diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96697e5..e620e53 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,5 @@
 ---
-latest_version: 3.2.17
+latest_version: 3.2.18
 released: 2026-05-29
 ---
 
@@ -12,6 +12,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+## [3.2.18] — 2026-05-29 — dependency + size cleanup (reqwest→ureq · serde_yaml_ng · async-stack drop)
+
+- **Perf/size: `reqwest` → `ureq` (blocking sync HTTP).** The 4 GitHub/tarball fetch sites (`update` · `vault-sync`) now use `ureq`, which carries no async runtime. This removes the entire async stack — `tokio` · `hyper` · `h2` · `tower` · `tower-http` · `hyper-rustls` · `tokio-rustls` · `hyper-util` — from the release binary (all pulled in only by reqwest). TLS stays rustls. Result: **−342 KB** binary (3.34 → 3.01 MB) · **−54 crates** (178 → 124) · **~12% faster clean build** (41.0s → 36.2s). Runtime of everyday commands is unchanged — they never made HTTP calls, and these fetch paths are network-bound.
+- **Internal: removed the dead `tokio_helper` runtime shim.** It was reserved for "future async commands (v3.1+ serve)" with zero callers and was the only direct `tokio` user, so dropping it lets the async stack leave entirely. The daemon (v3.3) re-introduces `tokio` deliberately for its async RPC server.
+- **Dep: `serde_yaml` (archived/unmaintained upstream) → `serde_yaml_ng`** via a package-rename alias — an actively-maintained drop-in, zero code changes.
+- **Internal: dropped the unused `clap` `env` feature** (no `#[arg(env)]` anywhere in the tree).
+- **Internal: unified the two `plugin update` text renderers** into one `render_plugin_update_inner`, removing the `PluginUpdateTextData` trait that existed only to make the static renderer generic over a test double (−~80 LOC · Code-Simplifier finding on PR #57).
+- **Internal: renamed `vault_sync::run_silent` + `register_schedule::run_quiet` → both `run_embedded`** — same intent (the embedded-from-plugin-update entry point), now a consistent name (Consistency reviewer finding on PR #57).
+
 ## [3.2.17] — 2026-05-29 — `onebrain update`: refresh Homebrew tap before upgrade + dedicated npm channel
 
 - **Fix: `onebrain update` on a Homebrew install now refreshes the `onebrain-ai/onebrain` tap before `brew upgrade`.** `brew upgrade` does not fetch new formulae, so running `onebrain update` right after a release found a stale local formula, no-op'd ("already installed"), and the post-install version guard then reported the upgrade "may not have taken effect" (a confusing false-ish failure that forced a manual `brew update && brew upgrade onebrain`). The fix git-pulls **only** our tap (not a full `brew update` — stays fast) so the freshly-published formula is visible and the upgrade applies in one `onebrain update`. Best-effort + non-fatal: a refresh failure falls through to `brew upgrade` exactly as before.
diff --git a/Cargo.lock b/Cargo.lock
index 532c66a..e82cf84 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -191,12 +191,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
-
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -392,17 +386,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "displaydoc"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -500,7 +483,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
- "futures-sink",
 ]
 
 [[package]]
@@ -509,12 +491,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
-[[package]]
-name = "futures-io"
-version = "0.3.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
-
 [[package]]
 name = "futures-sink"
 version = "0.3.32"
@@ -534,10 +510,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-core",
- "futures-io",
- "futures-sink",
  "futures-task",
- "memchr",
  "pin-project-lite",
  "slab",
 ]
@@ -577,10 +550,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "wasi",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -590,11 +561,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -733,23 +702,6 @@ dependencies = [
  "pin-project-lite",
  "smallvec",
  "tokio",
- "want",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.27.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
-dependencies = [
- "http",
- "hyper",
- "hyper-util",
- "rustls",
- "tokio",
- "tokio-rustls",
- "tower-service",
- "webpki-roots",
 ]
 
 [[package]]
@@ -758,21 +710,12 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
  "bytes",
- "futures-channel",
- "futures-util",
  "http",
  "http-body",
  "hyper",
- "ipnet",
- "libc",
- "percent-encoding",
  "pin-project-lite",
- "socket2",
  "tokio",
- "tower-service",
- "tracing",
 ]
 
 [[package]]
@@ -799,115 +742,12 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "icu_collections"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
-
-[[package]]
-name = "icu_properties"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
-dependencies = [
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
-
-[[package]]
-name = "icu_provider"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
 [[package]]
 name = "id-arena"
 version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -963,12 +803,6 @@ dependencies = [
  "tempfile",
 ]
 
-[[package]]
-name = "ipnet"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-
 [[package]]
 name = "is-terminal"
 version = "0.4.17"
@@ -1031,12 +865,6 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
-[[package]]
-name = "litemap"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -1052,12 +880,6 @@ version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
-[[package]]
-name = "lru-slab"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
-
 [[package]]
 name = "memchr"
 version = "2.8.0"
@@ -1166,7 +988,7 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
 [[package]]
 name = "onebrain-cache"
-version = "3.2.17"
+version = "3.2.18"
 dependencies = [
  "chrono",
  "onebrain-core",
@@ -1174,12 +996,12 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
 name = "onebrain-cli"
-version = "3.2.17"
+version = "3.2.18"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -1199,16 +1021,15 @@ dependencies = [
  "pretty_assertions",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml_ng",
  "tar",
  "tempfile",
- "tokio",
  "which",
 ]
 
 [[package]]
 name = "onebrain-core"
-version = "3.2.17"
+version = "3.2.18"
 dependencies = [
  "chrono",
  "indexmap",
@@ -1217,14 +1038,14 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml_ng",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
 name = "onebrain-fs"
-version = "3.2.17"
+version = "3.2.18"
 dependencies = [
  "chrono",
  "dirs",
@@ -1239,15 +1060,15 @@ dependencies = [
  "onebrain-core",
  "pretty_assertions",
  "regex",
- "reqwest",
  "semver",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_yaml_ng",
  "sha2",
  "tar",
  "tempfile",
- "thiserror 1.0.69",
+ "thiserror",
+ "ureq",
  "urlencoding",
  "wait-timeout",
  "walkdir",
@@ -1301,15 +1122,6 @@ version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
-[[package]]
-name = "potential_utf"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -1378,61 +1190,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "quinn"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
-dependencies = [
- "bytes",
- "cfg_aliases",
- "pin-project-lite",
- "quinn-proto",
- "quinn-udp",
- "rustc-hash",
- "rustls",
- "socket2",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-proto"
-version = "0.11.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
-dependencies = [
- "bytes",
- "getrandom 0.3.4",
- "lru-slab",
- "rand",
- "ring",
- "rustc-hash",
- "rustls",
- "rustls-pki-types",
- "slab",
- "thiserror 2.0.18",
- "tinyvec",
- "tracing",
- "web-time",
-]
-
-[[package]]
-name = "quinn-udp"
-version = "0.5.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
-dependencies = [
- "cfg_aliases",
- "libc",
- "once_cell",
- "socket2",
- "tracing",
- "windows-sys 0.60.2",
-]
-
 [[package]]
 name = "quote"
 version = "1.0.45"
@@ -1500,7 +1257,7 @@ checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
@@ -1532,46 +1289,6 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
-[[package]]
-name = "reqwest"
-version = "0.12.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -1586,12 +1303,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rustc-hash"
-version = "2.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
-
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -1611,6 +1322,7 @@ version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
+ "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
@@ -1625,7 +1337,6 @@ version = "1.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
 dependencies = [
- "web-time",
  "zeroize",
 ]
 
@@ -1730,10 +1441,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_yaml"
-version = "0.9.34+deprecated"
+name = "serde_yaml_ng"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
 dependencies = [
  "indexmap",
  "itoa",
@@ -1824,12 +1535,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -1853,26 +1558,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
-dependencies = [
- "futures-core",
-]
-
-[[package]]
-name = "synstructure"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "tar"
 version = "0.4.46"
@@ -1909,16 +1594,7 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
-dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -1932,17 +1608,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "thiserror-impl"
-version = "2.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "thread_local"
 version = "1.1.9"
@@ -1952,31 +1617,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "tinystr"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
-dependencies = [
- "displaydoc",
- "zerovec",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
-
 [[package]]
 name = "tokio"
 version = "1.52.3"
@@ -1989,31 +1629,9 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "socket2",
- "tokio-macros",
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "tokio-macros"
-version = "2.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-rustls"
-version = "0.26.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
-dependencies = [
- "rustls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -2027,51 +1645,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tower"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
-dependencies = [
- "futures-core",
- "futures-util",
- "pin-project-lite",
- "sync_wrapper",
- "tokio",
- "tower-layer",
- "tower-service",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
-dependencies = [
- "bitflags 2.11.1",
- "bytes",
- "futures-util",
- "http",
- "http-body",
- "pin-project-lite",
- "tower",
- "tower-layer",
- "tower-service",
- "url",
-]
-
-[[package]]
-name = "tower-layer"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
-
-[[package]]
-name = "tower-service"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
-
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -2091,12 +1664,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "try-lock"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
-
 [[package]]
 name = "typenum"
 version = "1.20.0"
@@ -2146,15 +1713,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
-name = "url"
-version = "2.5.8"
+name = "ureq"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
 dependencies = [
- "form_urlencoded",
- "idna",
+ "base64",
+ "flate2",
+ "log",
  "percent-encoding",
- "serde",
+ "rustls",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
 ]
 
 [[package]]
@@ -2164,10 +1748,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
 [[package]]
-name = "utf8_iter"
-version = "1.0.4"
+name = "utf8-zero"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
 [[package]]
 name = "utf8parse"
@@ -2200,15 +1784,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "want"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
-dependencies = [
- "try-lock",
-]
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -2246,16 +1821,6 @@ dependencies = [
  "wasm-bindgen-shared",
 ]
 
-[[package]]
-name = "wasm-bindgen-futures"
-version = "0.4.71"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96492d0d3ffba25305a7dc88720d250b1401d7edca02cc3bcd50633b424673b8"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.121"
@@ -2322,16 +1887,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "web-sys"
-version = "0.3.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b572dff8bcf38bad0fa19729c89bb5748b2b9b1d8be70cf90df697e3a8f32aa"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
 [[package]]
 name = "web-time"
 version = "1.1.0"
@@ -2477,15 +2032,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -2519,30 +2065,13 @@ dependencies = [
  "windows_aarch64_gnullvm 0.52.6",
  "windows_aarch64_msvc 0.52.6",
  "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
+ "windows_i686_gnullvm",
  "windows_i686_msvc 0.52.6",
  "windows_x86_64_gnu 0.52.6",
  "windows_x86_64_gnullvm 0.52.6",
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows-targets"
-version = "0.53.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.1",
- "windows_aarch64_msvc 0.53.1",
- "windows_i686_gnu 0.53.1",
- "windows_i686_gnullvm 0.53.1",
- "windows_i686_msvc 0.53.1",
- "windows_x86_64_gnu 0.53.1",
- "windows_x86_64_gnullvm 0.53.1",
- "windows_x86_64_msvc 0.53.1",
-]
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -2555,12 +2084,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -2573,12 +2096,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -2591,24 +2108,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
-
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -2621,12 +2126,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -2639,12 +2138,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -2657,12 +2150,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -2675,12 +2162,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
-
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
@@ -2775,12 +2256,6 @@ dependencies = [
  "wasmparser",
 ]
 
-[[package]]
-name = "writeable"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
-
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -2797,29 +2272,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe53a6657fd280eaa890a3bc59152892ffa3e30101319d168b781ed6529b049"
 
-[[package]]
-name = "yoke"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
 [[package]]
 name = "zerocopy"
 version = "0.8.48"
@@ -2840,66 +2292,12 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
-
 [[package]]
 name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
 
-[[package]]
-name = "zerotrie"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.21"
diff --git a/Cargo.toml b/Cargo.toml
index d2e7ec2..8297315 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ default-members = ["crates/*"]
 resolver = "2"
 
 [workspace.package]
-version = "3.2.17"
+version = "3.2.18"
 edition = "2021"
 license = "AGPL-3.0-only"
 authors = ["OneBrain Contributors"]
@@ -19,15 +19,12 @@ onebrain-cache = { path = "crates/onebrain-cache" }
 
 # Foundation (Slice 1)
 serde       = { version = "1", features = ["derive"] }
-serde_yaml  = "0.9"
+serde_yaml  = { package = "serde_yaml_ng", version = "0.10" }
 serde_json  = { version = "1", features = ["preserve_order"] }
 thiserror   = "1"
 anyhow      = "1"
 chrono      = { version = "0.4", features = ["serde"] }
-clap        = { version = "4", features = ["derive", "env"] }
-
-# v3.1 forward-compat (binary only)
-tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
+clap        = { version = "4", features = ["derive"] }
 
 # Filesystem (Slice 1 partial · used by count_unembedded)
 walkdir   = "2"
@@ -43,7 +40,14 @@ wait-timeout = "0.2"
 semver    = "1"
 
 # HTTP client (Slice 11 · update · GitHub releases API · Slice 13 · vault-sync tarball)
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "blocking"] }
+# v3.2.18: reqwest → ureq. ureq is a blocking, synchronous client, so swapping it
+# in drops the entire async stack (tokio · hyper · h2 · tower · tower-http ·
+# hyper-rustls · hyper-util) from the release binary — these were pulled in ONLY
+# by reqwest. TLS still rustls (ureq default features: rustls + ring + webpki-roots
+# + gzip). JSON is parsed via the existing serde_json dep, so ureq's `json` feature
+# is left off. The daemon (v3.3) re-introduces tokio deliberately for its async
+# RPC server — keeping it out of the one-shot CLI hot path until then.
+ureq = "3"
 
 # SHA-256 verification of the self-update binary (v3.1.4 · onebrain-fs update install path)
 sha2 = "0.10"
diff --git a/crates/onebrain-cli/Cargo.toml b/crates/onebrain-cli/Cargo.toml
index 5abad68..38b32a9 100644
--- a/crates/onebrain-cli/Cargo.toml
+++ b/crates/onebrain-cli/Cargo.toml
@@ -21,7 +21,6 @@ serde_yaml     = { workspace = true }
 serde_json     = { workspace = true }
 anyhow         = { workspace = true }
 chrono         = { workspace = true }
-tokio          = { workspace = true }
 which          = { workspace = true }
 dirs           = { workspace = true }
 indicatif      = { workspace = true }
diff --git a/crates/onebrain-cli/src/commands/register_schedule.rs b/crates/onebrain-cli/src/commands/register_schedule.rs
index b5d2b1b..29a3635 100644
--- a/crates/onebrain-cli/src/commands/register_schedule.rs
+++ b/crates/onebrain-cli/src/commands/register_schedule.rs
@@ -55,7 +55,7 @@ pub fn run(
 /// Returns `Ok(0)` when `onebrain.yml` has no `schedule:` entries (a
 /// well-formed no-op, NOT an error). `Ok(N)` where `N == entries.len()`
 /// on a successful registration pass. Errors bubble up via `?` as usual.
-pub fn run_quiet(vault: Option<PathBuf>, dry_run: bool, refresh: bool) -> Result<usize> {
+pub fn run_embedded(vault: Option<PathBuf>, dry_run: bool, refresh: bool) -> Result<usize> {
     run_with(vault, dry_run, false, refresh, None, false, None, true)
 }
 
diff --git a/crates/onebrain-cli/src/commands/vault_sync.rs b/crates/onebrain-cli/src/commands/vault_sync.rs
index 9938931..0c63315 100644
--- a/crates/onebrain-cli/src/commands/vault_sync.rs
+++ b/crates/onebrain-cli/src/commands/vault_sync.rs
@@ -33,18 +33,20 @@ pub fn run(vault_root_override: Option<PathBuf>, branch: Option<String>) -> Resu
 
 /// Same as [`run`] but routes the per-step progress reporter to
 /// `std::io::sink()` — so neither the "OneBrain Vault Sync" intro/outro
-/// frame nor the per-step `▸ <label>` lines leak. Used by `onebrain plugin
-/// update` (v3.2.15+), which renders its own framed doctor-style report;
-/// the framed report's animated spinner is the only progress signal the
-/// user sees, matching `doctor`/`update`.
+/// frame nor the per-step `▸ <label>` lines leak. This is the entry point
+/// `onebrain plugin update` (v3.2.15+) calls to embed vault-sync inside its
+/// own framed doctor-style report; the framed report's animated spinner is
+/// the only progress signal the user sees, matching `doctor`/`update`. The
+/// `register_schedule` sibling shares the `run_embedded` name (v3.2.18) so
+/// both plugin-update entry points read consistently.
 ///
-/// (v3.2.13 introduced `run_embedded` for the intro-only suppression; v3.2.15
-/// folded that into the silent path because no remaining caller wanted the
-/// in-between "embedded but with step lines" mode. v3.2.15 round-2 also
-/// dropped the now-dead `embedded` flag from the inner shape — the
-/// orchestrator only consults it when `progress_writer` is `None`, and the
-/// silent path always sets the writer to a sink.)
-pub fn run_silent(vault_root_override: Option<PathBuf>, branch: Option<String>) -> Result<i32> {
+/// (History: v3.2.13 had a separate intro-only-suppression variant under this
+/// name; v3.2.15 folded it into the fully-silent path because no remaining
+/// caller wanted the in-between "embedded but with step lines" mode, and
+/// round-2 dropped the now-dead `embedded` flag from the inner shape — the
+/// orchestrator only consults it when `progress_writer` is `None`, and this
+/// path always sets the writer to a sink.)
+pub fn run_embedded(vault_root_override: Option<PathBuf>, branch: Option<String>) -> Result<i32> {
     run_with(vault_root_override, branch, true)
 }
 
diff --git a/crates/onebrain-cli/src/main.rs b/crates/onebrain-cli/src/main.rs
index 0cc570e..10c8e3b 100644
--- a/crates/onebrain-cli/src/main.rs
+++ b/crates/onebrain-cli/src/main.rs
@@ -11,7 +11,6 @@ mod legacy_output;
 mod migration;
 mod output;
 mod safety;
-mod tokio_helper;
 mod v31;
 mod vault_ctx;
 
diff --git a/crates/onebrain-cli/src/tokio_helper.rs b/crates/onebrain-cli/src/tokio_helper.rs
deleted file mode 100644
index 3876ed9..0000000
--- a/crates/onebrain-cli/src/tokio_helper.rs
+++ /dev/null
@@ -1,16 +0,0 @@
-//! On-demand tokio runtime · used only by future async commands (v3.1+ serve, gateways).
-//!
-//! v3.0 commands are sync. This module exists so adding `Cmd::Serve` in v3.1 does NOT
-//! require restructuring main.rs.
-
-#[allow(dead_code)] // wired in v3.1
-pub fn run_async<F>(future: F) -> F::Output
-where
-    F: std::future::Future,
-{
-    tokio::runtime::Builder::new_multi_thread()
-        .enable_all()
-        .build()
-        .expect("failed to build tokio runtime")
-        .block_on(future)
-}
diff --git a/crates/onebrain-cli/src/v31/dispatch.rs b/crates/onebrain-cli/src/v31/dispatch.rs
index e511fe6..3c1b0e8 100644
--- a/crates/onebrain-cli/src/v31/dispatch.rs
+++ b/crates/onebrain-cli/src/v31/dispatch.rs
@@ -613,8 +613,57 @@ fn render_plugin_update_animated(
 pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
     report: &plugin_update::PluginUpdateReport,
     mode: &OutputMode,
-    mut writer: W,
+    writer: W,
     step_delay_override: Option<std::time::Duration>,
+) -> Result<()> {
+    // Animated path: `force_static = false` → the per-step braille spinner
+    // animates before each row resolves. Shares the whole render body with the
+    // static text path via `render_plugin_update_inner` (v3.2.18).
+    let fields = PluginUpdateFields {
+        vault_synced: report.vault_synced,
+        hooks_rewritten: report.hooks_rewritten,
+        plists_rewritten: report.plists_rewritten,
+        plists_count: report.plists_count,
+        version_before: report.version_before.as_deref(),
+        version_after: report.version_after.as_deref(),
+        dry_run: report.dry_run,
+        partial_failure: report.partial_failure.as_deref(),
+    };
+    render_plugin_update_inner(writer, &fields, mode, false, step_delay_override)
+}
+
+/// Plain, borrow-only view of the fields the `plugin update` renderer needs.
+/// Built from either the live [`plugin_update::PluginUpdateReport`] (animated
+/// path) or the serialized [`PluginUpdateData`] envelope payload (static text
+/// path), so [`render_plugin_update_inner`] stays agnostic to its data source.
+/// Replaces the old `PluginUpdateTextData` trait (v3.2.18 · Code-Simplifier
+/// finding 1.2/1.3 on PR #57 — the trait existed only to make the static
+/// renderer generic over a test double, which a plain struct does for free).
+struct PluginUpdateFields<'a> {
+    vault_synced: bool,
+    hooks_rewritten: u32,
+    plists_rewritten: bool,
+    plists_count: Option<u32>,
+    version_before: Option<&'a str>,
+    version_after: Option<&'a str>,
+    dry_run: bool,
+    partial_failure: Option<&'a str>,
+}
+
+/// Shared body for both `plugin update` text surfaces (v3.2.18 · unifies the
+/// former `render_plugin_update_text` + `render_plugin_update_animated_to`).
+/// `force_static = true` suppresses the per-step braille spinner (the static
+/// text-mode report rendered into a buffer); `false` animates each step (the
+/// live stdout path). `step_delay` overrides the per-step dwell — `Some(ZERO)`
+/// in unit tests so the animated branch runs without sleeping. The header,
+/// step list, and verdict footer are byte-identical across both modes; only
+/// the per-step spinner overlay differs.
+fn render_plugin_update_inner<W: std::io::Write>(
+    mut writer: W,
+    f: &PluginUpdateFields<'_>,
+    mode: &OutputMode,
+    force_static: bool,
+    step_delay: Option<std::time::Duration>,
 ) -> Result<()> {
     use crate::output::{
         framing_rule_n, is_color_text, write_framed_header, ProgressRenderer, Section, Step,
@@ -626,26 +675,25 @@ pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
     let dim = if color { "\x1b[2m" } else { "" };
     let reset = if color { "\x1b[0m" } else { "" };
 
-    // ── Header (no animation — same as static path) ───────────────────
+    // ── Header ────────────────────────────────────────────────────────
     write_framed_header(&mut writer, "🔄", "Plugin Update", color, rule_width)?;
 
-    // ── Step list (animated) ──────────────────────────────────────────
-    // Same per-step Ok/Fail mapping as the static `render_plugin_update_text`
-    // path. The visible difference is purely the rendering side: each step
-    // shows the braille spinner with its label for ~800–2000ms before the
-    // `\r`-clear-and-resolve transition — matches `doctor`/`update`.
-    let partial_failed = report.partial_failure.is_some();
-    let vault_detail = plugin_update_vault_detail(
-        report.vault_synced,
-        report.dry_run,
-        report.version_before.as_deref(),
-        report.version_after.as_deref(),
-    );
-    let hooks_detail = format!("{} rewritten", report.hooks_rewritten);
+    // ── Step list ─────────────────────────────────────────────────────
+    // v3.2.13: when `partial_failure` is set, mark the launchd-plist step as
+    // `Fail` so the per-step glyph matches the verdict (pre-3.2.13 it stayed
+    // `Ok` and silently misrepresented the failed step as succeeded). The
+    // plist re-registration is the only step that can populate it today.
+    let partial_failed = f.partial_failure.is_some();
+    let vault_detail =
+        plugin_update_vault_detail(f.vault_synced, f.dry_run, f.version_before, f.version_after);
+    let hooks_detail = format!("{} rewritten", f.hooks_rewritten);
+    // `plists_count` (v3.2.13): `Some(N>0)` → N refreshed; `Some(0)` → vault
+    // has no schedule entries (well-formed no-op); `None` → step didn't run
+    // (dry-run, or a prior step failed).
     let plists_detail = if partial_failed {
         "failed".to_string()
     } else {
-        match report.plists_count {
+        match f.plists_count {
             Some(0) => "no schedule entries".to_string(),
             Some(n) => format!("{n} refreshed"),
             None => "skipped".to_string(),
@@ -657,34 +705,23 @@ pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
         StepStatus::Ok
     };
     let steps = vec![
-        Step::new(
-            "vault sync",
-            StepStatus::Ok,
-            Some(vault_detail.to_string()),
-            None,
-        ),
+        Step::new("vault sync", StepStatus::Ok, Some(vault_detail), None),
         Step::new("hooks", StepStatus::Ok, Some(hooks_detail), None),
         Step::new("launchd plists", plists_status, Some(plists_detail), None),
     ];
-    let section_header = if report.dry_run {
+    let section_header = if f.dry_run {
         "Update plan (dry-run)"
     } else {
         "Update steps"
     };
     let section = Section::new(section_header, steps);
-    // `force_static = false` → spinner animates per step.
-    let mut renderer = ProgressRenderer::with_writer(&mut writer, false, color);
-    if let Some(d) = step_delay_override {
+    let mut renderer = ProgressRenderer::with_writer(&mut writer, force_static, color);
+    if let Some(d) = step_delay {
         renderer.set_step_delay(d);
     }
     renderer.render_section(&section)?;
 
     // ── Verdict footer ────────────────────────────────────────────────
-    // Reuse the static path's footer rendering by manually replicating it
-    // against the live writer — keeps the two surfaces byte-identical except
-    // for the spinner artifacts. The footer doesn't need animation: doctor's
-    // own footer is static, and the user has already absorbed the spinner
-    // pacing across the three step rows.
     let verdict_status = if partial_failed {
         StepStatus::Fail
     } else {
@@ -694,15 +731,16 @@ pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
     let verdict_prefix = verdict_status.ansi_prefix(color);
     let verdict_text = plugin_update_verdict_text(
         partial_failed,
-        report.dry_run,
-        report.vault_synced,
-        report.hooks_rewritten,
-        report.plists_rewritten,
-        report.version_before.as_deref(),
-        report.version_after.as_deref(),
+        f.dry_run,
+        f.vault_synced,
+        f.hooks_rewritten,
+        f.plists_rewritten,
+        f.version_before,
+        f.version_after,
     );
+    // Trailing count right-aligned to the rule width (matches doctor's layout).
     let total_str = "3 steps";
-    let left_cols = 1 + 1 + 2 + verdict_text.chars().count();
+    let left_cols = 1 + 1 + 2 + verdict_text.chars().count(); // " ✓  " + text
     let gap = rule_width
         .saturating_sub(left_cols + total_str.chars().count())
         .max(2);
@@ -714,7 +752,9 @@ pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
         " {verdict_prefix}{verdict_glyph}{reset}  {verdict_text}{pad}{total_str}",
         pad = " ".repeat(gap),
     )?;
-    if let Some(reason) = report.partial_failure.as_deref() {
+    // Failure hint — indented `└` line; multi-line reasons flattened to ` · `
+    // so the indented layout stays intact.
+    if let Some(reason) = f.partial_failure {
         let one_line = reason.replace('\n', " · ");
         if color {
             writeln!(writer, " {dim}└ {one_line}{reset}")?;
@@ -722,17 +762,12 @@ pub(crate) fn render_plugin_update_animated_to<W: std::io::Write>(
             writeln!(writer, " └ {one_line}")?;
         }
     }
-    // R6: surface the reload next-step whenever a real version change landed —
-    // INDEPENDENT of partial_failed. `version_after` is read post-sync, so the
-    // new version is already on disk; a later schedule-step failure doesn't
-    // un-land it, and the running session still holds the old one. Suppressing
-    // the hint on partial failure would lose the guidance exactly when the user
-    // most needs it.
-    if let Some(hint) = plugin_update_reload_hint(
-        report.dry_run,
-        report.version_before.as_deref(),
-        report.version_after.as_deref(),
-    ) {
+    // R6: reload next-step fires on a real version change regardless of partial
+    // failure — `version_after` is read post-sync, so the new version already
+    // landed on disk and the running session still holds the old one.
+    // Suppressing the hint on partial failure would lose it exactly when the
+    // user most needs it.
+    if let Some(hint) = plugin_update_reload_hint(f.dry_run, f.version_before, f.version_after) {
         if color {
             writeln!(writer, " {dim}↻ {hint}{reset}")?;
         } else {
@@ -881,33 +916,6 @@ struct PluginUpdateData<'a> {
     partial_failure: Option<&'a str>,
 }
 
-impl<'a> PluginUpdateTextData for PluginUpdateData<'a> {
-    fn vault_synced(&self) -> bool {
-        self.vault_synced
-    }
-    fn hooks_rewritten(&self) -> u32 {
-        self.hooks_rewritten
-    }
-    fn plists_rewritten(&self) -> bool {
-        self.plists_rewritten
-    }
-    fn plists_count(&self) -> Option<u32> {
-        self.plists_count
-    }
-    fn version_before(&self) -> Option<&str> {
-        self.version_before
-    }
-    fn version_after(&self) -> Option<&str> {
-        self.version_after
-    }
-    fn dry_run(&self) -> bool {
-        self.dry_run
-    }
-    fn partial_failure(&self) -> Option<&str> {
-        self.partial_failure
-    }
-}
-
 /// Same as [`emit_plugin_update_summary`] but with an injectable writer for
 /// unit tests. R2-M4: the broken-pipe regression test feeds a writer that
 /// always returns `io::ErrorKind::BrokenPipe`; the function must surface the
@@ -988,157 +996,34 @@ pub(crate) fn emit_plugin_update_summary_to<W: std::io::Write>(
 /// Partial-failure path replaces the verdict glyph with `✗` and prepends an
 /// indented `└ <reason>` hint line under the failing step's row (closest to
 /// doctor's warn/fail rendering).
-fn render_plugin_update_text<D>(env: &crate::output::Envelope<D>, mode: &OutputMode) -> String
-where
-    D: PluginUpdateTextData + serde::Serialize,
-{
-    use crate::output::{
-        framing_rule_n, is_color_text, write_framed_header, ProgressRenderer, Section, Step,
-        StepStatus, RULE_WIDTH,
-    };
-    use std::io::Write;
-
+fn render_plugin_update_text(
+    env: &crate::output::Envelope<PluginUpdateData<'_>>,
+    mode: &OutputMode,
+) -> String {
     let d = match env.data.as_ref() {
         Some(d) => d,
         None => return String::new(),
     };
-    let color = is_color_text(mode);
-    let rule_width = RULE_WIDTH;
-    let dim = if color { "\x1b[2m" } else { "" };
-    let reset = if color { "\x1b[0m" } else { "" };
-    let mut buf: Vec<u8> = Vec::new();
-
-    // ── Header ────────────────────────────────────────────────────────
-    let _ = write_framed_header(&mut buf, "🔄", "Plugin Update", color, rule_width);
-
-    // ── Step list ─────────────────────────────────────────────────────
-    // Today the only step that can populate `partial_failure` is the launchd
-    // plist re-registration (see `plugin_update::run` step 4 — vault-sync
-    // and hook-rewriter errors bubble as `Err` instead of leaving on-disk
-    // state half-applied). v3.2.13: when `partial_failure` is set we mark
-    // the plist step as `Fail` so the per-step glyph matches the verdict —
-    // pre-3.2.13 it stayed `Ok` and silently misrepresented the failed step
-    // as succeeded.
-    let partial_failed = d.partial_failure().is_some();
-    let vault_detail = plugin_update_vault_detail(
-        d.vault_synced(),
-        d.dry_run(),
-        d.version_before(),
-        d.version_after(),
-    );
-    let hooks_detail = format!("{} rewritten", d.hooks_rewritten());
-    // `plists_count` (v3.2.13): `Some(N>0)` → N refreshed; `Some(0)` →
-    // vault has no schedule entries (well-formed no-op); `None` → step
-    // didn't run (dry-run, or a prior step failed). Distinguishes the cases
-    // the pre-3.2.13 bool collapsed into a single "done"/"skipped".
-    let plists_detail = if partial_failed {
-        "failed".to_string()
-    } else {
-        match d.plists_count() {
-            Some(0) => "no schedule entries".to_string(),
-            Some(n) => format!("{n} refreshed"),
-            None => "skipped".to_string(),
-        }
-    };
-    let plists_status = if partial_failed {
-        StepStatus::Fail
-    } else {
-        StepStatus::Ok
-    };
-    let steps = vec![
-        Step::new("vault sync", StepStatus::Ok, Some(vault_detail), None),
-        Step::new("hooks", StepStatus::Ok, Some(hooks_detail), None),
-        Step::new("launchd plists", plists_status, Some(plists_detail), None),
-    ];
-    let header = if d.dry_run() {
-        "Update plan (dry-run)"
-    } else {
-        "Update steps"
-    };
-    let section = Section::new(header, steps);
-    // `force_static = true` — no spinner for `plugin update`; the operation
-    // is fast (single HTTP fetch + a few file writes) and the user already
-    // sees doctor-level animation elsewhere. Skip the artificial pacing.
-    let mut renderer = ProgressRenderer::with_writer(&mut buf, true, color);
-    let _ = renderer.render_section(&section);
-
-    // ── Verdict footer ────────────────────────────────────────────────
-    let _ = writeln!(buf);
-    let rule = framing_rule_n(rule_width);
-    let _ = writeln!(buf, "{dim}{rule}{reset}");
-    let verdict_status = if d.partial_failure().is_some() {
-        StepStatus::Fail
-    } else {
-        StepStatus::Ok
+    let fields = PluginUpdateFields {
+        vault_synced: d.vault_synced,
+        hooks_rewritten: d.hooks_rewritten,
+        plists_rewritten: d.plists_rewritten,
+        plists_count: d.plists_count,
+        version_before: d.version_before,
+        version_after: d.version_after,
+        dry_run: d.dry_run,
+        partial_failure: d.partial_failure,
     };
-    let verdict_glyph = verdict_status.glyph();
-    let verdict_prefix = verdict_status.ansi_prefix(color);
-    let verdict_text = plugin_update_verdict_text(
-        partial_failed,
-        d.dry_run(),
-        d.vault_synced(),
-        d.hooks_rewritten(),
-        d.plists_rewritten(),
-        d.version_before(),
-        d.version_after(),
-    );
-    // Trailing count right-aligned to the rule width (matches doctor's
-    // " ✓  N ok · M warn · K fail              N checks" layout).
-    let total_str = "3 steps";
-    let left_cols = 1 + 1 + 2 + verdict_text.chars().count(); // " ✓  " + text
-    let gap = rule_width
-        .saturating_sub(left_cols + total_str.chars().count())
-        .max(2);
-    let _ = writeln!(
-        buf,
-        " {verdict_prefix}{verdict_glyph}{reset}  {verdict_text}{pad}{total_str}",
-        pad = " ".repeat(gap),
-    );
-    // Failure hint — indented `└` line, doctor-style. Multi-line `reason`
-    // strings (deep anyhow chains can include newlines via `{:#}`) get
-    // flattened to ` · ` so the indented layout stays intact — without this
-    // the second line would have no `└ ` prefix and break the visual frame.
-    if let Some(reason) = d.partial_failure() {
-        let one_line = reason.replace('\n', " · ");
-        if color {
-            let _ = writeln!(buf, " {dim}└ {one_line}{reset}");
-        } else {
-            let _ = writeln!(buf, " └ {one_line}");
-        }
-    }
-    // R6: same reload next-step as the animated path (shared helper); fires on
-    // a real version change regardless of partial_failed — the version already
-    // landed on disk, so the running session needs a reload either way.
-    if let Some(hint) =
-        plugin_update_reload_hint(d.dry_run(), d.version_before(), d.version_after())
-    {
-        if color {
-            let _ = writeln!(buf, " {dim}↻ {hint}{reset}");
-        } else {
-            let _ = writeln!(buf, " ↻ {hint}");
-        }
-    }
-    let _ = writeln!(buf, "{dim}{rule}{reset}");
-
+    // Static text mode: `force_static = true` — no spinner for `plugin
+    // update`; the operation is fast (single HTTP fetch + a few file writes)
+    // and the user already sees doctor-level animation elsewhere. Render into
+    // a buffer and hand the string back to `emit` — writes to a `Vec` never
+    // fail, so the `io::Result` is safely discarded here.
+    let mut buf: Vec<u8> = Vec::new();
+    let _ = render_plugin_update_inner(&mut buf, &fields, mode, true, None);
     String::from_utf8(buf).unwrap_or_default()
 }
 
-/// Read-only view of the typed `plugin update` envelope payload — narrowing
-/// the renderer's coupling to the module-level [`PluginUpdateData`] struct.
-/// Lets the renderer stay generic over any payload that provides the same
-/// shape (used by the unit tests; production always goes through the real
-/// `PluginUpdateData` instance built in [`emit_plugin_update_summary_to`]).
-trait PluginUpdateTextData {
-    fn vault_synced(&self) -> bool;
-    fn hooks_rewritten(&self) -> u32;
-    fn plists_rewritten(&self) -> bool;
-    fn plists_count(&self) -> Option<u32>;
-    fn version_before(&self) -> Option<&str>;
-    fn version_after(&self) -> Option<&str>;
-    fn dry_run(&self) -> bool;
-    fn partial_failure(&self) -> Option<&str>;
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1433,7 +1318,7 @@ mod tests {
     #[test]
     fn plugin_update_text_no_schedule_entries_renders_distinct_detail() {
         // Round-2 review HIGH-1: a vault with zero `schedule:` entries
-        // returns `Ok(0)` from `register_schedule::run_quiet` — a well-formed
+        // returns `Ok(0)` from `register_schedule::run_embedded` — a well-formed
         // no-op. The plist step must render as "no schedule entries" rather
         // than the misleading "done" the pre-Round-2 bool collapse produced.
         let report = plugin_update::PluginUpdateReport {
diff --git a/crates/onebrain-cli/src/v31/plugin_update.rs b/crates/onebrain-cli/src/v31/plugin_update.rs
index bd9af15..4c28179 100644
--- a/crates/onebrain-cli/src/v31/plugin_update.rs
+++ b/crates/onebrain-cli/src/v31/plugin_update.rs
@@ -95,14 +95,14 @@ pub fn run(
     //    v3.2.13: invoke via the embedded-progress entry so the orchestrator
     //    skips its "OneBrain Vault Sync" intro frame and "vault-sync: done"
     //    outro.
-    //    v3.2.15: ALSO route through `run_silent` so the per-step `▸ <label>`
+    //    v3.2.15: ALSO route through `run_embedded` so the per-step `▸ <label>`
     //    TTY lines don't leak above the parent's framed report (user testing
     //    on v3.2.14 flagged "ไม่มี header เลย" — the step lines appeared
     //    BEFORE the parent's `🔄  Plugin Update` header). The framed report's
     //    animated spinner is the only progress signal, matching what
     //    `doctor`/`update` already do.
     if !dry_run {
-        let exit = crate::commands::vault_sync::run_silent(Some(vault_root.clone()), branch)
+        let exit = crate::commands::vault_sync::run_embedded(Some(vault_root.clone()), branch)
             .context("plugin update: vault-sync failed")?;
         // `vault_sync::run` returns Ok(0) on success, Ok(1) on critical fail.
         if exit != 0 {
@@ -135,12 +135,12 @@ pub fn run(
     //    we surface this as a partial failure rather than bubbling Err, so
     //    the dispatcher can render the partial state in the envelope.
     //
-    //    v3.2.13: use the `run_quiet` entry so the per-plist `✓ Wrote …`
+    //    v3.2.13: use the `run_embedded` entry so the per-plist `✓ Wrote …`
     //    confirmation lines and the trailing "Use launchctl to load …" hint
     //    don't leak through plugin update's framed report — those belong on
     //    the direct `onebrain schedule register` surface, not embedded.
     if !dry_run {
-        match crate::commands::register_schedule::run_quiet(
+        match crate::commands::register_schedule::run_embedded(
             Some(vault_root),
             /* dry_run */ false,
             /* refresh */ true,
diff --git a/crates/onebrain-fs/Cargo.toml b/crates/onebrain-fs/Cargo.toml
index 334131f..983afbe 100644
--- a/crates/onebrain-fs/Cargo.toml
+++ b/crates/onebrain-fs/Cargo.toml
@@ -20,7 +20,7 @@ globset       = { workspace = true }
 which         = { workspace = true }
 wait-timeout  = { workspace = true }
 semver        = { workspace = true }
-reqwest       = { workspace = true }
+ureq          = { workspace = true }
 sha2          = { workspace = true }
 indexmap      = { workspace = true }
 inquire       = { workspace = true }
diff --git a/crates/onebrain-fs/src/update/install.rs b/crates/onebrain-fs/src/update/install.rs
index c3fa497..88009fa 100644
--- a/crates/onebrain-fs/src/update/install.rs
+++ b/crates/onebrain-fs/src/update/install.rs
@@ -187,22 +187,25 @@ impl AssetInfo {
 }
 
 fn download_archive(url: &str) -> Result<Vec<u8>, UpdateError> {
-    let client = reqwest::blocking::Client::builder()
-        .timeout(std::time::Duration::from_secs(DOWNLOAD_TIMEOUT_SECS))
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .timeout_global(Some(std::time::Duration::from_secs(DOWNLOAD_TIMEOUT_SECS)))
         .user_agent("onebrain-cli-update")
         .build()
-        .map_err(|e| UpdateError::Network(format!("build http client: {e}")))?;
-    let mut resp = client
-        .get(url)
-        .send()
-        .map_err(|e| UpdateError::Network(format!("GET {url}: {e}")))?;
-    if !resp.status().is_success() {
-        return Err(UpdateError::GithubStatus(resp.status().as_u16()));
+        .into();
+    // ureq surfaces 4xx/5xx as `Err(StatusCode)`; an `Ok` is already 2xx. The
+    // release archive is several MB, so stream it through `into_reader()`
+    // (no size cap) rather than the limited `read_to_vec()`.
+    match agent.get(url).call() {
+        Ok(resp) => {
+            let mut reader = resp.into_body().into_reader();
+            let mut buf = Vec::with_capacity(8 * 1024 * 1024);
+            std::io::Read::read_to_end(&mut reader, &mut buf)
+                .map_err(|e| UpdateError::Network(format!("read body: {e}")))?;
+            Ok(buf)
+        }
+        Err(ureq::Error::StatusCode(code)) => Err(UpdateError::GithubStatus(code)),
+        Err(e) => Err(UpdateError::Network(format!("GET {url}: {e}"))),
     }
-    let mut buf = Vec::with_capacity(8 * 1024 * 1024);
-    resp.copy_to(&mut buf)
-        .map_err(|e| UpdateError::Network(format!("read body: {e}")))?;
-    Ok(buf)
 }
 
 fn extract_tar_gz(archive_bytes: &[u8], target_name: &str) -> Result<Vec<u8>, UpdateError> {
@@ -403,23 +406,21 @@ fn sha256_hex(bytes: &[u8]) -> String {
 /// `.sha256` sidecar. A missing sidecar is a `Checksum` error (we cannot
 /// verify, so we must refuse), not a generic network error.
 fn download_text(url: &str) -> Result<String, UpdateError> {
-    let client = reqwest::blocking::Client::builder()
-        .timeout(std::time::Duration::from_secs(DOWNLOAD_TIMEOUT_SECS))
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .timeout_global(Some(std::time::Duration::from_secs(DOWNLOAD_TIMEOUT_SECS)))
         .user_agent("onebrain-cli-update")
         .build()
-        .map_err(|e| UpdateError::Network(format!("build http client: {e}")))?;
-    let resp = client
-        .get(url)
-        .send()
-        .map_err(|e| UpdateError::Network(format!("GET {url}: {e}")))?;
-    if !resp.status().is_success() {
-        return Err(UpdateError::Checksum(format!(
-            "checksum file unavailable at {url} (HTTP {})",
-            resp.status().as_u16()
-        )));
+        .into();
+    match agent.get(url).call() {
+        Ok(mut resp) => resp
+            .body_mut()
+            .read_to_string()
+            .map_err(|e| UpdateError::Network(format!("read checksum body: {e}"))),
+        Err(ureq::Error::StatusCode(code)) => Err(UpdateError::Checksum(format!(
+            "checksum file unavailable at {url} (HTTP {code})"
+        ))),
+        Err(e) => Err(UpdateError::Network(format!("GET {url}: {e}"))),
     }
-    resp.text()
-        .map_err(|e| UpdateError::Network(format!("read checksum body: {e}")))
 }
 
 // ---------------------------------------------------------------------------
diff --git a/crates/onebrain-fs/src/update/mod.rs b/crates/onebrain-fs/src/update/mod.rs
index 46306b7..42a576c 100644
--- a/crates/onebrain-fs/src/update/mod.rs
+++ b/crates/onebrain-fs/src/update/mod.rs
@@ -16,7 +16,7 @@
 //!
 //! All four external IO surfaces are injectable through `UpdateOptions` so
 //! the unit + integration tests run offline. Defaults call out to the real
-//! environment via `reqwest::blocking` and `std::process::Command`.
+//! environment via `ureq` and `std::process::Command`.
 //!
 //! v3.0 ships non-TTY output only — TTY spinner / colored output is deferred
 //! to v3.0.1 (no `picocolors` / `cli-banner` equivalent in tree yet).
@@ -171,9 +171,8 @@ const HTTP_TIMEOUT_SECS: u64 = 15;
 /// the call from ~200 ms to ~5 ms.
 const RELEASE_CACHE_TTL: Duration = Duration::from_secs(3600);
 
-/// User-Agent. reqwest requires a non-empty UA for the GitHub API otherwise
-/// the API returns 403. Use a stable string the v3 release pipeline can
-/// audit.
+/// User-Agent. The GitHub API rejects requests that send no User-Agent
+/// (HTTP 403), so set a stable string the v3 release pipeline can audit.
 const USER_AGENT: &str = "onebrain-cli/3.0";
 
 // ---------------------------------------------------------------------------
@@ -246,22 +245,29 @@ pub fn default_fetch_latest_release(fresh: bool) -> Result<ReleaseInfo, UpdateEr
     }
     let url = std::env::var(GITHUB_ENV_OVERRIDE)
         .unwrap_or_else(|_| DEFAULT_GITHUB_RELEASES_URL.to_string());
-    let client = reqwest::blocking::Client::builder()
-        .timeout(Duration::from_secs(HTTP_TIMEOUT_SECS))
+    let agent: ureq::Agent = ureq::Agent::config_builder()
+        .timeout_global(Some(Duration::from_secs(HTTP_TIMEOUT_SECS)))
         .user_agent(USER_AGENT)
         .build()
-        .map_err(|e| UpdateError::Network(e.to_string()))?;
-    let resp = client
+        .into();
+    // ureq surfaces 4xx/5xx as `Err(StatusCode)` by default; an `Ok` response
+    // is already 2xx. Read the body as text and parse with the existing
+    // `serde_json` dep (ureq's own `json` feature is left off to avoid the dep).
+    let json: serde_json::Value = match agent
         .get(&url)
         .header("Accept", "application/vnd.github.v3+json")
-        .send()
-        .map_err(|e| UpdateError::Network(e.to_string()))?;
-    if !resp.status().is_success() {
-        return Err(UpdateError::GithubStatus(resp.status().as_u16()));
-    }
-    let json: serde_json::Value = resp
-        .json()
-        .map_err(|e| UpdateError::Decode(e.to_string()))?;
+        .call()
+    {
+        Ok(mut resp) => {
+            let body = resp
+                .body_mut()
+                .read_to_string()
+                .map_err(|e| UpdateError::Decode(e.to_string()))?;
+            serde_json::from_str(&body).map_err(|e| UpdateError::Decode(e.to_string()))?
+        }
+        Err(ureq::Error::StatusCode(code)) => return Err(UpdateError::GithubStatus(code)),
+        Err(e) => return Err(UpdateError::Network(e.to_string())),
+    };
     // The CLI repo endpoint returns an array (`/releases?per_page=1`) where
     // the previous plugin-repo endpoint returned an object (`/releases/latest`).
     // Accept both shapes so the env-override path still works against either
diff --git a/crates/onebrain-fs/src/vault_sync/download.rs b/crates/onebrain-fs/src/vault_sync/download.rs
index c4bfb36..bd75f05 100644
--- a/crates/onebrain-fs/src/vault_sync/download.rs
+++ b/crates/onebrain-fs/src/vault_sync/download.rs
@@ -19,7 +19,7 @@ use super::types::FetchFn;
 /// for URL-safety, which is trivial in practice (branch names are git refs).
 const TARBALL_BASE: &str = "https://api.github.com/repos/onebrain-ai/onebrain/tarball/";
 
-/// Default fetch implementation — a blocking reqwest GET that returns the raw
+/// Default fetch implementation — a blocking ureq GET that returns the raw
 /// body bytes on 2xx and an error string with Bun's hint table on 4xx/5xx.
 ///
 /// Test escape hatch: when the `ONEBRAIN_VAULT_SYNC_FIXTURE` environment variable
@@ -32,21 +32,25 @@ pub fn default_fetch_fn() -> FetchFn {
         if let Ok(fixture) = std::env::var("ONEBRAIN_VAULT_SYNC_FIXTURE") {
             return std::fs::read(&fixture).map_err(|e| format!("fixture read {fixture}: {e}"));
         }
-        let client = reqwest::blocking::Client::builder()
+        let agent: ureq::Agent = ureq::Agent::config_builder()
             .user_agent("onebrain-cli")
             .build()
-            .map_err(|e| format!("HTTP client init failed: {e}"))?;
-        let resp = client
-            .get(url)
-            .send()
-            .map_err(|e| format!("HTTP request failed: {e}"))?;
-        let status = resp.status();
-        if !status.is_success() {
-            return Err(format_http_error(status.as_u16(), url));
+            .into();
+        // ureq returns `Err(StatusCode)` for 4xx/5xx by default, so an `Ok`
+        // response is already 2xx — no explicit status check needed. The body
+        // is streamed through `into_reader()` (no size cap) since the tarball
+        // can be several MB — an unbounded read, not the limited `read_to_vec()`.
+        match agent.get(url).call() {
+            Ok(resp) => {
+                let mut reader = resp.into_body().into_reader();
+                let mut buf = Vec::new();
+                std::io::Read::read_to_end(&mut reader, &mut buf)
+                    .map_err(|e| format!("read body: {e}"))?;
+                Ok(buf)
+            }
+            Err(ureq::Error::StatusCode(code)) => Err(format_http_error(code, url)),
+            Err(e) => Err(format!("HTTP request failed: {e}")),
         }
-        resp.bytes()
-            .map(|b| b.to_vec())
-            .map_err(|e| format!("read body: {e}"))
     })
 }
 
diff --git a/crates/onebrain-fs/src/vault_sync/types.rs b/crates/onebrain-fs/src/vault_sync/types.rs
index 24f8219..aa251eb 100644
--- a/crates/onebrain-fs/src/vault_sync/types.rs
+++ b/crates/onebrain-fs/src/vault_sync/types.rs
@@ -27,7 +27,7 @@ pub type NowFn = Box<dyn Fn() -> DateTime<Utc> + Send + Sync>;
 pub struct VaultSyncOptions {
     /// Overrides `vault.yml::update_channel` branch resolution.
     pub branch: Option<String>,
-    /// Mock fetch — defaults to a real `reqwest::blocking` GET against GitHub.
+    /// Mock fetch — defaults to a real blocking `ureq` GET against GitHub.
     pub fetch_fn: Option<FetchFn>,
     /// Override path to `installed_plugins.json` (test-only).
     pub installed_plugins_path: Option<PathBuf>,
diff --git a/docs/reference/onebrain-cli.md b/docs/reference/onebrain-cli.md
index fa149ee..d7f0ff4 100644
--- a/docs/reference/onebrain-cli.md
+++ b/docs/reference/onebrain-cli.md
@@ -1,7 +1,7 @@
 # onebrain-cli
 
 ## Purpose & dependencies
-`onebrain-cli` is the binary crate at the top of the OneBrain CLI workspace — it owns everything between `argv` and a process exit code. It parses the locked v3.1 `<noun> <verb>` command tree (`clap`), dispatches each verb to a handler, renders results through the canonical `Envelope<T>` + `serialize_for_mode` output stack across five output modes (text/json/yaml/table/tsv), prints the TTY-only branded banner, resolves the active vault, and centralises `CoreError → exit code` mapping. It also carries the v3.0→v3.1 migration layer: hidden aliases that emit a one-time rename notice before dispatching, a `.claude/settings.json` hook-path rewriter, and `E_NOT_IMPLEMENTED` stubs for the forward-declared command surface. Depends on **all three** in-workspace library crates — `onebrain-core` (config, `CoreError`, vault resolution, scheduler model), `onebrain-fs` (init, vault-sync, register-hooks, doctor checks, update, harness detection), `onebrain-cache` (session token, checkpoint stop/reset, qmd queries) — plus `clap`, `anyhow`, `serde`, `serde_json`, `serde_yaml`, `chrono`, `tokio`, `indicatif`, `dirs`. Nothing in-workspace depends on it.
+`onebrain-cli` is the binary crate at the top of the OneBrain CLI workspace — it owns everything between `argv` and a process exit code. It parses the locked v3.1 `<noun> <verb>` command tree (`clap`), dispatches each verb to a handler, renders results through the canonical `Envelope<T>` + `serialize_for_mode` output stack across five output modes (text/json/yaml/table/tsv), prints the TTY-only branded banner, resolves the active vault, and centralises `CoreError → exit code` mapping. It also carries the v3.0→v3.1 migration layer: hidden aliases that emit a one-time rename notice before dispatching, a `.claude/settings.json` hook-path rewriter, and `E_NOT_IMPLEMENTED` stubs for the forward-declared command surface. Depends on **all three** in-workspace library crates — `onebrain-core` (config, `CoreError`, vault resolution, scheduler model), `onebrain-fs` (init, vault-sync, register-hooks, doctor checks, update, harness detection), `onebrain-cache` (session token, checkpoint stop/reset, qmd queries) — plus `clap`, `anyhow`, `serde`, `serde_json`, `serde_yaml`, `chrono`, `indicatif`, `dirs`. Nothing in-workspace depends on it.
 
 ## Module map
 ```
@@ -14,7 +14,6 @@ src/
 ├── safety.rs            refuse_dangerous_vault_path guard for FS-mutating commands
 ├── migration.rs         v3.0→v3.1 one-time rename notice (state file + suppression env)
 ├── legacy_output.rs     SessionInitOutput/Block byte-stable shapes + serialize_for_mode
-├── tokio_helper.rs      on-demand tokio runtime (reserved for v3.1+ async verbs)
 ├── output/
 │   ├── mod.rs           output stack root · re-exports Envelope/emit/OutputMode/TtyInputs
 │   ├── envelope.rs      canonical Envelope<T> {version,command,ok,vault,data,warnings,error}
@@ -108,9 +107,6 @@ Byte-stable v3.0 output shapes + the structured-mode serializer shared by the ho
 **Key functions** — `serialize_for_mode<T>(value, mode) -> String` — JSON (compact/pretty), YAML, Table/Tsv→compact-JSON fallback; Text-mode arrival is a caller bug (`debug_assert!`, compact-JSON fallback in release). Serde failures are loud on stderr (avoids the v3.0 empty-stdout regression).
 **Connections** — called by: `session_init`, `orphan_scan`, `harness`, `qmd_status`, `update`, `doctor`.
 
-### `src/tokio_helper.rs`
-On-demand multi-thread tokio runtime, `run_async<F>(future) -> F::Output`. Dead-code-allowed; reserved for future async verbs (`serve`, gateways) so adding them won't restructure `main`. **Connections** — none yet.
-
 ## `output/` — rendering & the Envelope
 Every v3.1 command body builds typed `data`, wraps it in an `Envelope<T>`, and hands it to `dispatcher::emit`, which picks the serializer from the `OutputMode` resolved from CLI flags + env + TTY state. The envelope is the canonical machine contract; the legacy hook-protocol commands instead use `legacy_output::serialize_for_mode` for their byte-stable shapes.
 
diff --git a/docs/reference/onebrain-fs.md b/docs/reference/onebrain-fs.md
index 53278d3..9ad7d0c 100644
--- a/docs/reference/onebrain-fs.md
+++ b/docs/reference/onebrain-fs.md
@@ -1,7 +1,7 @@
 # onebrain-fs
 
 ## Purpose & dependencies
-`onebrain-fs` is the filesystem-effects crate of the OneBrain CLI workspace — everything that reads, writes, walks, downloads, or mutates files on disk lives here. It owns: vault frontmatter parsing, orphan-checkpoint scanning, harness detection, timestamped config backups, the `onebrain init` bootstrap, the `doctor` health-check set (the `Box<dyn Check>` collection), the self-update install path (direct GitHub-Release tarball fetch + atomic binary swap — explicitly **not** npm/bun), `register-hooks` settings.json wiring, the `run-skill` prompt/binary resolver, idempotent structure migrations, and the multi-step `vault-sync` plugin-tarball overlay. It depends only on **`onebrain-core`** in-workspace (for `VaultConfig`, `CoreError`/`FsError` chaining, `Harness`, `DoctorResult`, config-file discovery, vault-root helpers). External crates: `serde`/`serde_json`/`serde_yaml`, `thiserror`, `chrono`, `walkdir`, `tar`/`flate2`, `reqwest` (blocking), `indicatif`, `inquire`, `which`, `wait-timeout`, `tempfile`, `dirs`, `semver`, `indexmap`, `is-terminal`, `filetime`. The binary crate `onebrain-cli` depends on it and drives every public entry point.
+`onebrain-fs` is the filesystem-effects crate of the OneBrain CLI workspace — everything that reads, writes, walks, downloads, or mutates files on disk lives here. It owns: vault frontmatter parsing, orphan-checkpoint scanning, harness detection, timestamped config backups, the `onebrain init` bootstrap, the `doctor` health-check set (the `Box<dyn Check>` collection), the self-update install path (direct GitHub-Release tarball fetch + atomic binary swap — explicitly **not** npm/bun), `register-hooks` settings.json wiring, the `run-skill` prompt/binary resolver, idempotent structure migrations, and the multi-step `vault-sync` plugin-tarball overlay. It depends only on **`onebrain-core`** in-workspace (for `VaultConfig`, `CoreError`/`FsError` chaining, `Harness`, `DoctorResult`, config-file discovery, vault-root helpers). External crates: `serde`/`serde_json`/`serde_yaml`, `thiserror`, `chrono`, `walkdir`, `tar`/`flate2`, `ureq` (blocking, sync), `indicatif`, `inquire`, `which`, `wait-timeout`, `tempfile`, `dirs`, `semver`, `indexmap`, `is-terminal`, `filetime`. The binary crate `onebrain-cli` depends on it and drives every public entry point.
 
 ## Module map
 ```
@@ -282,7 +282,7 @@ settings.json read + atomic write.
 Orchestrator + GitHub fetch/cache + pure version helpers.
 **Key types** — `UpdateResult { ok, exit_code, latest_version, current_version, error, latest_published_at }`; `ReleaseInfo`; `CurrentVersion`; `UpdateOptions { check, fresh, fetch_fn, install_fn, validate_fn, current_version_fn, stdout/stderr_lines }`; `UpdateError { GithubStatus, MissingTag, Network, Decode, Install, InstallBinary, Spawn }`.
 **Key functions** — `run_update(opts) -> UpdateResult`; `default_fetch_latest_release(fresh)` (1 h on-disk cache, `ONEBRAIN_GITHUB_RELEASES_URL` override; endpoint is `/releases?per_page=1` on the **CLI** repo); `parse_release_payload`; `default_install_binary(version)` → `install::fetch_and_swap_binary`; `default_validate_binary(expected)` (spawn `onebrain --version`, parse via `extract_version_token`, require `>= expected` semver — pure core split out as `validate_reported`); `default_current_version` (compile-time `CARGO_PKG_VERSION`); `version_at_least(current, candidate)` (semver-aware downgrade guard, string-eq fallback); helpers `extract_version_token`/`version_regex_matches`/`extract_version_prefix`/`extract_release_date`/`format_release_date`/`windows_shell`.
-**Connections** — calls: `reqwest::blocking`, `semver`, `dirs::cache_dir`, `chrono`, `install::fetch_and_swap_binary`; called by: `onebrain-cli` `update`.
+**Connections** — calls: `ureq`, `semver`, `dirs::cache_dir`, `chrono`, `install::fetch_and_swap_binary`; called by: `onebrain-cli` `update`.
 **Tests** — full orchestrator paths (upgrade/check/up-to-date/fetch-fail/install-fail/validate-fail) + cache round-trip/stale/corrupt + semver comparison matrix.
 
 ### `src/update/install.rs`
@@ -292,10 +292,10 @@ Direct GitHub-Release fetch + atomic binary swap (replaces the broken npm/bun pa
 - `fetch_and_swap_binary(version, current_exe) -> Result<(), UpdateError>` — resolve asset → build `{base}/v{version}/onebrain-{triple}.{ext}` → download → extract → swap.
 - `AssetInfo::for_running_target()` — resolves the running target triple via `cfg!(all(target_arch, target_os, target_env))` (8 triples incl. linux musl vs gnu; macOS/linux→`tar.gz`, windows→`zip`); unsupported triple → `UpdateError::Install` with arch/os/env hint.
 - `AssetInfo::extract_binary` — delegates to `extract_tar_gz` (Windows zip path intentionally unwired for v3.0.0 GA → error).
-- `download_archive(url)` — blocking reqwest GET (90 s timeout); non-2xx → `GithubStatus`.
+- `download_archive(url)` — blocking ureq GET (90 s `timeout_global`); non-2xx → `GithubStatus`.
 - `extract_tar_gz(bytes, target_name)` — gzip+tar; skips non-regular-file entries (symlink/dir guard); matches the binary by file_name at root or one-level prefix.
 - `swap_binary(current_exe, new_bytes)` — writes `<exe>.new` + `set_executable` (chmod 0755 Unix; no-op Windows), then atomic `rename` over the live binary on Unix; on Windows renames live exe → `.old` first, moves new into place, and **rolls back** `.old`→live if the second rename fails (surfacing rollback outcome to stderr).
-**Connections** — calls: `reqwest`, `flate2`, `tar`, `fs::{rename,File,set_permissions}`; called by: `update::mod::default_install_binary`.
+**Connections** — calls: `ureq`, `flate2`, `tar`, `fs::{rename,File,set_permissions}`; called by: `update::mod::default_install_binary`.
 **Tests** — tar extraction (found/skip/missing) + unix swap (replace + chmod + tmp cleanup) + running-target smoke.
 
 ## `vault_sync/` — plugin tarball overlay
@@ -319,8 +319,8 @@ Module root — declares step submodules and re-exports `run_vault_sync`, `resol
 
 ### `src/vault_sync/download.rs`
 Step 1 — tarball download + extract (pure-Rust `tar`+`flate2`, no system `tar` spawn).
-**Key functions** — `default_fetch_fn()` (blocking reqwest; `ONEBRAIN_VAULT_SYNC_FIXTURE` reads a local file for tests); `download_tarball(branch, fetch)`; `extract_tarball(bytes, dest_dir) -> io::Result<PathBuf>` (returns the single top-level dir); `tarball_url`/`format_http_error` (403/404/429 hints); `build_tar_spawn_overrides(platform, parent_env)` (kept for parity — empty on non-Windows, `TAR_OPTIONS=--force-local` on Windows).
-**Connections** — calls: `flate2`, `tar`, `reqwest`; called by: `orchestrate`.
+**Key functions** — `default_fetch_fn()` (blocking ureq, no timeout; `ONEBRAIN_VAULT_SYNC_FIXTURE` reads a local file for tests); `download_tarball(branch, fetch)`; `extract_tarball(bytes, dest_dir) -> io::Result<PathBuf>` (returns the single top-level dir); `tarball_url`/`format_http_error` (403/404/429 hints); `build_tar_spawn_overrides(platform, parent_env)` (kept for parity — empty on non-Windows, `TAR_OPTIONS=--force-local` on Windows).
+**Connections** — calls: `flate2`, `tar`, `ureq`; called by: `orchestrate`.
 
 ### `src/vault_sync/walker.rs`
 **Key functions** — `list_files_recursive(dir) -> Vec<PathBuf>` — best-effort recursive regular-file listing (missing/unreadable→empty, no symlink follow).