diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bf23b169..acc98078 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,7 +16,7 @@ on:
       - 'website/**'
       - 'frameworks.json'
       - 'config.json'
-  workflow_run: # zizmor: ignore[dangerous-triggers] internal pipeline step, only runs for main-branch runs of our own trusted workflow
+  workflow_run: # zizmor: ignore[dangerous-triggers] internal pipeline step, only runs for main-branch runs
     workflows: ["🔄 Transform Results"]
     types: [completed]
     branches: [main]
@@ -48,23 +48,23 @@ jobs:
         with:
           node-version: '22'
           cache: 'npm'
-          
+
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.9'
           cache: 'pip'
           cache-dependency-path: scripts/requirements.txt
-          
+
       - name: Install dependencies and setup project
         run: |
           pip install -r scripts/requirements.txt
           npm ci
           python scripts/setup/main.py --skip-build
-          
+
       - name: Verify setup
         run: python scripts/verify/check.py
-        
+
       - name: Cache setup for build jobs
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
@@ -75,7 +75,7 @@ jobs:
             apps/*/static
             assets
           key: setup-cache-${{ github.sha }}
-        
+
       - name: Determine frameworks to build
         id: matrix
         env:
@@ -112,11 +112,17 @@ jobs:
           python-version: '3.9'
           cache: 'pip'
           cache-dependency-path: scripts/requirements.txt
-          
+
       - name: Install Python dependencies
         run: pip install -r scripts/requirements.txt
-        
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: '22'
+
       - name: Restore setup cache
+        id: setup-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
@@ -126,8 +132,14 @@ jobs:
             apps/*/static
             assets
           key: setup-cache-${{ github.sha }}
-          fail-on-cache-miss: true
-        
+
+      # workflow_run runs get a read-only cache token, so rebuild on a miss
+      - name: Prepare environment (cache miss)
+        if: steps.setup-cache.outputs.cache-hit != 'true'
+        run: |
+          npm ci
+          python scripts/setup/main.py --skip-build
+
       - name: Build ${{ matrix.framework }}
         id: build-run
         env:
@@ -171,7 +183,7 @@ jobs:
 
           badge_url="https://img.shields.io/badge/Build-${status}-${color}?logo=rocket&logoColor=fff&labelColor=${label_color}"
           curl -o "build-${FRAMEWORK}.svg" "$badge_url"
-          
+
       - name: Upload badge
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -197,11 +209,17 @@ jobs:
           python-version: '3.9'
           cache: 'pip'
           cache-dependency-path: scripts/requirements.txt
-          
+
       - name: Install Python dependencies
         run: pip install -r scripts/requirements.txt
-        
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: '22'
+
       - name: Restore setup cache
+        id: setup-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: |
@@ -211,13 +229,18 @@ jobs:
             apps/*/static
             assets
           key: setup-cache-${{ github.sha }}
-          fail-on-cache-miss: true
-          
+
+      - name: Prepare environment (cache miss)
+        if: steps.setup-cache.outputs.cache-hit != 'true'
+        run: |
+          npm ci
+          python scripts/setup/main.py --skip-build
+
       - name: Build all frameworks and generate website
         run: |
           echo "Building all frameworks for comparison website..."
-          npm run build -- --static-site 
-          
+          npm run build -- --static-site
+
       - name: Upload website artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
@@ -285,7 +308,7 @@ jobs:
 
           # Commit only if there are changes
           git add -A
-          
+
           if git diff --staged --quiet; then
             echo "ℹ️ No website changes to deploy"
           else
@@ -329,10 +352,10 @@ jobs:
           git fetch origin badges:badges 2>/dev/null || git checkout --orphan badges
           git checkout badges 2>/dev/null || true
           git pull origin badges 2>/dev/null || true
-          
+
           # Copy badges and commit
           cp badges/*.svg . 2>/dev/null || echo "⚠️ No badge files found"
-          
+
           if git add ./*.svg && git diff --staged --quiet; then
             echo "ℹ️ No badge changes to commit"
           else
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bfa1857c..a18b6c50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -165,10 +165,10 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Build production image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           target: production
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a027e44c..6718a411 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -29,10 +29,10 @@ jobs:
           persist-credentials: false
 
       - name: 🐳 Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: 🔐 Login to Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -40,7 +40,7 @@ jobs:
 
       - name: 🏷️ Extract Metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -52,7 +52,7 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: 🔨 Build and Push Docker Image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           target: production
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 1dbae9d1..b26bc648 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -312,7 +312,7 @@ jobs:
       - name: Checkout with bot token
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          token: ${{ secrets.BOT_TOKEN }}
+          token: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -325,7 +325,7 @@ jobs:
 
       - name: Commit badges
         env:
-          TOKEN: ${{ secrets.BOT_TOKEN }}
+          TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           git config user.name 'liss-bot'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a83fbb0a..15a8057d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -150,7 +150,7 @@ jobs:
           previous_tag: ${{ steps.prev.outputs.tag }}
           fail_on_unmatched_files: true
           files: release-assets/*
-          token: ${{ secrets.BOT_TOKEN != '' && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
 
       - name: 📋 Job summary
         if: always()
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index 063540ef..d87bef3e 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -130,7 +130,7 @@ jobs:
         if: env.IS_MANUAL == 'true' || steps.check_pr.outputs.needs_tag == 'true'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }}
+          ref: ${{ github.event.pull_request.base.ref || github.ref }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -143,7 +143,7 @@ jobs:
       - name: 👤 Configure git identity and remote
         if: env.IS_MANUAL == 'true' || steps.check_pr.outputs.needs_tag == 'true'
         env:
-          TOKEN: ${{ secrets.BOT_TOKEN != '' && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 14b8d876..e1271cf2 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -42,32 +42,32 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-        
+
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '22'
           cache: 'npm'
           cache-dependency-path: package-lock.json
-          
+
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.9'
           cache: 'pip'
           cache-dependency-path: scripts/requirements.txt
-          
+
       - name: Install Python dependencies
         run: pip install -r scripts/requirements.txt
-          
+
       - name: Install root dependencies
         run: |
           npm ci
           npx playwright install --with-deps
-          
+
       - name: Run Python setup script
         run: python scripts/setup/main.py --skip-build
-        
+
       - name: Cache node_modules and Playwright browsers
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
@@ -79,7 +79,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-node-modules-playwright-
             ${{ runner.os }}-node-modules-
-            
+
       - name: Filter changed paths
         if: github.event_name == 'pull_request'
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
@@ -135,23 +135,23 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-        
+
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '22'
           cache: 'npm'
-          
+
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.9'
           cache: 'pip'
           cache-dependency-path: scripts/requirements.txt
-          
+
       - name: Install Python dependencies
         run: pip install -r scripts/requirements.txt
-          
+
       - name: Restore dependencies cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
@@ -160,7 +160,7 @@ jobs:
             apps/*/node_modules
             ~/.cache/ms-playwright
           key: ${{ runner.os }}-node-modules-playwright-${{ hashFiles('**/package-lock.json') }}
-          
+
       - name: Install dependencies (if cache miss)
         run: |
           if [ ! -d "node_modules" ]; then
@@ -169,10 +169,10 @@ jobs:
           else
             echo "Dependencies cache hit"
           fi
-          
+
       - name: Add node_modules/.bin to PATH
         run: echo "${{ github.workspace }}/node_modules/.bin" >> "$GITHUB_PATH"
-          
+
       - name: Install Playwright browsers (if cache miss)
         run: |
           if [ ! -d ~/.cache/ms-playwright ]; then
@@ -181,7 +181,7 @@ jobs:
           else
             echo "Playwright cache hit - skipping browser installation"
           fi
-          
+
       - name: Verify Playwright installation
         run: |
           echo "Checking @playwright/test availability..."
@@ -191,11 +191,11 @@ jobs:
             echo "❌ @playwright/test not found, forcing npm ci"
             npm ci
           fi
-          
+
       - name: Run setup for project preparation
         run: |
           python scripts/setup/main.py --skip-build
-          
+
       - name: Run tests for ${{ matrix.framework }}
         id: test-run
         uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
@@ -209,7 +209,7 @@ jobs:
             echo "::group::${{ matrix.framework }} Framework Tests"
             npm run test:${{ matrix.framework }} -- --reporter=github --reporter=list
             echo "::endgroup::"
-            
+
       - name: Create detailed result file
         if: always()
         env:
@@ -248,7 +248,7 @@ jobs:
             "playwright_version": "$(npx playwright --version | head -1)"
           }
           EOF
-            
+
       - name: Upload test results (conditional)
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -259,7 +259,7 @@ jobs:
             test-results/
           if-no-files-found: ignore
           retention-days: 30
-          
+
       - name: Upload test status and details
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -269,7 +269,7 @@ jobs:
             test-status/${{ matrix.framework }}.txt
             test-details/${{ matrix.framework }}.json
           retention-days: 7
-          
+
       - name: Generate test badge
         if: always()
         env:
@@ -298,7 +298,7 @@ jobs:
           # Generate badge
           badge_url="https://img.shields.io/badge/Tests-${status}-${color}?logo=vitest&logoColor=fff&labelColor=${label_color}"
           curl -o "test-${FRAMEWORK}.svg" "$badge_url"
-          
+
       - name: Upload badge
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -317,13 +317,13 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
-        
+
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: '22'
           cache: 'npm'
-          
+
       - name: Download all test status artifacts
         if: always()
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -331,7 +331,7 @@ jobs:
           pattern: "*-status"
           path: test-artifacts
           merge-multiple: true
-          
+
       - name: Generate test summary
         env:
           FRAMEWORKS_JSON: ${{ needs.setup.outputs.frameworks }}
@@ -340,6 +340,7 @@ jobs:
           ACTOR: ${{ github.actor }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
+          mkdir -p test-artifacts
           cd test-artifacts || exit 1
 
           # Get frameworks and initialize counters
@@ -348,7 +349,22 @@ jobs:
           passed_count=0
           failed_count=0
           total_count=${#frameworks_array[@]}
-          
+
+          # Empty matrix (nothing tested): note it and skip the divide-by-zero below
+          if [[ "$total_count" -eq 0 ]]; then
+            {
+              echo "# 🧪 Test Results Summary"
+              echo ""
+              echo "> ℹ️ No frameworks required testing for this change."
+            } >> "$GITHUB_STEP_SUMMARY"
+            {
+              echo "FAILED_COUNT=0"
+              echo "PASSED_COUNT=0"
+              echo "SUCCESS_RATE=100"
+            } >> "$GITHUB_ENV"
+            exit 0
+          fi
+
           # Generate summary header
           {
             echo "# 🧪 Test Results Summary"
@@ -365,21 +381,21 @@ jobs:
             echo "| Framework | Status | Attempts |"
             echo "|-----------|--------|----------|"
           } >> "$GITHUB_STEP_SUMMARY"
-          
+
           # Process each framework
           for framework in "${frameworks_array[@]}"; do
             status_file="test-status/${framework}.txt"
             details_file="test-details/${framework}.json"
-            
+
             if [[ -f "$status_file" ]]; then
               status=$(cat "$status_file" 2>/dev/null || echo "unknown")
-              
+
               # Parse JSON details
               attempts="1"
               if [[ -f "$details_file" ]] && command -v jq >/dev/null 2>&1; then
                 attempts=$(jq -r '.attempts // "1"' "$details_file" 2>/dev/null || echo "1")
               fi
-              
+
               # Build table row
               if [[ "$status" == "passed" ]]; then
                 icon="✅"
@@ -388,20 +404,20 @@ jobs:
                 icon="❌"
                 failed_count=$((failed_count + 1))
               fi
-              
+
               echo "| **${framework}** | ${icon} **${status^}** | ${attempts} |" >> "$GITHUB_STEP_SUMMARY"
             else
               echo "| **${framework}** | ⚠️ **Missing** | - |" >> "$GITHUB_STEP_SUMMARY"
               failed_count=$((failed_count + 1))
             fi
           done
-          
+
           # Add workflow information
           {
             echo ""
             echo "**Workflow Info:** Triggered by ${EVENT_NAME} on \`${REF_NAME}\` by @${ACTOR} | [View Run](${RUN_URL})"
           } >> "$GITHUB_STEP_SUMMARY"
-          
+
           # Set environment variables
           success_rate=$(( passed_count * 100 / total_count ))
           {
@@ -409,16 +425,16 @@ jobs:
             echo "PASSED_COUNT=$passed_count"
             echo "SUCCESS_RATE=$success_rate"
           } >> "$GITHUB_ENV"
-          
+
           cd ..
-          
+
       - name: Set workflow status
         run: |
           echo "📊 Final Results:"
           echo "   ✅ Passed: $PASSED_COUNT"
           echo "   ❌ Failed: $FAILED_COUNT"
           echo "   📈 Success Rate: $SUCCESS_RATE%"
-          
+
           if [[ "$FAILED_COUNT" -gt 0 ]]; then
             echo ""
             echo "❌ Some framework tests failed."
@@ -430,7 +446,7 @@ jobs:
             echo ""
             echo "✅ All framework tests passed successfully. Party time! 🎉"
           fi
-          
+
       - name: Create status badge data
         if: always()
         env:
@@ -442,13 +458,13 @@ jobs:
           frameworks="$FRAMEWORKS_JSON"
           read -ra frameworks_array <<< "$(echo "$frameworks" | tr -d '[]"' | tr ',' ' ')"
           total_count=${#frameworks_array[@]}
-          
+
           # Determine badge color (with null checks)
           if [[ -z "$FAILED_COUNT" || -z "$SUCCESS_RATE" ]]; then
             badge_color="lightgrey"
             badge_message="unknown"
           elif [ "$FAILED_COUNT" -eq 0 ]; then
-            badge_color="brightgreen" 
+            badge_color="brightgreen"
             badge_message="${PASSED_COUNT}/${total_count} passed"
           elif [ "$SUCCESS_RATE" -ge 80 ]; then
             badge_color="green"
@@ -460,7 +476,7 @@ jobs:
             badge_color="red"
             badge_message="${PASSED_COUNT}/${total_count} passed"
           fi
-          
+
           # Create badge JSON
           cat > badge-data/test-results.json << EOF
           {
@@ -472,7 +488,7 @@ jobs:
             "logoColor": "white"
           }
           EOF
-          
+
       - name: Upload badge data
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -493,7 +509,7 @@ jobs:
       - name: Checkout with bot token
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
-          token: ${{ secrets.BOT_TOKEN }}
+          token: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -506,7 +522,7 @@ jobs:
 
       - name: Commit badges
         env:
-          TOKEN: ${{ secrets.BOT_TOKEN }}
+          TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           git config user.name 'liss-bot'
@@ -517,10 +533,10 @@ jobs:
           git fetch origin badges:badges 2>/dev/null || git checkout --orphan badges
           git checkout badges 2>/dev/null || true
           git pull origin badges 2>/dev/null || true
-          
+
           # Copy badges and commit
           cp badges/*.svg . 2>/dev/null || echo "⚠️ No badge files found"
-          
+
           if git add ./*.svg && git diff --staged --quiet; then
             echo "ℹ️ No badge changes to commit"
           else
diff --git a/.github/workflows/transform-results.yml b/.github/workflows/transform-results.yml
index 0c67c1eb..7062a60b 100644
--- a/.github/workflows/transform-results.yml
+++ b/.github/workflows/transform-results.yml
@@ -1,7 +1,7 @@
 name: 🔄 Transform Results
 
 on:
-  workflow_run: # zizmor: ignore[dangerous-triggers] internal pipeline step, only runs for main-branch runs of our own trusted Benchmark workflow
+  workflow_run: # zizmor: ignore[dangerous-triggers] internal pipeline step, only runs for main-branch
     workflows: ["📈 Benchmark"]
     types: [completed]
     branches: [main]
@@ -19,7 +19,7 @@ jobs:
     name: Transform & Commit Results
     runs-on: ubuntu-latest
     if: github.event.workflow_run.conclusion == 'success'
-    
+
     steps:
       - name: 📥 Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -44,75 +44,68 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
           pattern: benchmark-results-*
+          merge-multiple: true
           path: ./downloaded-artifacts
 
       - name: 🔍 Verify Downloaded Artifacts
         run: |
           echo "📂 Downloaded artifacts structure:"
           find ./downloaded-artifacts -type f -name "*.json" | head -20 || echo "No JSON files found"
-          
+
           if [ ! -d "./downloaded-artifacts" ] || [ -z "$(find ./downloaded-artifacts -name "*.json" -type f)" ]; then
             echo "❌ No benchmark results found in artifacts"
             exit 1
           fi
-          
+
           echo "✅ Found benchmark results"
 
       - name: 🗂️ Prepare Benchmark Results Directory
         run: | # zizmor: ignore[github-env] COMMIT_TO_MAIN is a parsed true/false boolean from our own artifact, not arbitrary input
-          # Create benchmark-results directory structure
+          # Create a clean benchmark-results directory structure
           mkdir -p benchmark-results
-          
-          # Find and copy the benchmark results from artifacts
-          artifact_dir=$(find ./downloaded-artifacts -name "benchmark-results-*" -type d | head -1)
-          if [ -n "$artifact_dir" ]; then
-            echo "📂 Copying results from: $artifact_dir"
-            # Check if there's a nested benchmark-results directory
-            if [ -d "$artifact_dir/benchmark-results" ]; then
-              cp -r "$artifact_dir/benchmark-results"/* benchmark-results/ 2>/dev/null || true
-            else
-              cp -r "$artifact_dir"/* benchmark-results/ 2>/dev/null || true
-            fi
-            # Try alternative structure if nothing was copied
-            if [ -z "$(find benchmark-results -name "*.json" -type f 2>/dev/null)" ]; then
-              find "$artifact_dir" -name "*.json" -exec cp {} benchmark-results/ \; 2>/dev/null || true
-            fi
-          else
+
+          # Locate the results the benchmark job uploaded
+          src_dir=$(find ./downloaded-artifacts -type d -name benchmark-results | head -1)
+          if [ -n "$src_dir" ]; then
+            echo "📂 Copying results from: $src_dir"
+            cp -r "$src_dir"/. benchmark-results/ 2>/dev/null || true
+          fi
+
+          # Fallback: gather any stray JSON files (excluding the context file)
+          if [ -z "$(find benchmark-results -name "*.json" -type f 2>/dev/null)" ]; then
+            find ./downloaded-artifacts -name "*.json" -type f ! -name workflow-context.json \
+              -exec cp {} benchmark-results/ \; 2>/dev/null || true
+          fi
+
+          if [ -z "$(find benchmark-results -name "*.json" -type f 2>/dev/null)" ]; then
             echo "❌ Could not find benchmark results in artifacts"
             exit 1
           fi
-          
-          # Read workflow context to determine if we should skip main branch commit  
-          context_file=""
-          if [ -f "benchmark-results/workflow-context.json" ]; then
-            context_file="benchmark-results/workflow-context.json"
-          elif [ -f "$artifact_dir/workflow-context.json" ]; then
-            context_file="$artifact_dir/workflow-context.json"
-          fi
-          
+
+          # Read workflow context to determine if we should commit to main
+          context_file=$(find ./downloaded-artifacts benchmark-results -name workflow-context.json -type f 2>/dev/null | head -1)
           if [ -n "$context_file" ]; then
             COMMIT_TO_MAIN=$(python3 -c "import json; print(json.load(open('$context_file')).get('commit_to_main', 'false'))" 2>/dev/null || echo "false")
             echo "COMMIT_TO_MAIN=$COMMIT_TO_MAIN" >> "$GITHUB_ENV"
             echo "📋 Workflow context: commit_to_main=$COMMIT_TO_MAIN"
-            rm "$context_file" 2>/dev/null || true  # Clean up
           else
             echo "COMMIT_TO_MAIN=false" >> "$GITHUB_ENV"
             echo "📋 No workflow context found, defaulting to skip main branch commit"
           fi
-          
+
           echo "📊 Final benchmark-results structure:"
           find benchmark-results -type f -name "*.json" | head -10
 
       - name: 🔄 Transform Results
         run: |
           echo "🔄 Transforming benchmark results..."
-          
+
           # Ensure results directory exists
           mkdir -p results
-          
+
           # Set PYTHONPATH for our transform scripts
           export PYTHONPATH="$PWD:$PWD/scripts"
-          
+
           # Transform results with averaging (since benchmarks might run multiple executions)
           python scripts/transform/benchmark_results.py \
             --format both \
@@ -164,15 +157,15 @@ jobs:
           if [ -d "benchmark-results" ]; then cp -r benchmark-results /tmp/results-data/ 2>/dev/null || true; fi
           if [ -d "results" ]; then cp -r results /tmp/results-data/ 2>/dev/null || true; fi
           if [ -d "website/static/charts" ]; then cp -r website/static/charts /tmp/results-data/ 2>/dev/null || true; fi
-          
+
           # Switch to results branch
           git fetch origin results 2>/dev/null || echo "Results branch doesn't exist yet"
-          
+
           # Aggressively clean working directory to avoid checkout conflicts
           git add -A
           git reset --hard HEAD
           git clean -fdx
-          
+
           # Handle results branch carefully to avoid main branch contamination
           if git show-ref --verify --quiet refs/remotes/origin/results; then
             # Remote results branch exists - check if it's clean (results-only)
@@ -180,7 +173,7 @@ jobs:
             git rm -rf . 2>/dev/null || true
             git fetch origin results:temp-results
             git checkout temp-results
-            
+
             # Check if this branch has main branch files (contamination check)
             if [ -f ".github/README.md" ] || [ -f "package.json" ]; then
               echo "🧹 Results branch appears contaminated with main branch files, creating clean branch"
@@ -201,7 +194,7 @@ jobs:
 
           # Set up directory structure
           mkdir -p raw summary charts stats
-          
+
           # Copy files from temporary location to organized structure
           if [ -d "/tmp/results-data/benchmark-results" ]; then cp -r /tmp/results-data/benchmark-results/* raw/ 2>/dev/null || true; fi
           if [ -f "/tmp/results-data/results/summary.json" ]; then cp /tmp/results-data/results/summary.json "summary/summary-${TIMESTAMP}.json" 2>/dev/null || true; fi
@@ -211,7 +204,7 @@ jobs:
           if [ -d "/tmp/results-data/charts" ]; then cp -r /tmp/results-data/charts/* charts/ 2>/dev/null || true; fi
           if [ -f "/tmp/results-data/results/framework-stats.json" ]; then cp /tmp/results-data/results/framework-stats.json "stats/stats-${TIMESTAMP}.json" 2>/dev/null || true; fi
           if [ -f "/tmp/results-data/results/framework-stats.json" ]; then cp /tmp/results-data/results/framework-stats.json stats/framework-stats.json 2>/dev/null || true; fi
-          
+
           # Commit and push results branch
           if git add raw/ summary/ charts/ stats/ && ! git diff --staged --quiet; then
             git commit -m "chore: update results from run #${{ github.event.workflow_run.run_number }} [${TIMESTAMP}]"
@@ -235,7 +228,7 @@ jobs:
 
           # Switch back to main branch
           git checkout main
-          
+
           if [ "$COMMIT_TO_MAIN" = "true" ]; then
             git add results/ website/static/chart*.json website/static/charts/ .github/README.md || true
             if ! git diff --cached --quiet; then
diff --git a/.github/workflows/update-docs.yml b/.github/workflows/update-docs.yml
index e723ece2..27d1efb1 100644
--- a/.github/workflows/update-docs.yml
+++ b/.github/workflows/update-docs.yml
@@ -71,7 +71,7 @@ jobs:
       - name: Commit & push changes (if any)
         if: always()
         env:
-          TOKEN: ${{ secrets.BOT_TOKEN != '' && secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.BOT_TOKEN || secrets.GITHUB_TOKEN }}
           GIT_AUTHOR_NAME: liss-bot
           GIT_AUTHOR_EMAIL: alicia-gh-bot@mail.as93.net
         run: |