@@ -64,7 +64,7 @@ Current rules:
 | Force pushes | Blocked (`non_fast_forward` rule) |
 | Branch deletion | Blocked (`deletion` rule) |
 
-Required status checks (a PR cannot merge until all 7 pass):
+Required status checks (a PR cannot merge until all 8 pass):
 
 - `Validate registry.json`
 - `Validate docs site`
@@ -73,6 +73,7 @@ Required status checks (a PR cannot merge until all 7 pass):
 - `Public-repo safety scan`
 - `feat/fix commits require VERSION bump`
 - `CodeQL`
+- `Run drift_check tests` (the full pytest suite)
 
 Post-merge guard (not in required-contexts): `release.yml`'s `Check VERSION vs latest tag` job runs on every push to `main` and fails the release if `VERSION` is behind the latest tag. It is intentionally excluded from the PR-required list because it cannot run on a PR (`release.yml` only triggers on push), and including it would permanently block every PR.
 
 
@@ -3,6 +3,8 @@ name: Validate
 on:
   pull_request:
     branches: [main]
+    # edited: re-check when the PR title changes (version-bump-check).
+    types: [opened, synchronize, reopened, edited]
   push:
     branches: [main]
 
@@ -270,6 +272,9 @@ jobs:
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          # Squash merges use the PR title as the commit subject on main,
+          # so the title is checked like a commit (DTD#119).
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           set -euo pipefail
 
@@ -281,12 +286,21 @@ jobs:
           # record separator (\x1e Record Separator) was already safe.
           COMMITS="$(git log "${BASE_SHA}..${HEAD_SHA}" --pretty=format:'%H%x1f%s%x1f%b%x1e')"
 
-          if [ -z "$COMMITS" ]; then
+          NEEDS_BUMP="false"
+          if echo "$PR_TITLE" | grep -qF '[skip version]'; then
+            echo "skip  | PR title | $PR_TITLE  (opted out with [skip version])"
+          elif echo "$PR_TITLE" | grep -qiE '^(feat|fix)(\([^)]*\))?!?:'; then
+            echo "need  | PR title | $PR_TITLE"
+            NEEDS_BUMP="true"
+          else
+            echo "ok    | PR title | $PR_TITLE"
+          fi
+
+          if [ -z "$COMMITS" ] && [ "$NEEDS_BUMP" = "false" ]; then
             echo "No new commits to check."
             exit 0
           fi
 
-          NEEDS_BUMP="false"
           while IFS= read -r -d $'\x1e' record; do
             [ -z "$record" ] && continue
             SHA="$(echo "$record" | awk -F $'\x1f' '{print $1}')"
 
@@ -118,7 +118,7 @@ gh pr checks <number> --watch
 gh pr merge <number> --squash --delete-branch
 ```
 
-A PR cannot be merged until all 7 required status checks pass: `Validate registry.json`, `Validate docs site`, `Validate scaffold`, `Registry sync check`, `Public-repo safety scan`, `feat/fix commits require VERSION bump`, `CodeQL`. Required approvals are 0 (solo maintainer). `release.yml`'s `Check VERSION vs latest tag` is a post-merge guard, not a PR gate.
+A PR cannot be merged until all 8 required status checks pass: `Validate registry.json`, `Validate docs site`, `Validate scaffold`, `Registry sync check`, `Public-repo safety scan`, `feat/fix commits require VERSION bump`, `CodeQL`, `Run drift_check tests`. Required approvals are 0 (solo maintainer). `release.yml`'s `Check VERSION vs latest tag` is a post-merge guard, not a PR gate.
 
 ### Prerequisites
 
@@ -151,7 +151,8 @@ Open `docs/index.html` in a browser. The script falls back to embedded registry
 - Scaffold dry-run test (generates repo, verifies key files exist, scans for leaked business email)
 - `sync-check` job: runs `python scripts/sync_from_registry.py --check` and fails on drift
 - `safety-scan` job: blocks leaked business emails, drive-letter paths, unsafe DOM sinks (`innerHTML`/`eval` in `docs/`), and committed credential files
-- `version-bump-check` job (PR only): requires a `VERSION` bump when the PR contains any `feat:` or `fix:` commit; opt out per commit with `[skip version]`
+- `version-bump-check` job (PR only): requires a `VERSION` bump when the PR title or any commit is `feat:` or `fix:` (the title matters because squash merges use it as the commit subject); opt out with `[skip version]`
+- `test-drift-check` job: runs the full pytest suite (required check `Run drift_check tests`)
 
 ### Release workflow
 
 
@@ -254,7 +254,7 @@ Where `$TOOLS_ROOT` is the parent directory containing your checkouts of each to
 
 - Required approvals: 0 (solo-maintainer repo).
 - Merge method: squash merge only; merge commits and rebase merges are blocked.
-- All 7 required status checks listed under [CI checks](#ci-checks) must pass before merge is allowed.
+- All 8 required status checks listed under [CI checks](#ci-checks) must pass before merge is allowed.
 
 ### Branch naming
 
@@ -307,15 +307,16 @@ Before submitting a PR, verify:
 
 ### CI checks
 
-All PRs must pass these 7 required status checks (enforced by the `main protection` ruleset, not just advisory):
+All PRs must pass these 8 required status checks (enforced by the `main protection` ruleset, not just advisory):
 
 - `Validate registry.json` - JSON schema and required fields
-- `Validate docs site` - `docs/index.html`, `style.css`, `script.js` exist
+- `Validate docs site` - `docs/index.html` exists
 - `Validate scaffold` - Python syntax and scaffold dry-run
 - `Registry sync check` - `scripts/sync_from_registry.py --check` exits 0
 - `Public-repo safety scan` - no leaked emails, drive paths, unsafe DOM sinks, or committed secrets
-- `feat/fix commits require VERSION bump` - enforces the rule in the Versioning section
+- `feat/fix commits require VERSION bump` - enforces the rule in the Versioning section, checking the PR title (the squash commit subject) as well as each commit
 - `CodeQL` - security scan on Python code
+- `Run drift_check tests` - the full pytest suite under `tests/`
 
 `release.yml`'s `Check VERSION vs latest tag` runs on every push to `main` and will fail the release if `VERSION` is behind the latest tag. It is a post-merge guard, not a PR gate, so it is not in the required-contexts list.