The top two items from the punch list, one commit each.
packages.strategy was dead on every CLI path
--strategy carried { default: 'all' } on scan, update, check and schedule, so the option was always "set" and the handlers' options.strategy ?? config.packages?.strategy ?? 'all' chain never reached the config. packages.strategy — declared, validated, documented, and the first key in every example config — did nothing at a terminal unless a flag was typed. (The generated workflows pass explicit --strategy and were unaffected, which is why this hid so long.)
The CAC default is gone; the fallback chain the handlers already carry now works, and the help text says where the default actually comes from: (default: packages.strategy from config, else all). A cli-surface test pins the new surface.
CLAUDE.md's embedded README, synced
The audit established nothing regenerates it, and it showed: the embedded copy still opened with the dependency-bot-only tagline and carried none of the AI-review half of the product. Synced to the current README body (tagline through licence, badge link-definitions excluded), with a Sync: note added to the preamble recording the manual procedure — so the next drift is a known cost, not a surprise.
Tests
bun test: 2237 pass / 0 fail; typecheck, pickier and check-docs green (check-docs validates CLAUDE.md's claims too, so the sync is verified, not just pasted).
🤖 Generated with Claude Code