diff --git a/.github/workflows/larql-cli.yml b/.github/workflows/larql-cli.yml
index cfec2aaed..dba18ed11 100644
--- a/.github/workflows/larql-cli.yml
+++ b/.github/workflows/larql-cli.yml
@@ -104,12 +104,26 @@ jobs:
         if: runner.os == 'macOS'
         run: cargo check -p larql-cli --bins --tests
 
-      # Clippy is intentionally skipped: as of 2026-05-10 `larql-cli`
-      # carries ~82 pre-existing errors under default features and ~112
-      # under `--no-default-features` (mostly `large_enum_variant` and
-      # `dead_code` on metal-only paths). Re-enable once that backlog
-      # is cleared; the other crates' workflows already enforce
-      # `clippy -- -D warnings`.
+      # Re-enabled 2026-08-06 (issue #169). The backlog this step was
+      # disabled for on 2026-05-10 — ~82 errors under default features and
+      # ~112 under `--no-default-features`, mostly `large_enum_variant` and
+      # `dead_code` on metal-only paths — has since been cleared by other
+      # work. Both feature shapes now report zero under `-D warnings`.
+      #
+      # `--no-deps` matches the other crates' workflows: it keeps the gate
+      # on larql-cli's own code, so a lint that fires in a path dependency
+      # reds that dependency's workflow rather than this one.
+      #
+      # The feature split mirrors the Check steps above, and for the same
+      # reason: `gpu` pulls in larql-compute-metal, which only exists on
+      # macOS.
+      - name: Clippy (CPU only) on Linux/Windows
+        if: runner.os != 'macOS'
+        run: cargo clippy -p larql-cli --bins --tests --no-default-features --no-deps -- -D warnings
+
+      - name: Clippy (default features incl. gpu) on macOS
+        if: runner.os == 'macOS'
+        run: cargo clippy -p larql-cli --bins --tests --no-deps -- -D warnings
 
       - name: Tests (CPU only) on Linux/Windows
         if: runner.os != 'macOS'
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
new file mode 100644
index 000000000..888ae16ae
--- /dev/null
+++ b/.github/workflows/quality.yml
@@ -0,0 +1,241 @@
+# Workspace-level quality and supply-chain gates.
+#
+# The per-crate workflows (larql-*.yml) each cover fmt / check / clippy /
+# test / coverage for one crate. Nothing there looks at the dependency
+# graph as a whole, so until this workflow existed a RUSTSEC advisory
+# against a transitive crate was invisible to CI. See issue #165.
+#
+# Jobs:
+#   audit       — RustSec advisory scan of Cargo.lock            (blocking)
+#   deny        — licences, advisories, sources, bans            (blocking)
+#   msrv        — the declared rust-version really compiles      (blocking)
+#   proto-lint  — buf lint over the four gRPC schemas            (blocking)
+#   mutants     — mutation testing on the PR diff             (informational)
+#
+# NOTE ON `schedule`: this workflow deliberately has no `paths:` filter and
+# runs weekly. Advisories are published against code that has not changed —
+# the wasmtime and pyo3 findings that motivated #165 sat in a Cargo.lock
+# nobody had touched for months. A workflow that only fires when
+# Cargo.lock changes cannot catch that class of problem.
+
+name: quality
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Mondays 06:00 UTC — a fresh advisory-db scan against unchanged code.
+    - cron: '0 6 * * 1'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    name: cargo-audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      # Vulnerabilities fail the build. Unmaintained/unsound *warnings* do
+      # not: the four currently outstanding (number_prefix, paste,
+      # rustls-pemfile, scc) are all pinned by upstream crates we do not
+      # control, so failing on them would mean a permanently red gate that
+      # people learn to ignore. They are still printed in the log, and the
+      # rationale for each is recorded in deny.toml.
+      - name: Scan Cargo.lock for advisories
+        run: cargo audit --color always
+
+  deny:
+    name: cargo-deny · ${{ matrix.check }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        # Split so a licence failure and an advisory failure are
+        # distinguishable at a glance in the checks list.
+        check: [advisories, licenses, bans, sources]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: cargo-deny ${{ matrix.check }}
+        uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check ${{ matrix.check }}
+
+  msrv:
+    # Named without the version: a job-level `name` cannot reference `steps`,
+    # and hardcoding a number here would be a second place to forget to bump.
+    name: MSRV · ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      # Split by platform because no single runner can build the whole
+      # workspace. `larql-compute-metal` takes `blas-src` only under
+      # `cfg(target_os = "macos")` while its examples `extern crate blas_src`
+      # unconditionally, so on Linux they fail to resolve at *any* toolchain —
+      # nothing to do with the MSRV. Its own workflow is macOS-only for the
+      # same reason.
+      #
+      # So: Linux checks the workspace minus that crate (covering the
+      # cfg(linux) OpenBLAS paths in larql-compute and larql-inference), and
+      # macOS checks the crate Linux cannot. Between them every member crate
+      # is MSRV-gated with no silent hole.
+      matrix:
+        include:
+          - os: ubuntu-latest
+            args: --workspace --all-targets --exclude larql-compute-metal
+          - os: macos-14
+            args: -p larql-compute-metal --all-targets
+    steps:
+      - uses: actions/checkout@v7
+
+      # Read the declared MSRV out of Cargo.toml rather than hardcoding it
+      # here, so bumping rust-version in one place updates the gate too.
+      - name: Read declared rust-version
+        id: msrv
+        run: |
+          version=$(sed -n 's/^rust-version = "\(.*\)"/\1/p' Cargo.toml | head -1)
+          if [ -z "$version" ]; then
+            echo "::error::no rust-version found in workspace Cargo.toml"
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "declared MSRV: $version"
+
+      - name: Install Rust ${{ steps.msrv.outputs.version }}
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ steps.msrv.outputs.version }}
+
+      - name: Install OpenBLAS
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libopenblas-dev pkg-config
+
+      - name: Cache cargo registry + build artefacts
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-msrv-${{ steps.msrv.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-msrv-${{ steps.msrv.outputs.version }}-
+
+      # This is `cargo check` at the pinned toolchain rather than
+      # `cargo msrv verify`. cargo-msrv bisects across many toolchains to
+      # *discover* the minimum; we already know what we claim, and the only
+      # question CI needs answered is whether the claim is true. One pinned
+      # check answers it in a fraction of the time.
+      #
+      # `--locked` matters: without it cargo may resolve a newer dependency
+      # than Cargo.lock pins and the job would test a graph nobody ships.
+      - name: Check at declared MSRV
+        run: cargo check ${{ matrix.args }} --locked
+
+  proto-lint:
+    name: buf lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install buf
+        uses: bufbuild/buf-action@v1
+        with:
+          setup_only: true
+
+      - name: Lint gRPC schemas
+        run: buf lint
+
+      # Catches a malformed schema that lint alone would not (bad imports,
+      # duplicate field numbers, unresolvable types).
+      - name: Build descriptor set
+        run: buf build --output /dev/null
+
+  mutants:
+    name: cargo-mutants (informational)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    # PR-only: --in-diff needs a base to diff against, and a full-workspace
+    # mutation run is many hours of compute.
+    if: github.event_name == 'pull_request'
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-mutants
+        uses: taiki-e/install-action@cargo-mutants
+
+      - name: Install OpenBLAS
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libopenblas-dev pkg-config
+
+      - name: Compute PR diff
+        run: |
+          git diff "origin/${{ github.base_ref }}...HEAD" > /tmp/pr.diff
+          echo "diff is $(wc -l < /tmp/pr.diff) lines"
+
+      # This job is a signal, not a gate, and it is capped twice over:
+      # `--in-diff` restricts mutants to lines the PR touched, and
+      # `timeout-minutes: 45` bounds the job.
+      #
+      # Read a *timed-out* run as "incomplete", never as "clean". If the job
+      # hits the wall clock the runner kills this step and the summary below
+      # never prints — the only evidence is the job's own timeout status.
+      # `--no-shuffle` at least makes the mutants it did get through a
+      # deterministic prefix rather than a random sample, and the report
+      # upload runs `if: always()` so partial results survive.
+      - name: Mutation-test the diff
+        run: |
+          set +e
+          cargo mutants --in-diff /tmp/pr.diff --timeout 120 --no-shuffle
+          echo "cargo-mutants exit status: $?"
+
+          # Summarise from the per-outcome text files rather than
+          # outcomes.json — these filenames are cargo-mutants' stable
+          # surface, and one line per mutant is what a reviewer wants in
+          # the log anyway.
+          echo "--- mutation summary ---"
+          for f in caught missed timeout unviable; do
+            path="mutants.out/$f.txt"
+            if [ -f "$path" ]; then
+              printf '%5d  %s\n' "$(wc -l < "$path")" "$f"
+            fi
+          done
+
+          if [ -s mutants.out/missed.txt ]; then
+            echo
+            echo "Mutants that survived — the tests did not notice these edits:"
+            cat mutants.out/missed.txt
+          fi
+          exit 0
+
+      - name: Upload mutants report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mutants-report
+          path: mutants.out/
+          if-no-files-found: ignore
diff --git a/Cargo.lock b/Cargo.lock
index 830e68bb0..dca732ea5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "accelerate-src"
@@ -8,6 +8,15 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "415ed64958754dbe991900f3940677e6a7eefb4d7367afd70d642677b0c7d19d"
 
+[[package]]
+name = "addr2line"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
+dependencies = [
+ "gimli",
+]
+
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -116,18 +125,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
-
-[[package]]
-name = "ar_archive_writer"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7eb93bbb63b9c227414f6eb3a0adfddca591a8ce1e9b60661bb08969b87e340b"
-dependencies = [
- "object 0.37.3",
-]
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arbitrary"
@@ -521,6 +521,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -756,20 +767,47 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cranelift-assembler-x64"
+version = "0.123.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f8e1303ae2128891cb59691a74de4547dd208bc8511a2f287cca2b93bb3c728"
+dependencies = [
+ "cranelift-assembler-x64-meta",
+]
+
+[[package]]
+name = "cranelift-assembler-x64-meta"
+version = "0.123.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58b2740a5936332028d9a1e8f29a199de2fd386e426d44da5fea70cf8e3f8e75"
+dependencies = [
+ "cranelift-srcgen",
+]
+
 [[package]]
 name = "cranelift-bforest"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e15d04a0ce86cb36ead88ad68cf693ffd6cda47052b9e0ac114bc47fd9cd23c4"
+checksum = "37fd128d3629fb105e433bda09744c5a2959cd1da04617a455c4cc17dff1ebef"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c6e3969a7ce267259ce244b7867c5d3bc9e65b0a87e81039588dfdeaede9f34"
+checksum = "24a88f6d5a6cf6fcbc6386415d48948094721dfa4585d6615938b11ca938f20a"
 dependencies = [
  "serde",
  "serde_derive",
@@ -777,11 +815,12 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c22032c4cb42558371cf516bb47f26cdad1819d3475c133e93c49f50ebf304e"
+checksum = "daa4a357d030bdd586d8fe3da56b394f7f6b6ded506e59f945e7b32b1e126b71"
 dependencies = [
  "bumpalo",
+ "cranelift-assembler-x64",
  "cranelift-bforest",
  "cranelift-bitset",
  "cranelift-codegen-meta",
@@ -790,44 +829,50 @@ dependencies = [
  "cranelift-entity",
  "cranelift-isle",
  "gimli",
- "hashbrown 0.14.5",
+ "hashbrown 0.15.5",
  "log",
+ "pulley-interpreter",
  "regalloc2",
  "rustc-hash",
  "serde",
  "smallvec",
  "target-lexicon",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c904bc71c61b27fc57827f4a1379f29de64fe95653b620a3db77d59655eee0b8"
+checksum = "4121e36a8757dea6fb237435ee5095eba25bc13ecc2eaee57eb9bffd4b27784f"
 dependencies = [
+ "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
+ "cranelift-srcgen",
+ "heck",
+ "pulley-interpreter",
 ]
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40180f5497572f644ce88c255480981ae2ec1d7bb4d8e0c0136a13b87a2f2ceb"
+checksum = "5173265fc30b9e42205cf06dfca9a272ee949667ce4115d975ed2c08d466e2f8"
 
 [[package]]
 name = "cranelift-control"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d132c6d0bd8a489563472afc171759da0707804a65ece7ceb15a8c6d7dd5ef"
+checksum = "9b6ca8a393e66dc13f915c6f456bdcf496d78fac4995792f7022b7806352d7a4"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b2d0d9618275474fbf679dd018ac6e009acbd6ae6850f6a67be33fb3b00b323"
+checksum = "e609d9ba416bc26d774f343295a1d411515248a6a6d83d5f7492a0dd919569fa"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -836,9 +881,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fac41e16729107393174b0c9e3730fb072866100e1e64e80a1a963b2e484d57"
+checksum = "90a3a277b1a0aff1123f6bae61c080a4bcb6df964829ed427f98e18dff14257f"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -848,21 +893,27 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ca20d576e5070044d0a72a9effc2deacf4d6aa650403189d8ea50126483944d"
+checksum = "be53dd9b3a4cbeb9ced45c4a543ea8417ccfb334c3ba1cbb2233f4b25fb2531f"
 
 [[package]]
 name = "cranelift-native"
-version = "0.116.1"
+version = "0.123.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8dee82f3f1f2c4cba9177f1cc5e350fe98764379bcd29340caa7b01f85076c7"
+checksum = "ca62ab1d9f48cad97da5843b913ccf96c3dfde935af5d750cb5a6d367ccfb262"
 dependencies = [
  "cranelift-codegen",
  "libc",
  "target-lexicon",
 ]
 
+[[package]]
+name = "cranelift-srcgen"
+version = "0.123.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13b72860f54a2a19d3756bd47575fd8bddeafd6e5bbbf16372cdfebc482628a"
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -920,9 +971,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1070,33 +1121,13 @@ dependencies = [
  "crypto-common",
 ]
 
-[[package]]
-name = "dirs"
-version = "4.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3aa72a6f96ea37bbc5aa912f6788242832f75369bdfdadcb0e38423f100059"
-dependencies = [
- "dirs-sys 0.3.7",
-]
-
 [[package]]
 name = "dirs"
 version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
 dependencies = [
- "dirs-sys 0.5.0",
-]
-
-[[package]]
-name = "dirs-sys"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b1d1d91c932ef41c0f2663aa8b0ca0342d444d842c06914aa0a7e352d0bada6"
-dependencies = [
- "libc",
- "redox_users 0.4.6",
- "winapi",
+ "dirs-sys",
 ]
 
 [[package]]
@@ -1107,7 +1138,7 @@ checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
 dependencies = [
  "libc",
  "option-ext",
- "redox_users 0.5.2",
+ "redox_users",
  "windows-sys 0.61.2",
 ]
 
@@ -1493,11 +1524,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi 5.3.0",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -1507,17 +1536,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
+ "wasm-bindgen",
 ]
 
 [[package]]
 name = "gimli"
-version = "0.31.1"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 dependencies = [
  "fallible-iterator",
  "indexmap",
@@ -1597,15 +1629,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.14.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -1653,7 +1676,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aef3982638978efa195ff11b305f51f1f22f4f0a6cabee7af79b383ebee6a213"
 dependencies = [
- "dirs 6.0.0",
+ "dirs",
  "http",
  "indicatif 0.18.4",
  "libc",
@@ -2015,15 +2038,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "indoc"
-version = "2.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "io-extras"
 version = "0.18.4"
@@ -2082,15 +2096,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -2702,9 +2707,9 @@ dependencies = [
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
 ]
@@ -2715,15 +2720,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38d1115007560874e373613744c6fba374c17688327a71c1476d1a5954cc857b"
 
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "metal"
 version = "0.29.0"
@@ -2993,9 +2989,9 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 
 [[package]]
 name = "numpy"
-version = "0.24.0"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7cfbf3f0feededcaa4d289fe3079b03659e85c5b5a177f4ba6fb01ab4fb3e39"
+checksum = "6a5b15d63a5ff39e378daed0e1340d3a5964703ea9712eb09a0dc66fade996f4"
 dependencies = [
  "libc",
  "ndarray",
@@ -3018,9 +3014,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.7"
+version = "0.37.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
 dependencies = [
  "crc32fast",
  "hashbrown 0.15.5",
@@ -3028,15 +3024,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "object"
-version = "0.37.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -3097,7 +3084,7 @@ version = "0.10.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fccd2c4f5271ab871f2069cb6f1a13ef2c0db50e1145ce03428ee541f4c63c4f"
 dependencies = [
- "dirs 6.0.0",
+ "dirs",
  "openblas-build",
  "pkg-config",
  "vcpkg",
@@ -3442,25 +3429,26 @@ dependencies = [
 ]
 
 [[package]]
-name = "psm"
-version = "0.1.31"
+name = "pulley-interpreter"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "645dbe486e346d9b5de3ef16ede18c26e6c70ad97418f4874b8b1889d6e761ea"
+checksum = "2662666315cb90dfb4d99a652ee053d4d8598f71c474209e84da031ca56ae5a4"
 dependencies = [
- "ar_archive_writer",
- "cc",
+ "cranelift-bitset",
+ "log",
+ "pulley-macros",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
-name = "pulley-interpreter"
-version = "29.0.1"
+name = "pulley-macros"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62d95f8575df49a2708398182f49a888cf9dc30210fb1fd2df87c889edcee75d"
+checksum = "bb9a7d9ed2618f94b6d054aba3eb2768c9b489fe16b4ef8847fbc6ed41b707bb"
 dependencies = [
- "cranelift-bitset",
- "log",
- "sptr",
- "wasmtime-math",
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -3471,37 +3459,32 @@ checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 
 [[package]]
 name = "pyo3"
-version = "0.24.2"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5203598f366b11a02b13aa20cab591229ff0a89fd121a308a5df751d5fc9219"
+checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b"
 dependencies = [
- "cfg-if",
- "indoc",
  "libc",
- "memoffset",
  "once_cell",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
- "unindent",
 ]
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.24.2"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99636d423fa2ca130fa5acde3059308006d46f98caac629418e53f7ebb1e9999"
+checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9"
 dependencies = [
- "once_cell",
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.24.2"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78f9cf92ba9c409279bc3305b5409d90db2d2c22392d443a87df3a1adad59e33"
+checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -3509,9 +3492,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.24.2"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b999cb1a6ce21f9a6b147dcf1be9ffedf02e0043aec74dc390f3007047cecd9"
+checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -3521,13 +3504,12 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.24.2"
+version = "0.29.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "822ece1c7e1012745607d5cf0bcb2874769f0f7cb34c4cde03b9358eb9ef911a"
+checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
  "quote",
  "syn",
 ]
@@ -3561,14 +3543,15 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
 dependencies = [
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.2",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
@@ -3591,7 +3574,7 @@ dependencies = [
  "once_cell",
  "socket2 0.6.3",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3646,6 +3629,17 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -3684,6 +3678,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_distr"
 version = "0.4.3"
@@ -3694,6 +3694,15 @@ dependencies = [
  "rand 0.8.6",
 ]
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rawpointer"
 version = "0.2.1"
@@ -3762,17 +3771,6 @@ dependencies = [
  "bitflags 2.11.1",
 ]
 
-[[package]]
-name = "redox_users"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
-dependencies = [
- "getrandom 0.2.17",
- "libredox",
- "thiserror 1.0.69",
-]
-
 [[package]]
 name = "redox_users"
 version = "0.5.2"
@@ -3786,9 +3784,9 @@ dependencies = [
 
 [[package]]
 name = "regalloc2"
-version = "0.11.2"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc06e6b318142614e4a48bc725abbf08ff166694835c43c9dae5a9009704639a"
+checksum = "5216b1837de2149f8bc8e6d5f88a9326b63b8c836ed58ce4a0a29ec736a59734"
 dependencies = [
  "allocator-api2",
  "bumpalo",
@@ -4258,7 +4256,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -4269,7 +4267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -4282,15 +4280,6 @@ dependencies = [
  "lazy_static",
 ]
 
-[[package]]
-name = "shellexpand"
-version = "2.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ccc8076840c4da029af4f87e4e8daeb0fca6b87bbb02e10cb60b791450e11e4"
-dependencies = [
- "dirs 4.0.0",
-]
-
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -4377,12 +4366,6 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "sptr"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
-
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -4904,17 +4887,6 @@ dependencies = [
  "tracing-log",
 ]
 
-[[package]]
-name = "trait-variant"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70977707304198400eb4835a78f6a9f928bf41bba420deb8fdb175cd965d77a7"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "try-lock"
 version = "0.2.5"
@@ -4988,12 +4960,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
 
-[[package]]
-name = "unindent"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
-
 [[package]]
 name = "unit-prefix"
 version = "0.5.2"
@@ -5238,12 +5204,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.221.3"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc8444fe4920de80a4fe5ab564fff2ae58b6b73166b89751f8c6c93509da32e5"
+checksum = "724fccfd4f3c24b7e589d333fc0429c68042897a7e8a5f8694f31792471841e7"
 dependencies = [
- "leb128",
- "wasmparser 0.221.3",
+ "leb128fmt",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
@@ -5280,9 +5246,9 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.221.3"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d06bfa36ab3ac2be0dee563380147a5b81ba10dd8885d7fbbc9eb574be67d185"
+checksum = "a9b1e81f3eb254cf7404a82cee6926a4a3ccc5aad80cc3d43608a070c67aa1d7"
 dependencies = [
  "bitflags 2.11.1",
  "hashbrown 0.15.5",
@@ -5316,21 +5282,22 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.221.3"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7343c42a97f2926c7819ff81b64012092ae954c5d83ddd30c9fcdefd97d0b283"
+checksum = "2df225df06a6df15b46e3f73ca066ff92c2e023670969f7d50ce7d5e695abbb1"
 dependencies = [
  "anyhow",
  "termcolor",
- "wasmparser 0.221.3",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11976a250672556d1c4c04c6d5d7656ac9192ac9edc42a4587d6c21460010e69"
+checksum = "93d881c5dcff5f230368d84fcf110ca25fe47badc694e7d559c3891492159916"
 dependencies = [
+ "addr2line",
  "anyhow",
  "async-trait",
  "bitflags 2.11.1",
@@ -5338,76 +5305,99 @@ dependencies = [
  "cc",
  "cfg-if",
  "encoding_rs",
- "hashbrown 0.14.5",
+ "hashbrown 0.15.5",
  "indexmap",
  "libc",
  "log",
  "mach2",
  "memfd",
- "object 0.36.7",
+ "object",
  "once_cell",
- "paste",
  "postcard",
- "psm",
  "pulley-interpreter",
- "rustix 0.38.44",
+ "rustix 1.1.4",
  "semver",
  "serde",
  "serde_derive",
  "smallvec",
- "sptr",
  "target-lexicon",
- "trait-variant",
- "wasmparser 0.221.3",
- "wasmtime-asm-macros",
- "wasmtime-component-macro",
- "wasmtime-component-util",
- "wasmtime-cranelift",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
- "wasmtime-fiber",
- "wasmtime-jit-icache-coherence",
- "wasmtime-math",
- "wasmtime-slab",
- "wasmtime-versioned-export-macros",
- "wasmtime-winch",
- "windows-sys 0.59.0",
+ "wasmtime-internal-asm-macros",
+ "wasmtime-internal-component-macro",
+ "wasmtime-internal-component-util",
+ "wasmtime-internal-cranelift",
+ "wasmtime-internal-fiber",
+ "wasmtime-internal-jit-debug",
+ "wasmtime-internal-jit-icache-coherence",
+ "wasmtime-internal-math",
+ "wasmtime-internal-slab",
+ "wasmtime-internal-unwinder",
+ "wasmtime-internal-versioned-export-macros",
+ "wasmtime-internal-winch",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
-name = "wasmtime-asm-macros"
-version = "29.0.1"
+name = "wasmtime-environ"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f178b0d125201fbe9f75beaf849bd3e511891f9e45ba216a5b620802ccf64f2"
+checksum = "a4b25534a3ff9dd844701c2bc997f76cb1f97bf2af0546a7066ae96f49c2e068"
+dependencies = [
+ "anyhow",
+ "cranelift-bitset",
+ "cranelift-entity",
+ "gimli",
+ "indexmap",
+ "log",
+ "object",
+ "postcard",
+ "semver",
+ "serde",
+ "serde_derive",
+ "smallvec",
+ "target-lexicon",
+ "wasm-encoder 0.236.1",
+ "wasmparser 0.236.1",
+ "wasmprinter",
+ "wasmtime-internal-component-util",
+]
+
+[[package]]
+name = "wasmtime-internal-asm-macros"
+version = "36.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d02832d760351fb3a1aa99eb8f7b95596c0f4e4e52df1547fcdb295ea5c780c"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
-name = "wasmtime-component-macro"
-version = "29.0.1"
+name = "wasmtime-internal-component-macro"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d74de6592ed945d0a602f71243982a304d5d02f1e501b638addf57f42d57dfaf"
+checksum = "ba2ed6dbe24607573f7bcc59222f3bc2e7f7d31609466055c67b9484045a374a"
 dependencies = [
  "anyhow",
  "proc-macro2",
  "quote",
  "syn",
- "wasmtime-component-util",
- "wasmtime-wit-bindgen",
- "wit-parser 0.221.3",
+ "wasmtime-internal-component-util",
+ "wasmtime-internal-wit-bindgen",
+ "wit-parser 0.236.1",
 ]
 
 [[package]]
-name = "wasmtime-component-util"
-version = "29.0.1"
+name = "wasmtime-internal-component-util"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707dc7b3c112ab5a366b30cfe2fb5b2f8e6a0f682f16df96a5ec582bfe6f056e"
+checksum = "e21aadbf677ee3503ef2580ce3c6955508e90a2810e961739b30f79585af254c"
 
 [[package]]
-name = "wasmtime-cranelift"
-version = "29.0.1"
+name = "wasmtime-internal-cranelift"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "366be722674d4bf153290fbcbc4d7d16895cc82fb3e869f8d550ff768f9e9e87"
+checksum = "65821bab751956cddfc6ee957beb13a0e2a6cf682050d75dfb7a0228db2ed499"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -5417,100 +5407,131 @@ dependencies = [
  "cranelift-frontend",
  "cranelift-native",
  "gimli",
- "itertools 0.12.1",
+ "itertools 0.14.0",
  "log",
- "object 0.36.7",
+ "object",
+ "pulley-interpreter",
  "smallvec",
  "target-lexicon",
- "thiserror 1.0.69",
- "wasmparser 0.221.3",
+ "thiserror 2.0.18",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
- "wasmtime-versioned-export-macros",
+ "wasmtime-internal-math",
+ "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
-name = "wasmtime-environ"
-version = "29.0.1"
+name = "wasmtime-internal-fiber"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdadc1af7097347aa276a4f008929810f726b5b46946971c660b6d421e9994ad"
+checksum = "18cf73e5e8d28a2b30d86454430c7dea3b593598dcbbc0ebb927ca2716222d41"
 dependencies = [
  "anyhow",
- "cranelift-bitset",
- "cranelift-entity",
- "gimli",
- "indexmap",
- "log",
- "object 0.36.7",
- "postcard",
- "semver",
- "serde",
- "serde_derive",
- "smallvec",
- "target-lexicon",
- "wasm-encoder 0.221.3",
- "wasmparser 0.221.3",
- "wasmprinter",
- "wasmtime-component-util",
+ "cc",
+ "cfg-if",
+ "libc",
+ "rustix 1.1.4",
+ "wasmtime-internal-asm-macros",
+ "wasmtime-internal-versioned-export-macros",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
-name = "wasmtime-fiber"
-version = "29.0.1"
+name = "wasmtime-internal-jit-debug"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccba90d4119f081bca91190485650730a617be1fff5228f8c4757ce133d21117"
+checksum = "4279dc3147ddaa21e5b3d2c0eaff117881c4f937747bdd2379eb361665843bd3"
 dependencies = [
- "anyhow",
  "cc",
- "cfg-if",
- "rustix 0.38.44",
- "wasmtime-asm-macros",
- "wasmtime-versioned-export-macros",
- "windows-sys 0.59.0",
+ "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
-name = "wasmtime-jit-icache-coherence"
-version = "29.0.1"
+name = "wasmtime-internal-jit-icache-coherence"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec5e8552e01692e6c2e5293171704fed8abdec79d1a6995a0870ab190e5747d1"
+checksum = "a8eb677944201839c0be19b39b0f19dcd663efbcbc05a09c73f26fec7bdf0331"
 dependencies = [
  "anyhow",
  "cfg-if",
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
-name = "wasmtime-math"
-version = "29.0.1"
+name = "wasmtime-internal-math"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29210ec2aa25e00f4d54605cedaf080f39ec01a872c5bd520ad04c67af1dde17"
+checksum = "db9a153e184878df396a11f8912444531c2e4d0c7a1d9e9a52b30d9853d89cb9"
 dependencies = [
  "libm",
 ]
 
 [[package]]
-name = "wasmtime-slab"
-version = "29.0.1"
+name = "wasmtime-internal-slab"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb5821a96fa04ac14bc7b158bb3d5cd7729a053db5a74dad396cd513a5e5ccf"
+checksum = "b771494bead25e1f0c4c89a9476dd0b65eacca314ed82125f1e197fbc3f0396b"
 
 [[package]]
-name = "wasmtime-versioned-export-macros"
-version = "29.0.1"
+name = "wasmtime-internal-unwinder"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86ff86db216dc0240462de40c8290887a613dddf9685508eb39479037ba97b5b"
+checksum = "90199caed6925420434a923861d8ad813689ca8533d2c679f805d12e35b40a4b"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "cranelift-codegen",
+ "log",
+ "object",
+]
+
+[[package]]
+name = "wasmtime-internal-versioned-export-macros"
+version = "36.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae71687aa834f9cc9eb5b0f97c85184d7dc70b84d32fd8927af0887998a1ba35"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
+[[package]]
+name = "wasmtime-internal-winch"
+version = "36.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0ba45c0d766dd56257d97702d3284b6f69efdd4c53ca981a0754cc0a139df0"
+dependencies = [
+ "anyhow",
+ "cranelift-codegen",
+ "gimli",
+ "object",
+ "target-lexicon",
+ "wasmparser 0.236.1",
+ "wasmtime-environ",
+ "wasmtime-internal-cranelift",
+ "winch-codegen",
+]
+
+[[package]]
+name = "wasmtime-internal-wit-bindgen"
+version = "36.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a64d5112c06f9d54b41e61f0b757d3a5a52361bf359f01131cc7cb8551ac73"
+dependencies = [
+ "anyhow",
+ "bitflags 2.11.1",
+ "heck",
+ "indexmap",
+ "wit-parser 0.236.1",
+]
+
 [[package]]
 name = "wasmtime-wasi"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d1be69bfcab1bdac74daa7a1f9695ab992b9c8e21b9b061e7d66434097e0ca4"
+checksum = "82e4772f39340104c70837d421c71c50364c185936f07eaee19e46cb0754c9e1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5525,45 +5546,29 @@ dependencies = [
  "futures",
  "io-extras",
  "io-lifetimes",
- "rustix 0.38.44",
+ "rustix 1.1.4",
  "system-interface",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
- "trait-variant",
  "url",
  "wasmtime",
+ "wasmtime-wasi-io",
  "wiggle",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
-name = "wasmtime-winch"
-version = "29.0.1"
+name = "wasmtime-wasi-io"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdbabfb8f20502d5e1d81092b9ead3682ae59988487aafcd7567387b7a43cf8f"
+checksum = "b1267c55a52d9ce27da6ff522ddb5b847e811cf477b0ef4c7c1155dd544c25ac"
 dependencies = [
  "anyhow",
- "cranelift-codegen",
- "gimli",
- "object 0.36.7",
- "target-lexicon",
- "wasmparser 0.221.3",
- "wasmtime-cranelift",
- "wasmtime-environ",
- "winch-codegen",
-]
-
-[[package]]
-name = "wasmtime-wit-bindgen"
-version = "29.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8358319c2dd1e4db79e3c1c5d3a5af84956615343f9f89f4e4996a36816e06e6"
-dependencies = [
- "anyhow",
- "heck",
- "indexmap",
- "wit-parser 0.221.3",
+ "async-trait",
+ "bytes",
+ "futures",
+ "wasmtime",
 ]
 
 [[package]]
@@ -5646,14 +5651,14 @@ dependencies = [
 
 [[package]]
 name = "wiggle"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b9af35bc9629c52c261465320a9a07959164928b4241980ba1cf923b9e6751d"
+checksum = "3185c97adf4d5f4c0d2abfea7f0bdeb21b486970acd2cf19c7a7fd95308f1764"
 dependencies = [
  "anyhow",
  "async-trait",
  "bitflags 2.11.1",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tracing",
  "wasmtime",
  "wiggle-macro",
@@ -5661,24 +5666,23 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cf267dd05673912c8138f4b54acabe6bd53407d9d1536f0fadb6520dd16e101"
+checksum = "13a019367ecff91d714d8f6cba589c36d7b16195eff0598236f9ce5aaf8b811d"
 dependencies = [
  "anyhow",
  "heck",
  "proc-macro2",
  "quote",
- "shellexpand",
  "syn",
  "witx",
 ]
 
 [[package]]
 name = "wiggle-macro"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08c5c473d4198e6c2d377f3809f713ff0c110cab88a0805ae099a82119ee250c"
+checksum = "5e2f5a33059321aee91888c331b45de1d6e9f9d0f89ab88398ef1fda2d3ee1fb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5719,20 +5723,22 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "29.0.1"
+version = "36.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f849ef2c5f46cb0a20af4b4487aaa239846e52e2c03f13fa3c784684552859c"
+checksum = "82ea9625459ce35d6a4188cf0f07c9095cbb0e5afd86f711d63955bfc4216e64"
 dependencies = [
  "anyhow",
+ "cranelift-assembler-x64",
  "cranelift-codegen",
  "gimli",
  "regalloc2",
  "smallvec",
  "target-lexicon",
- "thiserror 1.0.69",
- "wasmparser 0.221.3",
- "wasmtime-cranelift",
+ "thiserror 2.0.18",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
+ "wasmtime-internal-cranelift",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
@@ -5811,7 +5817,7 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -5820,7 +5826,16 @@ version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
 ]
 
 [[package]]
@@ -5838,14 +5853,31 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
 ]
 
 [[package]]
@@ -5854,48 +5886,96 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
 [[package]]
 name = "winx"
 version = "0.36.4"
@@ -5984,9 +6064,9 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.221.3"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "896112579ed56b4a538b07a3d16e562d101ff6265c46b515ce0c701eef16b2ac"
+checksum = "16e4833a20cd6e85d6abfea0e63a399472d6f88c6262957c17f546879a80ba15"
 dependencies = [
  "anyhow",
  "id-arena",
@@ -5997,7 +6077,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-xid",
- "wasmparser 0.221.3",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index a3c232827..a110a203f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -47,7 +47,7 @@ default-members = [
 [workspace.package]
 version = "0.1.0"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.88"
 authors = []
 license = "Apache-2.0"
 repository = "https://github.com/chrishayuk/chuk-larql-rs"
diff --git a/buf.yaml b/buf.yaml
new file mode 100644
index 000000000..bd9b8a1c6
--- /dev/null
+++ b/buf.yaml
@@ -0,0 +1,48 @@
+# buf configuration for the workspace's gRPC schemas.
+#
+# Linted in CI by `.github/workflows/quality.yml`. Two modules, one per crate
+# that owns .proto files:
+#   crates/larql-router-protocol/proto — larql.grid.v1, larql.shard.v1,
+#                                        larql.expert.v1
+#   crates/larql-server/proto          — vindex
+version: v2
+
+modules:
+  - path: crates/larql-router-protocol/proto
+  - path: crates/larql-server/proto
+
+lint:
+  use:
+    - BASIC
+  except:
+    # Both remaining BASIC rules are about *where files sit on disk*, not
+    # about whether a schema is well-formed, and both would require moving
+    # the .proto files:
+    #
+    #   PACKAGE_DIRECTORY_MATCH — wants larql/grid/v1/grid.proto rather than
+    #     proto/grid.proto, for all four schemas.
+    #   DIRECTORY_SAME_PACKAGE  — wants the three larql.*.v1 packages split
+    #     into one directory each, instead of sharing proto/.
+    #
+    # Moving them means rewriting the `tonic_build` include paths in both
+    # crates' build.rs, and the layout buf wants is only load-bearing if
+    # these schemas are ever published to a buf registry. Nothing here
+    # depends on it today.
+    #
+    # Everything BASIC actually checks about schema content — field, message,
+    # enum and service naming, enum zero-values, reserved-field hygiene —
+    # stays enforced, which is the point: it catches mistakes in *new*
+    # schemas without demanding a layout migration first.
+    - PACKAGE_DIRECTORY_MATCH
+    - DIRECTORY_SAME_PACKAGE
+
+  # Deliberately NOT enabling the STANDARD category. It requires every RPC to
+  # take a dedicated `<Method>Request`/`<Method>Response` pair, which would
+  # rename GridService.Join's ServerMessage/RouterMessage, ExpertService's
+  # ExpertLayerInput/Output, and the shared AdminAck — changing the generated
+  # Rust types and every call site. Worth doing as its own change, not as a
+  # side effect of a lint config.
+
+breaking:
+  use:
+    - FILE
diff --git a/crates/larql-cli/Cargo.toml b/crates/larql-cli/Cargo.toml
index 740cd3154..9418c04af 100644
--- a/crates/larql-cli/Cargo.toml
+++ b/crates/larql-cli/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "CLI for LARQL knowledge graph extraction and querying"
 
 [[bin]]
diff --git a/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs b/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs
index 2afe673b2..b120e0ec1 100644
--- a/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs
+++ b/crates/larql-cli/src/commands/primary/shannon_trace/decode_diff.rs
@@ -29,17 +29,22 @@ use larql_inference::residual_diff::{compare_captures, ParityThreshold, Residual
 use super::DecodeDiffArgs;
 
 pub fn run_decode_diff(args: DecodeDiffArgs) -> Result<(), Box<dyn std::error::Error>> {
-    #[cfg(not(feature = "gpu"))]
+    // The `gpu` feature alone is not enough: it compiles on every target,
+    // but `larql_compute_metal::MetalBackend` is `#[cfg(target_os =
+    // "macos")]`, so a Linux build with the feature on reaches for a type
+    // that is not there. Cargo cannot express "this feature, on this OS",
+    // so the call site carries it.
+    #[cfg(not(all(feature = "gpu", target_os = "macos")))]
     {
         let _ = args;
         return Err(format!(
             "decode-diff compares the CPU and Metal backends, so it needs the \
-             `gpu` feature; rebuild with --features gpu"
+             `gpu` feature on macOS; rebuild with --features gpu on a Mac"
         )
         .into());
     }
 
-    #[cfg(feature = "gpu")]
+    #[cfg(all(feature = "gpu", target_os = "macos"))]
     {
         let vindex = &args.vindex;
         if !vindex.is_dir() {
diff --git a/crates/larql-compute-metal/Cargo.toml b/crates/larql-compute-metal/Cargo.toml
index 3ad2b7a92..d03ed2538 100644
--- a/crates/larql-compute-metal/Cargo.toml
+++ b/crates/larql-compute-metal/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Metal GPU backend for LARQL. Implements `larql_compute::ComputeBackend` on Apple Silicon via `metal-rs` + custom MSL shaders. Decoupled from larql-compute so non-Mac hosts skip the build entirely."
 keywords = ["metal", "gpu", "apple-silicon", "matmul", "quantization"]
 categories = ["science"]
diff --git a/crates/larql-compute/Cargo.toml b/crates/larql-compute/Cargo.toml
index 59a82a1b1..a510dd271 100644
--- a/crates/larql-compute/Cargo.toml
+++ b/crates/larql-compute/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Compute backend trait + CPU implementation for LARQL. GPU backends ship as sibling crates (larql-compute-metal, future larql-compute-vulkan / larql-compute-cuda)."
 keywords = ["matmul", "cpu", "blas", "quantization", "trait"]
 categories = ["science"]
diff --git a/crates/larql-core/Cargo.toml b/crates/larql-core/Cargo.toml
index 92a36ae44..95e2f8151 100644
--- a/crates/larql-core/Cargo.toml
+++ b/crates/larql-core/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Core graph engine for LARQL — knowledge graphs extracted from neural network weights"
 keywords = ["knowledge-graph", "llm", "interpretability", "graph"]
 categories = ["data-structures", "science"]
diff --git a/crates/larql-demos/Cargo.toml b/crates/larql-demos/Cargo.toml
index a7739df3b..fb80d6291 100644
--- a/crates/larql-demos/Cargo.toml
+++ b/crates/larql-demos/Cargo.toml
@@ -11,6 +11,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Runnable demonstrations of larql's shipped capabilities"
 publish = false
 autoexamples = false        # folders mirror the source crate; all declared below
diff --git a/crates/larql-execution/Cargo.toml b/crates/larql-execution/Cargo.toml
index ceac1a569..89904acd2 100644
--- a/crates/larql-execution/Cargo.toml
+++ b/crates/larql-execution/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Execution-refusal semantics shared across LARQL's runtime crates. Zero larql-* deps."
 keywords = ["execution", "refusal", "runtime"]
 categories = ["data-structures"]
diff --git a/crates/larql-factory/Cargo.toml b/crates/larql-factory/Cargo.toml
index dc49e8ac0..b80112150 100644
--- a/crates/larql-factory/Cargo.toml
+++ b/crates/larql-factory/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Vindex Factory recipe schema, build_id canonicaliser, and structural validator (docs/vindex-factory.md)"
 keywords = ["vindex", "factory", "recipe", "schema"]
 categories = ["data-structures", "encoding"]
diff --git a/crates/larql-inference/Cargo.toml b/crates/larql-inference/Cargo.toml
index 199f7b53d..0656b1adc 100644
--- a/crates/larql-inference/Cargo.toml
+++ b/crates/larql-inference/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Transformer inference engine — forward pass, attention, FFN, layer norm from safetensors weights"
 keywords = ["transformer", "inference", "llm", "interpretability"]
 categories = ["science"]
@@ -71,8 +72,8 @@ async-stream = "0.3"
 futures = "0.3"
 
 # WASM expert registry
-wasmtime = { version = "29", default-features = false, features = ["cranelift", "runtime"] }
-wasmtime-wasi = "29"
+wasmtime = { version = "36.0.7", default-features = false, features = ["cranelift", "runtime"] }
+wasmtime-wasi = "36.0.7"
 anyhow = "1"
 
 
diff --git a/crates/larql-inference/examples/decode_vs_prefill.rs b/crates/larql-inference/examples/decode_vs_prefill.rs
index c8b5aaae5..12cb2026f 100644
--- a/crates/larql-inference/examples/decode_vs_prefill.rs
+++ b/crates/larql-inference/examples/decode_vs_prefill.rs
@@ -24,18 +24,27 @@
 //!   cargo run --release --features metal -p larql-inference \
 //!     --example decode_vs_prefill -- <vindex-dir> [prompt]
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 extern crate blas_src;
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use std::path::PathBuf;
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use std::time::Instant;
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use larql_compute::{ComputeBackend, DecodeBackend};
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use larql_inference::layer_graph::generate::generate;
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use larql_inference::layer_graph::CachedLayerGraph;
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 use larql_inference::wrap_chat_prompt;
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 const DEFAULT_EXAMPLE_KV_CACHE_MAX_SEQ: usize = 4096;
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let mut args = std::env::args().skip(1);
     let vindex_path = PathBuf::from(
@@ -322,6 +331,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 fn build_layers<'a>(
     weights: &'a larql_inference::model::ModelWeights,
     index: &'a larql_vindex::VectorIndex,
@@ -358,6 +368,7 @@ fn build_layers<'a>(
     )
 }
 
+#[cfg(all(feature = "gpu", target_os = "macos"))]
 fn compare(a: &[f32], b: &[f32]) -> (f32, f32, f32, f32) {
     let mut dot = 0.0f64;
     let mut an = 0.0f64;
@@ -381,3 +392,8 @@ fn compare(a: &[f32], b: &[f32]) -> (f32, f32, f32, f32) {
     };
     (cos, max_abs, an.sqrt() as f32, bn.sqrt() as f32)
 }
+
+#[cfg(not(all(feature = "gpu", target_os = "macos")))]
+fn main() {
+    eprintln!("decode_vs_prefill requires `--features metal` on macOS.");
+}
diff --git a/crates/larql-kv/src/engines/boundary_kv/engine.rs b/crates/larql-kv/src/engines/boundary_kv/engine.rs
index c3e8ae61d..8b3a6c789 100644
--- a/crates/larql-kv/src/engines/boundary_kv/engine.rs
+++ b/crates/larql-kv/src/engines/boundary_kv/engine.rs
@@ -137,7 +137,7 @@ impl BoundaryKvEngine {
     /// True iff `abs_position` (the just-completed step) lands on a chunk
     /// boundary. Position 0 is never a boundary.
     fn at_chunk_boundary(&self) -> bool {
-        self.abs_position > 0 && self.abs_position % self.chunk_tokens() == 0
+        self.abs_position > 0 && self.abs_position.is_multiple_of(self.chunk_tokens())
     }
 
     /// The archive chain id frames are currently emitted under.
diff --git a/crates/larql-kv/src/engines/markov_residual/compute.rs b/crates/larql-kv/src/engines/markov_residual/compute.rs
index 6ede1cd6c..242b52202 100644
--- a/crates/larql-kv/src/engines/markov_residual/compute.rs
+++ b/crates/larql-kv/src/engines/markov_residual/compute.rs
@@ -342,10 +342,11 @@ pub(crate) fn markov_inplace_kv_enabled() -> bool {
 }
 
 fn markov_walk_kv_diag_layer(layer: usize) -> bool {
-    // `is_none_or` is MSRV 1.82; project pins MSRV 1.80. Equivalent
-    // semantics: env-var absent → true (diag applies to all layers),
-    // env-var present → check the comma-list.
-    read_markov_env("LARQL_MARKOV_WALK_KV_LAYERS").map_or(true, |spec| layer_in_spec(&spec, layer))
+    // Env-var absent → true (diag applies to all layers); present → check
+    // the comma-list. This was a `map_or(true, ..)` while the workspace
+    // pinned MSRV 1.80, since `is_none_or` stabilised in 1.82; the MSRV is
+    // 1.88 now, so it says what it means.
+    read_markov_env("LARQL_MARKOV_WALK_KV_LAYERS").is_none_or(|spec| layer_in_spec(&spec, layer))
 }
 
 fn layer_in_spec(spec: &str, layer: usize) -> bool {
diff --git a/crates/larql-kv/src/engines/turbo_quant/engine.rs b/crates/larql-kv/src/engines/turbo_quant/engine.rs
index de1ab812e..5b6239981 100644
--- a/crates/larql-kv/src/engines/turbo_quant/engine.rs
+++ b/crates/larql-kv/src/engines/turbo_quant/engine.rs
@@ -253,7 +253,7 @@ impl CompressedLayer {
 
 pub(super) fn detect_head_dim(kv_dim: usize) -> usize {
     for &hd in &[256usize, 128, 64, 32] {
-        if kv_dim % hd == 0 {
+        if kv_dim.is_multiple_of(hd) {
             return hd;
         }
     }
diff --git a/crates/larql-lql/Cargo.toml b/crates/larql-lql/Cargo.toml
index d98df1c88..45d3ed382 100644
--- a/crates/larql-lql/Cargo.toml
+++ b/crates/larql-lql/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "LQL parser, executor, and REPL for LARQL"
 
 [dependencies]
diff --git a/crates/larql-models/Cargo.toml b/crates/larql-models/Cargo.toml
index 9f81ce0e9..e10a210f0 100644
--- a/crates/larql-models/Cargo.toml
+++ b/crates/larql-models/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Model architecture definitions for LARQL — traits, config parsing, tensor key mappings"
 keywords = ["transformer", "model-config", "llm", "architecture"]
 categories = ["data-structures"]
diff --git a/crates/larql-python/Cargo.toml b/crates/larql-python/Cargo.toml
index 4c0189a42..79ef5f406 100644
--- a/crates/larql-python/Cargo.toml
+++ b/crates/larql-python/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Python bindings for LARQL knowledge graph engine and vindex"
 
 [lib]
@@ -17,8 +18,8 @@ larql-kv = { path = "../larql-kv" }
 larql-models = { path = "../larql-models" }
 larql-vindex = { path = "../larql-vindex" }
 larql-lql = { path = "../larql-lql" }
-pyo3 = { version = "0.24", features = ["extension-module"] }
-numpy = "0.24"
+pyo3 = { version = "0.29", features = ["extension-module"] }
+numpy = "0.29"
 ndarray = "0.16"
 memmap2 = "0.9"
 serde = { workspace = true }
diff --git a/crates/larql-python/src/lib.rs b/crates/larql-python/src/lib.rs
index 36f47c785..c19a7a09d 100644
--- a/crates/larql-python/src/lib.rs
+++ b/crates/larql-python/src/lib.rs
@@ -40,7 +40,7 @@ fn parse_merge_strategy(s: &str) -> lq::MergeStrategy {
 
 // ── PyEdge ──
 
-#[pyclass(name = "Edge")]
+#[pyclass(name = "Edge", from_py_object)]
 #[derive(Clone)]
 pub struct PyEdge {
     inner: lq::Edge,
@@ -209,7 +209,7 @@ impl PyEdge {
 
 // ── PyNode ──
 
-#[pyclass(name = "Node")]
+#[pyclass(name = "Node", from_py_object)]
 #[derive(Clone)]
 pub struct PyNode {
     inner: lq::core::node::Node,
diff --git a/crates/larql-python/src/vindex.rs b/crates/larql-python/src/vindex.rs
index 154e118cb..ac3488d89 100644
--- a/crates/larql-python/src/vindex.rs
+++ b/crates/larql-python/src/vindex.rs
@@ -156,7 +156,7 @@ fn is_content_token(tok: &str) -> bool {
 
 // ── PyDescribeEdge ──
 
-#[pyclass(name = "DescribeEdge")]
+#[pyclass(name = "DescribeEdge", from_py_object)]
 #[derive(Clone)]
 pub struct PyDescribeEdge {
     #[pyo3(get)]
@@ -190,7 +190,7 @@ impl PyDescribeEdge {
 
 // ── PyRelation ──
 
-#[pyclass(name = "Relation")]
+#[pyclass(name = "Relation", from_py_object)]
 #[derive(Clone)]
 pub struct PyRelation {
     #[pyo3(get)]
@@ -215,7 +215,7 @@ impl PyRelation {
 
 // ── PyFeatureMeta ──
 
-#[pyclass(name = "FeatureMeta")]
+#[pyclass(name = "FeatureMeta", from_py_object)]
 #[derive(Clone)]
 pub struct PyFeatureMeta {
     inner: FeatureMeta,
@@ -261,7 +261,7 @@ impl PyFeatureMeta {
 
 // ── PyWalkHit ──
 
-#[pyclass(name = "WalkHit")]
+#[pyclass(name = "WalkHit", from_py_object)]
 #[derive(Clone)]
 pub struct PyWalkHit {
     inner_layer: usize,
diff --git a/crates/larql-router-protocol/Cargo.toml b/crates/larql-router-protocol/Cargo.toml
index a30effaa9..4d4f723a4 100644
--- a/crates/larql-router-protocol/Cargo.toml
+++ b/crates/larql-router-protocol/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "gRPC protocol types for the larql-router self-assembling grid"
 
 [dependencies]
diff --git a/crates/larql-router/Cargo.toml b/crates/larql-router/Cargo.toml
index 38a7aab72..efe0a95d2 100644
--- a/crates/larql-router/Cargo.toml
+++ b/crates/larql-router/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Layer-sharding router for distributed larql-server deployments"
 
 [lib]
diff --git a/crates/larql-server/Cargo.toml b/crates/larql-server/Cargo.toml
index db123fdec..35bfa5ab5 100644
--- a/crates/larql-server/Cargo.toml
+++ b/crates/larql-server/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "HTTP server for vindex knowledge queries and inference"
 
 [lib]
diff --git a/crates/larql-vindex-spec/Cargo.toml b/crates/larql-vindex-spec/Cargo.toml
index 6a2ee7b06..459d80264 100644
--- a/crates/larql-vindex-spec/Cargo.toml
+++ b/crates/larql-vindex-spec/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Public contract for the vindex on-disk format: Rust types, JSON Schema, validation thresholds. Zero larql-* deps."
 keywords = ["vindex", "spec", "schema", "manifest"]
 categories = ["data-structures", "encoding"]
diff --git a/crates/larql-vindex/Cargo.toml b/crates/larql-vindex/Cargo.toml
index 1bfaf3a4f..70d2e9f51 100644
--- a/crates/larql-vindex/Cargo.toml
+++ b/crates/larql-vindex/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Vindex — the queryable model format. Storage, KNN index, build, load, mutate."
 keywords = ["transformer", "vindex", "knn", "interpretability"]
 categories = ["science"]
diff --git a/crates/model-compute/Cargo.toml b/crates/model-compute/Cargo.toml
index 3cc974590..731557634 100644
--- a/crates/model-compute/Cargo.toml
+++ b/crates/model-compute/Cargo.toml
@@ -4,6 +4,7 @@ version.workspace = true
 edition.workspace = true
 authors.workspace = true
 license.workspace = true
+rust-version.workspace = true
 description = "Bounded-cost compute for neural-model pipelines: native Rust kernels (default) and wasmtime-hosted WASM modules (opt-in)"
 keywords = ["wasm", "kernel", "deterministic", "solver", "aot"]
 categories = ["wasm", "mathematics"]
@@ -21,7 +22,7 @@ evalexpr = { version = "11", optional = true }
 chrono = { version = "0.4", optional = true, default-features = false, features = ["std", "clock"] }
 
 # Feature: wasm host
-wasmtime = { version = "29", optional = true, default-features = false, features = ["cranelift", "runtime", "std"] }
+wasmtime = { version = "36.0.7", optional = true, default-features = false, features = ["cranelift", "runtime", "std"] }
 
 [dev-dependencies]
 wat = "1"
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 000000000..2da24fe29
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,125 @@
+# cargo-deny configuration for the larql workspace.
+#
+# Checked in CI by `.github/workflows/quality.yml`. Four independent checks run:
+#   advisories — RustSec database scan (vulnerabilities are hard failures)
+#   licenses   — SPDX allow-list; anything outside it fails
+#   bans       — duplicate-version and banned-crate policy
+#   sources    — registries and git remotes crates may come from
+#
+# Schema targets cargo-deny 0.20.x.
+
+[graph]
+# Evaluate every target the workspace actually supports, so a Windows-only or
+# Linux-only dependency cannot smuggle in an unreviewed licence or advisory.
+targets = [
+    "aarch64-apple-darwin",
+    "x86_64-apple-darwin",
+    "x86_64-unknown-linux-gnu",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-pc-windows-msvc",
+]
+all-features = true
+
+[output]
+feature-depth = 1
+
+# ---------------------------------------------------------------------------
+# Advisories
+# ---------------------------------------------------------------------------
+[advisories]
+db-urls = ["https://github.com/rustsec/advisory-db"]
+# Vulnerabilities and unmaintained/unsound notices are all errors by default in
+# 0.20; everything we cannot act on is listed explicitly below with a reason.
+yanked = "deny"
+
+ignore = [
+    # --- unmaintained, pinned by upstream crates we do not control -----------
+    # number_prefix <- indicatif 0.17. No maintained fork; indicatif has not
+    # cut a release that drops it. Formatting-only crate, no untrusted input.
+    { id = "RUSTSEC-2025-0119", reason = "number_prefix is pulled by indicatif 0.17; no upstream release drops it yet" },
+    # paste <- tokenizers 0.21, metal 0.29, macro_rules_attribute. Proc-macro
+    # that expands at compile time only; nothing of it survives into a binary.
+    { id = "RUSTSEC-2024-0436", reason = "paste is a compile-time proc-macro pulled by tokenizers/metal; no runtime surface" },
+    # rustls-pemfile <- axum-server 0.7. Superseded by rustls-pki-types, which
+    # axum-server has not migrated to.
+    { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is pulled by axum-server 0.7; upstream has not migrated to rustls-pki-types" },
+
+    # NOTE: RUSTSEC-2026-0205 (scc 2.4.0, unsound `Array::insert`) is *not*
+    # listed here. cargo-deny's dependency graph does not reach it, so an
+    # ignore entry would only produce an `advisory-not-detected` warning.
+    # `cargo audit`, which scans Cargo.lock entry-by-entry, does report it as
+    # a warning. It stays a warning deliberately: scc arrives solely as a
+    # dev-dependency of serial_test, which pins `scc ^2` while the fix landed
+    # in scc 3.x. It is never linked into a shipped artefact.
+]
+
+# ---------------------------------------------------------------------------
+# Licenses
+# ---------------------------------------------------------------------------
+# The workspace itself ships under Apache-2.0. Everything below is either
+# permissive or (MPL-2.0) file-level copyleft that we satisfy by not modifying
+# the upstream files.
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MIT",
+    "MIT-0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "0BSD",
+    "BSL-1.0",          # clipboard-win, error-code, ryu (as an OR alternative)
+    "CC0-1.0",          # dunce (offered alongside MIT-0/Apache-2.0)
+    "Unlicense",        # offered alongside MIT by the `byteorder` family
+    "Unicode-3.0",      # the ICU4X crates behind idna/url
+    "CDLA-Permissive-2.0", # webpki-roots: a certificate *data* set, not code
+    "MPL-2.0",          # colored, option-ext — see note below
+]
+# `confidence-threshold` governs fuzzy matching of licence *files* for crates
+# that ship text rather than an SPDX expression. Every crate in the current
+# graph declares an expression, so this only guards future additions.
+confidence-threshold = 0.93
+
+# On MPL-2.0, the only non-permissive licence in the allow-list above.
+# It is file-level copyleft: the obligation to publish source attaches to
+# modified MPL-licensed *files*, not to anything that links against them.
+# The two crates carrying it — `colored` (terminal colour codes) and
+# `option-ext` (an Option extension trait, via dirs-sys) — are consumed
+# unmodified from crates.io, so Apache-2.0 distribution of larql is
+# unaffected. If either is ever vendored and patched, that patch must ship
+# under MPL-2.0.
+#
+# No `[[licenses.clarify]]` entries are needed: every crate in the graph
+# declares an SPDX expression in its manifest, so there is nothing to
+# disambiguate from licence-file text.
+
+# ---------------------------------------------------------------------------
+# Bans
+# ---------------------------------------------------------------------------
+[bans]
+multiple-versions = "warn"      # informational: the graph legitimately carries
+                                # several windows-sys / syn generations
+highlight = "all"
+
+# `wildcards` is "warn", not "deny", and that is a deliberate, temporary
+# setting. The workspace's own crates depend on each other by bare `path`
+# with no `version` key, which cargo-deny counts as a wildcard. Its
+# `allow-wildcard-paths` escape hatch does not apply here because it only
+# exempts crates marked `publish = false`, and all but larql-demos are
+# publishable. The real fix is to give each intra-workspace path dependency
+# a `version` alongside its `path` — required anyway before any of these can
+# be published to crates.io, and therefore owned by the release work in
+# ADR-0026 rather than by this security pass. Flip this to "deny" once that
+# lands.
+wildcards = "warn"
+
+# ---------------------------------------------------------------------------
+# Sources
+# ---------------------------------------------------------------------------
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
diff --git a/nix/README.md b/nix/README.md
index 039d2ff2d..0fb88d151 100644
--- a/nix/README.md
+++ b/nix/README.md
@@ -53,7 +53,7 @@ The Nix development environment provides the following (from nixpkgs unstable):
 
 | Package | Purpose |
 |---------|---------|
-| Rust (~1.92) | Compiler and cargo (well above `rust-version = "1.75"` minimum) |
+| Rust (~1.92) | Compiler and cargo (above the `rust-version = "1.88"` minimum) |
 | OpenBLAS | BLAS backend for `ndarray` (Linux) |
 | Accelerate | BLAS backend (macOS, via Apple framework) |
 | protobuf | gRPC code generation for `larql-server` |