diff --git a/AGENTS.md b/AGENTS.md
index e955f8b36a..336698bfe7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -212,3 +212,7 @@ them alone proves succession.
   variable in CI, so a failure class exists that cannot reproduce locally. Before calling a
   scheduler change clean, run the affected tests both ways, including
   `GITHUB_ACTIONS=true python3 -m pytest <paths>`.
+- Scheduler credential fixtures must provide distinct synthetic selected and workflow
+  tokens, not only a source label. Keep missing-token and same-token rejection tests;
+  never weaken production credential proof to restore a green fixture. Actions callable
+  doubles must accept and assert the real keyword arguments, including `stdin`.
diff --git a/tests/test_pr_review_merge_scheduler.py b/tests/test_pr_review_merge_scheduler.py
index b79cf24c55..1f711a704b 100644
--- a/tests/test_pr_review_merge_scheduler.py
+++ b/tests/test_pr_review_merge_scheduler.py
@@ -1787,11 +1787,12 @@ def map(self, func, items):
         ),
     )
     cancelled = []
-    monkeypatch.setattr(
-        sched,
-        "run_github_actions",
-        lambda args, stdin=None: cancelled.append(args),
-    )
+    def record_cancel(args, *, stdin=None):
+        assert stdin is None
+        cancelled.append(args)
+        return ""
+
+    monkeypatch.setattr(sched, "run_github_actions", record_cancel)
     monkeypatch.setattr(sched, "require_github_actions_control_actor", lambda x: None)
 
     run_ids = sched.cancel_stale_opencode_runs("owner/repo", "workflow", make_pr(), dry_run=False)
@@ -1802,7 +1803,8 @@ def map(self, func, items):
 
 
 def test_force_cancel_failure_logs_reason_and_does_not_raise(monkeypatch, capsys):
-    def fail_cancel(args, stdin=None):
+    def fail_cancel(args, *, stdin=None):
+        assert stdin is None
         raise RuntimeError(
             "Command failed (1): gh api -X POST "
             "repos/owner/repo/actions/runs/29263154177/force-cancel; "
@@ -1827,7 +1829,8 @@ def fail_cancel(args, stdin=None):
 
 
 def test_force_cancel_multiple_runs_reports_only_failures(monkeypatch):
-    def maybe_fail(args, stdin=None):
+    def maybe_fail(args, *, stdin=None):
+        assert stdin is None
         if "runs/2/force-cancel" in " ".join(args):
             raise RuntimeError("GitHub returned HTTP 500")
         return ""