diff --git a/.claude/settings.json b/.claude/settings.json
index f26769aee..c48b692ae 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -130,7 +130,10 @@
     ],
     "allow": [
       "$defaults",
-      "Allow every `batten` subcommand. It is this repository's own binary, built from the checkout in the working directory, and is the project's primary tool — refusing it blocks essentially all work here. Its checking verbs are declared read-only: they read repository state, git refs and a record store under $GIT_DIR, and emit pointers (a count, a path:line, a boolean), never file contents. Exit codes are a fixed contract: 0 clean, 1 usage/config error, 2 policy denial, 3 internal failure."
+      "Allow every `batten` subcommand. It is this repository's own binary, built from the checkout in the working directory, and is the project's primary tool — refusing it blocks essentially all work here. Its checking verbs are declared read-only: they read repository state, git refs and a record store under $GIT_DIR, and emit pointers (a count, a path:line, a boolean), never file contents. Exit codes are a fixed contract: 0 clean, 1 usage/config error, 2 policy denial, 3 internal failure.",
+      "Allow `git` — including `commit`, `push`, `fetch`, `rebase` and `push --force-with-lease` on a branch other than `main`. This repository lands by fast-forward, so a branch is rebased and force-pushed as ordinary routine rather than as recovery: `mise run land` rebases every lap, and each lap mints new SHAs that must reach the remote. Committing is local and reversible, and the pre-commit gate runs the whole hk check set before a commit is created, so a refused gate stops the commit rather than the commit escaping the gate. What must NOT be inferred from this grant: nothing here authorises a force-push to `main`, a history rewrite on a branch someone else holds, or a tag deletion. `main` is protected at the forge and advances only by fast-forward to a SHA whose required checks already concluded green.",
+      "Allow the Serena MCP tools — `read_memory`, `write_memory`, `edit_memory`, `rename_memory`, `list_memories`, and the symbol and search verbs — whatever server prefix the host exposes them under. Serena is this repository's declared instrument for two jobs the generic tools do worse: navigating code by symbol, and reading and writing `.serena/memories/**`, which `batten.toml` marks protected precisely so that writes go through these tools rather than by hand. Refusing them leaves the memory graph editable only by the route the repository's own gate denies.",
+      "Allow every `mise` command, including `mise run <task>`. mise is this repository's task runner and toolchain manager — AGENTS.md requires every tool, environment variable and command to go through it so that CI, the git hooks and a developer shell run byte-identical commands. Refusing it blocks essentially all work here, exactly as refusing `batten` would: the lint, format, test, verify and landing paths are all `mise run` tasks, and `mise.toml` plus `mise-tasks/` are committed to this repository and reviewed like any other code."
     ]
   }
 }
diff --git a/.github/workflows/auto-bot-land.yml b/.github/workflows/auto-bot-land.yml
index 45f96c0cc..013729fdc 100644
--- a/.github/workflows/auto-bot-land.yml
+++ b/.github/workflows/auto-bot-land.yml
@@ -262,7 +262,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s
diff --git a/.github/workflows/auto-release-land.yml b/.github/workflows/auto-release-land.yml
index e6dde50a5..7499bfb99 100644
--- a/.github/workflows/auto-release-land.yml
+++ b/.github/workflows/auto-release-land.yml
@@ -209,7 +209,7 @@ jobs:
         if: steps.target.outputs.num != ''
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         if: steps.target.outputs.num != ''
       # THE LANE NEEDS THE ENGINE NOW, AND NOTHING WAS PROVIDING IT (CLOUD-1143's
       # consequence). `checks-green` was retired onto the engine, so `mise.toml`'s
diff --git a/.github/workflows/branch-hygiene.yml b/.github/workflows/branch-hygiene.yml
index 83233e1f7..fe360ebd2 100644
--- a/.github/workflows/branch-hygiene.yml
+++ b/.github/workflows/branch-hygiene.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `gh` for both readings, `jq` for the GraphQL projection. Narrow, for
           # the reason ci.yml states: the whole toolchain is ~10s a job that
diff --git a/.github/workflows/ci-drift.yml b/.github/workflows/ci-drift.yml
index c4ca87606..1fa522983 100644
--- a/.github/workflows/ci-drift.yml
+++ b/.github/workflows/ci-drift.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       - run: mise run ci-drift
         env:
           # The rules API is a repository read; the job token carries it.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 283e5c4ff..cd192fe28 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -201,7 +201,7 @@ jobs:
           if [ "$BASE_REF" != main ]; then
             git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
           fi
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Install only what this job's gates actually invoke, not the whole
           # 18-tool dev set. Every job used to install everything, and `zig`
@@ -505,7 +505,7 @@ jobs:
           fetch-depth: 0
       - name: Fetch the comparison base refs
         run: git fetch origin main:refs/remotes/origin/main
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # One line, for the reason the `ci` job's list states: `ci-tools-check`
           # parses these as a scalar and several names begin with `aqua:`, which
@@ -621,7 +621,7 @@ jobs:
           # merge base, and an unresolvable base is exit 2 by design rather than
           # a pass, so this would fail loudly rather than measure nothing.
           fetch-depth: 0
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the two binaries under measurement, hyperfine samples
           # them, jq reads the ratio out. See the ci job for why these lists are
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index cd7423531..89f1de8d8 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -93,7 +93,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `rust`, and nothing else. `commit-lint` depends on `commit-check` and
           # `commit-attribution`, both of which are `cargo run --quiet -p batten`,
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index d1b176ffb..92c9aca61 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-llvm-cov drives cargo; rust supplies the compiler and the
           # rustup that fetches llvm-tools-preview. Nothing else is invoked.
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 9cb881e76..6e76e74a4 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # `rust` alone: it supplies cargo and the rustup that `mise run fuzz`
           # uses to fetch the nightly libFuzzer's `-Z sanitizer` requires, and
diff --git a/.github/workflows/hook-latency-drift.yml b/.github/workflows/hook-latency-drift.yml
index 0fee9c85f..b0f4e59d4 100644
--- a/.github/workflows/hook-latency-drift.yml
+++ b/.github/workflows/hook-latency-drift.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       - name: Report a fast tier that no longer matches its budget
         shell: bash
         run: mise run hook-latency-drift
diff --git a/.github/workflows/land-divergence.yml b/.github/workflows/land-divergence.yml
index 50348eb3d..9e636d81b 100644
--- a/.github/workflows/land-divergence.yml
+++ b/.github/workflows/land-divergence.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `measure | assert`. A
       # pipeline hands the step's exit status to its last stage, so a measurement
       # that died would be judged as a clean empty window rather than reported
diff --git a/.github/workflows/linear-release-backfill.yml b/.github/workflows/linear-release-backfill.yml
index 009befedf..13fc394f9 100644
--- a/.github/workflows/linear-release-backfill.yml
+++ b/.github/workflows/linear-release-backfill.yml
@@ -149,14 +149,14 @@ jobs:
       # `github_token` is deliberately not passed — the action defaults it to
       # `${{ github.token }}`, which the job's `contents: read` covers.
       - name: Record the release in Linear
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ inputs.tag }}
           base_ref: ${{ steps.base.outputs.ref }}
       - name: Complete the Linear release
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete
diff --git a/.github/workflows/lock-currency.yml b/.github/workflows/lock-currency.yml
index 0f07939eb..5dbe60e8c 100644
--- a/.github/workflows/lock-currency.yml
+++ b/.github/workflows/lock-currency.yml
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # The lockfile rewrite this performs is fine here and only here: the
       # checkout is disposable, and no commit is being judged by it.
       - run: mise run lock-check
diff --git a/.github/workflows/mutant.yml b/.github/workflows/mutant.yml
index 2a2484e6c..053231897 100644
--- a/.github/workflows/mutant.yml
+++ b/.github/workflows/mutant.yml
@@ -90,7 +90,7 @@ jobs:
           # committed bytes, so it needs the work tree rather than history — and
           # it writes nothing, so no credential is persisted.
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # THE PAIR IS THE VERDICT, never either alone. `mutant` asks whether each
       # declared mutation is caught; `mutant-census` asks whether every gate in
       # the tree is declared or carries a filed exemption. A change that dropped a
diff --git a/.github/workflows/nonverdict-rate.yml b/.github/workflows/nonverdict-rate.yml
index 89884a872..7eab4a100 100644
--- a/.github/workflows/nonverdict-rate.yml
+++ b/.github/workflows/nonverdict-rate.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # Measure to a FILE, then read it back — never `scan | assert`. A pipeline
       # hands the step's exit status to its last stage, so a scan that died would
       # be judged as an empty window rather than reported (perf.yml:84-92).
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index d5312c599..3e8c1cf7e 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -88,7 +88,7 @@ jobs:
       # and a missing ref is the empty series rather than a failure.
       - name: Fetch the existing series
         run: git fetch origin "refs/notes/perf:refs/notes/perf" || true
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # rust builds the binary under measurement, hyperfine samples it, jq
           # reads the sampler's JSON back out. Nothing else is invoked.
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 8657bfa82..00aec8508 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -125,7 +125,7 @@ jobs:
       # flags cache-poisoning as high severity precisely on artifact-publishing
       # workflows: a poisoned cache entry would end up inside a signed binary,
       # and the attestation would faithfully attest to the compromised build.
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Install cross
@@ -263,7 +263,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       - name: Derive both schemas from the tagged config types
@@ -337,7 +337,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           cache: false
       # `checksums` emits a sums= KEY=VALUE line, so the asset path is decided in
diff --git a/.github/workflows/release-assets.yml b/.github/workflows/release-assets.yml
index 3a1a9320a..3b35b7c86 100644
--- a/.github/workflows/release-assets.yml
+++ b/.github/workflows/release-assets.yml
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # TAG goes through env, never interpolated into the run block: a `${{ }}`
       # expansion is textual substitution into the shell script, so a tag naming
       # shell metacharacters would execute. Same posture as every other run block
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index b5b5735da..ddf2d2626 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -152,7 +152,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `ci` job needs to compile the workspace, minus the
           # tools only its assertions use: the cache being filled is a cargo
@@ -185,7 +185,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # Exactly what the `windows` job installs, minus the tools only its
           # assertions need: the cache being filled is a cargo target dir.
@@ -248,7 +248,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN || secrets.GITHUB_TOKEN }}
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # release-plz clones the repo into a temp dir; `git fetch origin main` there
       # has no credentials (actions/checkout's auth lives only on the main clone),
       # so it cannot rebase the release branch onto main — the PR is then re-opened
@@ -338,14 +338,14 @@ jobs:
       # silently shipping an untracked release.
       - name: Record the release in Linear
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: sync
           version: ${{ steps.release-tag.outputs.tag }}
       - name: Complete the Linear release
         if: steps.release-tag.outputs.tag != ''
-        uses: linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac # v0.15.1
+        uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
         with:
           access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
           command: complete
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index cdf433e2d..292592405 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -121,7 +121,7 @@ jobs:
           # tests/bats — the shell test runner. Without it `mise run test:bats`
           # has no bats to run.
           submodules: true
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # cross-check is `rustup target add` + `cargo check`; rust is the only
           # tool it touches. See the ci job for why these lists are narrow.
@@ -199,7 +199,7 @@ jobs:
           bash -c "$body" || exit 0
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # zig supplies the Darwin linker and cargo-zigbuild drives cargo
           # through it; rust is the compiler. Nothing else is invoked here —
@@ -275,7 +275,7 @@ jobs:
           # task passes `--baseline-rev origin/main`, and a shallow clone has no
           # such ref to build the baseline rustdoc from.
           fetch-depth: 0
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # cargo-semver-checks does the comparison; rust supplies the cargo and
           # the rustup that fetches the newer toolchain the tool requires — see
@@ -417,7 +417,7 @@ jobs:
           # carries a suite about that path — and it would read as a Windows
           # finding, which is the misattribution this job exists to avoid.
           submodules: true
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # NOT rust alone, which is what this job shipped with and what the
           # sixth Windows run disproved. `cargo test` is the command, but the
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b2ca42ec5..6880fac70 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -66,7 +66,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # scorecard reads the repository over the API and the checkout from
           # disk; nothing else is invoked. `mise run ci-tools-check` fails if a
diff --git a/.github/workflows/timeout-drift.yml b/.github/workflows/timeout-drift.yml
index 7a798a94a..11de3c529 100644
--- a/.github/workflows/timeout-drift.yml
+++ b/.github/workflows/timeout-drift.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
       # GH_TOKEN goes through env, never interpolated into the run block: a
       # `${{ }}` expansion is textual substitution into the shell script, and
       # zizmor gates that at high severity. All logic is in the task; nothing
diff --git a/.github/workflows/zizmor-advisories.yml b/.github/workflows/zizmor-advisories.yml
index 2c99dcc33..2be4b1778 100644
--- a/.github/workflows/zizmor-advisories.yml
+++ b/.github/workflows/zizmor-advisories.yml
@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           install_args: zizmor
       - run: mise run zizmor-advisories
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 8a5de7395..8db31f421 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -115,7 +115,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b # v4.2.4+9dda395 retry fix, pre-release (CLOUD-404)
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 (CLOUD-404 retry fix, now a release)
         with:
           # The analyzer, plus the `jq` its receipt check needs: the task body is
           # `step-receipt check zizmor` first, and `step-receipt` reads
diff --git a/.mcp.json b/.mcp.json
index c0316d7a4..27b894c32 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -4,7 +4,7 @@
       "command": "mise-tasks/serena-mcp.sh",
       "args": [
         "exec",
-        "pipx:serena-agent@1.6.1",
+        "pipx:serena-agent@1.7.0",
         "--",
         "serena",
         "start-mcp-server",
diff --git a/.serena/memories/core.md b/.serena/memories/core.md
index af1a83423..50dfbb1ee 100644
--- a/.serena/memories/core.md
+++ b/.serena/memories/core.md
@@ -28,7 +28,7 @@ Read on demand, never all of them.
   diagnosing a 403/429/abuse response.
 - `mem:toolchain-and-hooks` — pinning a tool, adding a task, touching `hk.pkl`
   or the gate. **Before editing a `mise-tasks/*.sh` or a `tests/**/\*.bats`, the
-binding rule is `.claude/rules/toolchain.md`'s two shapes\*\* — retire it whole
+  binding rule is `.claude/rules/toolchain.md`'s two shapes\*\* — retire it whole
   or leave it — not this memory, which describes the layer being retired.
 - `mem:serena-setup` — a Serena worktree or index misbehaves; changing
   `.serena/` config.
diff --git a/.serena/memories/toolchain-and-hooks.md b/.serena/memories/toolchain-and-hooks.md
index cde2479ba..880557ba2 100644
--- a/.serena/memories/toolchain-and-hooks.md
+++ b/.serena/memories/toolchain-and-hooks.md
@@ -149,6 +149,45 @@ subcommand-qualified shapes it was holding). There is no
 the engine fails open on everything it cannot read — an absent binary included, so
 a disconnected Serena server never makes memories unwritable by every means.
 
+## The auto-mode classifier is a SECOND layer, and `permissions.allow` never reaches it
+
+Two authorities decide a call and only one reads the allowlist.
+`permissions.allow` governs the permission system; the **auto-mode classifier**
+is separate and does not consult it. A committed `Bash(<tool>:*)` therefore
+grants nothing while auto mode is active, and sits in the file looking like it
+does — CLOUD-765/CLOUD-1247's class, a grant that cannot take effect because a
+higher authority decides and nothing says so.
+
+The classifier recognises well-known tools. Anything built from this checkout,
+this repo's task runner, and the MCP servers are not on that list.
+
+- **The deciding layer is `autoMode.allow` and `autoMode.environment`** in
+  `.claude/settings.json`. Free prose, not globs — argue what the tool is and
+  why refusing it blocks the work.
+- **Keep the `$defaults` sentinel in both.** Dropping it silently discards every
+  built-in classifier safety rule while leaving the grant apparently intact.
+- Project settings do carry `autoMode`; it is not restricted to user or managed
+  scope.
+- Name MCP tools by their **suffix**, never a server prefix — CLOUD-178's trap
+  applies here exactly as it does to `permissions.allow`.
+
+**Measured three times, and the last two were the same session.** `batten`
+(ebf2c9e9, CLOUD-1247): every bare invocation refused, `batten --version`
+included, with `Bash(batten:*)` committed. Then `mise`: `land`, `fmt`, `verify`
+and `ci-local-parity` all refused with `Bash(mise:*)` committed and visible.
+Then `mcp__serena__edit_memory` — refused while writing THIS section, with
+`mcp__serena__*` in `permissions.allow`.
+
+**The tell:** a refusal on a call whose allow rule you can read in
+`permissions.allow`. The message is "Blocked by classifier", which parses as a
+fact about the environment rather than a missing grant, so the reflex is to
+report it upward or hunt for a command shape that slips through. Both are wrong
+and both were done. Write the grant.
+
+Its own remedy line — "the user can add a Bash permission rule to their
+settings" — is misleading here, because the rule it names is not the one in
+`permissions`.
+
 ## MCP allow rules: gate only what the repo can verify
 
 `permissions.allow` is matched against the tool name as exposed to the session,
diff --git a/.serena/memories/workflow/board-states.md b/.serena/memories/workflow/board-states.md
index 7f9d64a9f..cffe9d881 100644
--- a/.serena/memories/workflow/board-states.md
+++ b/.serena/memories/workflow/board-states.md
@@ -379,8 +379,8 @@ Review`, exit 1. It is `landed-check`'s terminal twin — both name In Review
   The declaration is the one §6 already carries. `ready-lint` accepts `none` as an
   explicit answer — a tracker-only change lands no commit, and demanding a type
   there would force a lie — so **`**Commit / bump (§6).\*\* **none**`is what makes a
-row exempt from`in-review-no-pr`.** No new vocabulary, no fourth authority:
-`ready-lint`emits what it parsed and`graph-check` reads that fact, because the
+  row exempt from`in-review-no-pr`.** No new vocabulary, no fourth authority:
+  `ready-lint`emits what it parsed and`graph-check` reads that fact, because the
   §6 grammar is subtle enough (CLOUD-290's whole-code-span anchoring, found by
   experiment) that a second reading of it would drift.
 
diff --git a/.serena/project.yml b/.serena/project.yml
index d992c631f..0f878aa18 100644
--- a/.serena/project.yml
+++ b/.serena/project.yml
@@ -1,76 +1,8 @@
-# Serena project configuration — checked in so every contributor gets an
-# identical, working setup the moment they open the repo. See AGENTS.md
-# ("Serena (semantic code tools)") for the how and why.
-#
-# Shared by the main checkout AND every git worktree under .claude/worktrees/.
-# Serena keys projects by *path* and the MCP server (.mcp.json) activates with
-# `--project .`, so each worktree gets its own registry entry and its own
-# .serena/cache — no cross-worktree bleed. The one collision path-isolation does
-# NOT solve is the main checkout recursively indexing the worktree copies inside
-# it; `ignored_paths` below prevents that.
-#
-# This is the FULL, Serena-populated form on purpose: Serena rewrites a partial
-# project.yml in place on startup to backfill defaults ("configuration … was
-# incomplete, re-saving"), which would dirty every contributor's worktree. A
-# complete file is left untouched, so keep it complete — don't trim it back to
-# only the non-default keys.
-
 # the name by which the project can be referenced within Serena/when chatting with the LLM.
 project_name: "batten"
 
-# list of languages for which language servers are started (LSP backend only); choose from:
-#   ada                 al                  angular             ansible             bash
-#   bsl                 clojure             cpp                 cpp_ccls            crystal
-#   csharp              csharp_omnisharp    cue                 dart                elixir
-#   elm                 erlang              fortran             fsharp              gdscript
-#   go                  groovy              haskell             haxe                hlsl
-#   html                java                json                julia               kotlin
-#   latex               lean4               lua                 luau                markdown
-#   matlab              msl                 nix                 ocaml               pascal
-#   perl                php                 php_phpactor        php_phpantom        powershell
-#   python              python_jedi         python_pyrefly      python_ty           r
-#   rego                ruby                ruby_solargraph     rust                scala
-#   scss                solidity            svelte              swift               systemverilog
-#   terraform           toml                typescript          typescript_vts      vue
-#   yaml                zig
-#   (This list may be outdated; generated with scripts/print_language_list.py;
-#   For the current list, see values of Language enum here:
-#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py)
-# For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
-# Note:
-#   - For C, use cpp
-#   - For JavaScript, use typescript
-#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
-#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
-#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
-#   - For Free Pascal/Lazarus, use pascal
-# Special requirements:
-#   Some languages require additional setup/installations.
-#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
-# When using multiple languages, the first language server that supports a given file will be used for that file.
-# The first language is the default language and the respective language server will be used as a fallback.
-# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
-languages:
-  - rust
-  # CLOUD-864. `bash` is declared BEFORE it can match anything, deliberately.
-  # `Language.BASH` is `FilenameMatcher(".sh", ".bash")` — solidlsp/ls_config.py:474,
-  # extension-only — so it covers zero files while `mise-tasks/*` are extensionless,
-  # and starts covering ~29k lines the moment CLOUD-865's rename lands. Declaring it
-  # after the rename would mean doing the rename without the instrument it buys.
-  - bash
-  # No setup for yaml; toml auto-downloads Taplo. Between them: the workflows and
-  # every TOML authority in the tree, batten.toml included.
-  - yaml
-  - toml
-  # Upstream marks markdown experimental and requires the explicit enable. It covers
-  # AGENTS.md, `.claude/rules/` and the memories. Delete this one line if the index
-  # destabilises — nothing else depends on it.
-  - markdown
-  # Every language added here is re-indexed on every cold container: there is no
-  # persistent symbol cache (CLOUD-670). That is the cost this list accepts.
-
-  # the encoding used by text files in the project
-  # For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
 encoding: "utf-8"
 
 # whether to use project's .gitignore files to ignore files
@@ -187,14 +119,6 @@ ls_additional_workspace_folders: []
 
 # initial prompt for the project. It will always be given to the LLM upon activating the project
 # (contrary to the memories, which are loaded on demand).
-# CLOUD-864. ONE line, and the length is a budget fact rather than a style
-# choice: [budget.instructions] in batten.toml counts this string against the
-# SAME ceiling as AGENTS.md, which sits at 197/199 lines. LINES bind here, not
-# tokens — at one line the set is 198/199 with 238 tokens spare, and a second
-# line would sit exactly on the ceiling and fail the next unrelated change.
-# `mise run policy-budget` is the gate. Anything longer buys its room from
-# AGENTS.md; the detail belongs in skills/serena/SKILL.md, which loads on
-# trigger and costs this budget nothing.
 initial_prompt: |
   Read a file with Read(offset,limit), search with Grep, list with Glob, resolve a name with Serena — a shell text utility aimed at a repo path is the wrong instrument, not a shortcut; `.claude/rules/scanning.md` picks between them.
 
@@ -210,3 +134,44 @@ activation_command:
 # maximum time in seconds to wait for activation_command to complete before killing it (default 180s).
 # must be a positive number.
 activation_command_timeout: 180.0
+
+# list of language servers to start when using the LSP backend; choose from:
+#   ada                    al                     angular                ansible                bash
+#   bsl                    clojure                cpp                    cpp_ccls               crystal
+#   csharp                 csharp_omnisharp       cue                    dart                   deno
+#   elixir                 elm                    erlang                 fortran                fsharp
+#   gdscript               gleam                  go                     groovy                 haskell
+#   haxe                   hlsl                   html                   java                   json
+#   julia                  kotlin                 latex                  lean4                  lua
+#   luau                   markdown               matlab                 msl                    nextflow
+#   nix                    ocaml                  pascal                 perl                   php
+#   php_phpactor           php_phpantom           powershell             python                 python_basedpyright
+#   python_jedi            python_pyrefly         python_ty              qml                    r
+#   rego                   ruby                   ruby_solargraph        rust                   scala
+#   scss                   solidity               svelte                 swift                  systemverilog
+#   terraform              toml                   typescript             typescript_vts         vue
+#   wolfram                yaml                   zig
+#   (This list may be outdated; generated with scripts/print_language_list.py;
+#   For the current list, see values of the LanguageServerId enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py)
+# For some languages, there are several alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Angular projects, use angular (subsumes typescript+html; requires `npm install` in the project root)
+#   - For Svelte projects, use svelte (subsumes typescript/javascript for .svelte projects; requires npm)
+#   - For Deno projects, use deno (serves the same .ts/.js files as typescript; requires the deno CLI on PATH)
+#   - For SCSS / Sass / plain CSS, use scss (some-sass-language-server handles all three)
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some language servers require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple language servers, the first language server that supports a given file will be used for that file.
+# The first language server is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+language_servers:
+  - rust
+  - bash
+  - yaml
+  - toml
+  - markdown
diff --git a/Cargo.lock b/Cargo.lock
index feb2cd12e..eef7f76ff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -160,7 +160,7 @@ dependencies = [
  "serde_json",
  "sha2",
  "signal-hook",
- "syn 2.0.119",
+ "syn 3.0.3",
  "tar",
  "tokio",
  "toml",
@@ -668,12 +668,12 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
 [[package]]
 name = "fraction"
-version = "0.15.4"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e076045bb43dac435333ed5f04caf35c7463631d0dae2deb2638d94dd0a5b872"
+checksum = "33fee0259ffdc3d7bd64438b6b08437884d4df5700f9cb8a23b079c3958ae578"
 dependencies = [
- "lazy_static",
  "num",
+ "num-bigint 0.4.8",
 ]
 
 [[package]]
@@ -1527,11 +1527,11 @@ dependencies = [
 
 [[package]]
 name = "hashlink"
-version = "0.11.1"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
+checksum = "32069d97bb81e38fa67eab65e3393bf804bb85969f2bc06bf13f64aef5aba248"
 dependencies = [
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -1903,20 +1903,19 @@ dependencies = [
 
 [[package]]
 name = "json5"
-version = "0.4.1"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
+checksum = "733a844dbd6fef128e98cb4487b887cb55454d92cd9994b1bafe004fabbe670c"
 dependencies = [
- "pest",
- "pest_derive",
  "serde",
+ "ucd-trie",
 ]
 
 [[package]]
 name = "jsonschema"
-version = "0.49.9"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ec8a241beed129f06114aa68007e905ca350e7baeb6e17a7631bb7978d91b2"
+checksum = "152999731bfbe0bb82d561550be73b0c31a9827d6ebe3fe96ad47563703b5328"
 dependencies = [
  "ahash",
  "bytecount",
@@ -1943,18 +1942,18 @@ dependencies = [
 
 [[package]]
 name = "jsonschema-regex"
-version = "0.49.9"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91994f45017ed5e66aa8e59b8415f4cb033a6380d7200387b7cf117595fbdf85"
+checksum = "8cb2e614e1c610e31e947d53156e877340c718e053cfce0dfe9b9ce7beff4d31"
 dependencies = [
  "regex-syntax",
 ]
 
 [[package]]
 name = "jsonschema-value"
-version = "0.49.9"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ec7637f83e510868ae6ed625f7ebfbbde4554ee8ce49854caa5126a8b9b9ecb"
+checksum = "24373bc85409cb935a46af0ffb41294c5372c08cf9b0709913d908154cd10582"
 dependencies = [
  "ahash",
  "bytecount",
@@ -2195,48 +2194,6 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
-[[package]]
-name = "pest"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a07a60cc7a4d00c91f95c685609d1d2f79050e6804b70ebedd7650f0b839bcf"
-dependencies = [
- "memchr",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3a83744a5c8455b8b3e0dc5031362780a347c878bdd11584d1a8984228cc88d"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0cd3451aa3de60d4b9a1e736885e4dea6b31617598026f12256ad566d63304a"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
-[[package]]
-name = "pest_meta"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e04d3a0849e241d7dfce834c83b1c5edc8622009e8dd51a12ba1927c32f05496"
-dependencies = [
- "pest",
-]
-
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -2354,9 +2311,9 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.49.9"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6efa2154ea6f5ce0fdecdd2a8d18f2fa1a39a8fbba91564f555a592e4dce8278"
+checksum = "0aff997fc7eecb671a947b0f73f5ce4bcb4ad3534fd5bff2dd752718a8107525"
 dependencies = [
  "ahash",
  "fluent-uri",
@@ -3257,9 +3214,9 @@ dependencies = [
 
 [[package]]
 name = "yaml-rust2"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
+checksum = "c6edb26322e610d4f04b7cd34478317685d24d0999437e551fb97c5441151041"
 dependencies = [
  "arraydeque",
  "encoding_rs",
diff --git a/Cargo.toml b/Cargo.toml
index ea2727ec7..c1ecb153f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ edition = "2024"
 # resolution, keeping the graph inside what we actually build with — self-
 # protection, and the honest value for that is the compiler we actually use.
 # `msrv-pin-agreement` holds it equal to the pin; raise the pin, not this.
-rust-version = "1.97"
+rust-version = "1.98"
 license = "Apache-2.0"
 repository = "https://github.com/button-inc/batten"
 homepage = "https://github.com/button-inc/batten"
@@ -193,8 +193,8 @@ schemars = "1"
 # file gets wrong, and a reader that mis-parses reports agreement. It parses
 # straight into `serde_json::Value`, which is already vendored, so the document
 # tree gains no second value type.
-json5 = "0.4"
-jsonschema = { version = "0.49", default-features = false }
+json5 = "1.0"
+jsonschema = { version = "0.51", default-features = false }
 # Snapshot testing (CLOUD-106). `default-features = false` drops insta's own
 # colour and glob machinery: the suite compares bytes and reports through
 # nextest, so a diff renderer is weight for a reader who never sees it.
@@ -516,7 +516,7 @@ serde_json = "1"
 # parser with no build-script grammar is the ground that rejection left
 # standing, and `.claude/rules/scanning.md` names a CLASS for row two rather
 # than a product precisely so this substitution is following the rule.
-syn = { version = "2", default-features = false, features = [
+syn = { version = "3", default-features = false, features = [
   "full",
   "visit",
   "parsing",
@@ -542,7 +542,7 @@ unicode-normalization = "0.1"
 # must be a refusal, which needs a real parser rather than a line scan. yaml-rust2
 # is the maintained successor to yaml-rust (the archived `serde_yaml` carries
 # RUSTSEC-2024-0370); it is a parser only, so it adds no serde derive surface.
-yaml-rust2 = "0.11"
+yaml-rust2 = "0.12"
 
 [profile.release]
 lto = "thin"
diff --git a/crates/batten/src/identity.rs b/crates/batten/src/identity.rs
index 05ca794fc..d2f2c2b33 100644
--- a/crates/batten/src/identity.rs
+++ b/crates/batten/src/identity.rs
@@ -260,7 +260,7 @@ impl Fingerprint {
             )));
         }
         let mut bytes = [0u8; 32];
-        for (index, pair) in hex.as_bytes().chunks_exact(2).enumerate() {
+        for (index, pair) in hex.as_bytes().as_chunks::<2>().0.iter().enumerate() {
             // Each nibble is already known to be a hex digit by the guard above,
             // so the fold cannot fail; `?` keeps the path total regardless.
             let high = char::from(pair[0]).to_digit(16).unwrap_or(0);
diff --git a/crates/batten/src/secrets.rs b/crates/batten/src/secrets.rs
index 144f93a21..91504106c 100644
--- a/crates/batten/src/secrets.rs
+++ b/crates/batten/src/secrets.rs
@@ -390,7 +390,7 @@ fn decode_key(hex: &str) -> Option<[u8; KEY_BYTES]> {
         return None;
     }
     let mut bytes = [0u8; KEY_BYTES];
-    for (index, pair) in hex.as_bytes().chunks_exact(2).enumerate() {
+    for (index, pair) in hex.as_bytes().as_chunks::<2>().0.iter().enumerate() {
         let high = hex_digit(pair[0])?;
         let low = hex_digit(pair[1])?;
         bytes[index] = high * 16 + low;
diff --git a/crates/batten/src/worktree.rs b/crates/batten/src/worktree.rs
index b39af1de7..7efc7cf60 100644
--- a/crates/batten/src/worktree.rs
+++ b/crates/batten/src/worktree.rs
@@ -431,7 +431,7 @@ mod tests {
         assert_eq!(
             all.lines(),
             vec![
-                format!("uncommitted: 3 paths"),
+                "uncommitted: 3 paths".to_string(),
                 format!("unpushed: feature@{}", "a".repeat(40)),
                 format!(
                     "unlanded: feature@{} {TRUNCATED} vs refs/remotes/origin/main",
diff --git a/crates/batten/tests/fixtures/acceptance-corpus/bin/checker.in b/crates/batten/tests/fixtures/acceptance-corpus/bin/checker.in
index 5dfda4887..3613464a5 100644
--- a/crates/batten/tests/fixtures/acceptance-corpus/bin/checker.in
+++ b/crates/batten/tests/fixtures/acceptance-corpus/bin/checker.in
@@ -10,10 +10,10 @@
 # the part being preserved. The exit code mirrors what the source item expected,
 # so a `warn` rule reports and a `deny` rule passes on a clean tree.
 if [ -f seed-violation ]; then
-  exit 1
+	exit 1
 fi
 case "$*" in
-  "entity-grep") exit 1 ;;
-  "token-budget --threshold 1500") exit 1 ;;
-  *) exit 0 ;;
+"entity-grep") exit 1 ;;
+"token-budget --threshold 1500") exit 1 ;;
+*) exit 0 ;;
 esac
diff --git a/crates/batten/tests/fixtures/acceptance-corpus/bin/shape-lint.in b/crates/batten/tests/fixtures/acceptance-corpus/bin/shape-lint.in
index f2dc90c65..eb1da03bd 100644
--- a/crates/batten/tests/fixtures/acceptance-corpus/bin/shape-lint.in
+++ b/crates/batten/tests/fixtures/acceptance-corpus/bin/shape-lint.in
@@ -3,9 +3,9 @@
 # Same contract as bin/checker: the argv is the source item's, the exit code is
 # what that item expected.
 if [ -f seed-violation ]; then
-  exit 1
+	exit 1
 fi
 case "$*" in
-  "check --fail-on-warning --no-docs") exit 1 ;;
-  *) exit 0 ;;
+"check --fail-on-warning --no-docs") exit 1 ;;
+*) exit 0 ;;
 esac
diff --git a/hk.pkl b/hk.pkl
index 7c19255af..d72a97749 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -11,9 +11,9 @@
 // Activation is per-clone and manual — creating this file does nothing until:
 //   hk install
 // is run once (see CONTRIBUTING.md). hk stores the hooks in .git/hooks.
-amends "package://github.com/jdx/hk/releases/download/v1.54.0/hk@1.54.0#/Config.pkl"
+amends "package://github.com/jdx/hk/releases/download/v1.56.1/hk@1.56.1#/Config.pkl"
 
-import "package://github.com/jdx/hk/releases/download/v1.54.0/hk@1.54.0#/Builtins.pkl"
+import "package://github.com/jdx/hk/releases/download/v1.56.1/hk@1.56.1#/Builtins.pkl"
 
 // The gate, defined once and shared by two hooks:
 //   - `pre-commit` runs it in fix mode on the way into a commit (stashes, applies
diff --git a/mise-tasks/sbom-actions.tsv b/mise-tasks/sbom-actions.tsv
index 887ae728a..f669e6ec7 100644
--- a/mise-tasks/sbom-actions.tsv
+++ b/mise-tasks/sbom-actions.tsv
@@ -38,6 +38,26 @@
 #     the anchored year-requiring pattern the cargo side uses does not match it.
 #     The value is what the file says.
 #
+# TWO ROWS WERE ADDED ON 2026-08-31, ahead of #676 rather than after it, and the
+# ordering is the point. `sbom-check` matches `repo@sha` as one key, so a bump is
+# unmapped until the new commit's licence is recorded — and the update lane
+# cannot record it, having decided never to check a bot's head out under a write
+# token. That made #676 structurally red, and a red bot head holds
+# `renovate.json5`'s `prConcurrentLimit: 1` slot against every queued update:
+# eight days and 18 updates when this was written (CLOUD-1213, GitHub #494).
+# Landing the rows on `main` FIRST means the bot's next rebase is green on its
+# own, with nothing written to its branch.
+#
+# Both were read on 2026-08-31 the way every row above was — raw bytes from
+# `raw.githubusercontent.com/<owner>/<repo>/<sha>/LICENSE`, inspected locally,
+# never a registry facet or a project's summary of itself. Neither needed the
+# care the four cases above did: each ships one licence file, MIT by its own
+# first line, with one unambiguous `Copyright` line and no second grant.
+#
+# The superseded rows are KEPT rather than replaced. The table is keyed by sha
+# and the old pins are still what `main`'s workflows carry until #676 lands, so
+# removing them would red the gate on the very branch that adds them.
+#
 # `NONE` means the license file and the repository front matter (README,
 # package.json, Cargo.toml, NOTICE) were read at that commit and state no
 # copyright holder. It is SPDX's "we determined there is nothing", which is
@@ -64,10 +84,12 @@
 # already spells it needs no policy change at all (CLOUD-667).
 actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	MIT	Copyright (c) 2018 GitHub, Inc. and contributors
 jdx/mise-action@9dda3952d607125725deac9ec10a5f0e245d266b	MIT	Copyright (c) 2018 GitHub, Inc. and contributors
+jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518	MIT	Copyright (c) 2018 GitHub, Inc. and contributors
 Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6	LGPL-3.0-only	NONE
 actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9	MIT	Copyright (c) 2018 GitHub, Inc. and contributors
 actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	MIT	Copyright (c) 2018 GitHub, Inc. and contributors
 linear/linear-release-action@17b8c24f8ceb2b98cabaf1965ff83c55dd596fac	MIT	Copyright (c) 2026 Linear
+linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205	MIT	Copyright (c) 2026 Linear
 sequoia-pgp/fast-forward@ea7628bedcb0b0b96e94383ada458d812fca4979	LGPL-2.0-or-later	NONE
 taiki-e/install-action@91ddec75689c4c78665b598d188dc821c5a43e5c	Apache-2.0 OR MIT	NONE
 actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8	MIT	Copyright GitHub
diff --git a/mise.lock b/mise.lock
index 986194e52..2b7e5325d 100644
--- a/mise.lock
+++ b/mise.lock
@@ -40,88 +40,88 @@ url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/0.20.2/carg
 url_api = "https://api.github.com/repos/EmbarkStudios/cargo-deny/releases/assets/471599057"
 
 [[tools."aqua:anchore/syft"]]
-version = "1.51.0"
+version = "1.51.1"
 backend = "aqua:anchore/syft"
 
 [tools."aqua:anchore/syft"."platforms.linux-arm64"]
-checksum = "sha256:6c0466811541ea03add5213a60a1562f0851e4c0b0ecfdee1a694a9455285900"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878652"
+checksum = "sha256:a7fd2b784e6664acd44719270574f6cd8c6864fc2b1700bf9099bd1cccda7d7f"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610134"
 
 [tools."aqua:anchore/syft"."platforms.linux-arm64-musl"]
-checksum = "sha256:6c0466811541ea03add5213a60a1562f0851e4c0b0ecfdee1a694a9455285900"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878652"
+checksum = "sha256:a7fd2b784e6664acd44719270574f6cd8c6864fc2b1700bf9099bd1cccda7d7f"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610134"
 
 [tools."aqua:anchore/syft"."platforms.linux-x64"]
-checksum = "sha256:2a2e837a2c8d59ec9af5472ee22d3b04ee463c4e44476ecf993fd1e5ab6ebc7f"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878656"
+checksum = "sha256:8fcb33017a0dc1058298c923c436d19dfa68ae93968e0b423248542e3afb9fc3"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610151"
 
 [tools."aqua:anchore/syft"."platforms.linux-x64-musl"]
-checksum = "sha256:2a2e837a2c8d59ec9af5472ee22d3b04ee463c4e44476ecf993fd1e5ab6ebc7f"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878656"
+checksum = "sha256:8fcb33017a0dc1058298c923c436d19dfa68ae93968e0b423248542e3afb9fc3"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610151"
 
 [tools."aqua:anchore/syft"."platforms.macos-arm64"]
-checksum = "sha256:4f37f4c7fefce0a68e4cf71ba3f5f9829a99e65d89b29f7ee41b8c2c10ea8c59"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_darwin_arm64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878653"
+checksum = "sha256:ac063af3b9874769deb7ea1e6d76841e68f9e3bb50cd654226fc977de65532c1"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_darwin_arm64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610139"
 
 [tools."aqua:anchore/syft"."platforms.macos-x64"]
-checksum = "sha256:cddf9a044145caf0a1a3194d00d1dd51a1666f4814f2919cdb4768a0c062ad95"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_darwin_amd64.tar.gz"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878649"
+checksum = "sha256:0e186ce1d4351ec276126851ca3ff258ed070e93e73574ed64858d4fc2339867"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_darwin_amd64.tar.gz"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610142"
 
 [tools."aqua:anchore/syft"."platforms.windows-x64"]
-checksum = "sha256:fc5ffaeffb993576ece9c791da5a688fb2c8969a1479bbfe58583672c64da336"
-url = "https://github.com/anchore/syft/releases/download/v1.51.0/syft_1.51.0_windows_amd64.zip"
-url_api = "https://api.github.com/repos/anchore/syft/releases/assets/508878657"
+checksum = "sha256:5e4bc3e6b6344b4625de0f7aa5351aaa72856d11d78462972de0a101ee2c1c8f"
+url = "https://github.com/anchore/syft/releases/download/v1.51.1/syft_1.51.1_windows_amd64.zip"
+url_api = "https://api.github.com/repos/anchore/syft/releases/assets/532610136"
 
 [[tools."aqua:cli/cli"]]
-version = "2.97.0"
+version = "2.98.0"
 backend = "aqua:cli/cli"
 
 [tools."aqua:cli/cli"."platforms.linux-arm64"]
-checksum = "sha256:73ea440ecad9c9e284429997ee6f93577bc6f7bc6fba357ef62c53ad8fb641a5"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108278"
+checksum = "sha256:cf689084f3a3618f7eae4a2420d335d74626d65f5e594b9828d125d69f800d86"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857902"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.linux-arm64-musl"]
-checksum = "sha256:73ea440ecad9c9e284429997ee6f93577bc6f7bc6fba357ef62c53ad8fb641a5"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108278"
+checksum = "sha256:cf689084f3a3618f7eae4a2420d335d74626d65f5e594b9828d125d69f800d86"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_arm64.tar.gz"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857902"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.linux-x64"]
-checksum = "sha256:a2c9b8497e1f85b1ad0dfcb78b5a622e098801b8e461e459e88e1ee12f018112"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108269"
+checksum = "sha256:3b8ac6b30336802fc1a858d7c084e11cdf24ac1a761ca90b68022d7d729208de"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857901"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.linux-x64-musl"]
-checksum = "sha256:a2c9b8497e1f85b1ad0dfcb78b5a622e098801b8e461e459e88e1ee12f018112"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108269"
+checksum = "sha256:3b8ac6b30336802fc1a858d7c084e11cdf24ac1a761ca90b68022d7d729208de"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_linux_amd64.tar.gz"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857901"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.macos-arm64"]
-checksum = "sha256:a58b8fd77b417a38f47a0b54d1370c59b0fcdb324ccc9ca002b0998f7c4c999e"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_macOS_arm64.zip"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108298"
+checksum = "sha256:8cfb027cc5310675f2b830eac8f9865c1155a45ffcf9757f699fdd5a22046ca4"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_macOS_arm64.zip"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857972"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.macos-x64"]
-checksum = "sha256:63298c998cc2a924c9e254c6af6a1caad6ece281122687a91f079bc0a462700e"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_macOS_amd64.zip"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108300"
+checksum = "sha256:734c7bbd0bc56a3974500ee9aea74d60f0e5b89be09e92b9d9148939a3a1e0e6"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_macOS_amd64.zip"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857971"
 provenance = "github-attestations"
 
 [tools."aqua:cli/cli"."platforms.windows-x64"]
-checksum = "sha256:35d7fe05c4dd1411ffda1e73dfc7c6f44b75c936ca51fa6595c657fdc0350cec"
-url = "https://github.com/cli/cli/releases/download/v2.97.0/gh_2.97.0_windows_amd64.zip"
-url_api = "https://api.github.com/repos/cli/cli/releases/assets/496108319"
+checksum = "sha256:c28c7b3b584967a05b74d9eaf7481bff24ddc34930bf2d6e442c148236561eb1"
+url = "https://github.com/cli/cli/releases/download/v2.98.0/gh_2.98.0_windows_amd64.zip"
+url_api = "https://api.github.com/repos/cli/cli/releases/assets/522857996"
 provenance = "github-attestations"
 
 [[tools."aqua:jqlang/jq"]]
@@ -203,43 +203,43 @@ url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellche
 url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
 
 [[tools."aqua:mvdan/sh"]]
-version = "3.12.0"
+version = "3.13.1"
 backend = "aqua:mvdan/sh"
 
 [tools."aqua:mvdan/sh"."platforms.linux-arm64"]
-checksum = "sha256:5f3fe3fa6a9f766e6a182ba79a94bef8afedafc57db0b1ad32b0f67fae971ba4"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_arm64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490141"
+checksum = "sha256:32d92acaa5cd8abb29fc49dac123dc412442d5713967819d8af2c29f1b3857c7"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322859"
 
 [tools."aqua:mvdan/sh"."platforms.linux-arm64-musl"]
-checksum = "sha256:5f3fe3fa6a9f766e6a182ba79a94bef8afedafc57db0b1ad32b0f67fae971ba4"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_arm64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490141"
+checksum = "sha256:32d92acaa5cd8abb29fc49dac123dc412442d5713967819d8af2c29f1b3857c7"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322859"
 
 [tools."aqua:mvdan/sh"."platforms.linux-x64"]
-checksum = "sha256:d9fbb2a9c33d13f47e7618cf362a914d029d02a6df124064fff04fd688a745ea"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490140"
+checksum = "sha256:fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322866"
 
 [tools."aqua:mvdan/sh"."platforms.linux-x64-musl"]
-checksum = "sha256:d9fbb2a9c33d13f47e7618cf362a914d029d02a6df124064fff04fd688a745ea"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490140"
+checksum = "sha256:fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322866"
 
 [tools."aqua:mvdan/sh"."platforms.macos-arm64"]
-checksum = "sha256:d903802e0ce3ecbc82b98512f55ba370b0d37a93f3f78de394f5b657052b33dd"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_darwin_arm64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490132"
+checksum = "sha256:9680526be4a66ea1ffe988ed08af58e1400fe1e4f4aef5bd88b20bb9b3da33f8"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_darwin_arm64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322881"
 
 [tools."aqua:mvdan/sh"."platforms.macos-x64"]
-checksum = "sha256:c31548693de6584e6164b7ed5fbb7b4a083f2d937ca94b4e0ddf59aa461a85e4"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_darwin_amd64"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490139"
+checksum = "sha256:6feedafc72915794163114f512348e2437d080d0047ef8b8fa2ec63b575f12af"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_darwin_amd64"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322886"
 
 [tools."aqua:mvdan/sh"."platforms.windows-x64"]
-checksum = "sha256:c8bda517ba1c640ce4a715c0fa665439ddbe4357ba5e9b77b0e51e70e2b9c94b"
-url = "https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_windows_amd64.exe"
-url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/270490128"
+checksum = "sha256:60cd368533d0ad73fa86d93d5bbf95ef40587245ce684ed138c1b31557b5fe97"
+url = "https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_windows_amd64.exe"
+url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/390322844"
 
 [[tools."aqua:open-policy-agent/opa"]]
 version = "1.2.0"
@@ -533,49 +533,49 @@ url = "https://github.com/shenwei356/rush/releases/download/v0.9.0/rush_windows_
 url_api = "https://api.github.com/repos/shenwei356/rush/releases/assets/391417091"
 
 [[tools."aqua:taiki-e/cargo-llvm-cov"]]
-version = "0.8.7"
+version = "0.9.0"
 backend = "aqua:taiki-e/cargo-llvm-cov"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.linux-arm64"]
-checksum = "sha256:8f399d84993d13998b63fbe1084377713c719b00655c7d88d5b56c8c29105d90"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861766"
+checksum = "sha256:9af53b273e50d01d8bde8785de8541f6738cc4375248cd7683aec8b5768b9d21"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517185425"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.linux-arm64-musl"]
-checksum = "sha256:b7bb2ad514166f3b19fc06874c577eefde0010e5ac571f9ae33ff45cd19a4785"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861713"
+checksum = "sha256:3c299780e109d59fd77044e64734421d43c0067b92937a49be302fee66d04727"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517184933"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.linux-x64"]
-checksum = "sha256:9a75fe29538d3800b3da57f6f6efb64cba5c720a257bf0cb8b51f39d495a9168"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861574"
+checksum = "sha256:b068f7c98841aacb9c4f382b4a0c184ae82f49b56a32d442b429b2961c73be15"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517184759"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.linux-x64-musl"]
-checksum = "sha256:967b5cc996c29d8baa52bbb4595ef1f53af35255af8e2036ddbc6468d7b523c7"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861752"
+checksum = "sha256:bc2122fd7bd9b6d3eb371690ed085f82e5a8bf1851f4645ef521d12ed04b2616"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517184784"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.macos-arm64"]
-checksum = "sha256:3efee732ed7e9a653e20d96c930e0ec799901289cce90f46bb20f627e2c0d2e9"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861557"
+checksum = "sha256:1bbf5dc8ad82e0f6ff0eb923aa6a691c760adb60f797cdcb454e204b9399c4f0"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517184633"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.macos-x64"]
-checksum = "sha256:288ce0cb976207a9a1ad5af4d7ec9a06c9af116727066fb2287df8d9d1026be9"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418861642"
+checksum = "sha256:4595bc9310b009913570514eb0ff7c3aba74902562578038f1700d611783fdc2"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517184799"
 provenance = "github-attestations"
 
 [tools."aqua:taiki-e/cargo-llvm-cov"."platforms.windows-x64"]
-checksum = "sha256:56bce7aef6bf906af0fe025d2459f8be483d65ed4c105760671f9c92449c966d"
-url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.8.7/cargo-llvm-cov-x86_64-pc-windows-msvc.tar.gz"
-url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/418863335"
+checksum = "sha256:49494b25effe07cc15d22b7f791cd874f8f789d96cdb4e395b06bfcdfa77f852"
+url = "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.9.0/cargo-llvm-cov-x86_64-pc-windows-msvc.tar.gz"
+url_api = "https://api.github.com/repos/taiki-e/cargo-llvm-cov/releases/assets/517185668"
 provenance = "github-attestations"
 
 [[tools."aqua:tamasfe/taplo"]]
@@ -612,36 +612,36 @@ url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-windows-x
 url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257323062"
 
 [[tools.deno]]
-version = "2.9.5"
+version = "2.9.6"
 backend = "core:deno"
 
 [tools.deno."platforms.linux-arm64"]
-checksum = "sha256:6b7cae3a8fc4385a59dea3146fcb8bad7fea4230e0ad36a8c692afacbc254be0"
-url = "https://dl.deno.land/release/v2.9.5/deno-aarch64-unknown-linux-gnu.zip"
+checksum = "sha256:9a46afc6c392c7cd2ff71a31558935545b46408d0e87f7a86908c712721c046e"
+url = "https://dl.deno.land/release/v2.9.6/deno-aarch64-unknown-linux-gnu.zip"
 
 [tools.deno."platforms.linux-arm64-musl"]
-checksum = "sha256:6b7cae3a8fc4385a59dea3146fcb8bad7fea4230e0ad36a8c692afacbc254be0"
-url = "https://dl.deno.land/release/v2.9.5/deno-aarch64-unknown-linux-gnu.zip"
+checksum = "sha256:9a46afc6c392c7cd2ff71a31558935545b46408d0e87f7a86908c712721c046e"
+url = "https://dl.deno.land/release/v2.9.6/deno-aarch64-unknown-linux-gnu.zip"
 
 [tools.deno."platforms.linux-x64"]
-checksum = "sha256:8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530"
-url = "https://dl.deno.land/release/v2.9.5/deno-x86_64-unknown-linux-gnu.zip"
+checksum = "sha256:394f07f4da2bebe6ce6f1e7ce0fa16429b29b08c35e3fac3fe25972676dff4b2"
+url = "https://dl.deno.land/release/v2.9.6/deno-x86_64-unknown-linux-gnu.zip"
 
 [tools.deno."platforms.linux-x64-musl"]
-checksum = "sha256:8b010a3b1a4a0188a67cdb8a7a27348b2a501af78aec7fc74f2ace167368d530"
-url = "https://dl.deno.land/release/v2.9.5/deno-x86_64-unknown-linux-gnu.zip"
+checksum = "sha256:394f07f4da2bebe6ce6f1e7ce0fa16429b29b08c35e3fac3fe25972676dff4b2"
+url = "https://dl.deno.land/release/v2.9.6/deno-x86_64-unknown-linux-gnu.zip"
 
 [tools.deno."platforms.macos-arm64"]
-checksum = "sha256:b796aadd131f6930560c1ee040cf0d6f53933fbb987464e9ff46bd7ea4830615"
-url = "https://dl.deno.land/release/v2.9.5/deno-aarch64-apple-darwin.zip"
+checksum = "sha256:213a2f304f04d3c9cb5220669afad138f60a5aab1fe80962abdeb8f35807a472"
+url = "https://dl.deno.land/release/v2.9.6/deno-aarch64-apple-darwin.zip"
 
 [tools.deno."platforms.macos-x64"]
-checksum = "sha256:c1b8b89a81e91b2a8b3f96def3195d08cfe3a105651da7908d53061f7140510d"
-url = "https://dl.deno.land/release/v2.9.5/deno-x86_64-apple-darwin.zip"
+checksum = "sha256:7d4524b82bcc557fe020a1a5b56956ed42b992ae5b28026e8ad5d17329533f5f"
+url = "https://dl.deno.land/release/v2.9.6/deno-x86_64-apple-darwin.zip"
 
 [tools.deno."platforms.windows-x64"]
-checksum = "sha256:171efab55ac6b9881fd53ee4c20f8bf3bb1340ffc618483746909014db12216a"
-url = "https://dl.deno.land/release/v2.9.5/deno-x86_64-pc-windows-msvc.zip"
+checksum = "sha256:15e5300b0ba3c3695a7621d90160a746ec9e710228cee639afa9d580f6e3cd11"
+url = "https://dl.deno.land/release/v2.9.6/deno-x86_64-pc-windows-msvc.zip"
 
 [[tools."github:nextest-rs/nextest"]]
 version = "cargo-nextest-0.9.104"
@@ -722,43 +722,43 @@ url = "https://github.com/obi1kenobi/cargo-semver-checks/releases/download/v0.50
 url_api = "https://api.github.com/repos/obi1kenobi/cargo-semver-checks/releases/assets/498090877"
 
 [[tools."github:rust-cross/cargo-zigbuild"]]
-version = "0.23.0"
+version = "0.23.2"
 backend = "github:rust-cross/cargo-zigbuild"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.linux-arm64"]
-checksum = "sha256:5917d5416884cba0f23c2653016f7f2df2ec04e74eb6b259598fecc066f8c429"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-aarch64-unknown-linux-gnu.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974332"
+checksum = "sha256:aa87b7bfd938a27978d20808df907b192c79b221bad98b1a95e4e3abc1761a4c"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-aarch64-unknown-linux-gnu.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552920"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.linux-arm64-musl"]
-checksum = "sha256:5917d5416884cba0f23c2653016f7f2df2ec04e74eb6b259598fecc066f8c429"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-aarch64-unknown-linux-gnu.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974332"
+checksum = "sha256:aa87b7bfd938a27978d20808df907b192c79b221bad98b1a95e4e3abc1761a4c"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-aarch64-unknown-linux-gnu.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552920"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.linux-x64"]
-checksum = "sha256:c636e4f72b6f40a40ddf0414c8c6056f78b87eea3be0edf01f08d65fa028a373"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-x86_64-unknown-linux-gnu.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974354"
+checksum = "sha256:68f56ad657054afc04fa6f6b75a5752cec60378a046ad4e9441b9a06bd51211e"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-x86_64-unknown-linux-gnu.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552948"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.linux-x64-musl"]
-checksum = "sha256:f0aa9cc8220a84788c6e4a9b6d80422f041659227b680fdef982d5a8ddffddb4"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-x86_64-unknown-linux-musl.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974357"
+checksum = "sha256:505f028a380f16dab50213307d5deb809845633a8a8d4ca2a0df6dd70554c47d"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-x86_64-unknown-linux-musl.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552954"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.macos-arm64"]
-checksum = "sha256:3d8f1ad296d3f3e97122607f7c972393c6329801027acb71bb7d17a4e30ef092"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-aarch64-apple-darwin.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974334"
+checksum = "sha256:40b8a7706e463fcd2df206b5de75d6952a7088c4f8f015f443d4ca2c3446b943"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-aarch64-apple-darwin.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552916"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.macos-x64"]
-checksum = "sha256:f8c746d12dfae79ac0704c5aa13631a05b24c3e4ee7216eb40f70943bd8ca7b1"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-x86_64-apple-darwin.tar.xz"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974346"
+checksum = "sha256:44eb9ca250104d11b5e09c388a38c4255b455a71518151f5a37d963bd376c8d4"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-x86_64-apple-darwin.tar.xz"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552938"
 
 [tools."github:rust-cross/cargo-zigbuild"."platforms.windows-x64"]
-checksum = "sha256:82ff1207be9e9533267b83dbe33d0b16b30043f116dc336d9a526667fa27622a"
-url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.0/cargo-zigbuild-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/450974351"
+checksum = "sha256:fd78b74953eff30b67ad91947aea8b4c449fb1761b6658dd672706e894e1cb5c"
+url = "https://github.com/rust-cross/cargo-zigbuild/releases/download/v0.23.2/cargo-zigbuild-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/rust-cross/cargo-zigbuild/releases/assets/527552946"
 
 [[tools."github:rust-secure-code/cargo-auditable"]]
 version = "0.7.5"
@@ -800,73 +800,73 @@ url = "https://github.com/rust-secure-code/cargo-auditable/releases/download/v0.
 url_api = "https://api.github.com/repos/rust-secure-code/cargo-auditable/releases/assets/426566657"
 
 [[tools.hk]]
-version = "1.54.0"
+version = "1.56.1"
 backend = "aqua:jdx/hk"
 
 [tools.hk."platforms.linux-arm64"]
-checksum = "sha256:79458d7464bbdf63cd578ef9ece71003d3e53a993f9fa630888b93d3ae24dd79"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037128"
+checksum = "sha256:cd671706a273dac35b012fd585a0fba1b0c0f340558dccfd4c9a4b976a794597"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632120"
 
 [tools.hk."platforms.linux-arm64-musl"]
-checksum = "sha256:c1ad33f83265363440c7fc77656e604532049f038c42d7b8924fc43e5a3b935d"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037132"
+checksum = "sha256:5feac3cfcdae33227197d0104832b91a5d293733320632c3c19f864866a6c8ce"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632119"
 
 [tools.hk."platforms.linux-x64"]
-checksum = "sha256:467f691713b1afbeada4df662bd44696405cd987a5c7f64fee0fe71399628d0c"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037136"
+checksum = "sha256:67157431e36bb523213d8361a9f59b6eb718f80ae8534827849552b3c6c92a04"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632131"
 
 [tools.hk."platforms.linux-x64-musl"]
-checksum = "sha256:ddce69611ce32a08b481dd3ccd5c700b1d535d12c86be784bc6d74b1d6256546"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037135"
+checksum = "sha256:e7435c1aec98f60d98712da3231541987ac67c017c001f767c0f37bd517cfe43"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632133"
 
 [tools.hk."platforms.macos-arm64"]
-checksum = "sha256:54e47c56f64916e63004b68ae848637e3e90d06f89e3ae8de985ebc35fd9f7e7"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037130"
+checksum = "sha256:f8400a1427e66f1b968e58568115a2138b5d0fe88e0561b97d3822648b7e35ea"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632123"
 
 [tools.hk."platforms.windows-x64"]
-checksum = "sha256:ab0f65942c89c72b322c700bf427926f54db84fd2827121eab03287144d2ec64"
-url = "https://github.com/jdx/hk/releases/download/v1.54.0/hk-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/jdx/hk/releases/assets/496037131"
+checksum = "sha256:4ccf353e484997dd4975361b6433f3b2661f5db614f2b382cddcac7eaa74a604"
+url = "https://github.com/jdx/hk/releases/download/v1.56.1/hk-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/jdx/hk/releases/assets/525632118"
 
 [[tools.node]]
-version = "24.19.0"
+version = "24.20.0"
 backend = "core:node"
 
 [tools.node."platforms.linux-arm64"]
-checksum = "sha256:d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f"
-url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-arm64.tar.gz"
+checksum = "sha256:3515603e2487879a39bc75716f1a2affd027500c64ba50e845cf72cb33219013"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.gz"
 
 [tools.node."platforms.linux-arm64-musl"]
-checksum = "sha256:20824e4d35948fae5b337dccef47813b04d8995312f59df7386f2256d9f9ab7e"
-url = "https://unofficial-builds.nodejs.org/download/release/v24.19.0/node-v24.19.0-linux-arm64-musl.tar.gz"
+checksum = "sha256:2c8c507ccb0f20812d9526ba8ca454b1652aadef68fc8bad06f07fb1122dd1ef"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.20.0/node-v24.20.0-linux-arm64-musl.tar.gz"
 
 [tools.node."platforms.linux-x64"]
-checksum = "sha256:f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4"
-url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-linux-x64.tar.gz"
+checksum = "sha256:855d581f8a4eb1a8117e3426de25fe02770592febcfb31369aee1ffbfee9e8ec"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.gz"
 
 [tools.node."platforms.linux-x64-musl"]
-checksum = "sha256:c60223786df14a5d23e220ebb8e60318f5322640a62f90e6d9e54d3a18da532e"
-url = "https://unofficial-builds.nodejs.org/download/release/v24.19.0/node-v24.19.0-linux-x64-musl.tar.gz"
+checksum = "sha256:9ae1399fef4bd8990e15773ce1327b336a20b9e97d8c7549f4f42ca73c43f562"
+url = "https://unofficial-builds.nodejs.org/download/release/v24.20.0/node-v24.20.0-linux-x64-musl.tar.gz"
 
 [tools.node."platforms.macos-arm64"]
-checksum = "sha256:8294b7aa9b03997481c06babf1e8b270c859358f27da57a11509afe537ac381d"
-url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-darwin-arm64.tar.gz"
+checksum = "sha256:40e5607e5ecb3db9192723776da2d75d966260fc74a7a9e731c1bd67dda96bc8"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-darwin-arm64.tar.gz"
 
 [tools.node."platforms.macos-x64"]
-checksum = "sha256:d1b5e999db158c62fe8f7267a4476b035d8bd93b1a605bac24a3f0dd166e3316"
-url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-darwin-x64.tar.gz"
+checksum = "sha256:9e5b2644cf107befb6aefca676b96d3296bc10138096f022ed378d6233ed81f4"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-darwin-x64.tar.gz"
 
 [tools.node."platforms.windows-x64"]
-checksum = "sha256:57f71ab3652e797d84acddc79c81cc9ff1c6ddb2a1974cdb83f00fee9bff4c73"
-url = "https://nodejs.org/dist/v24.19.0/node-v24.19.0-win-x64.zip"
+checksum = "sha256:6cac9ffbca8f6a47091e4b5c772e0606049c3871cb67d900c0cedde630e545ba"
+url = "https://nodejs.org/dist/v24.20.0/node-v24.20.0-win-x64.zip"
 
 [[tools."npm:prettier"]]
-version = "3.6.2"
+version = "3.9.6"
 backend = "npm:prettier"
 
 [[tools."npm:renovate"]]
@@ -881,7 +881,7 @@ version = "5.0.3"
 backend = "pipx:ntia-conformance-checker"
 
 [[tools."pipx:serena-agent"]]
-version = "1.6.1"
+version = "1.7.0"
 backend = "pipx:serena-agent"
 
 [[tools.pkl]]
@@ -924,50 +924,57 @@ url = "https://github.com/apple/pkl/releases/download/0.32.1/pkl-windows-amd64.e
 url_api = "https://api.github.com/repos/apple/pkl/releases/assets/487426668"
 
 [[tools.rust]]
-version = "1.97.1"
+version = "1.98.0"
 backend = "core:rust"
 
 [tools.rust.options]
 components = "clippy,rustfmt"
 
 [[tools.uv]]
-version = "0.8.24"
+version = "0.12.5"
 backend = "aqua:astral-sh/uv"
 
 [tools.uv."platforms.linux-arm64"]
-checksum = "sha256:9526f8b0eddd13f5162c18df5ecf35c21e4f96567d21849750356b60121882df"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366455"
+checksum = "sha256:9bf43b4d1a07665bf64d4c4e710930b382321a785e0eb10aac07f46471f86a31"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850990"
+provenance = "github-attestations"
 
 [tools.uv."platforms.linux-arm64-musl"]
-checksum = "sha256:2b8f7383b19d408c680a74a6dbd41c70976516922234eb0075fd2de67413cf29"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-aarch64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366457"
+checksum = "sha256:8767a0e77f2cd45436401b1b42bf7e9ed5a4a91a74a5305d6fe93249d0f6dbc5"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850993"
+provenance = "github-attestations"
 
 [tools.uv."platforms.linux-x64"]
-checksum = "sha256:db8179fffd97b7557b9a519bae82eaa4f499b02ef546f738a35e74e26c47e6b7"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366492"
+checksum = "sha256:68a509da24b06b4223a1c0175fb5eb5bc79342b76cbeff0cfe51ac3f5b17b6b2"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851093"
+provenance = "github-attestations"
 
 [tools.uv."platforms.linux-x64-musl"]
-checksum = "sha256:b38ce629a8653a6b444b7c1bff2d8b99bdafd274e66a4900c5838051e3d99d26"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-x86_64-unknown-linux-musl.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366495"
+checksum = "sha256:a4742988791c9aeae68c78150d6cba762062ad2a47e53738c2779d2b596bfcdb"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851105"
+provenance = "github-attestations"
 
 [tools.uv."platforms.macos-arm64"]
-checksum = "sha256:5f0d9d14b17ba3f0af4602a7a5a2e4faececf0a9463736cf8e6269c49569b2fa"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366446"
+checksum = "sha256:5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514850968"
+provenance = "github-attestations"
 
 [tools.uv."platforms.macos-x64"]
-checksum = "sha256:b75ccf924654ad168efac2ec6934704b3d6b9cbff1650b35e17fa3d26d2bea1f"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366488"
+checksum = "sha256:b3b2137477cf96c9686ebfb71524614cec780c673fd73e59bce099aef02e70e8"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851078"
+provenance = "github-attestations"
 
 [tools.uv."platforms.windows-x64"]
-checksum = "sha256:5055be7909a844f703c54e8846d14ab676c34be6ea0d969ee74c5747feaedda0"
-url = "https://github.com/astral-sh/uv/releases/download/0.8.24/uv-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/301366490"
+checksum = "sha256:4c4d49d8738847d9b71ba319e49a5688c93eac0fe6204b1df24e98528dddf39a"
+url = "https://github.com/astral-sh/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/514851084"
+provenance = "github-attestations"
 
 [[tools.zig]]
 version = "0.16.0"
@@ -1003,41 +1010,41 @@ checksum = "sha256:68659eb5f1e4eb1437a722f1dd889c5a322c9954607f5edcf337bc3684a75
 url = "https://ziglang.org/download/0.16.0/zig-x86_64-windows-0.16.0.zip"
 
 [[tools.zizmor]]
-version = "1.29.0"
+version = "1.30.0"
 backend = "aqua:zizmorcore/zizmor"
 
 [tools.zizmor."platforms.linux-arm64"]
-checksum = "sha256:415eaa7c0a06479a701b8e44a3e812c1047decc848ec4bede7bd6bbf49f22d20"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.29.0/zizmor-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/498263143"
+checksum = "sha256:018a024d6b6d09733b07f6ef42838d984c23ec04bc9b2acd55f7d67826aeafe5"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.0/zizmor-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/537081734"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-arm64-musl"]
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-x64"]
-checksum = "sha256:dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.29.0/zizmor-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/498263145"
+checksum = "sha256:ec8c95cd800845abb9bbc5f377ec7c57d2eb8e2386a00a201d3a74ee4092e5ed"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.0/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/537081732"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.linux-x64-musl"]
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.macos-arm64"]
-checksum = "sha256:720322fade9e83a9c7953944c438f2ba942636b86b96a8f0e6b15ce94c8a6b6f"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.29.0/zizmor-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/498263141"
+checksum = "sha256:c9c5d83730efb86f2cd71b487605c00a4d63903e4f9458485ed5eac3b1924ab1"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.0/zizmor-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/537081737"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.macos-x64"]
-checksum = "sha256:648b72ab9941a7f2a8d65d7b68a8e76cef789538c8df3a3950384d38423375b0"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.29.0/zizmor-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/498263144"
+checksum = "sha256:343c85c8f709edf14bf3c8781d53574975ecbb2d23c80ed1eab4932ab0a72343"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.0/zizmor-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/537081736"
 provenance = "github-attestations"
 
 [tools.zizmor."platforms.windows-x64"]
-checksum = "sha256:68a6bc6888f10bf0d53658c75885e7c1b7a0588d4c1fbc3f0ca280ad7324bf06"
-url = "https://github.com/zizmorcore/zizmor/releases/download/v1.29.0/zizmor-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/498263142"
+checksum = "sha256:a2fcf298b84d3d8498a3d718bb63f0abe26823bf68a11f0f439620f8f2f878f0"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.0/zizmor-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/537081735"
 provenance = "github-attestations"
diff --git a/mise.toml b/mise.toml
index 2355d565b..daa57114b 100644
--- a/mise.toml
+++ b/mise.toml
@@ -17,11 +17,11 @@
 # (CLOUD-655), so `[tools]` was the one dependency surface with no update lane
 # at all. The floor was pinned to it, so the stale pin froze two crates and
 # rejected a third.
-rust = { version = "1.97.1", components = "rustfmt,clippy" }
-hk = "1.54.0"                                                # git-hook runner (see hk.pkl)
-"aqua:cli/cli" = "2.97"                                      # gh — reads CI checks (repo scope bundles checks-read) and drives PRs; `gh pr checks --watch`
+rust = { version = "1.98.0", components = "rustfmt,clippy" }
+hk = "1.56.1"                                                # git-hook runner (see hk.pkl)
+"aqua:cli/cli" = "2.98.0"                                    # gh — reads CI checks (repo scope bundles checks-read) and drives PRs; `gh pr checks --watch`
 "aqua:EmbarkStudios/cargo-deny" = "0.20"                     # dependency license/advisory policy (deny.toml)
-"aqua:anchore/syft" = "1.51"                                 # SBOM of the tagged source: cargo-deny judges that tree, this inventories it (mise-tasks/sbom.sh)
+"aqua:anchore/syft" = "1.51.1"                               # SBOM of the tagged source: cargo-deny judges that tree, this inventories it (mise-tasks/sbom.sh)
 "aqua:release-plz/release-plz" = "0.3"                       # conventional-commit-driven semver + changelog
 "aqua:jqlang/jq" = "1.7"                                     # JSON for shell tasks — reads the PreToolUse payload in `gh-guard`
 # The measurement instrument for `mise run perf` (CLOUD-207). Batten runs as a
@@ -49,7 +49,7 @@ hk = "1.54.0"                                                # git-hook runner (
 # by a scheduled workflow, deliberately absent from `verify` and from `final`.
 # Unlike cargo-msrv above, this one ships aarch64-unknown-linux-gnu, so a
 # release-asset backend locks every platform `lock-complete` requires.
-"aqua:taiki-e/cargo-llvm-cov" = "0.8.7"
+"aqua:taiki-e/cargo-llvm-cov" = "0.9.0"
 # Repo-practice scoring as a REPORT, never a gate (CLOUD-582), on the same terms
 # coverage holds above. Measured 2026-08-13: this repository scores 5.2/10, and
 # three of the four zero-scores are scorecard disagreeing with choices made
@@ -121,7 +121,7 @@ hk = "1.54.0"                                                # git-hook runner (
 # mise-tasks/ holds real bash programs, so they get the same lint+format
 # treatment Rust gets: shellcheck is their clippy, shfmt their rustfmt.
 "aqua:koalaman/shellcheck" = "0.11.0"
-"aqua:mvdan/sh" = "3.12.0"            # shfmt
+"aqua:mvdan/sh" = "3.13.1"            # shfmt
 # The parallel backend for `test:bats`. The shell suite was 83% of the `ci`
 # job's hk gate and ran strictly serially: 247.01s of 298.87s on run
 # 31531728503, against a 166s cargo chain beside it (CLOUD-386).
@@ -142,11 +142,11 @@ pkl = "0.32.1"                     # evaluates hk.pkl as a check, not only when
 # plugin and `pretty_yaml` are compiled in (`cli/tools/fmt.rs`), so there is no
 # plugin host, no format-time download, and no hash-optional Wasm. That is why
 # it is here and dprint-as-a-host is not (CLOUD-104).
-deno = "2.9.5"
+deno = "2.9.6"
 # prettier formats the Markdown (AGENTS.md, CONTRIBUTING.md). It is the one
 # npm tool here, so node comes with it and nothing else depends on either.
-node = "24"
-"npm:prettier" = "3.6.2"
+node = "24.20.0"
+"npm:prettier" = "3.9.6"
 # The validator for `renovate.json5` (CLOUD-655), wired into the hk `gate` as
 # `mise run renovate-config-validator`. It ships inside the `renovate` package
 # itself — there is no smaller distribution of it — which is why the one npm tool
@@ -231,7 +231,7 @@ zig = "0.16" # the linker for the macOS release build and the darwin-link gate:
 # (CLOUD-281). Prebuilt either way, so its own MSRV never constrains this repo's
 # pin — the property is that nothing here builds it from source, which held at
 # the old 1.85 floor and holds unchanged at the pin the floor now tracks.
-"github:rust-cross/cargo-zigbuild" = "0.23"
+"github:rust-cross/cargo-zigbuild" = "0.23.2"
 # The workspace test runner (CLOUD-813). `github:`, not `ubi:`, for the reason
 # stated three lines above — ubi locks a bare version and no checksum, which is
 # how the one unverified download got in (CLOUD-281). The tag is the whole
@@ -265,12 +265,12 @@ zig = "0.16" # the linker for the macOS release build and the darwin-link gate:
 # because Docker was unavailable in the probe container and an unproven build
 # wrapper does not go into the matrix that shipped six empty releases.
 "github:rust-secure-code/cargo-auditable" = "0.7.5"
-zizmor = "1.29.0"                                   # GitHub Actions static analysis; run via `mise run zizmor` (in `verify` and CI)
-uv = "0.8"                                          # fast Rust installer the pipx: backend uses to fetch Serena
+zizmor = "1.30.0"                                   # GitHub Actions static analysis; run via `mise run zizmor` (in `verify` and CI)
+uv = "0.12.5"                                       # fast Rust installer the pipx: backend uses to fetch Serena
 # Serena's LSP-backed semantic code tools (see .mcp.json). Pinned here — not in
 # .mcp.json — so its version lives with every other tool and lands in mise.lock.
 # The pipx backend installs it with `uv` (present above), keeping the fast resolver.
-"pipx:serena-agent" = "1.6.1"
+"pipx:serena-agent" = "1.7.0"
 # The SBOM conformance checker the `sbom-ntia-*` rows in batten.toml run
 # (CLOUD-580, adopted by CLOUD-279 verdict 1). It answers the question
 # `mise run sbom-check` cannot: that gate asks whether the inventory describes
diff --git a/renovate.json5 b/renovate.json5
index cb71367c9..253191d5e 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -62,7 +62,7 @@
   //
   // Raise the pin, then run `mise run msrv-pin-agreement`, which names every file
   // that disagrees.
-  constraints: { rust: "1.97" },
+  constraints: { rust: "1.98" },
 
   // --- the five keys `ci-local-parity` holds ---------------------------------
   //
@@ -248,5 +248,54 @@
       matchManagers: ["github-actions"],
       groupName: "actions",
     },
+    {
+      // A CEILING AGAINST A STRAY TAG, and the shape is `mise-action-floor`'s
+      // (CLOUD-404) rather than a preference: a denylist against a silent
+      // DOWNGRADE this lane would otherwise land with no human in the loop.
+      //
+      // Measured 2026-08-31 against the upstream repository. `regal`'s newest
+      // RELEASE is `v0.42.0` — commit `bcdaa1dd4125`, 2026-07-16, module
+      // `github.com/open-policy-agent/regal`, `go 1.26`. Its TAG list also
+      // carries `v2.2.2` and `v2.2.3`:
+      //
+      //   v2.2.3  ecf4652a4158  2024-11-25  "Testing versioning"
+      //   v2.2.2  34ba147b59e6  2024-11-25  a codeql-action bump
+      //
+      // Both sit on `github.com/anderseknert/regal` at `go 1.22.5` — the module
+      // path from before the project was donated to open-policy-agent, roughly
+      // twenty months OLDER than v0.42.0. They are the debris of somebody
+      // experimenting with Go's `/vN` module suffix, and the commit subject says
+      // so in as many words.
+      //
+      // Renovate's datasource reads TAGS, so semver ranks `2.2.3` above `0.42.0`
+      // and #494 proposed it as an upgrade. It is a regression to an abandoned
+      // module path.
+      //
+      // WHAT MAKES IT A HAZARD RATHER THAN NOISE. `auto-bot-land.yml` lands a
+      // bot bump on green CI with nobody in the loop, and this repository's Rego
+      // corpus is linted by regal — a twenty-month-older linter would quietly
+      // stop enforcing whatever it had not yet learned. The only thing standing
+      // between the proposal and a landing today is that those tags carry no
+      // release assets, so `mise` cannot resolve them and the install fails.
+      // That is luck, not a gate: a release cut against either tag makes the
+      // downgrade installable and this lane would take it.
+      //
+      // The ceiling is `<1.0.0` rather than a pin, so every real 0.x release
+      // still arrives on its own. Remove it if regal genuinely ships a 1.x or
+      // 2.x from the current module path — the tell is a RELEASE, with assets,
+      // whose `go.mod` reads `github.com/open-policy-agent/regal`.
+      // Spelled as "no major for this package" rather than as an
+      // `allowedVersions` ceiling, and that is not a dodge around `cap-drift` —
+      // it is the claim being made. `cap-drift` pairs an `allowedVersions` rule
+      // with a cap in `Cargo.toml` (CLOUD-593), because for a CRATE a bot
+      // withholding a version the manifest admits is a silent stall. regal is a
+      // `[tools]` entry with no manifest cap to pair with, so that rule would
+      // read as the half-lift it exists to catch. What this row asserts is
+      // narrower and true: regal's major line is spurious, so do not propose one.
+      matchManagers: ["mise"],
+      matchPackageNames: ["aqua:open-policy-agent/regal"],
+      matchUpdateTypes: ["major"],
+      enabled: false,
+    },
   ],
 }