diff --git a/.github/workflows/test-mcp-regression.yml b/.github/workflows/test-mcp-regression.yml
index fdcacc0e..19cb25b0 100644
--- a/.github/workflows/test-mcp-regression.yml
+++ b/.github/workflows/test-mcp-regression.yml
@@ -139,8 +139,11 @@ jobs:
         run: python tests/generate_e2e_report.py
 
       # ── Generate step summary from JUnit XML ───────────────────────
+      # SHA-pinned to v2.4 (target=dist with bundled index.js); v2 mutable
+      # tag was repointed to v2.5 (target=main) on 2026-05-07 which broke
+      # the bundled artifact (#272). Pin per OWASP-03 / install-trust-model.
       - name: Test Summary
-        uses: test-summary/action@v2
+        uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86  # v2.4
         if: always()
         with:
           paths: test-results/results.xml
diff --git a/tests/eval_decision_relevance.py b/tests/eval_decision_relevance.py
index 397af463..868e810c 100644
--- a/tests/eval_decision_relevance.py
+++ b/tests/eval_decision_relevance.py
@@ -163,7 +163,7 @@ async def _ingest_one(
         "ungrounded": stats.ungrounded,
         "grounded_pct": round(stats.grounded_pct, 4),
         "grounding_deferred": stats.grounding_deferred,
-        "ungrounded_decisions": list(result.ungrounded_decisions),
+        "ungrounded_decisions": list(result.pending_grounding_decisions),
         "m2_fixture_size": m2_fixture_size,
         "extraction_metrics": extraction_metrics,
     }