diff --git a/data/repo-awareness-snapshot.json b/data/repo-awareness-snapshot.json
index 42eb385724..15d39a5f4b 100644
--- a/data/repo-awareness-snapshot.json
+++ b/data/repo-awareness-snapshot.json
@@ -2859,6 +2859,11 @@
         "section": "superpowers",
         "catalogued": true
       },
+      {
+        "path": "docs/decisions/2026-10-16-sign-off-pins-cover-source-records.md",
+        "section": "decisions",
+        "catalogued": true
+      },
       {
         "path": "docs/decisions/2026-08-29-compact-roles-tap-floor-40px.md",
         "section": "decisions",
@@ -23693,6 +23698,14 @@
         "outcome": "P2 findings confirmed: complete review corpus omitted legacy/archive rows; fallback UI counts disagreed with rendered groups. Smallest fixes applied; no additional P0-P2 findings in changed scope.",
         "checks": "Hosted failure root cause: stale review_state snapshot; focused Vitest first attempt blocked by repository coordinator capacity; local snapshot gate reproduced expected review_state drift."
       },
+      {
+        "date": "2026-10-16",
+        "ref": "fix/adversarial-remediation-20261016",
+        "head": "d5775ec60c00faff2b1a2485c4ee84f53b915a56",
+        "scope": "Adversarial assessment + parallel fix swarm + post-fix adversarial review across calculators, handover privacy, teaching QR/attendance, EPA magic links, and roster swaps (zero RAG diff)",
+        "outcome": "All P0/P1/P2 findings fixed and verified; zero RAG files touched",
+        "checks": "typecheck (10171 files), eslint --max-warnings=0 (33 code files), check:diff-integrity, check:forms-review-sheet, check:source-acquisitions, vitest (14 suites, 344/344 passed)"
+      },
       {
         "date": "2026-07-31",
         "ref": "codex/moderate-batch-20260730",
@@ -24957,6 +24970,14 @@
         "outcome": "merged origin/main; resolved outstanding-issues against #1508 IDs; kept pre-snapshot wording",
         "checks": "check:outstanding-issues,docs:check-links"
       },
+      {
+        "date": "2026-10-16",
+        "ref": "feat/backlog-remediation-20261016",
+        "head": "e526f8a4d5ad00ad05c5b780262b84a5e347938c",
+        "scope": "prlanded",
+        "outcome": "PR #3571 squash-merged cleanly into main (e526f8a4d5ad00ad05c5b780262b84a5e347938c); two-dot tree diff against pushed head 7c00d1f35e960dc9ca92f4d6c4d50ccd1242724e is empty.",
+        "checks": "gh pr view 3571 (MERGED), git rev-list --parents -n 1 e526f8a4d5ad00ad05c5b780262b84a5e347938c (1 parent 24eeea365e782c651047eebf0ecbe9db87e4fd07), git diff --stat e526f8a4d5ad00ad05c5b780262b84a5e347938c 7c00d1f35e960dc9ca92f4d6c4d50ccd1242724e (empty)"
+      },
       {
         "date": "2026-07-17",
         "ref": "main (origin/main)",
diff --git a/docs/decisions/2026-10-16-sign-off-pins-cover-source-records.md b/docs/decisions/2026-10-16-sign-off-pins-cover-source-records.md
new file mode 100644
index 0000000000..d1b8d1d8d5
--- /dev/null
+++ b/docs/decisions/2026-10-16-sign-off-pins-cover-source-records.md
@@ -0,0 +1,8 @@
+# Decision: Clinical sign-off pins cover the reviewed source record, not the published copy
+
+- **Status:** decided 2026-10-16
+- **Source:** `scripts/publish-site-content-first-catalogue.ts`, find "The owner decided the pin covers the reviewed source record, not the published copy."
+
+The owner kept the clinical sign-off content pin covering the record a clinician actually reviewed. For a form, that is the review record with its sign-off fields removed, the catalogue entry fields, and the guidance rendered from them. For a service, it is the curated service record. The pin does not cover the projected publication row, so existing sign-offs stay valid without re-signing. Metadata added only at projection, such as aliases, search terms and risk level, is not attested by the pin. First publication still refuses any record whose reviewed content has changed since sign-off.
+
+If this summary and the source ever differ, the source wins.
diff --git a/scripts/publish-site-content-first-catalogue.ts b/scripts/publish-site-content-first-catalogue.ts
index 808d8a0a89..3418e23dba 100644
--- a/scripts/publish-site-content-first-catalogue.ts
+++ b/scripts/publish-site-content-first-catalogue.ts
@@ -17,6 +17,11 @@
  * 2. Content pin check: each sign-off's `reviewedContentSha256` must still match the content it
  *    signed, worked out the same way npm run clinical:review wrote it. A record edited after its
  *    sign-off is refused, so a stale approval can never publish changed text.
+ *    The owner decided the pin covers the reviewed source record, not the published copy.
+ *    For a form that is the review record with its sign-off fields removed, the catalogue
+ *    entry fields and the guidance rendered from them. For a service it is the curated record.
+ *    That keeps every existing sign-off valid. Metadata added only when the row is projected
+ *    (for example aliases, search terms and risk level) is not covered by the pin.
  * 3. Offline by default: `--dry-run` and `--out <path>` never import or call a live Supabase
  *    client. Live execution requires BOTH `--execute` and `ALLOW_DESTRUCTIVE_SITE_CONTENT_INIT=true`.
  *