[morphatic]

Two live cross-checks in test/live/cross-check.live.test.ts have been failing since late August. Nobody saw it because the live suites only ever ran on a laptop. Both failures come from Morphemeris changes, and no library code changes here.

Composite: the API contract changed

The test failed on a 400 before it compared anything. morphemeris#105 (2026-08-24) made resolution a strict lower|higher tie-break for the exact-180° case, because composite midpoints are always the shorter arc, and it now rejects nearest. The oracle now sends lower, which is the same tie the library resolves to (spec §7.1). The values agree to 1e-13.

Davison: the server now works in UT1

An audit of Morphemeris's ephemeris engine changed how UTC timestamps are converted. They now go through the leap-second table to TT, then back through the ΔT model to UT1, which matches swe_utc_to_jd. /v1/davison averages those UT1 Julian Days, as its spec §4.18 says. The library averages UTC instants.

	Server	Library
A (1990-06-15 13:30Z)	+18 ms	0
B (1985-12-21 02:00Z)	+327 ms	0
Midpoint (UTC)	19:44:59.910	19:45:00.000

At the Sun's speed, 90 ms is 1.03e-6°, just past the 1e-6° tolerance. The Moon is off by 1.5e-5° for the same reason.

As you decided, the library keeps the UTC midpoint. Spec §7.1 now names the time scale, and the rationale records why. The test is split rather than loosened, so the convention gap cannot hide a geometry bug:

1. The instant is within 1 s of the server's datetime_iso, since UT1 − UTC is under 0.9 s.
2. The place matches the server's location to 1e-9.
3. A chart cast at the server's reported instant matches its positions to 1e-6°.

A 2 s shift in instantMidpoint fails test 1. I checked by mutation and then reverted it.

Weekly live run

.github/workflows/live.yml runs test/live and test/browser weekly (Wednesdays 06:00 UTC) and on dispatch. It never runs on pull requests, per spec §13.1, which is updated. It reads the MORPHEMERIS_API_KEY repository secret, which I set from your .env.local without printing it. It fails outright if the secret is missing, rather than letting the suites skip themselves and report green. Comments in vitest.config.ts, load-env.ts, the browser test, and CLAUDE.md that said "never in CI" are updated.

Verification

• Locally, with the key: pnpm test gives 238/238 unit and live tests and 33/33 scenarios.
• typecheck, lint, format, cspell, and markdownlint all pass.

Manual test

1. git checkout test/live-drift && pnpm install
2. pnpm vitest run test/live: 9/9 pass, including the three new Davison checks.
3. After merge: gh workflow run live.yml, then gh run watch. It should go green, which confirms the secret works. A workflow can't be dispatched before it exists on main, so this is the first CI run of it.
4. Optional: delete the secret temporarily and dispatch, to see the "would silently skip" error.

No user-facing surface. The test type means release-please will not cut a release.

🤖 Generated with Claude Code

[morphatic]

Merge order: #34 first. The second commit edits ci.yml, which is in the deps path filter, so the audit ran against main's lockfile. That lockfile still has the advisories #34 clears, and the audit is the only red job. The test matrix passed on Node 20, 22 and 24, and it actually ran this time thanks to the filter fix. After #34 merges, Update branch here and CI should go green.