! grep -qx 'non-closing' "$analysis" &&
+    ! grep -qx 'no-issue' "$analysis"; then
+    linkage_errors+=('Missing a native closing keyword (Closes/Fixes/Resolves #N). If this PR references an issue it must not close, put "Refs: #N" (or "Relates to: #N") on its own line. If it relates to no GitHub issue at all, state "No linked issue" (or "No related issue:") in the body instead.')
+  fi
+
+  if [[ ${#linkage_errors[@]} -gt 0 ]]; then
+    linkage_result=fail
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Step 5 — advisory outcome: one marker comment, upserted, plus the label.
+# ---------------------------------------------------------------------------
+find_marker_comment() {
+  # shellcheck disable=SC2310 # gh_api handles its own errexit; the caller classifies the status.
+  if ! gh_api GET "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" --paginate --slurp; then
+    return 1
+  fi
+  # Bot-authored only, newest first. On a public repository anyone can comment,
+  # so a stranger who plants the marker would otherwise capture the upsert and
+  # the gate would edit their comment instead of posting its own. `--slurp`
+  # wraps every page in one outer array, so `max_by` sees all pages at once
+  # rather than printing one id per page.
+  jq -r --arg marker "$LINKAGE_MARKER" \
+    '[ .[][] | select((.user.type // "") == "Bot" and ((.body // "") | contains($marker))) ] | (max_by(.id).id // empty)' \
+    <"$gh_stdout"
+}
+
+# shellcheck disable=SC2329 # invoked indirectly through best_effort.
+upsert_marker_comment() {
+  local body="$1" comment_id=""
+  # shellcheck disable=SC2310 # find_marker_comment reports the read failure through its status.
+  if ! comment_id="$(find_marker_comment)"; then
+    return 1
+  fi
+  jq -n --arg body "$body" '{body: $body}' >"$scratch/comment-payload.json"
+  if [[ -n "$comment_id" ]]; then
+    gh_api PATCH "repos/${REPOSITORY}/issues/comments/${comment_id}" --input "$scratch/comment-payload.json"
+  else
+    gh_api POST "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" --input "$scratch/comment-payload.json"
+  fi
+}
+
+# shellcheck disable=SC2329 # invoked indirectly through best_effort.
+add_linkage_label() {
+  jq -n --arg label "$LINKAGE_LABEL" '{labels: [$label]}' >"$scratch/label-payload.json"
+  gh_api POST "repos/${REPOSITORY}/issues/${PR_NUMBER}/labels" --input "$scratch/label-payload.json"
+}
+
+# shellcheck disable=SC2329 # invoked indirectly through best_effort.
+remove_linkage_label() {
+  # Percent-encoded so the label stays one path segment.
+  gh_api DELETE "repos/${REPOSITORY}/issues/${PR_NUMBER}/labels/$(url_encode "$LINKAGE_LABEL")"
+}
+
+if [[ "$linkage_result" == fail ]]; then
+  for message in "${linkage_errors[@]}"; do
+    if [[ "$LINKAGE_MODE" == enforce ]]; then
+      # The linkage messages quote body text (a negated closing reference and
+      # its trigger word), so they are escaped like the title.
+      echo "::error::pr-contract: $(escape_annotation "$message")"
+    else
+      echo "::warning::pr-contract: $(escape_annotation "$message")"
+    fi
+  done
+
+  {
+    printf '%s\n\n' "$LINKAGE_MARKER"
+    printf '%s\n\n' '**PR body contract — issue linkage**'
+    printf '%s\n\n' 'This PR body does not yet satisfy the issue-linkage contract:'
+    for message in "${linkage_errors[@]}"; do
+      printf -- '- %s\n' "$message"
+    done
+    printf '\n%s\n' 'Edit the body and this comment updates itself on the next run.'
+  } >"$scratch/comment-body.md"
+
+  best_effort 'upserting the linkage comment' upsert_marker_comment "$(cat "$scratch/comment-body.md")"
+  best_effort 'adding the linkage label' add_linkage_label
+else
+  if [[ "$linkage_result" == pass ]]; then
+    echo 'pr-contract: the PR body satisfies the issue-linkage contract.'
+  fi
+  # Never delete the marker comment: editing it keeps the audit trail of what
+  # the gate said and why it stopped saying it.
+  {
+    printf '%s\n\n' "$LINKAGE_MARKER"
+    printf '%s\n\n' '**PR body contract — issue linkage**'
+    printf '%s\n' 'This PR body conforms to the issue-linkage contract. Nothing to do.'
+  } >"$scratch/comment-body.md"
+
+  # shellcheck disable=SC2310 # a failed read simply means there is no comment to update.
+  if [[ -n "$(find_marker_comment 2>/dev/null || true)" ]]; then
+    best_effort 'updating the linkage comment' upsert_marker_comment "$(cat "$scratch/comment-body.md")"
+  fi
+  if grep -qxF -- "$LINKAGE_LABEL" "$scratch/labels.txt"; then
+    best_effort 'removing the linkage label' remove_linkage_label
+  fi
+fi
+
+# ---------------------------------------------------------------------------
+# Step 6 — outputs and the single exit decision.
+#
+# Every check runs before any exit so all three outputs are always emitted; an
+# early exit on the title would leave `linkage` unset for the caller.
+# ---------------------------------------------------------------------------
+emit_output title "$title_result"
+emit_output do-not-merge "$do_not_merge_result"
+emit_output linkage "$linkage_result"
+
+exit_code=0
+if [[ "$title_result" == fail ]]; then
+  exit_code=1
+fi
+if [[ "$do_not_merge_result" == fail ]]; then
+  exit_code=1
+fi
+if [[ "$linkage_result" == fail && "$LINKAGE_MODE" == enforce ]]; then
+  exit_code=1
+fi
+if [[ "$linkage_result" == fail && "$LINKAGE_MODE" == advisory ]]; then
+  echo '::notice::pr-contract: issue linkage is advisory in this repository; the step does not fail on it.'
+fi
+
+exit "$exit_code"
diff --git a/components/pr-convention-policy/fixtures/lockstep/check-contract-run.sh.txt b/components/pr-convention-policy/fixtures/lockstep/check-contract-run.sh.txt
index bcb23d13..5e56124f 100755
--- a/components/pr-convention-policy/fixtures/lockstep/check-contract-run.sh.txt
+++ b/components/pr-convention-policy/fixtures/lockstep/check-contract-run.sh.txt
@@ -15,6 +15,10 @@ DO_NOT_MERGE_LABEL="${DO_NOT_MERGE_LABEL:-do-not-merge}"
 EXEMPT_AUTHORS="${EXEMPT_AUTHORS:-}"
 LINKAGE_LABEL="${LINKAGE_LABEL:-needs-issue-linkage}"
 LINKAGE_MODE="${LINKAGE_MODE:-advisory}"
+# GitHub's own grammar: `#N` with an optional `OWNER/REPO` prefix.
+DEFAULT_ISSUE_REF_PATTERN='([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'
+ISSUE_REF_PATTERN="${ISSUE_REF_PATTERN:-$DEFAULT_ISSUE_REF_PATTERN}"
+export ISSUE_REF_PATTERN DEFAULT_ISSUE_REF_PATTERN
 
 # Stable HTML marker on the advisory comment: the upsert finds its own previous
 # comment by this string, so a re-run edits rather than posting a second one.
@@ -63,21 +67,54 @@ url_encode() {
 }
 
 case "$LINKAGE_MODE" in
-advisory | enforce) ;;
-*)
-  echo "::error::pr-contract: linkage-mode must be 'advisory' or 'enforce', got: ${LINKAGE_MODE}"
-  exit 1
-  ;;
+  advisory | enforce) ;;
+  *)
+    echo "::error::pr-contract: linkage-mode must be 'advisory' or 'enforce', got: ${LINKAGE_MODE}"
+    exit 1
+    ;;
 esac
 
 case "$REQUIRE_SCOPE" in
-true | false) ;;
-*)
-  echo "::error::pr-contract: require-scope must be 'true' or 'false', got: ${REQUIRE_SCOPE}"
-  exit 1
-  ;;
+  true | false) ;;
+  *)
+    echo "::error::pr-contract: require-scope must be 'true' or 'false', got: ${REQUIRE_SCOPE}"
+    exit 1
+    ;;
 esac
 
+# The pattern reaches awk only through ENVIRON, never the program text, so it
+# cannot inject awk code. It must compile both bare and as the parenthesized
+# group the analyzer splices it into (an unbalanced `)` would otherwise escape
+# the group), and must not match the empty string, which would make a bare
+# "Closes" count as a closing reference.
+if [[ "$ISSUE_REF_PATTERN" == *$'\n'* || "$ISSUE_REF_PATTERN" == *$'\r'* ]]; then
+  echo '::error::pr-contract: issue-ref-pattern must be a single line'
+  exit 1
+fi
+# Spliced after a keyword, an anchor could never match mid-line.
+if [[ "$ISSUE_REF_PATTERN" == '^'* || ("$ISSUE_REF_PATTERN" == *'$' && "$ISSUE_REF_PATTERN" != *'\$') ]]; then
+  echo "::error::pr-contract: issue-ref-pattern must not be anchored with ^ or \$: $(escape_annotation "$ISSUE_REF_PATTERN")"
+  exit 1
+fi
+# Case-insensitive matching lowercases the body and the pattern with the same
+# awk `tolower`. A case class name is already lowercase, so `[:upper:]` would
+# then match nothing; it becomes `[:alpha:]`, its case-folded equivalent. This
+# fold is repeated verbatim in analyze_body.
+pattern_status=0
+awk 'BEGIN {
+  p = tolower(ENVIRON["ISSUE_REF_PATTERN"])
+  gsub(/\[:upper:\]/, "[:alpha:]", p)
+  if ("" ~ p || "" ~ ("(" p ")")) exit 3
+}' </dev/null 2>/dev/null || pattern_status=$?
+if [[ "$pattern_status" -ne 0 ]]; then
+  if [[ "$pattern_status" -eq 3 ]]; then
+    echo "::error::pr-contract: issue-ref-pattern matches the empty string: $(escape_annotation "$ISSUE_REF_PATTERN")"
+  else
+    echo "::error::pr-contract: issue-ref-pattern is not a valid extended regex: $(escape_annotation "$ISSUE_REF_PATTERN")"
+  fi
+  exit 1
+fi
+
 # Step 0 — no pull request in this event. The composite is a pull-request gate;
 # a push, schedule or workflow_dispatch run must report skipped, not fail.
 if [[ -z "${PR_NUMBER//[[:space:]]/}" ]]; then
@@ -275,7 +312,7 @@ function scan_line(line,   indent, rest, lower, offset, chunk, start, len, befor
   while (substr(line, indent + 1, 1) == " ") indent++
   if (indent <= 3) {
     rest = tolower(substr(line, indent + 1))
-    if (rest ~ /^(refs|relates[ \t]+to):[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+[ \t]*$/) {
+    if (rest ~ non_closing_regex) {
       has_non_closing = 1
     }
   }
@@ -283,7 +320,7 @@ function scan_line(line,   indent, rest, lower, offset, chunk, start, len, befor
   offset = 0
   while (1) {
     chunk = substr(lower, offset + 1)
-    if (!match(chunk, /(close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)[ \t]*:?[ \t]*([a-z0-9_.-]+\/[a-z0-9_.-]+)?#[0-9]+/)) break
+    if (!match(chunk, closing_regex)) break
     start = offset + RSTART
     len = RLENGTH
     offset = start + len - 1
@@ -292,6 +329,9 @@ function scan_line(line,   indent, rest, lower, offset, chunk, start, len, befor
     # Word-boundary equivalent of the upstream /\b...\b/ anchors.
     if (before ~ /[a-z0-9_]/) continue
     if (after ~ /[a-z0-9_]/) continue
+    # A custom id can contain hyphens, so "ENG-123-extra" is not a complete
+    # ENG-123; `#N` keeps the original boundary.
+    if (custom && after == "-") continue
     text = substr(line, start, len)
     trigger = negation_trigger(line, start)
     if (trigger != "") {
@@ -344,6 +384,19 @@ BEGIN {
   has_closing = 0
   has_non_closing = 0
   negated_count = 0
+  # The caller pattern arrives through ENVIRON, so awk applies no escape
+  # processing to it and it never becomes program text.
+  ref = tolower(ENVIRON["ISSUE_REF_PATTERN"])
+  gsub(/\[:upper:\]/, "[:alpha:]", ref)
+  ref = "(" ref ")"
+  custom = (ENVIRON["ISSUE_REF_PATTERN"] != ENVIRON["DEFAULT_ISSUE_REF_PATTERN"])
+  non_closing_regex = "^(refs|relates[ \t]+to):[ \t]*" ref "[ \t]*$"
+  # A custom id can start with letters, so the keyword needs a real separator,
+  # spellchecker:ignore-next-line
+  # or "fixture-1" would read as "fix" + "ture-1". `#N` cannot continue a word,
+  # so the default keeps the original optional separator exactly.
+  separator = custom ? "([ \t]+|[ \t]*:[ \t]*)" : "[ \t]*:?[ \t]*"
+  closing_regex = "(close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)" separator ref
 }
 
 {
@@ -443,17 +496,30 @@ END {
 
 section_guidance() {
   case "$1" in
-  Summary) echo 'Describe what this PR changes and why, in a sentence or two.' ;;
-  Fix) echo 'State the concrete change and how it addresses the problem.' ;;
-  Verification) echo 'Record concrete evidence the change works (commands, gates, output).' ;;
-  Related) echo 'List related PRs, ADRs, or decision-log entries this PR does not close.' ;;
-  *) echo 'Fill this section in.' ;;
+    Summary) echo 'Describe what this PR changes and why, in a sentence or two.' ;;
+    Fix) echo 'State the concrete change and how it addresses the problem.' ;;
+    Verification) echo 'Record concrete evidence the change works (commands, gates, output).' ;;
+    Related) echo 'List related PRs, ADRs, or decision-log entries this PR does not close.' ;;
+    *) echo 'Fill this section in.' ;;
   esac
 }
 
 linkage_result=pass
 linkage_errors=()
 
+ref_hint='#N'
+pattern_note=''
+keyword_kind=native
+issue_kind='GitHub issue'
+negation_reason="GitHub's linkage parser ignores the surrounding words, so this still registers a closing reference and still auto-closes the issue when this PR merges."
+if [[ "$ISSUE_REF_PATTERN" != "$DEFAULT_ISSUE_REF_PATTERN" ]]; then
+  ref_hint='<ref>'
+  pattern_note=" Here <ref> must match this repository's issue-ref-pattern \`${ISSUE_REF_PATTERN}\`."
+  keyword_kind=recognized
+  issue_kind='tracked issue'
+  negation_reason='Keyword-based closing parsers ignore the surrounding words, so this still reads as a closing reference.'
+fi
+
 is_exempt_author=false
 if [[ -n "${EXEMPT_AUTHORS//[[:space:]]/}" && -n "$pr_author" ]]; then
   while IFS= read -r candidate; do
@@ -480,13 +546,13 @@ else
 
   while IFS=$'\t' read -r kind name _rest; do
     case "$kind" in
-    section-missing)
-      linkage_errors+=("Missing a \"## ${name}\" section. $(section_guidance "$name")")
-      ;;
-    section-empty)
-      linkage_errors+=("The \"## ${name}\" section is empty.")
-      ;;
-    *) ;;
+      section-missing)
+        linkage_errors+=("Missing a \"## ${name}\" section. $(section_guidance "$name")")
+        ;;
+      section-empty)
+        linkage_errors+=("The \"## ${name}\" section is empty.")
+        ;;
+      *) ;;
     esac
   done <"$analysis"
 
@@ -500,13 +566,13 @@ else
   done <"$analysis"
 
   if [[ -n "$negated_quoted" ]]; then
-    linkage_errors+=("Negated closing reference (${negated_quoted}). GitHub's linkage parser ignores the surrounding words, so this still registers a closing reference and still auto-closes the issue when this PR merges. Remove the closing keyword and use \"Refs: #N\" (or \"Relates to: #N\") on its own line instead.")
+    linkage_errors+=("Negated closing reference (${negated_quoted}). ${negation_reason} Remove the closing keyword and use \"Refs: ${ref_hint}\" (or \"Relates to: ${ref_hint}\") on its own line instead.${pattern_note}")
   fi
 
   if ! grep -qx 'closing' "$analysis" &&
     ! grep -qx 'non-closing' "$analysis" &&
     ! grep -qx 'no-issue' "$analysis"; then
-    linkage_errors+=('Missing a native closing keyword (Closes/Fixes/Resolves #N). If this PR references an issue it must not close, put "Refs: #N" (or "Relates to: #N") on its own line. If it relates to no GitHub issue at all, state "No linked issue" (or "No related issue:") in the body instead.')
+    linkage_errors+=("Missing a ${keyword_kind} closing keyword (Closes/Fixes/Resolves ${ref_hint}). If this PR references an issue it must not close, put \"Refs: ${ref_hint}\" (or \"Relates to: ${ref_hint}\") on its own line. If it relates to no ${issue_kind} at all, state \"No linked issue\" (or \"No related issue:\") in the body instead.${pattern_note}")
   fi
 
   if [[ ${#linkage_errors[@]} -gt 0 ]]; then
diff --git a/components/pr-convention-policy/lockstep-behavior.mjs b/components/pr-convention-policy/lockstep-behavior.mjs
index eaa598e4..091aa035 100644
--- a/components/pr-convention-policy/lockstep-behavior.mjs
+++ b/components/pr-convention-policy/lockstep-behavior.mjs
@@ -385,11 +385,38 @@ export function extractCompositeAnalyzer(runShText, location) {
   return match[1].replaceAll(`'"'"'`, "'");
 }
 
-export function runCompositeAnalyzer(program, body, location) {
+// From ci-workflows#733 on, the analyzer reads its issue-reference grammar
+// from ENVIRON["ISSUE_REF_PATTERN"], which run.sh fills from the
+// `issue-ref-pattern` input and otherwise from its DEFAULT_ISSUE_REF_PATTERN.
+// Returns that default, or null for a composite that still inlines `#N`. A
+// composite that reads the variable without declaring the default and the
+// fallback is drift: the gate would then run with no reference grammar.
+export function parseCompositeIssueRef(runShText, location) {
+  if (!runShText.includes('ENVIRON["ISSUE_REF_PATTERN"]')) {
+    return null;
+  }
+  const declaration = runShText.match(/^DEFAULT_ISSUE_REF_PATTERN='([^']+)'$/m);
+  const wired =
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: bash, not a JS template
+    runShText.includes('ISSUE_REF_PATTERN="${ISSUE_REF_PATTERN:-$DEFAULT_ISSUE_REF_PATTERN}"') &&
+    /^export ISSUE_REF_PATTERN DEFAULT_ISSUE_REF_PATTERN$/m.test(runShText);
+  if (!declaration || !wired) {
+    throw new DriftError(
+      `${location}: run.sh reads ISSUE_REF_PATTERN but does not declare and export DEFAULT_ISSUE_REF_PATTERN as its fallback`,
+    );
+  }
+  return declaration[1];
+}
+
+export function runCompositeAnalyzer(program, body, location, issueRef = null) {
+  // The analyzer runs with the default pattern, as it does for every caller
+  // that leaves `issue-ref-pattern` unset; policy.json describes `#N` only.
+  const refEnv =
+    issueRef === null ? {} : { ISSUE_REF_PATTERN: issueRef, DEFAULT_ISSUE_REF_PATTERN: issueRef };
   const result = run(
     "gawk",
     ["--sandbox", "--", program],
-    { input: body, env: { ...SANDBOX_ENV, LC_ALL: "C.UTF-8" } },
+    { input: body, env: { ...SANDBOX_ENV, LC_ALL: "C.UTF-8", ...refEnv } },
     location,
     "analyzer",
   );
@@ -412,13 +439,16 @@ export function runCompositeAnalyzer(program, body, location) {
 // analyzer and policy serves them all.
 const compositeMismatchCache = new Map();
 
-export function checkCompositeBehavior(runShText, policy, location) {
+// `wiringLocation` names a broken DEFAULT_ISSUE_REF_PATTERN the way the static
+// checks do, so the caller's collector reports it once, not once per check.
+export function checkCompositeBehavior(runShText, policy, location, wiringLocation = location) {
   const program = extractCompositeAnalyzer(runShText, location);
-  const key = `${JSON.stringify(policy.body)}\0${program}`;
+  const issueRef = parseCompositeIssueRef(runShText, wiringLocation);
+  const key = `${JSON.stringify(policy.body)}\0${program}\0${issueRef}`;
   if (!compositeMismatchCache.has(key)) {
     const mismatches = [];
     for (const { line, body, expect } of linkageMatrix(policy)) {
-      const actual = runCompositeAnalyzer(program, body, location);
+      const actual = runCompositeAnalyzer(program, body, location, issueRef);
       if (describe(actual) !== describe(expect)) {
         mismatches.push({ line, expected: describe(expect), actual: describe(actual) });
       }
diff --git a/components/pr-convention-policy/lockstep-drift.mjs b/components/pr-convention-policy/lockstep-drift.mjs
index 4aea43c0..1e27c992 100755
--- a/components/pr-convention-policy/lockstep-drift.mjs
+++ b/components/pr-convention-policy/lockstep-drift.mjs
@@ -33,7 +33,11 @@ import { pathToFileURL } from "node:url";
 
 import { parse as parseYaml } from "yaml";
 
-import { checkCompositeBehavior, checkHookBehavior } from "./lockstep-behavior.mjs";
+import {
+  checkCompositeBehavior,
+  checkHookBehavior,
+  parseCompositeIssueRef,
+} from "./lockstep-behavior.mjs";
 import { parseUniqueJson } from "./pr-convention-policy.mjs";
 
 const MODULE_DIRECTORY = import.meta.dirname;
@@ -123,7 +127,10 @@ function collect(errors, fn) {
     if (!(error instanceof DriftError)) {
       throw error;
     }
-    errors.push(error.message);
+    // Checks that share a parser can raise its finding verbatim; report it once.
+    if (!errors.includes(error.message)) {
+      errors.push(error.message);
+    }
   }
 }
 
@@ -146,8 +153,32 @@ export function parseCompositeSections(runShText, location) {
 // were: extract each declared pattern and probe it with every policy
 // keyword/marker. A keyword that survives only in a comment or an error
 // message no longer passes.
+//
+// Before ci-workflows#733 the keyword scan is an inline `/.../` literal. From
+// #733 on it is `closing_regex`, assembled in the analyzer's BEGIN block from
+// the keyword alternation, a separator (custom pattern or default), and the
+// reference pattern; the default-pattern form is the one rebuilt here, since
+// it is what runs for every caller that leaves `issue-ref-pattern` unset.
+function compositeKeywordPattern(runShText, location) {
+  const literal = runShText.match(/match\(chunk, \/(.+)\/\)\) break/);
+  if (literal) {
+    return literal[1];
+  }
+  if (!/match\(chunk, closing_regex\)\) break/.test(runShText)) {
+    return null;
+  }
+  const issueRef = parseCompositeIssueRef(runShText, location);
+  const separator = runShText.match(/^\s*separator = custom \? "[^"]*" : "([^"]*)"$/m);
+  const assembled = runShText.match(/^\s*closing_regex = "([^"]*)" separator ref$/m);
+  const reference = /^\s*ref = "\(" ref "\)"$/m.test(runShText);
+  if (issueRef === null || !separator || !assembled || !reference) {
+    return null;
+  }
+  return `${assembled[1]}${separator[1]}(${issueRef})`;
+}
+
 export function parseCompositePatterns(runShText, location) {
-  const keyword = runShText.match(/match\(chunk, \/(.+)\/\)\) break/);
+  const keyword = compositeKeywordPattern(runShText, location);
   const marker = runShText.match(/tolower\(body\) ~ \/(.+)\/\) print "no-issue"/);
   if (!keyword || !marker) {
     throw new DriftError(
@@ -166,7 +197,7 @@ export function parseCompositePatterns(runShText, location) {
       `${location}: the closing-keyword scan no longer lowercases the line (\`lower = tolower(line)\`), so the extracted pattern is not the one the gate applies`,
     );
   }
-  return { keyword: new RegExp(keyword[1]), marker: new RegExp(marker[1]) };
+  return { keyword: new RegExp(keyword), marker: new RegExp(marker[1]) };
 }
 
 function parseActionYml(actionYmlText, location) {
@@ -222,6 +253,24 @@ export function parseCompositeRequireScope(actionYmlText, location) {
   );
 }
 
+// The behavioral check runs the analyzer with run.sh's DEFAULT_ISSUE_REF_PATTERN.
+// A caller that leaves `issue-ref-pattern` unset gets action.yml's default
+// instead, and any value other than run.sh's own default switches the analyzer
+// to its custom-pattern rules (a mandatory keyword separator), so the two
+// defaults must agree for the behavioral verdict to describe the gate.
+export function assertCompositeIssueRefDefault(runShText, actionYmlText, location) {
+  const issueRef = parseCompositeIssueRef(runShText, location);
+  if (issueRef === null) {
+    return;
+  }
+  const declared = parseActionYml(actionYmlText, location)?.inputs?.["issue-ref-pattern"]?.default;
+  if (declared !== undefined && declared !== "" && declared !== issueRef) {
+    throw new DriftError(
+      `${location}: action.yml's \`issue-ref-pattern\` default ${JSON.stringify(declared)} differs from run.sh's DEFAULT_ISSUE_REF_PATTERN ${JSON.stringify(issueRef)}`,
+    );
+  }
+}
+
 // ---------------------------------------------------------------------------
 // The `pr-issue-linkage.yml` reusable (the predecessor, still pinned by every
 // consumer that has not taken its Phase 3 pull request yet).
@@ -370,8 +419,14 @@ export function parseValidatorNonClosing(shellText, location) {
   return { markers: nonClosingAlternation(declaration[1], location) };
 }
 
+// The marker test is an inline literal before ci-workflows#733 and
+// `non_closing_regex` (its marker prefix, then the reference) from #733 on.
 export function parseCompositeNonClosing(runShText, location) {
-  const declaration = runShText.match(/rest ~ \/(.+)\/\) \{\s*has_non_closing = 1/);
+  const declaration =
+    runShText.match(/rest ~ \/(.+)\/\) \{\s*has_non_closing = 1/) ??
+    (/rest ~ non_closing_regex\) \{\s*has_non_closing = 1/.test(runShText)
+      ? runShText.match(/^\s*non_closing_regex = "([^"]*)" ref "[^"]*"$/m)
+      : null);
   if (!declaration) {
     throw new DriftError(
       `${location}: the \`rest ~ /.../\` non-closing marker test (has_non_closing = 1) was not found in run.sh`,
@@ -409,7 +464,7 @@ export function assertCompositeVerdictReads(runShText, location) {
     ],
     [
       "a `non-closing` report satisfies linkage",
-      /if ! grep -qx 'closing' "\$analysis" &&\s*! grep -qx 'non-closing' "\$analysis" &&\s*! grep -qx 'no-issue' "\$analysis"; then\s*\n\s*linkage_errors\+=\('Missing a native closing keyword/,
+      /if ! grep -qx 'closing' "\$analysis" &&\s*! grep -qx 'non-closing' "\$analysis" &&\s*! grep -qx 'no-issue' "\$analysis"; then\s*\n\s*linkage_errors\+=\((?:'Missing a native|"Missing a \$\{keyword_kind\}) closing keyword/,
     ],
     [
       "a `negated` report is a linkage error",
@@ -915,7 +970,10 @@ export function checkCopies(policy, texts) {
       "hook validator (negated closers)",
     ),
   );
-  run(() => checkCompositeBehavior(texts.gateRun, policy, "gate composite (behavior)"));
+  run(() => assertCompositeIssueRefDefault(texts.gateRun, texts.gateAction, "gate composite"));
+  run(() =>
+    checkCompositeBehavior(texts.gateRun, policy, "gate composite (behavior)", "gate composite"),
+  );
   run(() => assertCompositeVerdictReads(texts.gateRun, "gate composite (verdict)"));
   run(() => checkHookBehavior(texts.hookValidator, policy, "hook validator (behavior)"));
   return errors;
@@ -986,7 +1044,8 @@ export function checkPinnedComposite(policy, repo, sha, runShText, actionYmlText
   );
   run(() => assertNonClosing(parseCompositeNonClosing(runShText, location), policy, location));
   run(() => assertNegation(parseCompositeNegation(runShText, location), policy, location));
-  run(() => checkCompositeBehavior(runShText, policy, `${location} (behavior)`));
+  run(() => assertCompositeIssueRefDefault(runShText, actionYmlText, location));
+  run(() => checkCompositeBehavior(runShText, policy, `${location} (behavior)`, location));
   run(() => assertCompositeVerdictReads(runShText, `${location} (verdict)`));
   return errors;
 }
diff --git a/components/pr-convention-policy/lockstep-drift.test.mjs b/components/pr-convention-policy/lockstep-drift.test.mjs
index 61f8709f..f0991bbc 100644
--- a/components/pr-convention-policy/lockstep-drift.test.mjs
+++ b/components/pr-convention-policy/lockstep-drift.test.mjs
@@ -55,13 +55,18 @@ const POLICY = parseUniqueJson(
 
 // The two executable copies are vendored verbatim, because the behavioral
 // layer runs them: the composite's run.sh from ci-workflows
-// a932d486c5a4d0a959c42e60ff015f50cf2103f3 and the hook validator from
+// 8b3cc4bf282b30e51dd0eef31e2997b978770cea (ci-workflows#733, the
+// `issue-ref-pattern` shape, plus one `spellchecker:ignore-next-line` awk
+// comment for this repository's typos lane), the same run.sh from ci-workflows
+// a932d486c5a4d0a959c42e60ff015f50cf2103f3 (the inline `#N` shape older pins
+// still run), and the hook validator from
 // claude-code-plugins 53d5c6a09dfb5890b9767b447a28ca10ba922173. The `.txt`
 // suffix keeps the shell lint lanes off code this repository does not own.
 // Refresh them when either upstream changes shape the tests depend on.
 const readFixture = (name) =>
   readFile(path.join(MODULE_DIRECTORY, "fixtures", "lockstep", name), "utf8");
 const GOOD_COMPOSITE_RUN = await readFixture("check-contract-run.sh.txt");
+const LITERAL_REF_COMPOSITE_RUN = await readFixture("check-contract-run-literal-ref.sh.txt");
 const GOOD_VALIDATOR = await readFixture("pr-linkage-validator.sh.txt");
 
 const GOOD_COMPOSITE_ACTION = [
@@ -75,6 +80,9 @@ const GOOD_COMPOSITE_ACTION = [
   "      Comma-separated allowed Conventional Commits types. The default is the",
   "      twelve types policy.json declares.",
   "    default: build,chore,ci,docs,feat,fix,perf,refactor,revert,security,style,test",
+  "  issue-ref-pattern:",
+  "    description: POSIX extended regex for the issue reference.",
+  "    default: '([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'",
   "runs:",
   "  using: composite",
   "",
@@ -409,6 +417,75 @@ test("a composite at a consumer pin passes when it matches policy", () => {
   );
 });
 
+test("a composite pin that still inlines the #N reference passes", () => {
+  assert.deepEqual(
+    checkPinnedComposite(
+      POLICY,
+      "codex-plugins",
+      "d".repeat(40),
+      LITERAL_REF_COMPOSITE_RUN,
+      GOOD_COMPOSITE_ACTION,
+    ),
+    [],
+  );
+});
+
+// From ci-workflows#733 the analyzer reads its reference grammar from the
+// environment, so each link from run.sh's default to the analyzer is checked.
+test("an issue-ref-pattern composite that loses its default is drift", () => {
+  for (const [from, to] of [
+    [/^DEFAULT_ISSUE_REF_PATTERN=.*$/m, "DEFAULT_ISSUE_REF_PATTERN="],
+    ["export ISSUE_REF_PATTERN DEFAULT_ISSUE_REF_PATTERN", "export DEFAULT_ISSUE_REF_PATTERN"],
+  ]) {
+    const errors = mutate("gateRun", from, to);
+    assert.deepEqual(errors, [
+      "gate composite: run.sh reads ISSUE_REF_PATTERN but does not declare and export DEFAULT_ISSUE_REF_PATTERN as its fallback",
+    ]);
+    // Three checks read the default; a consumer pin reports the finding once.
+    const pinned = checkPinnedComposite(
+      POLICY,
+      "codex-plugins",
+      "d".repeat(40),
+      GOOD_COMPOSITE_RUN.replace(from, to),
+      GOOD_COMPOSITE_ACTION,
+    );
+    assert.equal(pinned.length, 1, pinned.join("; "));
+    assert.match(pinned[0], /^caller codex-plugins pin ddddddd: .*DEFAULT_ISSUE_REF_PATTERN/);
+  }
+});
+
+test("an issue-ref-pattern default that drops the #N grammar is drift", () => {
+  const errors = mutate(
+    "gateRun",
+    "DEFAULT_ISSUE_REF_PATTERN='([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'",
+    "DEFAULT_ISSUE_REF_PATTERN='[a-z]+-[0-9]+'",
+  );
+  assert.ok(
+    errors.some((e) => e.startsWith("gate composite (enforcement patterns): ")),
+    errors.join("; "),
+  );
+  assert.ok(
+    errors.some((e) => e.startsWith("gate composite (behavior): ")),
+    errors.join("; "),
+  );
+});
+
+test("the default closing scan losing its optional colon is drift", () => {
+  const errors = mutate("gateRun", ': "[ \\t]*:?[ \\t]*"', ': "[ \\t]+"');
+  assertOnlyBehavior(errors, "gateRun", /should be closing, got no linkage/);
+});
+
+test("an action.yml issue-ref-pattern default that differs from run.sh is drift", () => {
+  const texts = goodTexts();
+  texts.gateAction = texts.gateAction.replace(
+    "default: '([a-z0-9_.-]+/[a-z0-9_.-]+)?#[0-9]+'",
+    "default: '#[0-9]+'",
+  );
+  const errors = checkCopies(POLICY, texts);
+  assert.equal(errors.length, 1, errors.join("; "));
+  assert.match(errors[0], /^gate composite: action\.yml's .*differs from run\.sh/);
+});
+
 test("a composite pin predating the security type is drift at that pin", () => {
   const errors = checkPinnedComposite(
     POLICY,