diff --git a/.github/workflows/sdk-cli-release.yml b/.github/workflows/sdk-cli-release.yml
index 2122b24a..eed870c8 100644
--- a/.github/workflows/sdk-cli-release.yml
+++ b/.github/workflows/sdk-cli-release.yml
@@ -360,6 +360,19 @@ jobs:
       - name: Build every workspace
         run: npm run build
 
+      # `src/rulesets/opa/policy.wasm` is gitignored (root .gitignore:154), so a fresh
+      # runner does not have it and nothing above compiles it: the root build is
+      # `tsc -b`. `prepublishOnly` then runs copy-rulesets -> build -> copy-assets ->
+      # check:release-drift -> check:install-smoke, and the smoke check REQUIRES a
+      # non-trivial `rulesets/opa/policy.wasm` (that check exists because 1.2.2
+      # shipped 87 .rego sources and zero wasm). Without this step the first
+      # `cli-v*` tag dies inside `npm publish`, after every gate above went green.
+      # Same step, same reason, as npm-release.yml.
+      - name: Compile the OPA policy bundle
+        run: |
+          npm run build:policy
+          test -f src/rulesets/opa/policy.wasm
+
       - name: Build
         working-directory: ${{ env.CLI_DIR }}
         run: npm run build
diff --git a/.harness/scripts/ci/66-validate-bilingual-sync.mjs b/.harness/scripts/ci/66-validate-bilingual-sync.mjs
index e8f56957..cc0608c2 100644
--- a/.harness/scripts/ci/66-validate-bilingual-sync.mjs
+++ b/.harness/scripts/ci/66-validate-bilingual-sync.mjs
@@ -70,9 +70,18 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..
  * That is why this stays empty rather than being deleted outright. A commit that is
  * genuinely and permanently one-sided — one whose counterpart will never move for any
  * reason — belongs here WITH its reason, because for that case the classifier has
- * nothing to observe. Nothing in this repository is currently in that position.
+ * nothing to observe. One entry is in that position today: an ES-only link repair on
+ * README.es.md (the EN link was already right), declared below.
  */
-const ALLOWED = new Map([]);
+const ALLOWED = new Map([
+  [
+    '02833d76',
+    'ES-only link repair: README.es.md pointed the first-run capture at first-run-capture.md ' +
+      'instead of first-run-capture.es.md (the EN half already pointed at its own file). No EN ' +
+      'counterpart exists to change; README.md is touched by too many commits for convergedAfter ' +
+      'to mean anything (see the note above). PR #711.',
+  ],
+]);
 
 function fail(lines) {
   console.error(`\n\x1b[31m✗\x1b[0m ${GUARD}: ${lines[0]}`);
diff --git a/README.es.md b/README.es.md
index c61cb8f9..41320c47 100644
--- a/README.es.md
+++ b/README.es.md
@@ -13,7 +13,7 @@
 
 <img src="./docs/assets/evolith-demo.es.svg" alt="Terminal: evolith init, evolith validate; 133 reglas evaluadas, 26 omitidas, 9 bloqueantes no evaluadas reportadas como fallo; exit 2" width="960">
 
-<sub>Salida real del CLI publicado sobre un repositorio vacío (2026-09-14, abreviada; <a href="./docs/evidence/first-run-capture.md">captura completa de 71 filas</a>).</sub>
+<sub>Salida real del CLI publicado sobre un repositorio vacío (2026-09-14, abreviada; <a href="./docs/evidence/first-run-capture.es.md">captura completa de 71 filas</a>).</sub>
 
 </div>