diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e26369f..aa0b68cc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,13 @@ PyPI version — not the changelog header.
 
 ## [2026-07-18]
 
+**docs** — merge playbook gains a site drift-check step (DPLAN-0249 follow-on):
+every merge run now asks whether install commands, onboarding flow, agent count,
+or the platform/CLI story changed — if yes, aipass.ai must be updated the same
+day. Codifies the S323 ruling that the site is a projection of the README, never
+its own source of facts. Template edit by @flow, one checklist line in the
+post-merge section.
+
 **docs** — root README v3 restructure (DPLAN-0249): single-funnel story with
 zero duplicated commands (install, `aipass new`/`init run`, trees, drone
 examples each taught exactly once), hero link line to aipass.ai/PyPI/r/AIPass,
diff --git a/src/aipass/flow/templates/playbook_plans/merge.md b/src/aipass/flow/templates/playbook_plans/merge.md
index 743d3a2c..bacf12a3 100644
--- a/src/aipass/flow/templates/playbook_plans/merge.md
+++ b/src/aipass/flow/templates/playbook_plans/merge.md
@@ -116,6 +116,7 @@ The PR gate (verified against `.github/workflows/`):
 - [ ] **Stay on `dev`. Do not check out `main`.** Local main being behind is fine — `drone @git sync` from dev covers it.
 - [ ] Never rebase, never reset, never checkout main.
 - [ ] Dependabot / other PRs targeting main: they go green once main has the fix + bots rebase — check after the push
+- [ ] **Site drift check (S323):** does this merge change install commands, onboarding flow, agent count, or the platform/CLI story? If YES → note it here and flag that aipass.ai must be updated same-day (devpulse handles the site edit; the site is a projection of the README, never its own source of facts).
 
 ## 7. Release tag