diff --git a/.github/workflows/breaking-change-guard.yml b/.github/workflows/breaking-change-guard.yml
index 71420bda..6c3984fc 100644
--- a/.github/workflows/breaking-change-guard.yml
+++ b/.github/workflows/breaking-change-guard.yml
@@ -41,7 +41,14 @@ jobs:
           set -euo pipefail
 
           BASE="origin/${{ github.base_ref }}"
-          DIFF=$(git diff "${BASE}"...HEAD -- docker/compose.yaml)
+
+          # Guard: if docker/compose.yaml does not exist in the base branch, this
+          # is a new file — no contract existed before, so no regression is possible.
+          if ! git cat-file -e "${BASE}:docker/compose.yaml" 2>/dev/null; then
+            echo "[i] docker/compose.yaml is new in this PR (not present on ${BASE}) — skipping contract check"
+            echo "breaking=0" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
 
           BREAKING=0
 
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 056e0bb0..5061e873 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -288,7 +288,11 @@ jobs:
   # ---------------------------------------------------------------------------
   smoke-test:
     name: Smoke test integrated image
-    needs: [publish-integrated, publish-dashboard]
+    # Depends only on publish-integrated, NOT publish-dashboard.
+    # publish-dashboard is skipped on prerelease (rc.N) events — if it were
+    # listed here, GitHub Actions would also skip smoke-test and
+    # promote-mutable-tags on every rc publish, breaking the rc soak flow.
+    needs: [publish-integrated]
     # Run on both rc and stable releases; skip if integrated publish was skipped
     if: ${{ needs.publish-integrated.outputs.publish == 'true' }}
     runs-on: [self-hosted, linux, x64, cliproxy]
@@ -355,7 +359,11 @@ jobs:
 
       - name: Run network-contract test
         run: |
-          bash tests/docker/network-contract.sh "${{ steps.image.outputs.ref }}"
+          # network-contract.sh signature: <compose-file> [image-ref]
+          # Pass compose.yaml as $1 and the pinned image ref as $2 so the
+          # smoke test exercises the canonical compose file with the exact
+          # image that was just published, not whatever tag is in the file.
+          bash tests/docker/network-contract.sh docker/compose.yaml "${{ steps.image.outputs.ref }}"
 
       - name: Probe dashboard port 3000
         run: |
diff --git a/.github/workflows/docs-parity.yml b/.github/workflows/docs-parity.yml
index f51a316d..b7c7c20e 100644
--- a/.github/workflows/docs-parity.yml
+++ b/.github/workflows/docs-parity.yml
@@ -19,6 +19,9 @@ on:
 jobs:
   quickstart-parity:
     name: Assert quickstart snippet matches in README.md and docker/README.md
+    if: >-
+      contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.pull_request.author_association)
+      || github.event_name == 'push'
     runs-on: [self-hosted, linux, x64, cliproxy]
 
     steps:
diff --git a/docker/compose.yaml b/docker/compose.yaml
index 4f653d16..e4616cba 100644
--- a/docker/compose.yaml
+++ b/docker/compose.yaml
@@ -20,6 +20,11 @@ services:
       - "3000:3000"
       - "8317:8317"
     volumes:
+      # /root/.ccs matches the HOME used inside the integrated image.
+      # entrypoint-integrated.sh runs as root (supervisord user=root) and
+      # explicitly mkdir -p /root/.ccs, so state always lands here.
+      # Note: docker/entrypoint.sh (legacy dashboard image) uses a different
+      # default — it does NOT apply to this integrated image.
       - ccs_home:/root/.ccs
       - ccs_logs:/var/log/ccs
     networks:
diff --git a/src/cliproxy/quota/quota-manager.ts b/src/cliproxy/quota/quota-manager.ts
index 39841eb6..4493aeb6 100644
--- a/src/cliproxy/quota/quota-manager.ts
+++ b/src/cliproxy/quota/quota-manager.ts
@@ -524,8 +524,9 @@ export async function preflightCheck(provider: CLIProxyProvider): Promise<Prefli
     return { proceed: true, accountId: defaultAccount?.id || '' };
   }
 
-  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } =
-    await import('../accounts/account-safety');
+  const { pauseAccountForQuotaCooldown, restoreExpiredQuotaPauses } = await import(
+    '../accounts/account-safety'
+  );
   restoreExpiredQuotaPauses();
 
   const config = loadOrCreateUnifiedConfig();
diff --git a/src/management/checks/image-analysis-check.ts b/src/management/checks/image-analysis-check.ts
index d6d2dc05..50e9ba99 100644
--- a/src/management/checks/image-analysis-check.ts
+++ b/src/management/checks/image-analysis-check.ts
@@ -112,8 +112,9 @@ export async function runImageAnalysisCheck(results: HealthCheck): Promise<void>
  * Fix image analysis configuration issues
  */
 export async function fixImageAnalysisConfig(): Promise<boolean> {
-  const { updateConfig, loadOrCreateUnifiedConfig } =
-    await import('../../config/config-loader-facade');
+  const { updateConfig, loadOrCreateUnifiedConfig } = await import(
+    '../../config/config-loader-facade'
+  );
 
   const config = loadOrCreateUnifiedConfig();
   let fixed = false;
diff --git a/tests/unit/scripts/github/ci-workflow.test.ts b/tests/unit/scripts/github/ci-workflow.test.ts
index ae546e35..a7aa8788 100644
--- a/tests/unit/scripts/github/ci-workflow.test.ts
+++ b/tests/unit/scripts/github/ci-workflow.test.ts
@@ -19,7 +19,8 @@ describe('pr ci workflow', () => {
     expect(workflow).toContain('name: CI');
     expect(workflow).toContain('pull_request:');
     expect(workflow).toContain('branches: [main, dev]');
-    expect(workflow.split(trustedAuthorGate).length - 1).toBe(3);
+    // 4 jobs: validate (matrix), build, test, compose-parity — each gated
+    expect(workflow.split(trustedAuthorGate).length - 1).toBe(4);
     expect(workflow).toContain('group: ci-${{ github.ref }}');
     expect(workflow).toContain('cancel-in-progress: true');
     expect(workflow).toContain('fail-fast: false');