diff --git a/gstack-upgrade/SKILL.md b/gstack-upgrade/SKILL.md
index 59e72163f..84371a245 100644
--- a/gstack-upgrade/SKILL.md
+++ b/gstack-upgrade/SKILL.md
@@ -135,14 +135,12 @@ is saved in a rescue ref instead of being left as conflict markers:
 cd -- "${INSTALL_DIR:?INSTALL_DIR is not set: re-run Step 2 and substitute the printed path}" || exit 1
 { [ -f VERSION ] && [ -f setup ] && [ -f bin/gstack-config ] && _p=$(git rev-parse --show-prefix 2>/dev/null) && [ -z "$_p" ] && [ "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = true ]; } || { echo "ERROR: $INSTALL_DIR is not a gstack checkout; nothing was changed. Re-run Step 2." >&2; exit 1; }
 git fetch origin
-# The update channel (docs/releases.md): origin/stable, the weekly release, for
-# a team install; origin/main otherwise. The helper fetches the channel ref
-# (single-branch clones do not get stable from a plain fetch) and names it.
+# Channel ref (docs/releases.md): origin/stable for a team install, else origin/main.
 UPSTREAM_REF=$(bash bin/gstack-update-channel.sh --fetch-ref 2>/dev/null) || UPSTREAM_REF=origin/main
 echo "UPSTREAM_REF=${UPSTREAM_REF:=origin/main}"
 # Same pre-advance check as the auto-updater: the incoming release's Bun floor,
 # judged by bash whatever this tool shell is (zsh does not word-split).
-HOLD=$(bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . "$1"' _ "$UPSTREAM_REF" 2>/dev/null) && { case "$HOLD" in bun-version-unreadable*) echo "BUN_VERSION_UNREADABLE: $HOLD; nothing was changed" >&2 ;; *) echo "BUN_TOO_OLD: $HOLD; nothing was changed" >&2 ;; esac; exit 1; }
+HOLD=$(UPSTREAM_REF="$UPSTREAM_REF" bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . "$UPSTREAM_REF"' 2>/dev/null) && { case "$HOLD" in bun-version-unreadable*) echo "BUN_VERSION_UNREADABLE: $HOLD; nothing was changed" >&2 ;; *) echo "BUN_TOO_OLD: $HOLD; nothing was changed" >&2 ;; esac; exit 1; }
 PRE_UPGRADE_COMMIT=$(git rev-parse HEAD)
 echo "PRE_UPGRADE_COMMIT=$PRE_UPGRADE_COMMIT"
 FF=$(bash bin/gstack-ff-update . "$UPSTREAM_REF"); FF_RC=$?
@@ -182,7 +180,7 @@ On `SETUP_FAILED`, STOP; keep user changes and report the recovery commit. There
 those commits. Gate it:
 
 1. Run `git status --porcelain` and `git rev-list "${UPSTREAM_REF:-origin/main}"..HEAD --oneline`
-   in `$INSTALL_DIR` (`UPSTREAM_REF` is the channel ref the fast-forward block printed).
+   in `$INSTALL_DIR`.
 2. If BOTH are empty, the reset is provably safe — run the fallback block
    below without asking.
 3. Otherwise ask via AskUserQuestion (one-way door — destructive), listing
diff --git a/gstack-upgrade/SKILL.md.tmpl b/gstack-upgrade/SKILL.md.tmpl
index 0e6ab6a80..042144ee1 100644
--- a/gstack-upgrade/SKILL.md.tmpl
+++ b/gstack-upgrade/SKILL.md.tmpl
@@ -141,14 +141,12 @@ is saved in a rescue ref instead of being left as conflict markers:
 cd -- "${INSTALL_DIR:?INSTALL_DIR is not set: re-run Step 2 and substitute the printed path}" || exit 1
 { [ -f VERSION ] && [ -f setup ] && [ -f bin/gstack-config ] && _p=$(git rev-parse --show-prefix 2>/dev/null) && [ -z "$_p" ] && [ "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = true ]; } || { echo "ERROR: $INSTALL_DIR is not a gstack checkout; nothing was changed. Re-run Step 2." >&2; exit 1; }
 git fetch origin
-# The update channel (docs/releases.md): origin/stable, the weekly release, for
-# a team install; origin/main otherwise. The helper fetches the channel ref
-# (single-branch clones do not get stable from a plain fetch) and names it.
+# Channel ref (docs/releases.md): origin/stable for a team install, else origin/main.
 UPSTREAM_REF=$(bash bin/gstack-update-channel.sh --fetch-ref 2>/dev/null) || UPSTREAM_REF=origin/main
 echo "UPSTREAM_REF=${UPSTREAM_REF:=origin/main}"
 # Same pre-advance check as the auto-updater: the incoming release's Bun floor,
 # judged by bash whatever this tool shell is (zsh does not word-split).
-HOLD=$(bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . "$1"' _ "$UPSTREAM_REF" 2>/dev/null) && { case "$HOLD" in bun-version-unreadable*) echo "BUN_VERSION_UNREADABLE: $HOLD; nothing was changed" >&2 ;; *) echo "BUN_TOO_OLD: $HOLD; nothing was changed" >&2 ;; esac; exit 1; }
+HOLD=$(UPSTREAM_REF="$UPSTREAM_REF" bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . "$UPSTREAM_REF"' 2>/dev/null) && { case "$HOLD" in bun-version-unreadable*) echo "BUN_VERSION_UNREADABLE: $HOLD; nothing was changed" >&2 ;; *) echo "BUN_TOO_OLD: $HOLD; nothing was changed" >&2 ;; esac; exit 1; }
 PRE_UPGRADE_COMMIT=$(git rev-parse HEAD)
 echo "PRE_UPGRADE_COMMIT=$PRE_UPGRADE_COMMIT"
 FF=$(bash bin/gstack-ff-update . "$UPSTREAM_REF"); FF_RC=$?
@@ -188,7 +186,7 @@ On `SETUP_FAILED`, STOP; keep user changes and report the recovery commit. There
 those commits. Gate it:
 
 1. Run `git status --porcelain` and `git rev-list "${UPSTREAM_REF:-origin/main}"..HEAD --oneline`
-   in `$INSTALL_DIR` (`UPSTREAM_REF` is the channel ref the fast-forward block printed).
+   in `$INSTALL_DIR`.
 2. If BOTH are empty, the reset is provably safe — run the fallback block
    below without asking.
 3. Otherwise ask via AskUserQuestion (one-way door — destructive), listing
diff --git a/test/bun-version-shells.test.ts b/test/bun-version-shells.test.ts
index 5d1e880f2..6cd918206 100644
--- a/test/bun-version-shells.test.ts
+++ b/test/bun-version-shells.test.ts
@@ -107,7 +107,7 @@ describe.skipIf(process.platform === 'win32')('Bun floor check in every shell (#
 
   test('/gstack-upgrade Step 4 runs the floor check through bash, whatever the tool shell is', () => {
     const tmpl = fs.readFileSync(path.join(ROOT, 'gstack-upgrade', 'SKILL.md.tmpl'), 'utf8');
-    expect(tmpl).toContain(`HOLD=$(bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . origin/main' 2>/dev/null)`);
+    expect(tmpl).toContain(`HOLD=$(UPSTREAM_REF="$UPSTREAM_REF" bash -c '. bin/gstack-bun-version.sh && gstack_bun_incoming_hold . "$UPSTREAM_REF"' 2>/dev/null)`);
     expect(tmpl).not.toMatch(/HOLD=\$\(\. bin\/gstack-bun-version\.sh/);
     expect(tmpl).toContain('BUN_VERSION_UNREADABLE');
   });