diff --git a/.opencode/skills/cctest-recipe-upstream/SKILL.md b/.opencode/skills/cctest-recipe-upstream/SKILL.md
index 2710596..e48a4c1 100644
--- a/.opencode/skills/cctest-recipe-upstream/SKILL.md
+++ b/.opencode/skills/cctest-recipe-upstream/SKILL.md
@@ -82,7 +82,10 @@ base produces the very messy 3-dot compare this guard exists to prevent (real ca
 first "rebase" landed on a stray `main` and had to be redone onto `master`).
 
 **Branch-name mismatch mirror vs upstream.** The mirror and upstream can use different base-branch
-names (gitea: mirror `main`, upstream `master`). When emitting step 3 (the post-merge release),
-NEVER hardcode `main` — derive the upstream default branch from the existing remotes (`git
-remote show origin` or `git ls-remote --symref origin HEAD`) and emit `git checkout <that>;
-git fetch origin; git merge --ff-only origin/<that>;` before `abra recipe release`.
+names, and a mirror can even carry a stray, divergent `main` alongside the real base (gitea: mirror
+PR against `main`, upstream `master`; keycloak PR #9: base `main`, both mirror and upstream on
+`master`). The canonical script now detects the upstream default branch by evidence (`git
+ls-remote --symref origin HEAD`, then the git.coopcloud.tech API, then the PR base with a warning)
+and uses it for the compare URL AND the post-merge release steps — never hardcode `main`, and when
+it prints the base-mismatch warning, confirm the upgrade branch actually sits on that line
+(`git merge-base` against both candidates) before emitting the push step.
diff --git a/references/recipe-maintainer b/references/recipe-maintainer
index ef3d703..6698723 160000
--- a/references/recipe-maintainer
+++ b/references/recipe-maintainer
@@ -1 +1 @@
-Subproject commit ef3d70384ca790c8fa2d3cdf1fef74e06dab5116
+Subproject commit 6698723a77a8d51301e947fa131b4f3931ce3883
diff --git a/scripts/gen-cctest-skills.py b/scripts/gen-cctest-skills.py
index bd74f60..4a94ffa 100644
--- a/scripts/gen-cctest-skills.py
+++ b/scripts/gen-cctest-skills.py
@@ -110,10 +110,13 @@ base produces the very messy 3-dot compare this guard exists to prevent (real ca
 first "rebase" landed on a stray `main` and had to be redone onto `master`).
 
 **Branch-name mismatch mirror vs upstream.** The mirror and upstream can use different base-branch
-names (gitea: mirror `main`, upstream `master`). When emitting step 3 (the post-merge release),
-NEVER hardcode `main` — derive the upstream default branch from the existing remotes (`git
-remote show origin` or `git ls-remote --symref origin HEAD`) and emit `git checkout <that>;
-git fetch origin; git merge --ff-only origin/<that>;` before `abra recipe release`.
+names, and a mirror can even carry a stray, divergent `main` alongside the real base (gitea: mirror
+PR against `main`, upstream `master`; keycloak PR #9: base `main`, both mirror and upstream on
+`master`). The canonical script now detects the upstream default branch by evidence (`git
+ls-remote --symref origin HEAD`, then the git.coopcloud.tech API, then the PR base with a warning)
+and uses it for the compare URL AND the post-merge release steps — never hardcode `main`, and when
+it prints the base-mismatch warning, confirm the upgrade branch actually sits on that line
+(`git merge-base` against both candidates) before emitting the push step.
 """,
 }