diff --git a/.woodpecker/default.yml b/.woodpecker/default.yml
index 103c284e..1fd6b1b1 100644
--- a/.woodpecker/default.yml
+++ b/.woodpecker/default.yml
@@ -143,7 +143,12 @@ steps:
         DIFF_BASE="HEAD~1"
         if [ -n "${CI_PREV_COMMIT_SHA:-}" ] && [ "$CI_PREV_COMMIT_SHA" != "$CI_COMMIT_SHA" ]; then
           git cat-file -e "$CI_PREV_COMMIT_SHA^{commit}" 2>/dev/null || git fetch --depth=50 origin master 2>/dev/null || true
-          if git cat-file -e "$CI_PREV_COMMIT_SHA^{commit}" 2>/dev/null; then
+          # Restarted pipelines after master moved produce REVERSE diffs
+          # (CI_PREV ahead of the checked-out HEAD re-applied stale trees and
+          # reverted a sibling apply on 2026-06-12, pipeline 148). Only use
+          # CI_PREV when it is an ancestor of HEAD.
+          if git cat-file -e "$CI_PREV_COMMIT_SHA^{commit}" 2>/dev/null \
+             && git merge-base --is-ancestor "$CI_PREV_COMMIT_SHA" HEAD 2>/dev/null; then
             DIFF_BASE="$CI_PREV_COMMIT_SHA"
           fi
         fi
diff --git a/scripts/publish-gate b/scripts/publish-gate
index 3d38c92b..1d6ff6db 100755
--- a/scripts/publish-gate
+++ b/scripts/publish-gate
@@ -46,7 +46,7 @@ fi
 say ""; say "-- PII heuristics (tracked files) --"
 cd "$CLONE"
 EMAILS=$(git grep -hoiE '[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}' -- ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml' ':!.beads' 2>/dev/null \
-  | grep -viE '@(viktorbarzin\.me|example\.(com|org|test)|test\.(com|local)|localhost|users\.noreply\.github\.com|googlegroups\.com)' \
+  | grep -viE '@(viktorbarzin\.me|meta\.com|example\.(com|org|test)|test\.(com|local)|localhost|users\.noreply\.github\.com|googlegroups\.com)' \
   | grep -viE '^(noreply|no-reply|ci|admin|info|support|hello|user|foo|bar|test.*)@' \
   | sort -u | head -20)
 if [ -n "$EMAILS" ]; then say "real-looking emails found:"; say "$EMAILS"; say "(review: PII?)"; DIRTY=1; else say "emails: none beyond allowlist"; fi