diff --git a/.gitea/workflows/api-surface.yml b/.gitea/workflows/api-surface.yml
deleted file mode 100644
index ff621c7..0000000
--- a/.gitea/workflows/api-surface.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-name: API and SemVer surface
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/api-surface.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "api/**"
-      - "ci/evidence/api-audit.json"
-      - "crates/**"
-      - "tests/api-compile/**"
-      - "tests/semver-port/**"
-      - "tools/check_api_coverage.py"
-      - "tools/generate_api_shims.py"
-      - "tools/generate_rust_mapping.py"
-      - "tools/ci-matrix/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/api-surface.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "api/**"
-      - "ci/evidence/api-audit.json"
-      - "crates/**"
-      - "tests/api-compile/**"
-      - "tests/semver-port/**"
-      - "tools/check_api_coverage.py"
-      - "tools/generate_api_shims.py"
-      - "tools/generate_rust_mapping.py"
-      - "tools/ci-matrix/**"
-
-jobs:
-  api-surface:
-    runs-on: ubuntu-latest
-    env:
-      CARGO_BUILD_JOBS: "1"
-      CARGO_INCREMENTAL: "0"
-      CARGO_PROFILE_DEV_DEBUG: "0"
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install native prerequisites
-        run: sudo apt-get update && sudo apt-get install -y libopus-dev pkg-config
-
-      - name: Install Rust 1.97
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: "1.97.0"
-          components: rustfmt, clippy
-
-      - name: Verify deterministic mapping and export coverage
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-
-      - name: Verify reviewed API baseline
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- api-baseline-write
-          git diff --exit-code -- api/SEMVER-BASELINE.json api/SEMVER-AUDIT.md
-          cargo run --locked -p metacrate-ci-matrix -- api-audit --evidence /tmp/metacrate-api-audit.json
-          cmp /tmp/metacrate-api-audit.json ci/evidence/api-audit.json
-
-      - name: Compile downstream API consumers
-        run: |
-          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
-          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
-
-      - name: Check formatting and lints
-        run: |
-          cargo fmt --all -- --check
-          cargo fmt --manifest-path tests/semver-port/Cargo.toml -- --check
-          cargo clippy --locked -p metacrate-ci-matrix --all-targets -- -D warnings
-          cargo clippy --locked --manifest-path tests/semver-port/Cargo.toml --all-targets -- -D warnings
-
-      - name: Upload audit evidence
-        uses: actions/upload-artifact@v3
-        with:
-          name: api-semver-audit
-          path: ci/evidence/api-audit.json
diff --git a/.gitea/workflows/artifact-audit.yml b/.gitea/workflows/artifact-audit.yml
deleted file mode 100644
index de5b969..0000000
--- a/.gitea/workflows/artifact-audit.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-name: Native release artifact audit
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/artifact-audit.yml"
-      - "ci/artifact-policy.json"
-      - "ci/dependency-policy.json"
-      - "ci/provenance-policy.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-artifacts.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/artifact-audit.yml"
-      - "ci/artifact-policy.json"
-      - "ci/dependency-policy.json"
-      - "ci/provenance-policy.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-artifacts.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-artifact-audit
-  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib/pkgconfig
-  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-artifact-audit/lib
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.97.1
-      - name: Install documented native prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-          pkg-config --exact-version 2.5.4 libopenjp2
-          pkg-config --modversion opus
-      - name: Record source identity without a shipped build helper
-        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
-      - name: Fetch the locked dependency graph
-        run: cargo fetch --locked
-      - name: Create every release source package atomically
-        run: |
-          cargo package --locked --no-verify \
-            -p libremetaverse-types \
-            -p libremetaverse-structured-data \
-            -p libremetaverse-imaging \
-            -p libremetaverse-imaging-skia \
-            -p libremetaverse-openjpeg \
-            -p libremetaverse-opus \
-            -p libremetaverse-prim-mesher \
-            -p libremetaverse-lsl-tools \
-            -p libremetaverse \
-            -p libremetaverse-rendering-simple \
-            -p libremetaverse-rendering-mesh-foundry \
-            -p libremetaverse-rlv \
-            -p libremetaverse-utilities \
-            -p libremetaverse-voice-vivox \
-            -p libremetaverse-voice-webrtc \
-            -p libremetaverse-programs
-      - name: Build every shipped native executable
-        run: cargo build --locked --release -j 1 -p libremetaverse-programs --bins
-      - name: Inspect packages, binaries, links, and offline runtime behavior
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- artifact-audit \
-            --artifact-dir target/release \
-            --package-dir target/package \
-            --evidence artifacts/release/artifact-audit.json
-      - name: Upload immutable audit evidence and source packages
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: native-release-artifact-audit
-          path: |
-            artifacts/release/artifact-audit.json
-            target/package/*.crate
-          if-no-files-found: error
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..25c1a0b
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,104 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      cold_cache:
+        description: Deliberately clear the required dependency/native cache before validation
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  required:
+    name: required
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_INCREMENTAL: "0"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      RUSTDOCFLAGS: "-D warnings"
+      CARGO_HOME: ${{ runner.tool_cache }}/metacrate/cargo/home-rust-1.97.1-aarch64-unknown-linux-gnu
+      METACRATE_EXPECTED_HOST: aarch64-unknown-linux-gnu
+      METACRATE_PROVENANCE_DIAGNOSTICS_DIR: artifacts/ci/provenance-candidates
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Inspect the runner-persistent, architecture-keyed cache
+        run: |
+          cache_key="$(sha256sum .gitea/workflows/ci.yml Cargo.lock Cargo.toml ci/ci-coverage.json ci/dependency-policy.json deny.toml tools/install_openjpeg_2_5_4.sh crates/libremetaverse-imaging-skia/Cargo.toml | sha256sum | cut -d ' ' -f 1)"
+          cargo_target="${{ runner.tool_cache }}/metacrate/cargo/target-rust-1.97.1-aarch64-unknown-linux-gnu-$cache_key"
+          openjpeg_prefix="${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}"
+          skia_dir="${{ runner.tool_cache }}/metacrate/native/skia-0.99.0-aarch64-unknown-linux-gnu"
+          skia_archive="$skia_dir/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz"
+          if test "${{ github.event_name }}" = workflow_dispatch && test "${{ inputs.cold_cache }}" = true; then
+            cargo clean --target-dir "$cargo_target"
+            rm -rf -- "$CARGO_HOME/registry" "$CARGO_HOME/git" "$openjpeg_prefix" "$skia_dir"
+            rm -f -- "$CARGO_HOME/bin/cargo-deny" "$CARGO_HOME/bin/cargo-machete"
+          fi
+          mkdir -p "$CARGO_HOME" "$cargo_target" "$skia_dir"
+          test -f "$cargo_target/.metacrate-ready" && cargo_hit=true || cargo_hit=false
+          test -f "$openjpeg_prefix/metacrate-openjpeg.identity" && test -f "$skia_archive" && native_hit=true || native_hit=false
+          test -x "$CARGO_HOME/bin/cargo-deny" && test -x "$CARGO_HOME/bin/cargo-machete" && tools_hit=true || tools_hit=false
+          echo "CARGO_TARGET_DIR=$cargo_target" >> "$GITHUB_ENV"
+          echo "OPENJPEG_PREFIX=$openjpeg_prefix" >> "$GITHUB_ENV"
+          echo "PKG_CONFIG_PATH=$openjpeg_prefix/lib/pkgconfig" >> "$GITHUB_ENV"
+          echo "LD_LIBRARY_PATH=$openjpeg_prefix/lib" >> "$GITHUB_ENV"
+          echo "METACRATE_SKIA_ARCHIVE=$skia_archive" >> "$GITHUB_ENV"
+          echo "METACRATE_CARGO_CACHE_HIT=$cargo_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_NATIVE_CACHE_HIT=$native_hit" >> "$GITHUB_ENV"
+          echo "METACRATE_TOOLS_CACHE_HIT=$tools_hit" >> "$GITHUB_ENV"
+
+      - name: Install the single native prerequisite set
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl git ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+
+      - name: Install pinned Rust and audit tools
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: clippy,rustfmt
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny@0.20.2,cargo-machete@0.9.2
+
+      - name: Verify pinned audit tool versions
+        run: |
+          cargo deny --version | grep '0.20.2'
+          cargo machete --version | grep '0.9.2'
+
+      - name: Validate and populate the exact native cache
+        run: |
+          test "$(uname -m)" = aarch64
+          rustc -vV | grep '^host: aarch64-unknown-linux-gnu$'
+          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+          pkg-config --exact-version 2.5.4 libopenjp2
+          mkdir -p "$(dirname "$METACRATE_SKIA_ARCHIVE")"
+          if ! echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check --status; then
+            curl --fail --location --proto '=https' --tlsv1.2 --output "$METACRATE_SKIA_ARCHIVE" \
+              https://github.com/rust-skia/skia-binaries/releases/download/0.99.0/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz
+          fi
+          echo 'dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c  '"$METACRATE_SKIA_ARCHIVE" | sha256sum --check
+
+      - name: Run the authoritative code-ready graph
+        run: cargo run --locked -p metacrate-ci-matrix -- required-gate --evidence artifacts/ci/required-gate.json
+
+      - name: Mark the validated cache generation ready
+        run: touch "$CARGO_TARGET_DIR/.metacrate-ready"
+
+      - name: Upload stage timing and audit evidence
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: required-ci-evidence
+          path: artifacts/ci/
+          if-no-files-found: error
diff --git a/.gitea/workflows/codegen.yml b/.gitea/workflows/codegen.yml
deleted file mode 100644
index c616c8a..0000000
--- a/.gitea/workflows/codegen.yml
+++ /dev/null
@@ -1,175 +0,0 @@
-name: Native code generation
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/codegen.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "api/**"
-      - "codegen/**"
-      - "tools/codegen/**"
-      - "tools/generate_*.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_api_coverage.py"
-      - "tools/check_codegen_gate.py"
-      - "tools/check_milestone_08.py"
-      - "tools/check_milestone_09_issue_59.py"
-      - "tools/check_milestone_09_issue_60.py"
-      - "tools/check_milestone_09_issue_61.py"
-      - "tools/check_milestone_09_issue_62.py"
-      - "tools/check_milestone_09_issue_63.py"
-      - "tools/check_milestone_09_issue_64.py"
-      - "tools/check_milestone_09_issue_65.py"
-      - "tools/check_milestone_09_issue_66.py"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "crates/libremetaverse/src/agent_movement.rs"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse/src/inventory_ais.rs"
-      - "crates/libremetaverse/src/inventory_ais_internal_semantics.rs"
-      - "docs/agent-movement.md"
-      - "docs/inventory.md"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/packets.rs"
-      - "crates/libremetaverse/src/packet_*.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "tests/api-compile/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/wire_semantics.rs"
-      - "tests/compat/tests/appearance_visual_semantics.rs"
-      - "tests/compat/tests/inventory_store_semantics.rs"
-      - "tests/compat/tests/inventory_manager_semantics.rs"
-      - "tests/compat/tests/inventory_ais_semantics.rs"
-      - "tests/compat/tests/task_inventory_semantics.rs"
-      - "tests/compat/tests/misclassified_link_semantics.rs"
-      - "tests/upstream-tests.json"
-  pull_request:
-    paths:
-      - ".gitea/workflows/codegen.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "api/**"
-      - "codegen/**"
-      - "tools/codegen/**"
-      - "tools/generate_*.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_api_coverage.py"
-      - "tools/check_codegen_gate.py"
-      - "tools/check_milestone_08.py"
-      - "tools/check_milestone_09_issue_59.py"
-      - "tools/check_milestone_09_issue_60.py"
-      - "tools/check_milestone_09_issue_61.py"
-      - "tools/check_milestone_09_issue_62.py"
-      - "tools/check_milestone_09_issue_63.py"
-      - "tools/check_milestone_09_issue_64.py"
-      - "tools/check_milestone_09_issue_65.py"
-      - "tools/check_milestone_09_issue_66.py"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "crates/libremetaverse/src/agent_movement.rs"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse/src/inventory_ais.rs"
-      - "crates/libremetaverse/src/inventory_ais_internal_semantics.rs"
-      - "docs/agent-movement.md"
-      - "docs/inventory.md"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/packets.rs"
-      - "crates/libremetaverse/src/packet_*.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "tests/api-compile/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/wire_semantics.rs"
-      - "tests/compat/tests/appearance_visual_semantics.rs"
-      - "tests/compat/tests/inventory_store_semantics.rs"
-      - "tests/compat/tests/inventory_manager_semantics.rs"
-      - "tests/compat/tests/inventory_ais_semantics.rs"
-      - "tests/compat/tests/task_inventory_semantics.rs"
-      - "tests/compat/tests/misclassified_link_semantics.rs"
-      - "tests/upstream-tests.json"
-  workflow_dispatch:
-
-jobs:
-  deterministic:
-    runs-on: ubuntu-latest
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy,rustfmt
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Test diagnostics and byte-identical generation
-        run: cargo test -p libremetaverse-codegen
-      - name: Verify vendored hashes and checked-in output
-        run: cargo run -p libremetaverse-codegen -- check
-      - name: Verify authoritative API mappings and consumer fixture
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-          python3 tools/check_milestone_08.py
-          python3 tools/check_milestone_09_issue_59.py
-          python3 tools/check_milestone_09_issue_60.py
-          python3 tools/check_milestone_09_issue_61.py
-          python3 tools/check_milestone_09_issue_62.py
-          python3 tools/check_milestone_09_issue_63.py
-          python3 tools/check_milestone_09_issue_64.py
-          python3 tools/check_milestone_09_issue_65.py
-          python3 tools/check_milestone_09_issue_66.py
-          python3 tools/check_milestone_09.py
-          cargo check --manifest-path tests/api-compile/Cargo.toml --locked
-      - name: Test generated wire codecs and translated parity cases
-        run: |
-          cargo test -p libremetaverse --lib generated_codec_tests
-          cargo test -p libremetaverse --test packet_wire
-          cargo test -p libremetaverse --test packet_osd
-          cargo test -p libremetaverse-compat-tests --test wire_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_store_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_manager_semantics
-          cargo test -p libremetaverse-compat-tests --test inventory_ais_semantics
-          cargo test -p libremetaverse --lib inventory_ais_internal_semantics
-          cargo test -p libremetaverse-compat-tests --test task_inventory_semantics
-          cargo test -p libremetaverse-compat-tests --test misclassified_link_semantics
-      - name: Test generated visual and foliage catalogs
-        run: |
-          cargo test -p libremetaverse --test generated_catalogs
-          cargo test -p libremetaverse-compat-tests --test appearance_visual_semantics
-          cargo test -p libremetaverse-compat-tests --test appearance_semantics
-          cargo test -p libremetaverse --lib appearance_
-          cargo test -p libremetaverse --lib initial_outfit::tests
-      - name: Test generated skeleton, attention, and genepool catalogs
-        run: |
-          cargo test -p libremetaverse --test generated_avatar_catalogs
-          cargo test -p libremetaverse --lib linden_skeleton
-          cargo test -p libremetaverse --lib joint_base_support_category
-          cargo test -p libremetaverse --lib joint_get_aliases_list
-      - name: Build and audit clean Rust-only release artifacts
-        run: |
-          cargo build -p libremetaverse-codegen --release --locked -j 1
-          python3 tools/check_codegen_gate.py --release-dir target/release
-      - name: Lint native generator
-        run: |
-          cargo clippy -p libremetaverse-codegen --all-targets -- -D warnings
-          cargo clippy -p libremetaverse --lib --no-deps -- -D warnings
-      - name: Prove normal consumer build does not execute generation
-        run: cargo build -p libremetaverse --locked
diff --git a/.gitea/workflows/concurrency-audit.yml b/.gitea/workflows/concurrency-audit.yml
deleted file mode 100644
index 1d0d793..0000000
--- a/.gitea/workflows/concurrency-audit.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Concurrency and resource soak audit
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/concurrency-audit.yml"
-      - "ci/concurrency-thresholds.json"
-      - "tools/concurrency-audit/**"
-      - "docs/concurrency-hardening.md"
-      - "crates/libremetaverse/src/client_core.rs"
-      - "crates/libremetaverse/src/download_manager.rs"
-      - "crates/libremetaverse/src/appearance_manager.rs"
-      - "crates/libremetaverse/src/asset_manager.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse-voice-webrtc/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/concurrency-audit.yml"
-      - "ci/concurrency-thresholds.json"
-      - "tools/concurrency-audit/**"
-      - "docs/concurrency-hardening.md"
-      - "crates/libremetaverse/src/client_core.rs"
-      - "crates/libremetaverse/src/download_manager.rs"
-      - "crates/libremetaverse/src/appearance_manager.rs"
-      - "crates/libremetaverse/src/asset_manager.rs"
-      - "crates/libremetaverse/src/inventory_manager.rs"
-      - "crates/libremetaverse-voice-webrtc/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-
-jobs:
-  soak:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - name: Install native voice prerequisite
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes libopus-dev pkg-config
-      - name: Check formatting and focused race regressions
-        run: |
-          cargo fmt --all -- --check
-          cargo test --locked -p libremetaverse --lib shutdown_does_not_hold_service_registry_lock_across_callbacks -j 1
-          cargo test --locked -p libremetaverse --lib event_registry_isolates_panics_and_releases_subscriptions -j 1
-          cargo test --locked -p libremetaverse --lib dispatch_isolates_panics_and_does_not_retain_dropped_handlers -j 1
-          cargo test --locked -p libremetaverse --test caps_http download_queue_applies_backpressure_and_cancellation_drains_every_job -j 1
-          cargo test --locked -p libremetaverse-voice-webrtc concurrent_provisioning_admits_one_session_without_leaking_the_loser -j 1
-      - name: Run bounded native soak
-        run: |
-          mkdir -p artifacts
-          cargo run --locked -p metacrate-concurrency-audit -j 1 -- \
-            --cycles 16 --evidence artifacts/concurrency-audit.json
-      - name: Upload sanitized resource evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: concurrency-audit-evidence
-          path: artifacts/concurrency-audit.json
-          if-no-files-found: error
diff --git a/.gitea/workflows/documentation.yml b/.gitea/workflows/documentation.yml
deleted file mode 100644
index 40ad4a6..0000000
--- a/.gitea/workflows/documentation.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: Documentation
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/documentation.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "README.md"
-      - "api/**"
-      - "crates/**"
-      - "docs/**"
-      - "programs/**"
-      - "tools/ci-matrix/**"
-      - "tools/generate_api_shims.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/documentation.yml"
-      - "Cargo.lock"
-      - "Cargo.toml"
-      - "README.md"
-      - "api/**"
-      - "crates/**"
-      - "docs/**"
-      - "programs/**"
-      - "tools/ci-matrix/**"
-      - "tools/generate_api_shims.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  documentation:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      FORCE_SKIA_BINARIES_DOWNLOAD: "1"
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install native documentation prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build \
-            pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-
-      - name: Install Rust 1.97 toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: 1.97.0
-          components: rustfmt
-
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-
-      - name: Verify documentation coverage report
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- documentation-report
-          git diff --exit-code -- api/DOCUMENTATION-COVERAGE.md
-          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence /tmp/metacrate-documentation-audit.json
-          cmp /tmp/metacrate-documentation-audit.json ci/evidence/documentation-audit.json
-
-      - name: Build warning-free workspace documentation
-        env:
-          RUSTDOCFLAGS: "-D warnings"
-        run: cargo doc --workspace --no-deps --locked -j 1
-
-      - name: Compile guide snippets and examples
-        run: |
-          cargo test --locked -p libremetaverse --doc -j 1
-          cargo test --locked -p libremetaverse --examples -j 1
-          cargo run --locked -p libremetaverse --example offline_client
-          cargo run --locked -p libremetaverse --example cancellation
-
-      - name: Verify documented program quick starts
-        run: cargo test --locked -p libremetaverse-programs --tests -j 1
-
-      - name: Upload documentation evidence
-        uses: actions/upload-artifact@v3
-        with:
-          name: documentation-evidence
-          path: ci/evidence/documentation-audit.json
-          if-no-files-found: error
diff --git a/.gitea/workflows/imaging-meshing.yml b/.gitea/workflows/imaging-meshing.yml
deleted file mode 100644
index fef5e09..0000000
--- a/.gitea/workflows/imaging-meshing.yml
+++ /dev/null
@@ -1,91 +0,0 @@
-name: Imaging and meshing gate
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/imaging-meshing.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/skeleton.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-      - "crates/libremetaverse-prim-mesher/**"
-      - "crates/libremetaverse-rendering-mesh-foundry/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/imaging_meshing_semantics.rs"
-      - "tests/upstream-tests.json"
-      - "tools/check_milestone_06.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/imaging-meshing.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse/src/generated.rs"
-      - "crates/libremetaverse/src/skeleton.rs"
-      - "crates/libremetaverse/src/*_catalog.rs"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-      - "crates/libremetaverse-prim-mesher/**"
-      - "crates/libremetaverse-rendering-mesh-foundry/**"
-      - "tests/compat/Cargo.toml"
-      - "tests/compat/build.rs"
-      - "tests/compat/src/**"
-      - "tests/compat/tests/imaging_meshing_semantics.rs"
-      - "tests/upstream-tests.json"
-      - "tools/check_milestone_06.py"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  native:
-    runs-on: ubuntu-latest
-    env:
-      RUSTDOCFLAGS: -D warnings
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy,rustfmt
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Audit milestone ownership and feature isolation
-        run: python tools/check_milestone_06.py
-      - name: Test native imaging and meshing crates
-        run: |
-          cargo test -p libremetaverse-imaging
-          cargo test -p libremetaverse-imaging-skia --no-default-features
-          cargo test -p libremetaverse-prim-mesher
-      - name: Test reviewed milestone parity cases
-        run: |
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_managedimagetests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_coordtests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_quattests_
-          cargo test -p libremetaverse-compat-tests --test imaging_meshing_semantics reviewed_primmeshtests_
-      - name: Compile performance baselines
-        run: |
-          cargo bench -p libremetaverse-imaging --bench image_pipeline --no-run -j 1
-          cargo bench -p libremetaverse-prim-mesher --bench meshing --no-run -j 1
-      - name: Lint and document milestone crates
-        run: |
-          cargo clippy -p libremetaverse-imaging -p libremetaverse-imaging-skia -p libremetaverse-prim-mesher --all-targets -- -D warnings
-          cargo doc -p libremetaverse-imaging -p libremetaverse-imaging-skia -p libremetaverse-prim-mesher --no-deps
-      - name: Verify formatting
-        run: cargo fmt --all -- --check
diff --git a/.gitea/workflows/jpeg2000.yml b/.gitea/workflows/jpeg2000.yml
deleted file mode 100644
index be2aa00..0000000
--- a/.gitea/workflows/jpeg2000.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: JPEG 2000 feature
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/jpeg2000.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-openjpeg/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-  pull_request:
-    paths:
-      - ".gitea/workflows/jpeg2000.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse/Cargo.toml"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-openjpeg/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-  workflow_dispatch:
-
-jobs:
-  linux:
-    runs-on: ubuntu-latest
-    env:
-      # Ubuntu also ships an older libopenjp2.so.7. Ensure both pkg-config and
-      # the runtime loader select this run's isolated, audited 2.5.4 install.
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Build and test optional feature
-        run: |
-          cargo test -p libremetaverse-imaging --features jpeg2000
-          cargo check -p libremetaverse --features jpeg2000
diff --git a/.gitea/workflows/performance.yml b/.gitea/workflows/performance.yml
deleted file mode 100644
index c52e23a..0000000
--- a/.gitea/workflows/performance.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: performance evidence
-
-on:
-  push:
-    paths:
-      - "benchmarks/**"
-      - "tools/performance/**"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/targa.rs"
-      - ".gitea/workflows/performance.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - "benchmarks/**"
-      - "tools/performance/**"
-      - "crates/libremetaverse/src/inventory.rs"
-      - "crates/libremetaverse/src/targa.rs"
-      - ".gitea/workflows/performance.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    env:
-      CARGO_PROFILE_BENCHMARK_OPT_LEVEL: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: 1.97.1
-          components: rustfmt, clippy
-      - uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: |
-            8.0.x
-            10.0.x
-      - name: Check out pinned C# reference
-        run: |
-          git clone --filter=blob:none https://github.com/cinderblocks/libremetaverse.git "$RUNNER_TEMP/libremetaverse"
-          git -C "$RUNNER_TEMP/libremetaverse" checkout 2aa70bb68513b39795da5d13c88f31b86e85a3ba
-      - name: Compile separate C# reference runner
-        run: >-
-          dotnet build benchmarks/csharp-reference/MetaCrate.ReferenceBenchmarks.csproj
-          -c Release -p:ReferenceRoot="$RUNNER_TEMP/libremetaverse"
-      - name: Verify harness
-        run: cargo test -p metacrate-performance --profile benchmark --locked -j1
-      - name: Audit committed evidence
-        run: >-
-          cargo run -p metacrate-performance --profile benchmark --locked -j1 --
-          audit --fixture-root benchmarks/fixtures
-          --rust benchmarks/results/rust-linux-x86_64.json
-          --reference benchmarks/results/csharp-linux-x86_64.json
-          --comparison benchmarks/results/comparison.json
diff --git a/.gitea/workflows/release-candidate.yml b/.gitea/workflows/release-candidate.yml
deleted file mode 100644
index ac2949e..0000000
--- a/.gitea/workflows/release-candidate.yml
+++ /dev/null
@@ -1,103 +0,0 @@
-name: First release candidate
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/release-candidate.yml"
-      - "ci/release-candidate-policy.json"
-      - "ci/evidence/**"
-      - "docs/release-candidate.md"
-      - "CHANGELOG.md"
-      - "release/**"
-      - "api/**"
-      - "programs/**"
-      - "tests/**"
-      - "tools/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/release-candidate.yml"
-      - "ci/release-candidate-policy.json"
-      - "ci/evidence/**"
-      - "docs/release-candidate.md"
-      - "CHANGELOG.md"
-      - "release/**"
-      - "api/**"
-      - "programs/**"
-      - "tests/**"
-      - "tools/**"
-      - "crates/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-release-candidate
-  PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-release-candidate/lib/pkgconfig
-  LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-release-candidate/lib
-  RUSTDOCFLAGS: -D warnings
-
-jobs:
-  non-fuzz-release-gate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: 1.97.1
-          components: rustfmt, clippy
-      - name: Install every Linux release prerequisite
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Record source identity without a shipped helper
-        run: echo "METACRATE_RUST_COMMIT=$(git rev-parse --verify HEAD)" >>"$GITHUB_ENV"
-      - name: Verify generated surfaces, mappings, parity, and milestone inventories
-        run: |
-          python3 tools/generate_rust_mapping.py --check
-          python3 tools/generate_api_shims.py --check
-          python3 tools/check_api_coverage.py
-          python3 tools/check_test_parity.py
-          python3 tools/generate_lsl_tables.py --check
-          python3 tools/check_milestone_09.py
-          python3 tools/check_milestone_10.py
-      - name: Format, compile, test, lint, and document the complete workspace
-        run: |
-          cargo fmt --all -- --check
-          cargo check --workspace --all-targets --all-features --locked -j 1
-          cargo test --workspace --all-features --locked -j 1
-          cargo clippy --workspace --all-targets --all-features --locked -j 1 -- -D warnings
-          cargo doc --workspace --all-features --no-deps --locked -j 1
-      - name: Compile downstream and SemVer consumers
-        run: |
-          cargo check --locked --manifest-path tests/api-compile/Cargo.toml
-          cargo run --locked --manifest-path tests/semver-port/Cargo.toml
-      - name: Exercise all offline program and fake-grid behavior
-        run: |
-          cargo test --locked -p libremetaverse-programs --tests -j 1
-          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --audit-only
-          cargo run --locked -p libremetaverse-programs --bin live-grid-smoke -- --fake --evidence artifacts/release-candidate/fake-grid-smoke.jsonl
-      - name: Revalidate all checked-in audits and checksums
-        run: |
-          cargo run --locked -p metacrate-ci-matrix -- audit
-          cargo run --locked -p metacrate-ci-matrix -- documentation-audit --evidence artifacts/release-candidate/documentation.json
-          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/release-candidate/dependency.json
-          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/release-candidate/provenance.json
-          sha256sum --check release/SHA256SUMS
-      - name: Enforce the aggregate non-fuzz release-candidate decision
-        run: cargo run --locked -p metacrate-ci-matrix -- release-candidate-audit --evidence artifacts/release-candidate/status.json
-      - name: Upload release-candidate evidence, including failures
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: metacrate-0.0.1-release-candidate
-          path: artifacts/release-candidate/
-          if-no-files-found: error
diff --git a/.gitea/workflows/release-matrix.yml b/.gitea/workflows/release-matrix.yml
deleted file mode 100644
index 054a249..0000000
--- a/.gitea/workflows/release-matrix.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-name: Release platform and feature matrix
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/release-matrix.yml"
-      - "ci/release-matrix.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-ci-matrix.md"
-      - "README.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-      - "tests/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/release-matrix.yml"
-      - "ci/release-matrix.json"
-      - "tools/ci-matrix/**"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "docs/release-ci-matrix.md"
-      - "README.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
-      - "programs/**"
-      - "tests/**"
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-  CARGO_PROFILE_TEST_DEBUG: 0
-  FORCE_SKIA_BINARIES_DOWNLOAD: 1
-  RUSTDOCFLAGS: -D warnings
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Validate matrix coverage and ubuntu-only policy
-        run: cargo run --locked -p metacrate-ci-matrix -- audit
-
-  matrix:
-    needs: audit
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - profile: linux-msrv-portable
-            toolchain: 1.96.0
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-default
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-minimal
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: false
-          - profile: linux-stable-features
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: linux-stable-release-surface
-            toolchain: stable
-            target: x86_64-unknown-linux-gnu
-            native_dependencies: true
-          - profile: windows-stable-portable
-            toolchain: stable
-            target: x86_64-pc-windows-gnu
-            native_dependencies: false
-          - profile: macos-stable-portable
-            toolchain: stable
-            target: x86_64-apple-darwin
-            native_dependencies: false
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}-${{ matrix.profile }}/lib
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache immutable Cargo downloads only
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: release-downloads-${{ runner.os }}-${{ matrix.toolchain }}-${{ hashFiles('Cargo.lock') }}
-      - uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: ${{ matrix.toolchain }}
-          targets: ${{ matrix.target }}
-      - name: Install pinned native feature prerequisites
-        if: matrix.native_dependencies == true
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang cmake curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-          pkg-config --modversion libopenjp2
-          pkg-config --modversion opus
-          pkg-config --modversion alsa
-      - name: Revalidate matrix with selected toolchain
-        run: cargo run --locked -p metacrate-ci-matrix -- audit
-      - name: Execute isolated release profile
-        run: cargo run --locked -p metacrate-ci-matrix -- run ${{ matrix.profile }} --evidence artifacts/ci-matrix/${{ matrix.profile }}.json
-      - name: Upload exact matrix evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: release-matrix-${{ matrix.profile }}
-          path: artifacts/ci-matrix/${{ matrix.profile }}.json
-          if-no-files-found: error
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..95ce1e6
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,61 @@
+name: Non-routine release validation
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 0"
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_INCREMENTAL: "0"
+      RUSTDOCFLAGS: "-D warnings"
+      OPENJPEG_PREFIX: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}
+      PKG_CONFIG_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib/pkgconfig
+      LD_LIBRARY_PATH: ${{ runner.tool_cache }}/metacrate/native/openjpeg-2.5.4-${{ runner.arch }}/lib
+      METACRATE_RUST_COMMIT: ${{ github.sha }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ${{ runner.tool_cache }}/metacrate/native
+            target/release-gate
+          key: release-rust-1.97.1-${{ runner.arch }}-${{ hashFiles('.gitea/workflows/release.yml', 'Cargo.lock', 'ci/ci-coverage.json', 'ci/release-matrix.json', 'ci/artifact-policy.json', 'tools/install_openjpeg_2_5_4.sh') }}
+      - name: Install the release prerequisite set once
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes build-essential clang cmake curl git mingw-w64 ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev libopus-dev libasound2-dev
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.97.1
+          components: clippy,rustfmt
+          targets: x86_64-pc-windows-gnu,x86_64-apple-darwin
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.96.0
+      - name: Validate the native release dependency
+        run: tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
+      - name: Run the Rust-owned non-routine release graph
+        run: cargo +1.97.1 run --locked -p metacrate-ci-matrix -- release-gate --evidence artifacts/release/release-gate.json
+      - name: Upload release evidence and packages
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: non-routine-release-evidence
+          path: |
+            artifacts/release/
+            target/release-gate/package/*.crate
+          if-no-files-found: error
diff --git a/.gitea/workflows/rust-workspace.yml b/.gitea/workflows/rust-workspace.yml
deleted file mode 100644
index 579e56a..0000000
--- a/.gitea/workflows/rust-workspace.yml
+++ /dev/null
@@ -1,119 +0,0 @@
-name: Native Rust workspace compile
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/rust-workspace.yml"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "tools/check_milestone_10_issue_76.py"
-      - "tools/check_milestone_10_issue_77.py"
-      - "tools/check_milestone_10_issue_78.py"
-      - "tools/check_milestone_10_issue_79.py"
-      - "tools/check_milestone_10_issue_80.py"
-      - "tools/check_milestone_10_issue_81.py"
-      - "tools/check_milestone_10_issue_82.py"
-      - "tools/check_milestone_10_issue_83.py"
-      - "tools/check_milestone_10.py"
-      - "tools/test_milestone_10.py"
-      - "tools/generate_lsl_tables.py"
-      - "codegen/inputs/lsl_tools_grammar.json"
-      - "docs/extension-milestone-gate.md"
-      - "docs/live-grid-smoke.md"
-      - "programs/README.md"
-      - "api/SHIM-COVERAGE.md"
-      - "**/*.rs"
-      - "**/Cargo.toml"
-      - "Cargo.lock"
-  pull_request:
-    paths:
-      - ".gitea/workflows/rust-workspace.yml"
-      - "tools/install_openjpeg_2_5_4.sh"
-      - "tools/check_milestone_09.py"
-      - "tools/test_milestone_09.py"
-      - "tools/check_milestone_10_issue_76.py"
-      - "tools/check_milestone_10_issue_77.py"
-      - "tools/check_milestone_10_issue_78.py"
-      - "tools/check_milestone_10_issue_79.py"
-      - "tools/check_milestone_10_issue_80.py"
-      - "tools/check_milestone_10_issue_81.py"
-      - "tools/check_milestone_10_issue_82.py"
-      - "tools/check_milestone_10_issue_83.py"
-      - "tools/check_milestone_10.py"
-      - "tools/test_milestone_10.py"
-      - "tools/generate_lsl_tables.py"
-      - "codegen/inputs/lsl_tools_grammar.json"
-      - "docs/extension-milestone-gate.md"
-      - "docs/live-grid-smoke.md"
-      - "programs/README.md"
-      - "api/SHIM-COVERAGE.md"
-      - "**/*.rs"
-      - "**/Cargo.toml"
-      - "Cargo.lock"
-  workflow_dispatch:
-
-jobs:
-  compile:
-    runs-on: ubuntu-latest
-    env:
-      OPENJPEG_PREFIX: /tmp/metacrate-openjpeg-${{ github.run_id }}
-      PKG_CONFIG_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib/pkgconfig
-      LD_LIBRARY_PATH: /tmp/metacrate-openjpeg-${{ github.run_id }}/lib
-      CARGO_BUILD_JOBS: 1
-      CARGO_INCREMENTAL: 0
-      CARGO_PROFILE_DEV_DEBUG: 0
-      CARGO_PROFILE_TEST_DEBUG: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - name: Install audited OpenJPEG 2.5.4
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential cmake pkg-config libopus-dev libasound2-dev
-          tools/install_openjpeg_2_5_4.sh "$OPENJPEG_PREFIX"
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-      - name: Audit native implementation boundaries
-        run: |
-          python3 tools/check_milestone_09_issue_59.py
-          python3 tools/check_milestone_09_issue_60.py
-          python3 tools/check_milestone_09_issue_61.py
-          python3 tools/check_milestone_09_issue_62.py
-          python3 tools/check_milestone_09_issue_63.py
-          python3 tools/check_milestone_09_issue_64.py
-          python3 tools/check_milestone_09_issue_65.py
-          python3 tools/check_milestone_09_issue_66.py
-          python3 tools/check_milestone_09.py
-          python3 tools/check_milestone_10_issue_76.py
-          python3 tools/check_milestone_10_issue_77.py
-          python3 tools/check_milestone_10_issue_78.py
-          python3 tools/check_milestone_10_issue_79.py
-          python3 tools/check_milestone_10_issue_80.py
-          python3 tools/check_milestone_10_issue_81.py
-          python3 tools/check_milestone_10_issue_82.py
-          python3 tools/check_milestone_10_issue_83.py
-          python3 tools/generate_lsl_tables.py --check
-          python3 tools/check_milestone_10.py
-      - name: Test the complete native world milestone
-        run: python3 tools/test_milestone_09.py
-      - name: Test the complete native extension milestone
-        run: python3 tools/test_milestone_10.py
-      - name: Compile every workspace target with bounded memory
-        run: cargo check --workspace --all-targets --locked -j 1
-      - name: Audit and fake-smoke every native program target
-        run: |
-          cargo run -p libremetaverse-programs --bin live-grid-smoke --locked -- --audit-only
-          cargo test -p libremetaverse-programs --test live_grid_smoke_cli --locked -j 1
-      - name: Check optional cross-platform real audio backend
-        run: |
-          cargo check -p libremetaverse-voice-webrtc --all-targets --features real-audio --locked -j 1
-          cargo check -p libremetaverse-programs --bin webrtc-test --features real-audio --locked -j 1
-      - name: Lint every native extension target with bounded memory
-        run: cargo clippy -p libremetaverse-rendering-simple -p libremetaverse-rendering-mesh-foundry -p libremetaverse-rlv -p libremetaverse-lsl-tools --all-targets --locked -j 1 -- -D warnings
-      - name: Document every native extension crate
-        env:
-          RUSTDOCFLAGS: -D warnings
-        run: cargo doc -p libremetaverse-rendering-simple -p libremetaverse-rendering-mesh-foundry -p libremetaverse-rlv -p libremetaverse-lsl-tools --no-deps --locked -j 1
diff --git a/.gitea/workflows/skia.yml b/.gitea/workflows/skia.yml
deleted file mode 100644
index 883e8d0..0000000
--- a/.gitea/workflows/skia.yml
+++ /dev/null
@@ -1,38 +0,0 @@
-name: Skia feature
-
-on:
-  push:
-    paths:
-      - ".gitea/workflows/skia.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-  pull_request:
-    paths:
-      - ".gitea/workflows/skia.yml"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/libremetaverse-types/**"
-      - "crates/libremetaverse-imaging/**"
-      - "crates/libremetaverse-imaging-skia/**"
-  workflow_dispatch:
-
-jobs:
-  linux:
-    runs-on: ubuntu-latest
-    env:
-      FORCE_SKIA_BINARIES_DOWNLOAD: "1"
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install native link prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install --yes build-essential clang curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev
-      - name: Test default and Skia feature builds
-        run: |
-          cargo test -p libremetaverse-imaging-skia --no-default-features
-          cargo test -p libremetaverse-imaging-skia --features skia
-          cargo package -p libremetaverse-imaging-skia --list
diff --git a/.gitea/workflows/supply-chain.yml b/.gitea/workflows/supply-chain.yml
deleted file mode 100644
index e02071f..0000000
--- a/.gitea/workflows/supply-chain.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Dependency and supply-chain audit
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-env:
-  CARGO_BUILD_JOBS: 1
-  CARGO_INCREMENTAL: 0
-  CARGO_PROFILE_DEV_DEBUG: 0
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Cache immutable Cargo downloads and advisory database
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            ~/.cargo/advisory-dbs
-          key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Fetch every immutable locked package archive
-        run: cargo fetch --locked
-      - name: Install pinned audit tools
-        run: |
-          cargo install --locked cargo-deny --version 0.20.2
-          cargo install --locked cargo-machete --version 0.9.2
-      - name: Record and validate the reviewed graph
-        run: |
-          mkdir -p artifacts
-          cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
-          cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
-          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/provenance-audit.json
-      - name: Reject advisories, licenses, duplicates, and sources outside policy
-        run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
-      - name: Reject unused direct dependencies
-        run: cargo machete --with-metadata
-      - name: Upload dependency evidence
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: supply-chain-evidence
-          path: artifacts/
-          if-no-files-found: error
diff --git a/.gitignore b/.gitignore
index 769b0c1..b0d5c6c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 /crates/libremetaverse-openjpeg/Cargo.lock
 /tests/api-compile/target/
 /tests/semver-port/target/
+/artifacts/
 .env
 .env.*
 !.env.example
diff --git a/api/DOCUMENTATION-COVERAGE.md b/api/DOCUMENTATION-COVERAGE.md
index 27f5905..9f8ca11 100644
--- a/api/DOCUMENTATION-COVERAGE.md
+++ b/api/DOCUMENTATION-COVERAGE.md
@@ -9,6 +9,6 @@ Generated by `metacrate-ci-matrix documentation-report`; do not edit by hand.
 | Mapped public members | 30789 | 30789 | 100% |
 | Compiled Rust guide snippets | 5 | 4 minimum | pass |
 | Linked native programs | 9 | 9 | 100% |
-| Checked local Markdown links | 86 | 86 | 100% |
+| Checked local Markdown links | 84 | 84 | 100% |
 
 Every mapped item is tied to its exact C# documentation ID and to the ownership, asyncness, error, overload, mapping-kind, and Rust-signature decisions in [`RUST-MAPPING.tsv`](RUST-MAPPING.tsv). Public types are tied to the corresponding type mapping. The upstream source is pinned to [`2aa70bb68513b39795da5d13c88f31b86e85a3ba`](https://github.com/cinderblocks/libremetaverse/tree/2aa70bb68513b39795da5d13c88f31b86e85a3ba).
diff --git a/ci/ci-coverage.json b/ci/ci-coverage.json
new file mode 100644
index 0000000..f1b3469
--- /dev/null
+++ b/ci/ci-coverage.json
@@ -0,0 +1,117 @@
+{
+  "schema": 1,
+  "required_workflow": ".gitea/workflows/ci.yml",
+  "release_workflow": ".gitea/workflows/release.yml",
+  "hard_timeout_minutes": 15,
+  "internal_target_seconds": 720,
+  "required_checks": [
+    "format",
+    "deterministic-generation",
+    "api-semver",
+    "workspace-tests",
+    "compatibility-parity",
+    "minimal-features",
+    "jpeg2000",
+    "skia-binary",
+    "program-offline-smoke",
+    "clippy",
+    "documentation",
+    "dependency-policy",
+    "provenance-policy",
+    "performance-evidence",
+    "concurrency-regressions"
+  ],
+  "legacy_workflows": [
+    {
+      "workflow": "api-surface.yml",
+      "responsibility": "Generated API mappings, SemVer baseline and audit, downstream consumer compilation, and focused lint",
+      "destination": "required",
+      "checks": ["deterministic-generation", "api-semver", "clippy"],
+      "rationale": "Public API drift must block every code-ready change."
+    },
+    {
+      "workflow": "artifact-audit.yml",
+      "responsibility": "Source packages, release binaries, native linkage, and artifact/provenance inspection",
+      "destination": "release",
+      "checks": ["release-packaging", "native-artifact-audit"],
+      "rationale": "Full packaging is expensive; routine provenance policy and package metadata validation remain required."
+    },
+    {
+      "workflow": "codegen.yml",
+      "responsibility": "Deterministic generation, generated wire/catalog tests, API fixture, and clean generator artifact",
+      "destination": "required",
+      "checks": ["format", "deterministic-generation", "workspace-tests", "compatibility-parity"],
+      "rationale": "Generated-source and translated compatibility drift must fail before compilation proceeds."
+    },
+    {
+      "workflow": "concurrency-audit.yml",
+      "responsibility": "Focused race regressions and bounded resource soak",
+      "destination": "split",
+      "checks": ["concurrency-regressions", "long-resource-soak"],
+      "rationale": "Focused regressions remain required; the 16-cycle resource soak runs in the non-routine release gate."
+    },
+    {
+      "workflow": "documentation.yml",
+      "responsibility": "Documentation audit, warning-free docs, doctests, examples, and documented program tests",
+      "destination": "required",
+      "checks": ["documentation", "program-offline-smoke"],
+      "rationale": "Documentation and documented offline behavior are part of the public release surface."
+    },
+    {
+      "workflow": "imaging-meshing.yml",
+      "responsibility": "Imaging and meshing tests, parity cases, benchmark compilation, lint, and docs",
+      "destination": "split",
+      "checks": ["workspace-tests", "compatibility-parity", "clippy", "documentation", "benchmark-compilation"],
+      "rationale": "Tests, parity, lint, and docs remain required; redundant benchmark compilation moves to the release gate."
+    },
+    {
+      "workflow": "jpeg2000.yml",
+      "responsibility": "Optional OpenJPEG/JPEG 2000 feature build and tests",
+      "destination": "required",
+      "checks": ["jpeg2000"],
+      "rationale": "The optional native codec is tested independently with an exact cached OpenJPEG 2.5.4 identity."
+    },
+    {
+      "workflow": "performance.yml",
+      "responsibility": "Pinned C# comparison harness and committed performance evidence audit",
+      "destination": "split",
+      "checks": ["performance-evidence", "performance-regeneration"],
+      "rationale": "Committed evidence validation remains required; C# checkout and evidence regeneration are manual release work."
+    },
+    {
+      "workflow": "release-candidate.yml",
+      "responsibility": "Aggregate release-readiness gate and evidence",
+      "destination": "release",
+      "checks": ["release-candidate-audit"],
+      "rationale": "The aggregate release decision is non-routine and no longer recompiles the required gate."
+    },
+    {
+      "workflow": "release-matrix.yml",
+      "responsibility": "MSRV, default, minimal, features, release profiles, and portable cross-target checks",
+      "destination": "split",
+      "checks": ["minimal-features", "jpeg2000", "skia-binary", "msrv", "portable-cross-targets", "release-profile"],
+      "rationale": "Fast feature isolation remains required; clean MSRV, cross-target, and release-profile builds run non-routinely."
+    },
+    {
+      "workflow": "rust-workspace.yml",
+      "responsibility": "Milestone checks, workspace compilation, program smoke, audio feature, extension lint, and docs",
+      "destination": "required",
+      "checks": ["workspace-tests", "compatibility-parity", "program-offline-smoke", "clippy", "documentation"],
+      "rationale": "One all-feature test graph replaces overlapping compile and test invocations."
+    },
+    {
+      "workflow": "skia.yml",
+      "responsibility": "Default and Skia feature tests plus package listing",
+      "destination": "required",
+      "checks": ["skia-binary", "workspace-tests"],
+      "rationale": "The required gate proves the exact ARM64 GNU archive is installed and forbids source compilation."
+    },
+    {
+      "workflow": "supply-chain.yml",
+      "responsibility": "Dependency graph, advisory, license, source, provenance, duplicate, and unused-dependency audits",
+      "destination": "required",
+      "checks": ["dependency-policy", "provenance-policy"],
+      "rationale": "Pinned prebuilt audit tools and cached advisory data keep policy enforcement in the routine gate."
+    }
+  ]
+}
diff --git a/ci/evidence/documentation-audit.json b/ci/evidence/documentation-audit.json
index f1fad26..0c17418 100644
--- a/ci/evidence/documentation-audit.json
+++ b/ci/evidence/documentation-audit.json
@@ -8,7 +8,7 @@
   "documented_members": 30789,
   "tested_rust_snippets": 5,
   "linked_programs": 9,
-  "checked_local_links": 86,
+  "checked_local_links": 84,
   "required_guide_sections": 11,
   "status": "ok"
 }
diff --git a/ci/evidence/provenance-audit.json b/ci/evidence/provenance-audit.json
index f79f0ef..49d47a1 100644
--- a/ci/evidence/provenance-audit.json
+++ b/ci/evidence/provenance-audit.json
@@ -1,18 +1,18 @@
 {
   "schema": 1,
-  "recorded_unix_seconds": 1786546522,
+  "recorded_unix_seconds": 1786557316,
   "upstream_commit": "2aa70bb68513b39795da5d13c88f31b86e85a3ba",
   "material_count": 27,
   "generated_output_count": 8,
   "provenance_ledger_count": 3,
-  "source_file_count": 538,
+  "source_file_count": 530,
   "dependency_count": 389,
-  "dependency_notice_count": 284,
+  "dependency_notice_count": 276,
   "native_component_count": 6,
-  "dependency_manifest_sha256": "6482698a22201b04f3234363790edc0be0dba39f445ac939e3fc8d4edeb372e9",
-  "third_party_notices_sha256": "de5088841682813cc952af4d1dcc57d2521694e192888042d5585e344e570d16",
+  "dependency_manifest_sha256": "1e7fbc87186c490b0c94751c6c471b488a856f9c3507d0b2a040dd285b035574",
+  "third_party_notices_sha256": "4f30d077fb4563e48d0f954e8b3dd1f540d53cc782b727bd391259243eb66968",
   "native_notices_sha256": "b417ee7bf6b748cc86839e5354753c0f8c1f8309d13c0fea379c77f602e69fc0",
-  "distribution_manifest_sha256": "18afd63d96e675c826cf138293df0ae73be279f45c9efa258bbbb30a1c7577e7",
+  "distribution_manifest_sha256": "d7b628f087d9bd260a897b9534a2b8ae6d0d9378cf8c6c8e8ee374bbe39016e7",
   "unknown_materials": 0,
   "unknown_bundled_assets": 0,
   "status": "ok"
diff --git a/crates/libremetaverse-imaging-skia/Cargo.toml b/crates/libremetaverse-imaging-skia/Cargo.toml
index b23a889..972c400 100644
--- a/crates/libremetaverse-imaging-skia/Cargo.toml
+++ b/crates/libremetaverse-imaging-skia/Cargo.toml
@@ -19,13 +19,13 @@ libremetaverse-types = { version = "0.0.1", path = "../libremetaverse-types" }
 # and without Vulkan on macOS. Matching those sets avoids an hours-long Skia
 # source build on every supported desktop target.
 [target.'cfg(any(target_os = "linux", target_os = "windows"))'.dependencies]
-skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "pdf", "svg", "textlayout", "vulkan", "webp"], optional = true }
+skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "no-compile", "pdf", "svg", "textlayout", "vulkan", "webp"], optional = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
-skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "pdf", "svg", "textlayout", "webp"], optional = true }
+skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "no-compile", "pdf", "svg", "textlayout", "webp"], optional = true }
 
 [target.'cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))'.dependencies]
-skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "pdf", "webp"], optional = true }
+skia-safe = { version = "0.99.0", default-features = false, features = ["binary-cache", "jpeg", "no-compile", "pdf", "webp"], optional = true }
 
 [lints]
 workspace = true
diff --git a/docs/ci-runtime-evidence.md b/docs/ci-runtime-evidence.md
new file mode 100644
index 0000000..81f4007
--- /dev/null
+++ b/docs/ci-runtime-evidence.md
@@ -0,0 +1,25 @@
+# Required CI runtime evidence
+
+This record is populated from the consolidated `CI / required` Gitea job. A
+qualifying sample consists of one deliberate cold native/dependency cache run
+and four normal warm-cache runs on `aarch64-unknown-linux-gnu`. Each uploaded
+`required-gate.json` contains per-stage elapsed time, Rust host/target, cache
+hit state, available peak-memory evidence, and the Skia binary outcome.
+
+The pre-consolidation Gitea baseline was 13 automatic workflows and 333 runs.
+Successful maxima included 22.9 minutes for the native workspace, 32.0 minutes
+for Skia, 66.6 minutes for artifact audit, and 86.0 minutes for the release
+matrix. Native code generation had a 13.2-minute median and 18.5-minute maximum;
+even this one concern could exceed the new complete-gate budget.
+
+| Run | Cache | Elapsed | Result | Evidence |
+| --- | --- | ---: | --- | --- |
+| pending first consolidated run | cold | pending | pending | pending |
+| pending second consolidated run | warm | pending | pending | pending |
+| pending third consolidated run | warm | pending | pending | pending |
+| pending fourth consolidated run | warm | pending | pending | pending |
+| pending fifth consolidated run | warm | pending | pending | pending |
+
+Branch protection must require only `CI / required` after all five rows are
+green and at or below 15:00. Until then, this file deliberately records that
+runtime parity and branch-protection migration are not yet proven.
diff --git a/docs/dependency-policy.md b/docs/dependency-policy.md
index ea8720c..3c57f8a 100644
--- a/docs/dependency-policy.md
+++ b/docs/dependency-policy.md
@@ -22,7 +22,7 @@ not raise it accidentally.
 
 ## Automated gates
 
-The Ubuntu-only `supply-chain` Gitea workflow installs pinned versions of
+The Ubuntu-only consolidated required Gitea gate installs pinned versions of
 `cargo-deny` and `cargo-machete`, then runs:
 
 ```sh
diff --git a/docs/imaging-meshing.md b/docs/imaging-meshing.md
index d1b75ef..2b3a0fe 100644
--- a/docs/imaging-meshing.md
+++ b/docs/imaging-meshing.md
@@ -23,9 +23,9 @@ and [`MeshFoundry` guide](../crates/libremetaverse-rendering-mesh-foundry/README
 OpenJPEG is a non-default workspace member so release tooling can package the
 adapter explicitly, and imaging reaches it only through the optional
 dependency. Skia is likewise an optional, target-specific dependency. The
-dedicated Gitea workflows exercise both optional features on `ubuntu-latest`;
-the default `imaging-meshing` workflow proves that no native codec is needed
-for the owned Rust and translated compatibility tests.
+consolidated required Gitea gate exercises both optional features on
+`ubuntu-latest` while its minimal-feature check proves that no native codec is
+needed for the owned Rust and translated compatibility tests.
 
 ## Bounds and rendering contract
 
@@ -50,10 +50,10 @@ python3 tools/check_milestone_06.py
 
 The audit rejects owned Rust stubs, feature leakage, missing platform jobs,
 missing performance targets, or drift in the 48 reviewed ManagedImage,
-Coord/Quat, and PrimMesh compatibility cases. The cross-platform workflow also
-runs each reviewed group explicitly, native crate tests, workspace test
-compilation, Clippy with warnings denied, rustdoc with warnings denied, and
-benchmark compilation.
+Coord/Quat, and PrimMesh compatibility cases. The required gate runs the native
+crate and reviewed parity tests, Clippy with warnings denied, and rustdoc with
+warnings denied. Benchmark compilation is retained in the non-routine release
+gate.
 
 The focused performance baselines are executable Rust programs rather than
 wall-clock assertions, so slower shared runners do not weaken or destabilize
diff --git a/docs/release-ci-matrix.md b/docs/release-ci-matrix.md
index bca796d..a697a22 100644
--- a/docs/release-ci-matrix.md
+++ b/docs/release-ci-matrix.md
@@ -1,90 +1,123 @@
-# Release platform and feature CI matrix
+# Consolidated CI and release matrix
 
-The release matrix is declared in [`ci/release-matrix.json`](../ci/release-matrix.json)
-and validated and executed by the native Rust `metacrate-ci-matrix` tool. The
-manifest is the single reviewed inventory of toolchains, targets, feature sets,
-native prerequisites, Cargo commands, and explicit manual gates. The runner
-does not execute shell fragments from the manifest: every entry is an
-allow-listed Cargo subcommand and argument list.
+MetaCrate has one routine code-ready signal: the `required` job in
+`.gitea/workflows/ci.yml`. It runs for every push and pull request on
+`ubuntu-latest`, has a hard 15-minute timeout, and cancels an older run for the
+same branch or pull request. `.gitea/workflows/release.yml` is the only other
+workflow. It is manual, weekly, and tag-only; it never runs for an ordinary
+source push or pull request.
 
-## Platform boundary
+The reviewed coverage map is `ci/ci-coverage.json`. It maps every responsibility
+from the former 13 workflows to the required gate, the non-routine release
+gate, or both, with a rationale. `metacrate-ci-matrix ci-audit` rejects missing
+routes, additional workflow fan-out, non-Ubuntu jobs, Skia source-build
+fallback, and changes to the 15-minute limit.
 
-Repository policy requires every Gitea Actions job to use `ubuntu-latest`.
-Accordingly, the matrix runs the complete default, minimal, optional-feature,
-test, example, and documentation surfaces natively on Linux. Windows GNU and
-macOS use their official Rust standard-library targets from the same Ubuntu
-host to compile the portable public crates with default features disabled.
-Those cross-target profiles cover code selected by `cfg` without pretending to
-run Windows or macOS executables or to possess an Apple SDK.
+## Required gate
 
-Platform-native Skia, OpenJPEG, Opus, Vorbis, and CPAL adapters are exercised
-in isolated Linux profiles with their versions recorded. WASAPI, CoreAudio,
-platform packaging, and physical-device behavior remain explicit release/manual
-gates; a successful Ubuntu cross check is never reported as a native runtime
-test on another operating system.
+The Rust `required-gate` command owns the command graph and records the elapsed
+time and result of every stage. YAML performs checkout, one package install,
+one coherent persistent-cache inspection, pinned toolchain/tool setup, and exact native-cache
+preparation before invoking it. Fast-failure order is:
 
-## Feature isolation
+1. formatting, deterministic generators, API mappings, parity catalogs, and
+   milestone ownership checks;
+2. regenerated API, documentation, dependency, and provenance evidence;
+3. exact Skia ARM64 GNU binary installation proof;
+4. all-feature workspace library/integration tests, minimal and JPEG 2000
+   feature isolation, compatibility tests, and concurrency regressions;
+5. offline/fake program smoke and downstream API/SemVer consumers;
+6. Clippy, warning-free documentation, dependency policy, unused dependency,
+   provenance, and committed performance-evidence audits.
 
-`libremetaverse` defaults to the pure-Rust `dds-bc67` feature. OpenJPEG-backed
-JPEG 2000 and Vorbis encoding are independently selectable as `jpeg2000` and
-`vorbis`; neither native codec is discovered or linked for a default library
-consumer. Skia and CPAL remain isolated in their existing `skia` and
-`real-audio` features. The matrix validates each feature independently before
-checking workspace-wide `--all-features` unification.
+The driver stops starting work after its 12-minute internal target. This leaves
+three minutes for shutdown and artifact upload beneath the workflow's hard
+limit. `CARGO_BUILD_JOBS=2` is the bounded ARM64 setting; it permits useful
+parallelism without the repeated high-memory compiles caused by the former
+13-job fan-out. The generated-heavy `libremetaverse` library is prebuilt with
+one Cargo job before its test harnesses start; this is the sole memory-safety
+exception, while the harnesses and every other gate command retain the
+two-job bound.
 
-The checked profiles cover:
-
-- Rust 1.96.0 and current stable;
-- native Linux default, no-default, individual optional features, and all
-  features;
-- all targets, test compilation and execution, doctests, shipped
-  example-program binaries, and API documentation;
-- portable Windows GNU and macOS cross-target compilation;
-- exact OpenJPEG, Skia, Opus, ALSA, and Vorbis prerequisite declarations.
-
-Dependency purpose, maintenance, license, advisory, source, and duplicate
-review is the separate supply-chain gate documented in
-[`dependency-policy.md`](dependency-policy.md). Changes to manifests or the
-lockfile trigger both gates.
-
-Release-file provenance, Linden CC BY-SA separation, complete locked package
-notices, native redistribution obligations, and the source/binary notice set
-are enforced by the companion
-[`release provenance audit`](release-provenance.md). Its distribution manifest
-hashes the full source tree, so the supply-chain workflow runs for every source
-change rather than only dependency changes.
-
-## Clean-build evidence
-
-Each profile uses `target/ci/<profile>` and refuses to start if that directory
-already exists. Incremental compilation is disabled. This makes an accidental
-cache hit a hard failure instead of allowing it to hide a missing clean-build
-dependency. Gitea may cache Cargo registry and Git downloads using a key derived
-from the lockfile and toolchain; it never caches a `target` directory. Each
-successful or failed run creates one JSON evidence file with the source commit,
-requested toolchain and target, actual `rustc` and Cargo versions, feature sets,
-native prerequisite versions, exact Cargo commands, completion count,
-timestamp, and final status.
-
-Run the audit locally with:
+Run the structural audit locally on Linux, Windows, or macOS with:
 
 ```sh
-cargo run --locked -p metacrate-ci-matrix -- audit
+cargo run --locked -p metacrate-ci-matrix -- ci-audit
 ```
 
-Run one clean profile with:
+The full required graph expects the CI native-cache environment. On an ARM64
+GNU Linux host with OpenJPEG installed by `tools/install_openjpeg_2_5_4.sh` and
+the pinned Skia archive available, reproduce it with:
 
 ```sh
+OPENJPEG_PREFIX=/path/to/openjpeg \
+METACRATE_EXPECTED_HOST=aarch64-unknown-linux-gnu \
+METACRATE_SKIA_ARCHIVE=/path/to/skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz \
 cargo run --locked -p metacrate-ci-matrix -- \
-  run linux-stable-minimal \
-  --evidence /tmp/metacrate-linux-stable-minimal.json
+  required-gate --evidence artifacts/ci/local-required.json
 ```
 
-Before rerunning the same profile, use Cargo's scoped cleanup command:
+The driver is shell-free and constructs child processes with argument arrays,
+so command and path mappings are portable. Gitea jobs intentionally remain
+Ubuntu-only. Windows GNU and macOS portable surfaces are cross-checked from
+Ubuntu by the non-routine release graph; no native runtime claim is inferred.
+
+## Cache identity and invalidation
+
+The dedicated VPS runner's persisted tool-cache mount stores Cargo registry/git
+downloads, the two pinned audit binaries, the routine target directory, and
+native archives/installations. The target directory is content-keyed by Rust
+1.97.1, `aarch64-unknown-linux-gnu`, `Cargo.lock`, the CI coverage and dependency
+policies, the Skia feature manifest, and the OpenJPEG installer. Changing any of
+these selects a new target generation. This avoids depending on an external
+GitHub cache service that is unreachable from the isolated Gitea runner.
+The manual `cold_cache` dispatch input clears only those exact keyed Cargo,
+tool, and native paths before setup; it exists to produce the required cold-run
+measurement. Ordinary pushes and dispatches reuse the last validated generation.
+
+OpenJPEG caches include a three-line identity containing version 2.5.4, commit
+`6c4a29b00211eb0430fa0e5e890f1ce5c80f409f`, and runner architecture. The
+installer checks this identity and `pkg-config --exact-version` before reuse.
+The Skia cache is the exact 0.99.0 ARM64 GNU feature archive with SHA-256
+`dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c`.
+
+The workflow never sets `FORCE_SKIA_BINARIES_DOWNLOAD`: rust-skia uses the
+normal crates.io `.cargo_vcs_info.json` hash. The proof reads rust-skia's
+persisted build-script output even on a cache hit and requires
+`DOWNLOAD AND INSTALL SUCCEEDED`; the Rust driver rejects missing success output
+or any `STARTING A FULL BUILD`. The adapter enables
+rust-skia's `no-compile` feature on every target, making an unavailable or
+incorrect binary a fast failure rather than a source build.
+
+To invalidate local artifacts, remove only the relevant target directory or use:
 
 ```sh
-cargo clean --target-dir target/ci/linux-stable-minimal
+cargo clean --target-dir target/required
+cargo clean --target-dir target/release-gate
 ```
 
-Live-grid credentials, physical audio devices, and proprietary services remain
-outside automatic CI and retain their dedicated opt-in gates.
+## Non-routine release gate
+
+The Rust `release-gate` command owns clean MSRV and portable cross-target
+checks, benchmark compilation, the 16-cycle resource soak, all 16 source
+packages, release binaries, native artifact inspection, and the aggregate
+release-candidate audit. Reference C# performance regeneration and live-grid,
+physical-audio, proprietary-service, signing, and platform-native installer
+checks retain their documented credential/device/manual boundaries. Their
+committed evidence and fast regression checks remain in routine CI.
+
+## Troubleshooting and runtime evidence
+
+- A host mismatch means the required runner label is not the documented ARM64
+  GNU VPS. Do not substitute a musl or x86 archive.
+- An OpenJPEG identity failure requires deleting only its native cache entry and
+  rerunning the installer.
+- A Skia hash/download failure indicates an upstream release-asset or redirect
+  reachability problem. Restore the exact archive in the configured cache; do
+  not enable source compilation.
+- A 12-minute driver failure identifies the last completed stage in the uploaded
+  `required-gate.json`. Optimize or remove duplicate work only after updating
+  the coverage manifest; do not raise the 15-minute timeout.
+
+The validation record and five qualifying ARM64 run links are maintained in
+[`ci-runtime-evidence.md`](ci-runtime-evidence.md).
diff --git a/release/DEPENDENCY-LICENSES.json b/release/DEPENDENCY-LICENSES.json
index 4a0599f..6828f15 100644
--- a/release/DEPENDENCY-LICENSES.json
+++ b/release/DEPENDENCY-LICENSES.json
@@ -237,18 +237,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "db8373b96caffc61198be37c43785776f781715905ae048cf209ad620102e0aa"
-        },
-        {
-          "path": "ogg_vendor/COPYING",
-          "sha256": "d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814"
-        },
-        {
-          "path": "vorbis_vendor/COPYING",
-          "sha256": "0c72574d90753e1eda1f21a83c1a04990e67b26bb56e01acf3ce241140518156"
-        },
-        {
-          "path": "vorbis_vendor/debian/copyright",
-          "sha256": "1f6c6b6397d86d20968d7856d6945591b89e4cb64e5fc1ec8b992811f6a65ed8"
         }
       ]
     },
@@ -385,10 +373,6 @@
         {
           "path": "LICENSE",
           "sha256": "728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e"
-        },
-        {
-          "path": "aws-lc/LICENSE",
-          "sha256": "728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e"
         }
       ]
     },
@@ -547,14 +531,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "475831d2d53152709a88c227624ba00e969be34ec17c5126465236de2b9fcad8"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/copying.rs",
-          "sha256": "259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/tests/copying.rs",
-          "sha256": "23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423"
         }
       ]
     },
@@ -2235,10 +2211,6 @@
         {
           "path": "repository-license/str0m-0.22.0/LICENSE-MIT.txt",
           "sha256": "5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b"
-        },
-        {
-          "path": "repository-license/str0m-0.22.0/src/packet/LICENSE-APACHE.txt",
-          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2"
         }
       ]
     },
@@ -2907,14 +2879,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "98cc7a184cd170cfeb58b4c0c7d71b76a1c50572c266eecbf789b9d4be602911"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/copying.rs",
-          "sha256": "259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/tests/copying.rs",
-          "sha256": "23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423"
         }
       ]
     },
@@ -3071,14 +3035,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "dd8e1e06a3f555211262d27eaf12aac2b974b7f116c654fdabac296f902bebf6"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/copying.rs",
-          "sha256": "259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f"
-        },
-        {
-          "path": "repository-license/objc2-foundation-0.3.2/src/tests/copying.rs",
-          "sha256": "23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423"
         }
       ]
     },
@@ -3092,14 +3048,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "6f87e5292ee474c131f892c49ac0f637b9eb422e35024375ac4b8172aca86ea9"
-        },
-        {
-          "path": "src/copying.rs",
-          "sha256": "259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f"
-        },
-        {
-          "path": "src/tests/copying.rs",
-          "sha256": "23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423"
         }
       ]
     },
@@ -3165,10 +3113,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "5de9719e1ca3406135681f64fdd6dff12e602a9ba3adea72cf8df46e1a2596a8"
-        },
-        {
-          "path": "ogg_vendor/COPYING",
-          "sha256": "d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814"
         }
       ]
     },
@@ -3857,10 +3801,6 @@
         {
           "path": "LICENSE-MIT",
           "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb"
-        },
-        {
-          "path": "src/unicode_tables/LICENSE-UNICODE",
-          "sha256": "74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3"
         }
       ]
     },
@@ -3916,10 +3856,6 @@
         {
           "path": "LICENSE-other-bits",
           "sha256": "f025ccfb7dfb6bdfedc75ca0f67acc69e6fb4998143d834f7c2f38a29989680f"
-        },
-        {
-          "path": "third_party/fiat/LICENSE",
-          "sha256": "9eacbcb81be660840c714a560a9d65ba07913db98dd4baf969f78dd499fdd60f"
         }
       ]
     },
@@ -4553,10 +4489,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "e6d6e0146d16ea19abea522d8ed77aadcdc4f90718a11d4d2cfb55c199ec8b4f"
-        },
-        {
-          "path": "skia/LICENSE",
-          "sha256": "5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd"
         }
       ]
     },
@@ -4570,10 +4502,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "85160b23bdf006db68c232129bbf4ace9b3eee2fd21ba41025f447c8281c4f9d"
-        },
-        {
-          "path": "repository-license/skia-bindings-0.99.0/skia/LICENSE",
-          "sha256": "5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd"
         }
       ]
     },
@@ -4587,10 +4515,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "3eefd55332613883150398d8fcf426ac1036bbedecdf28c510573a2da294cf16"
-        },
-        {
-          "path": "repository-license/skia-bindings-0.99.0/skia/LICENSE",
-          "sha256": "5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd"
         }
       ]
     },
@@ -4698,10 +4622,6 @@
         {
           "path": "LICENSE-MIT.txt",
           "sha256": "5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b"
-        },
-        {
-          "path": "src/packet/LICENSE-APACHE.txt",
-          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2"
         }
       ]
     },
@@ -4719,10 +4639,6 @@
         {
           "path": "repository-license/str0m-0.22.0/LICENSE-MIT.txt",
           "sha256": "5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b"
-        },
-        {
-          "path": "repository-license/str0m-0.22.0/src/packet/LICENSE-APACHE.txt",
-          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2"
         }
       ]
     },
@@ -4740,10 +4656,6 @@
         {
           "path": "repository-license/str0m-0.22.0/LICENSE-MIT.txt",
           "sha256": "5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b"
-        },
-        {
-          "path": "repository-license/str0m-0.22.0/src/packet/LICENSE-APACHE.txt",
-          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2"
         }
       ]
     },
@@ -5253,10 +5165,6 @@
         {
           "path": "LICENSE",
           "sha256": "898b1ae9821e98daf8964c8d6c7f61641f5f5aa78ad500020771c0939ee0dea1"
-        },
-        {
-          "path": "src/spin/LICENSE",
-          "sha256": "58545fed1565e42d687aecec6897d35c6d37ccb71479a137c0deb2203e125c79"
         }
       ]
     },
@@ -5487,18 +5395,6 @@
         {
           "path": "generated-package-license-notice.txt",
           "sha256": "6b304bd3ec8aa970304048a405fe12c5f48cc2aa3736712f7fe1acddceae0359"
-        },
-        {
-          "path": "repository-license/aotuv_lancer_vorbis_sys-0.1.6/ogg_vendor/COPYING",
-          "sha256": "d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814"
-        },
-        {
-          "path": "repository-license/aotuv_lancer_vorbis_sys-0.1.6/vorbis_vendor/COPYING",
-          "sha256": "0c72574d90753e1eda1f21a83c1a04990e67b26bb56e01acf3ce241140518156"
-        },
-        {
-          "path": "repository-license/aotuv_lancer_vorbis_sys-0.1.6/vorbis_vendor/debian/copyright",
-          "sha256": "1f6c6b6397d86d20968d7856d6945591b89e4cb64e5fc1ec8b992811f6a65ed8"
         }
       ]
     },
diff --git a/release/DISTRIBUTION-MANIFEST.json b/release/DISTRIBUTION-MANIFEST.json
index 4b2fc25..3b5c3b5 100644
--- a/release/DISTRIBUTION-MANIFEST.json
+++ b/release/DISTRIBUTION-MANIFEST.json
@@ -16,74 +16,19 @@
       "sha256": "a7c5358f9d0b0ed236519fec9d5d4faee9c04127eedac9ba3ab536d3dcf1b1f2"
     },
     {
-      "path": ".gitea/workflows/api-surface.yml",
-      "bytes": 2661,
-      "sha256": "0d65e6a99ba54f6501681c8a8eb6d07b1debcdfcfd3e7649fe2aa72b2c7798a0"
+      "path": ".gitea/workflows/ci.yml",
+      "bytes": 5236,
+      "sha256": "9d53f65c0479c7a8ca3d03f33f0f243312b2cb15d1e1019bb3985d3aa72222c3"
     },
     {
-      "path": ".gitea/workflows/artifact-audit.yml",
-      "bytes": 3497,
-      "sha256": "91105987b707aa932cc476d8d496c0610e4ce9d0301c40e05916edae425225cb"
-    },
-    {
-      "path": ".gitea/workflows/codegen.yml",
-      "bytes": 7978,
-      "sha256": "c31c803c50d0e4dac495b80e503c4fc9a99ecf3a1ea95f670317aff75f5d3b94"
-    },
-    {
-      "path": ".gitea/workflows/concurrency-audit.yml",
-      "bytes": 2842,
-      "sha256": "095a90f2dbaf2b5a97155d8a21fc2ecafcfb70eab4f2535dce5aa94e22af93ca"
-    },
-    {
-      "path": ".gitea/workflows/documentation.yml",
-      "bytes": 2957,
-      "sha256": "8b004db1451886a81fc07de394657a8cc0f8aa6df0ea4d71e6b835daad18267b"
-    },
-    {
-      "path": ".gitea/workflows/imaging-meshing.yml",
-      "bytes": 3893,
-      "sha256": "bf99f0a0dc344033c1a702812013b5f643cc7be15e3b4a9703bfde47864ab611"
-    },
-    {
-      "path": ".gitea/workflows/jpeg2000.yml",
-      "bytes": 1607,
-      "sha256": "f7a23f0c89bb9476fffc3036b257ab8022a7af8b3b3ecd586d98cb7d76a23db6"
-    },
-    {
-      "path": ".gitea/workflows/performance.yml",
-      "bytes": 1907,
-      "sha256": "6cb5f7803765d91a45816275d8e86c26546b627319813d3ee8f3b463f6db2dad"
-    },
-    {
-      "path": ".gitea/workflows/release-candidate.yml",
-      "bytes": 4397,
-      "sha256": "e7ad8872f32f6d241a57e75eb7210953697869220a8e0af8a57b814b3aa8c216"
-    },
-    {
-      "path": ".gitea/workflows/release-matrix.yml",
-      "bytes": 4263,
-      "sha256": "5e8b05b3cedc46d7fb15a7b35ba5944db520dd747b6fc893eb5dd57954c61ac7"
-    },
-    {
-      "path": ".gitea/workflows/rust-workspace.yml",
-      "bytes": 5284,
-      "sha256": "2c11810e9d8eefb5f81e3e48043b0794262bc7a93f5ae3f731df314a2546adb9"
-    },
-    {
-      "path": ".gitea/workflows/skia.yml",
-      "bytes": 1186,
-      "sha256": "ab1c88406ad7e555a250cab587259d63c924062e7aeb743b75bcc2743c04cf5d"
-    },
-    {
-      "path": ".gitea/workflows/supply-chain.yml",
-      "bytes": 1808,
-      "sha256": "0f988ff455e6d09a79c058df95913b22b8f227d35dd24ebd902986684d046dfd"
+      "path": ".gitea/workflows/release.yml",
+      "bytes": 2371,
+      "sha256": "1db8899a6745f61bec38809f78f1475c0f6afc06b450ef112fea4d03deca069b"
     },
     {
       "path": ".gitignore",
-      "bytes": 233,
-      "sha256": "a8724cbe50232030f415af0eeb5e4c5ec9b068d26b0f2478506481f14cbe2915"
+      "bytes": 245,
+      "sha256": "a8a3b5c04d22081afedd1c34ac2949dfa6204185f9f8efbf78f9bbb746cce475"
     },
     {
       "path": "AGENTS.md",
@@ -133,7 +78,7 @@
     {
       "path": "api/DOCUMENTATION-COVERAGE.md",
       "bytes": 911,
-      "sha256": "490856724eaac1b6ee6065b048c50ae0bec6905ffebe6f7431ed7e6c6691cdc0"
+      "sha256": "0d05fc115a7754074ba9c084654556ac32ce07b006236d21d406223cc5074de9"
     },
     {
       "path": "api/MAPPING-COVERAGE.md",
@@ -265,6 +210,11 @@
       "bytes": 3011,
       "sha256": "718c065c78377c846ccd962922e06b19de276c32f427f73a026060eec9b7a45c"
     },
+    {
+      "path": "ci/ci-coverage.json",
+      "bytes": 5480,
+      "sha256": "4d1633c1cb396f934a8eff5f4e27362f6872b95ac66b95e9c4ac8e75ef833b29"
+    },
     {
       "path": "ci/concurrency-thresholds.json",
       "bytes": 169,
@@ -293,7 +243,7 @@
     {
       "path": "ci/evidence/documentation-audit.json",
       "bytes": 363,
-      "sha256": "56e6e2224c3f7ebabc4f1d3c4c8d63a9208a03101d571728dab10a63332f51f6"
+      "sha256": "8ee4ebd39572fc6ea00c40536bb59fd03e59e6973417f931166c4da1d963e9f3"
     },
     {
       "path": "ci/evidence/fake-grid-smoke.jsonl",
@@ -382,8 +332,8 @@
     },
     {
       "path": "crates/libremetaverse-imaging-skia/Cargo.toml",
-      "bytes": 1398,
-      "sha256": "bb17594c9cb1699b5e1d0ec3e3d885ca44d1b6dcd18c98d6e7e0d1c374572d34"
+      "bytes": 1440,
+      "sha256": "0fb038f36280490487eb3f9e24176abd0f002504918b7bdac83ca319d92298e2"
     },
     {
       "path": "crates/libremetaverse-imaging-skia/README.md",
@@ -1600,6 +1550,11 @@
       "bytes": 5813,
       "sha256": "cae4c875a9c1b83133a32dbfca1a64cd834e8459e8c7bab47d416527cceb45ca"
     },
+    {
+      "path": "docs/ci-runtime-evidence.md",
+      "bytes": 1457,
+      "sha256": "f085654b74e2c9d7f9cd8d44f307f6b778eafb496f1dd496bdb7b975c0f8cfad"
+    },
     {
       "path": "docs/client-core.md",
       "bytes": 2145,
@@ -1612,8 +1567,8 @@
     },
     {
       "path": "docs/dependency-policy.md",
-      "bytes": 4485,
-      "sha256": "2f25574432215ea38530de1a1f4680fc5a94f1439820059b8b16d86eb0c5ad95"
+      "bytes": 4488,
+      "sha256": "2e822f2deefa949a4d2173ee6d993a7e3c5874c01cb4b90755d98d1b8805f3e8"
     },
     {
       "path": "docs/discovery.md",
@@ -1627,8 +1582,8 @@
     },
     {
       "path": "docs/imaging-meshing.md",
-      "bytes": 3413,
-      "sha256": "46559b199f5ef7de10a3280724cd1b06b733be7a078f85efefc569a001370ca5"
+      "bytes": 3406,
+      "sha256": "51ae2dfb88f5a40a01ab9394ae0545806377c6cbb2cbd85da2b7947b5534859e"
     },
     {
       "path": "docs/inventory.md",
@@ -1662,8 +1617,8 @@
     },
     {
       "path": "docs/release-ci-matrix.md",
-      "bytes": 4072,
-      "sha256": "c4bf34fcc9c204824c68329d7bd2aca5a8799a7d34b44e2f8168ada923d34f47"
+      "bytes": 6475,
+      "sha256": "2ed60e66f6e4b5b357d4e99ef9fc9f21557fb247dcc79c632ce554d46a7ef604"
     },
     {
       "path": "docs/release-provenance.md",
@@ -2013,7 +1968,7 @@
     {
       "path": "release/SHA256SUMS",
       "bytes": 909,
-      "sha256": "67a50c93a6d574b82e30f923819fd7ee1dd102a62c27fe7db9f435f8ef5c246a"
+      "sha256": "2dee8c4cbdc89f004fa3cd3a290a0943325f051dc4f169e4fe20f32f4a118c18"
     },
     {
       "path": "tests/PARITY.md",
@@ -2452,8 +2407,8 @@
     },
     {
       "path": "tools/check_milestone_06.py",
-      "bytes": 5531,
-      "sha256": "a5cc71300f5b28695830eb8e88bbe3da0facad76a11120d0445bbe3a771a6d2c"
+      "bytes": 5598,
+      "sha256": "18f389b59020a6705595cfa18e6c374e09e4d81c8c3b1e397aa01da13c885e33"
     },
     {
       "path": "tools/check_milestone_08.py",
@@ -2507,48 +2462,48 @@
     },
     {
       "path": "tools/check_milestone_10.py",
-      "bytes": 9122,
-      "sha256": "da1dba171d8f234e6d9234e70296f82a7eb87c943111ffd59be7d802d08e76bb"
+      "bytes": 9038,
+      "sha256": "34b7c8bc4d924364abe2ffc14738a9b237e00b931691b2e6a9adb4cfd3ef2289"
     },
     {
       "path": "tools/check_milestone_10_issue_76.py",
-      "bytes": 4616,
-      "sha256": "e307ed630fb6ab9d1cc1e9c4692f378014400a4a839d6b746a5863322d1f861d"
+      "bytes": 4573,
+      "sha256": "62034c4d0a77bc5a2d848306148e274150049ec2baec61ca1a5fbfd56d601f99"
     },
     {
       "path": "tools/check_milestone_10_issue_77.py",
-      "bytes": 6627,
-      "sha256": "32932d8e5154d5b4232071708ece6742398a551faa6d9e513ad8b9d7956359ee"
+      "bytes": 6584,
+      "sha256": "38d0f7216b875add2b7b761148e3c13a2fecb2cc0498ebabb5713d0e09ad5bdf"
     },
     {
       "path": "tools/check_milestone_10_issue_78.py",
-      "bytes": 5251,
-      "sha256": "b0b66b1cfa2ab0407346acd94233cd4c681d05bb9bd8d2a6771ee37ba79c7bf3"
+      "bytes": 5208,
+      "sha256": "bfb1dabc8eabbe7e102b413fb9cff132e226a38c70a069d5af9feaa62ed1b57e"
     },
     {
       "path": "tools/check_milestone_10_issue_79.py",
-      "bytes": 5346,
-      "sha256": "917090381f099b0322996e28abe997012b2d9f8335e6d5f9296b4810de0a6a81"
+      "bytes": 5303,
+      "sha256": "97b0048bd8e52a2e678962f6b4ee327967895b547fd34e20ba604f4c73a3e6ae"
     },
     {
       "path": "tools/check_milestone_10_issue_80.py",
-      "bytes": 6673,
-      "sha256": "429d4e879a6f8508c0c6b9407ac05953b9615764e4496d163a79793d1b2bd62c"
+      "bytes": 6630,
+      "sha256": "80364edcbf7eafe6ed7764dc8c014a893e5f92aef0296137b057e17036b7d74e"
     },
     {
       "path": "tools/check_milestone_10_issue_81.py",
-      "bytes": 6933,
-      "sha256": "1f96c80e9dae61ad3e54fa4c7208e9fed2a30face4904fe8791ad9a4615f424b"
+      "bytes": 6890,
+      "sha256": "3438337735c4a011840c2ee83aa37ba680de26e9a21e429214f98bb957b225b6"
     },
     {
       "path": "tools/check_milestone_10_issue_82.py",
-      "bytes": 6664,
-      "sha256": "dfbd3657efc57a7c02fd326545c6a8b08fc234d8df30fc98362cfbdf113c3e8f"
+      "bytes": 6621,
+      "sha256": "20a0b1a39d7d8c6262638277db87640c6031185765da24d2178b7a8d59c8d105"
     },
     {
       "path": "tools/check_milestone_10_issue_83.py",
-      "bytes": 7722,
-      "sha256": "017613c5df110f2e469846e57b3e734e63447d52f94cec3e5e08eb487c0f254e"
+      "bytes": 7619,
+      "sha256": "e3f31776d6b2ee56d93618a83258d833194c8ec5da4fef5617cf3c6613f4f13b"
     },
     {
       "path": "tools/check_test_parity.py",
@@ -2570,6 +2525,11 @@
       "bytes": 36939,
       "sha256": "f1b56f753d77ea40e72d8a4288174fdbc5974285c13d07f04ea52b34dbdd7506"
     },
+    {
+      "path": "tools/ci-matrix/src/ci_gate.rs",
+      "bytes": 41789,
+      "sha256": "f1f2c2ee00c15ab18b8fc4c4bcd5b7163cd4e1801b8f3dc999c2c4a407b5d839"
+    },
     {
       "path": "tools/ci-matrix/src/dependency.rs",
       "bytes": 12796,
@@ -2582,18 +2542,18 @@
     },
     {
       "path": "tools/ci-matrix/src/lib.rs",
-      "bytes": 21442,
-      "sha256": "c4a04b3342249af495fad0f9c1a7b8e84f247f00a590cf87e50f3747d2be7fd0"
+      "bytes": 21175,
+      "sha256": "096d055e5d295be43ae1db78acbc98557d27d63631c7699b6eb5d281fcc18424"
     },
     {
       "path": "tools/ci-matrix/src/main.rs",
-      "bytes": 8006,
-      "sha256": "e61c19db7036796311182afb6c0671bbbfdd681f8eb1b4df08e596b43c0b0218"
+      "bytes": 9422,
+      "sha256": "33a3c408f2347b48b4ec43ca3771fa561dd9d58657fda5b067c4e06c4fe7c7fb"
     },
     {
       "path": "tools/ci-matrix/src/provenance.rs",
-      "bytes": 44270,
-      "sha256": "6946295307a3740ba6b70187a37e0f4011f8070a4ef9e1adccecc3487aa71499"
+      "bytes": 46028,
+      "sha256": "ef484527f5013dd63dfac5610464e12e9a7768d3044ed95f9573e80a87405088"
     },
     {
       "path": "tools/ci-matrix/src/release_candidate.rs",
@@ -2662,8 +2622,8 @@
     },
     {
       "path": "tools/install_openjpeg_2_5_4.sh",
-      "bytes": 2085,
-      "sha256": "cece0ccb847dfc015734297b6988752d140e15a44f5347236266d2af699f7052"
+      "bytes": 2582,
+      "sha256": "7ca7eb0ab184f4acbdb475a20d140f001d7bd020d3244d163695406e88f52925"
     },
     {
       "path": "tools/performance/Cargo.toml",
@@ -2699,13 +2659,13 @@
   "generated_release_files": [
     {
       "path": "release/DEPENDENCY-LICENSES.json",
-      "bytes": 217677,
-      "sha256": "6482698a22201b04f3234363790edc0be0dba39f445ac939e3fc8d4edeb372e9"
+      "bytes": 213190,
+      "sha256": "1e7fbc87186c490b0c94751c6c471b488a856f9c3507d0b2a040dd285b035574"
     },
     {
       "path": "release/THIRD-PARTY-NOTICES.md",
-      "bytes": 848536,
-      "sha256": "de5088841682813cc952af4d1dcc57d2521694e192888042d5585e344e570d16"
+      "bytes": 825067,
+      "sha256": "4f30d077fb4563e48d0f954e8b3dd1f540d53cc782b727bd391259243eb66968"
     },
     {
       "path": "release/NATIVE-LICENSES.md",
diff --git a/release/SHA256SUMS b/release/SHA256SUMS
index 16901b3..18c6c81 100644
--- a/release/SHA256SUMS
+++ b/release/SHA256SUMS
@@ -5,6 +5,6 @@
 5f23a03801161141e4e7baa57b787a606ea83ffc3ccd8de5e760240b399707cc  ci/evidence/api-audit.json
 9c9c6ed236d04880bab504387251f7a9e283f338c48fe46a6fe0ece472eb8063  ci/evidence/artifact-audit.json
 80c926cfdb7f4055659392cba69e37352a8d501cf235a244362384b04b78a02a  ci/evidence/concurrency-audit.json
-56e6e2224c3f7ebabc4f1d3c4c8d63a9208a03101d571728dab10a63332f51f6  ci/evidence/documentation-audit.json
+8ee4ebd39572fc6ea00c40536bb59fd03e59e6973417f931166c4da1d963e9f3  ci/evidence/documentation-audit.json
 db355bb598888d08e1bfac56436f0dc786312defb8345741dd5003ff4e37409f  ci/evidence/provenance-audit.json
 b417ee7bf6b748cc86839e5354753c0f8c1f8309d13c0fea379c77f602e69fc0  release/NATIVE-LICENSES.md
diff --git a/release/THIRD-PARTY-NOTICES.md b/release/THIRD-PARTY-NOTICES.md
index 8e5acad..8cde8a0 100644
--- a/release/THIRD-PARTY-NOTICES.md
+++ b/release/THIRD-PARTY-NOTICES.md
@@ -21,7 +21,7 @@ This document must accompany source and binary distributions. A package's presen
 | `anstyle-parse 1.0.0` | `MIT OR Apache-2.0` | `52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e` | `c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08`<br>`6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6` |
 | `anstyle-query 1.1.5` | `MIT OR Apache-2.0` | `40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc` | `c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08`<br>`6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6` |
 | `anstyle-wincon 3.0.11` | `MIT OR Apache-2.0` | `291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d` | `c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08`<br>`6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6` |
-| `aotuv_lancer_vorbis_sys 0.1.6` | `BSD-3-Clause` | `5bc4fd1a61860d2f1198b60bedd30910eaffa978f1ee6214dfb24ac70d589225` | `db8373b96caffc61198be37c43785776f781715905ae048cf209ad620102e0aa`<br>`d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814`<br>`0c72574d90753e1eda1f21a83c1a04990e67b26bb56e01acf3ce241140518156`<br>`1f6c6b6397d86d20968d7856d6945591b89e4cb64e5fc1ec8b992811f6a65ed8` |
+| `aotuv_lancer_vorbis_sys 0.1.6` | `BSD-3-Clause` | `5bc4fd1a61860d2f1198b60bedd30910eaffa978f1ee6214dfb24ac70d589225` | `db8373b96caffc61198be37c43785776f781715905ae048cf209ad620102e0aa` |
 | `arrayvec 0.7.8` | `MIT OR Apache-2.0` | `d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`4da95ec4ecb65b738d470b7d762894ad9c97da93e6cbfb18b570fc2c96f4b871` |
 | `asn1-rs 0.7.2` | `MIT OR Apache-2.0` | `b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`a5c61b93b6ee1d104af9920cf020ff3c7efe818e31fe562c72261847a728f513` |
 | `asn1-rs-derive 0.6.0` | `MIT OR Apache-2.0` | `3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`a5c61b93b6ee1d104af9920cf020ff3c7efe818e31fe562c72261847a728f513` |
@@ -29,7 +29,7 @@ This document must accompany source and binary distributions. A package's presen
 | `atomic-waker 1.1.2` | `Apache-2.0 OR MIT` | `1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3`<br>`6226d0632e2e1a80c23597e964da9812ae193c535fe058154afb034e94167aa5` |
 | `autocfg 1.5.1` | `Apache-2.0 OR MIT` | `f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`27995d58ad5c1145c1a8cd86244ce844886958a35eb2b78c6b772748669999ac` |
 | `aws-lc-rs 1.18.0` | `ISC AND (Apache-2.0 OR ISC)` | `ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e` | `b50b376e7d24a0598488b730c3034ffcd0b58dd36c0913a24b9903a3cfd04bf7` |
-| `aws-lc-sys 0.44.0` | `ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0)` | `f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483` | `728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e`<br>`728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e` |
+| `aws-lc-sys 0.44.0` | `ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0)` | `f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483` | `728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e` |
 | `base16ct 0.2.0` | `Apache-2.0 OR MIT` | `4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`0aa8963e105e8b6e02f634484145d4e5b0f42d0a6dd05c16f8148f033383adef` |
 | `base64 0.22.1` | `MIT OR Apache-2.0` | `72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`0dd882e53de11566d50f8e8e2d5a651bcf3fabee4987d70f306233cf39094ba7` |
 | `base64ct 1.8.3` | `Apache-2.0 OR MIT` | `2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`2d1c57bff28344b9e698f51063bc8509799cc4c99a4e0cf2aa3f7e7c3e1f9a9d` |
@@ -39,7 +39,7 @@ This document must accompany source and binary distributions. A package's presen
 | `bitflags 2.13.1` | `MIT OR Apache-2.0` | `b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb` |
 | `block-buffer 0.10.4` | `MIT OR Apache-2.0` | `3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`d5c22aa3118d240e877ad41c5d9fa232f9c77d757d4aac0c2f943afc0a95e0ef` |
 | `block-buffer 0.12.1` | `MIT OR Apache-2.0` | `d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`98181e7249d0c01737645ec982499ce99a0f07eb8f7d625b8840d799d10dbc01` |
-| `block2 0.6.2` | `MIT` | `cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5` | `475831d2d53152709a88c227624ba00e969be34ec17c5126465236de2b9fcad8`<br>`259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f`<br>`23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423` |
+| `block2 0.6.2` | `MIT` | `cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5` | `475831d2d53152709a88c227624ba00e969be34ec17c5126465236de2b9fcad8` |
 | `bumpalo 3.20.3` | `MIT OR Apache-2.0` | `72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`65f94e99ddaf4f5d1782a6dae23f35d4293a9a01444a13135a6887017d353cee` |
 | `bytes 1.12.1` | `MIT` | `fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04` | `45f522cacecb1023856e46df79ca625dfc550c94910078bd8aec6e02880b3d42` |
 | `cc 1.4.2` | `MIT OR Apache-2.0` | `5d262e149917187838d5b42777c8253bcb64500067342904e7d429499a6f277e` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397` |
@@ -143,7 +143,7 @@ This document must accompany source and binary distributions. A package's presen
 | `indexmap 2.14.0` | `Apache-2.0 OR MIT` | `d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`ecc269ef87fd38a1d98e30bfac9ba964a9dbd9315c3770fed98d4d7cb5882055` |
 | `inout 0.1.4` | `MIT OR Apache-2.0` | `879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`304b898acad7f02e03d6d8832d682a3b43ee729ab5d3a069af5a36979083b6b4` |
 | `ipnet 2.12.1` | `MIT OR Apache-2.0` | `6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78` | `87d9feb9238c6bd8e0024fc4733b06cff036f89f36d93b7df1c8a0549bbb7a5b`<br>`47dc9ff29128ddfb4d6a0435383c9f89120bc374dbcc1dd00b933a0b28aa7865` |
-| `is 0.11.0` | `MIT OR Apache-2.0` | `d08f9118d003d441f79c1070e84d0a2a89f35721ca8ae0cd5e1f9026dc4a2517` | `02217aa1b23390c93aa28811bd3f98ca613dc686cad4addb331443a7fa5850e1`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b`<br>`a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2` |
+| `is 0.11.0` | `MIT OR Apache-2.0` | `d08f9118d003d441f79c1070e84d0a2a89f35721ca8ae0cd5e1f9026dc4a2517` | `02217aa1b23390c93aa28811bd3f98ca613dc686cad4addb331443a7fa5850e1`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b` |
 | `is_terminal_polyfill 1.70.2` | `MIT OR Apache-2.0` | `a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695` | `c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08`<br>`6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6` |
 | `itertools 0.13.0` | `MIT OR Apache-2.0` | `413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`7576269ea71f767b99297934c0b2367532690f8c4badc695edf8e04ab6a1e545` |
 | `itoa 1.0.18` | `MIT OR Apache-2.0` | `8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
@@ -183,7 +183,7 @@ This document must accompany source and binary distributions. A package's presen
 | `num-traits 0.2.19` | `MIT OR Apache-2.0` | `071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb` |
 | `num_enum 0.7.6` | `BSD-3-Clause OR MIT OR Apache-2.0` | `5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a`<br>`0be96d891d00e0ae0df75d7f3289b12871c000a1f5ac744f3b570768d4bb277c`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
 | `num_enum_derive 0.7.6` | `BSD-3-Clause OR MIT OR Apache-2.0` | `680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a`<br>`0be96d891d00e0ae0df75d7f3289b12871c000a1f5ac744f3b570768d4bb277c`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
-| `objc2 0.6.4` | `MIT` | `3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f` | `98cc7a184cd170cfeb58b4c0c7d71b76a1c50572c266eecbf789b9d4be602911`<br>`259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f`<br>`23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423` |
+| `objc2 0.6.4` | `MIT` | `3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f` | `98cc7a184cd170cfeb58b4c0c7d71b76a1c50572c266eecbf789b9d4be602911` |
 | `objc2-audio-toolbox 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `6948501a91121d6399b79abaa33a8aa4ea7857fe019f341b8c23ad6e81b79b08` | `4281ed9257b9829bdef146843907c39db1a11a0fe6e738c906827da03d4eb6cf` |
 | `objc2-avf-audio 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `13a380031deed8e99db00065c45937da434ca987c034e13b87e4441f9e4090be` | `90d83d9c2046378b1191c252f61de9993ceffa5576b9f856589e4e2f6255ebfb` |
 | `objc2-cloud-kit 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c` | `7785efa9fca585958a2ddb080c8bc89763abb52d8b6d5850edd09b6cce7b020f` |
@@ -195,13 +195,13 @@ This document must accompany source and binary distributions. A package's presen
 | `objc2-core-image 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006` | `cd2317b6acb2486c3b85662d448fd19e83bd69cac703d81d685cd9e6449905aa` |
 | `objc2-core-location 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009` | `7f3cba7c1d6df6f7b9f461a7833cbec495a9542559ecf94db105206adcab110b` |
 | `objc2-core-text 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d` | `baddcee5ef92af83405bcca13d9bd463ee48ce193842200a116eb9a062bf3111` |
-| `objc2-encode 4.1.0` | `MIT` | `ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33` | `dd8e1e06a3f555211262d27eaf12aac2b974b7f116c654fdabac296f902bebf6`<br>`259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f`<br>`23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423` |
-| `objc2-foundation 0.3.2` | `MIT` | `e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272` | `6f87e5292ee474c131f892c49ac0f637b9eb422e35024375ac4b8172aca86ea9`<br>`259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f`<br>`23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423` |
+| `objc2-encode 4.1.0` | `MIT` | `ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33` | `dd8e1e06a3f555211262d27eaf12aac2b974b7f116c654fdabac296f902bebf6` |
+| `objc2-foundation 0.3.2` | `MIT` | `e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272` | `6f87e5292ee474c131f892c49ac0f637b9eb422e35024375ac4b8172aca86ea9` |
 | `objc2-io-surface 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d` | `df44b43675774e726cb083101d49e9f06c02e51e64d22bebf850a13d70e6ece6` |
 | `objc2-quartz-core 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f` | `3d23b97ee7b9df344bbfdcc734e0db9468dc029f3778744c83584d0fa7acd00b` |
 | `objc2-ui-kit 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22` | `94e0abb9d4d49f9ba7826a66df31bb044e2de7354b61845ce3c085fa424657bb` |
 | `objc2-user-notifications 0.3.2` | `Zlib OR Apache-2.0 OR MIT` | `9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e` | `6b87dcce847a39dd3625813d58f295fb3c0ef998d20ef9b62b3aa3b3da766ecd` |
-| `ogg_next_sys 0.1.5` | `BSD-3-Clause` | `ed2d7a48e247c2bb07e633aefb65a38648ea58c7eedd4e4408a5861721ab049b` | `5de9719e1ca3406135681f64fdd6dff12e602a9ba3adea72cf8df46e1a2596a8`<br>`d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814` |
+| `ogg_next_sys 0.1.5` | `BSD-3-Clause` | `ed2d7a48e247c2bb07e633aefb65a38648ea58c7eedd4e4408a5861721ab049b` | `5de9719e1ca3406135681f64fdd6dff12e602a9ba3adea72cf8df46e1a2596a8` |
 | `oid-registry 0.8.1` | `MIT OR Apache-2.0` | `12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`a5c61b93b6ee1d104af9920cf020ff3c7efe818e31fe562c72261847a728f513` |
 | `once_cell 1.21.4` | `MIT OR Apache-2.0` | `9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
 | `once_cell_polyfill 1.70.2` | `MIT OR Apache-2.0` | `384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe` | `c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08`<br>`6efb0476a1cc085077ed49357026d8c173bf33017278ef440f222fb9cbcb66e6` |
@@ -241,10 +241,10 @@ This document must accompany source and binary distributions. A package's presen
 | `rcgen 0.14.9` | `MIT OR Apache-2.0` | `091e7a8e7d86e6feb87a27ce8e2cba29d49eff9507afeebefab7eeb2ca667fb4` | `debe6fed7ac143217c7f533759c54b14f18cd01d5fe195c51d83c2ae2d136cb4` |
 | `regex 1.13.1` | `MIT OR Apache-2.0` | `f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb` |
 | `regex-automata 0.4.18` | `MIT OR Apache-2.0` | `ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb` |
-| `regex-syntax 0.8.11` | `MIT OR Apache-2.0` | `d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb`<br>`74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3` |
+| `regex-syntax 0.8.11` | `MIT OR Apache-2.0` | `d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb` |
 | `reqwest 0.13.4` | `MIT OR Apache-2.0` | `219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3` | `751963a8b88c0e3a9f27e98933079fbcf09b9998b2c13ac49c2e4d58444520d6`<br>`dd87e27dfbaa888cb77ea34592648a7743636b8dce07e49543bddda0fcfc73bc` |
 | `rfc6979 0.4.0` | `Apache-2.0 OR MIT` | `f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2` | `78779d420019e6b4630376af8e86b6b335ee8a2f89ede6e0411e0469a326aaa4`<br>`bdebaf9156a298f8fdab56dd26cb5144673de522d80f4c0d88e0039145f147f9` |
-| `ring 0.17.14` | `Apache-2.0 AND ISC` | `a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7` | `b3d734001a94efff3579978d953391aa7115f877657d25eb54037a43875d078a`<br>`005fc765ddc5115da796cca915baa9557abae13ff35e0a47c47affc56f6c414d`<br>`f025ccfb7dfb6bdfedc75ca0f67acc69e6fb4998143d834f7c2f38a29989680f`<br>`9eacbcb81be660840c714a560a9d65ba07913db98dd4baf969f78dd499fdd60f` |
+| `ring 0.17.14` | `Apache-2.0 AND ISC` | `a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7` | `b3d734001a94efff3579978d953391aa7115f877657d25eb54037a43875d078a`<br>`005fc765ddc5115da796cca915baa9557abae13ff35e0a47c47affc56f6c414d`<br>`f025ccfb7dfb6bdfedc75ca0f67acc69e6fb4998143d834f7c2f38a29989680f` |
 | `roxmltree 0.21.1` | `MIT OR Apache-2.0` | `f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`fffe218c1e349e1d482a05677f2ce850502f88298174d77f6ac7c04821db7899` |
 | `rustc-hash 2.1.3` | `Apache-2.0 OR MIT` | `6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
 | `rustc_version 0.4.1` | `MIT OR Apache-2.0` | `cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`c9a75f18b9ab2927829a208fc6aa2cf4e63b8420887ba29cdb265d6619ae82d5` |
@@ -281,18 +281,18 @@ This document must accompany source and binary distributions. A package's presen
 | `simd-adler32 0.3.10` | `MIT` | `3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea` | `42a35170233e83e18856792e748de4c1ce4a63b2afce9a370c89ef3fe23f9f2d` |
 | `simd_cesu8 1.2.0` | `Apache-2.0 OR MIT` | `11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
 | `simdutf8 0.1.5` | `MIT OR Apache-2.0` | `e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e` | `0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594`<br>`508a77d2e7b51d98adeed32648ad124b7b30241a8e70b2e72c99f92d8e5874d1` |
-| `skia-bindings 0.99.0` | `MIT` | `3e2d1c3ebd697c0cbded0145e9204a38fa6b268446051b7196d0a096414ea7f3` | `e6d6e0146d16ea19abea522d8ed77aadcdc4f90718a11d4d2cfb55c199ec8b4f`<br>`5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd` |
-| `skia-safe 0.99.0` | `MIT` | `9f512ac418a64194842dd05566320805dad1c957c521039db2486fd6368865bc` | `85160b23bdf006db68c232129bbf4ace9b3eee2fd21ba41025f447c8281c4f9d`<br>`5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd` |
-| `skia-svg-macros 0.1.0` | `MIT` | `044dd2233c9717a74f75197f3e7f0a966db2127c0ffb5e05013b480a9b75b2c7` | `3eefd55332613883150398d8fcf426ac1036bbedecdf28c510573a2da294cf16`<br>`5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd` |
+| `skia-bindings 0.99.0` | `MIT` | `3e2d1c3ebd697c0cbded0145e9204a38fa6b268446051b7196d0a096414ea7f3` | `e6d6e0146d16ea19abea522d8ed77aadcdc4f90718a11d4d2cfb55c199ec8b4f` |
+| `skia-safe 0.99.0` | `MIT` | `9f512ac418a64194842dd05566320805dad1c957c521039db2486fd6368865bc` | `85160b23bdf006db68c232129bbf4ace9b3eee2fd21ba41025f447c8281c4f9d` |
+| `skia-svg-macros 0.1.0` | `MIT` | `044dd2233c9717a74f75197f3e7f0a966db2127c0ffb5e05013b480a9b75b2c7` | `3eefd55332613883150398d8fcf426ac1036bbedecdf28c510573a2da294cf16` |
 | `slab 0.4.12` | `MIT` | `0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5` | `8ce0830173fdac609dfb4ea603fdc002c2f4af0dc9b1a005653f5da9cf534b18` |
 | `smallvec 1.15.2` | `MIT OR Apache-2.0` | `8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9` |
 | `socket2 0.6.5` | `MIT OR Apache-2.0` | `c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397` |
 | `spki 0.7.3` | `Apache-2.0 OR MIT` | `d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d` | `a9040321c3712d8fd0b09cf52b17445de04a23a10165049ae187cd39e5c86be5`<br>`c995204cc6bad2ed67dd41f7d89bb9f1a9d48e0edd745732b30640d7912089a4` |
 | `stable_deref_trait 1.2.1` | `MIT OR Apache-2.0` | `6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`3c125f249fc6fb19f2415d027a0d9a170860583960ea53d08ea1d2b3f269d153` |
 | `stats_alloc 0.1.10` | `MIT` | `5c0e04424e733e69714ca1bbb9204c1a57f09f5493439520f9f68c132ad25eec` | `620434146064377fc36b3100c47ac0740352c50e7d1c9a2c0b1f1a9cd599f607` |
-| `str0m 0.22.0` | `MIT OR Apache-2.0` | `4656b60e74d1a0cf7c407b0d992c5bc141c3e75193f4b1399817d54a180505f3` | `5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b`<br>`a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2` |
-| `str0m-proto 0.7.0` | `MIT OR Apache-2.0` | `e8f3d99f2cf6c76a502e45feb896ea71e54787ede8744bcdb215acfbfcb905dd` | `1fd983eabb98b4f818bfcef344a2b2faf040d5c4b6bf6a826afeff4e26de485f`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b`<br>`a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2` |
-| `str0m-rust-crypto 0.6.0` | `MIT OR Apache-2.0` | `947c2417bf43e47504911f92f47c22b6125a57d162e1661f1c77b78ebb3aa9d3` | `a8b47a93504bfe6e7991ec0151e179a68fd68e0b662e81ce1ff17528c24f79fc`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b`<br>`a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2` |
+| `str0m 0.22.0` | `MIT OR Apache-2.0` | `4656b60e74d1a0cf7c407b0d992c5bc141c3e75193f4b1399817d54a180505f3` | `5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b` |
+| `str0m-proto 0.7.0` | `MIT OR Apache-2.0` | `e8f3d99f2cf6c76a502e45feb896ea71e54787ede8744bcdb215acfbfcb905dd` | `1fd983eabb98b4f818bfcef344a2b2faf040d5c4b6bf6a826afeff4e26de485f`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b` |
+| `str0m-rust-crypto 0.6.0` | `MIT OR Apache-2.0` | `947c2417bf43e47504911f92f47c22b6125a57d162e1661f1c77b78ebb3aa9d3` | `a8b47a93504bfe6e7991ec0151e179a68fd68e0b662e81ce1ff17528c24f79fc`<br>`5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b` |
 | `strsim 0.11.1` | `MIT` | `7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f` | `1e697ce8d21401fbf1bddd9b5c3fd4c4c79ae1e3bdf51f81761c85e11d5a89cd` |
 | `subtle 2.6.1` | `BSD-3-Clause` | `13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292` | `cc0332a88c2ea21d5f3c1298f966120f4c95196871c3f6bb4fcf615508b93fa1` |
 | `syn 2.0.119` | `MIT OR Apache-2.0` | `872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
@@ -325,7 +325,7 @@ This document must accompany source and binary distributions. A package's presen
 | `tower-service 0.3.3` | `MIT` | `8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3` | `4249c8e6c5ebb85f97c77e6457c6fafc1066406eb8f1ef61e796fbdc5ff18482` |
 | `tracing 0.1.44` | `MIT` | `63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100` | `898b1ae9821e98daf8964c8d6c7f61641f5f5aa78ad500020771c0939ee0dea1` |
 | `tracing-attributes 0.1.31` | `MIT` | `7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da` | `898b1ae9821e98daf8964c8d6c7f61641f5f5aa78ad500020771c0939ee0dea1` |
-| `tracing-core 0.1.36` | `MIT` | `db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a` | `898b1ae9821e98daf8964c8d6c7f61641f5f5aa78ad500020771c0939ee0dea1`<br>`58545fed1565e42d687aecec6897d35c6d37ccb71479a137c0deb2203e125c79` |
+| `tracing-core 0.1.36` | `MIT` | `db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a` | `898b1ae9821e98daf8964c8d6c7f61641f5f5aa78ad500020771c0939ee0dea1` |
 | `try-lock 0.2.5` | `MIT` | `e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b` | `c816a0749cdc6bf062a5111c159723de51b2bfac66a1dac2655abd9e6b1583eb` |
 | `typenum 1.20.1` | `MIT OR Apache-2.0` | `b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20` | `36bb253818ac13761081556ff5c457d626da9df1eb4f56194d9ad3926c418a68`<br>`3c97f5b6ad4e73ad22dc0d1e0c7120579a350df57095120017ddfe5a8669604e`<br>`a825bd853ab71619a4923d7b4311221427848070ff44d990da39b0b274c1683f` |
 | `unicode-general-category 1.1.0` | `Apache-2.0` | `0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f` | `b40930bbcf80744c86c46a12bc9da056641d722716c378f5659b9e555ef833e1` |
@@ -339,7 +339,7 @@ This document must accompany source and binary distributions. A package's presen
 | `uuid 1.24.0` | `Apache-2.0 OR MIT` | `bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`436bc5a105d8e57dcd8778730f3754f7bf39c14d2f530e4cde4bd2d17a83ec3d` |
 | `vcpkg 0.2.15` | `MIT/Apache-2.0` | `accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426` | `3708458dee7f359ac6c9c5558023ed481be87e5372c43ebd7f2ca7ad23c12026`<br>`ff7d99434986ba68f6575d689fd9cc11d93a486876b19004e1bacc0f6ca554d4` |
 | `version_check 0.9.5` | `MIT/Apache-2.0` | `0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e` |
-| `vorbis_rs 0.5.6` | `BSD-3-Clause` | `49c5da94d280f7a27e8c937e9b73df2da3e23a2583f48471fd8fb4c72f9c1933` | `6b304bd3ec8aa970304048a405fe12c5f48cc2aa3736712f7fe1acddceae0359`<br>`d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814`<br>`0c72574d90753e1eda1f21a83c1a04990e67b26bb56e01acf3ce241140518156`<br>`1f6c6b6397d86d20968d7856d6945591b89e4cb64e5fc1ec8b992811f6a65ed8` |
+| `vorbis_rs 0.5.6` | `BSD-3-Clause` | `49c5da94d280f7a27e8c937e9b73df2da3e23a2583f48471fd8fb4c72f9c1933` | `6b304bd3ec8aa970304048a405fe12c5f48cc2aa3736712f7fe1acddceae0359` |
 | `walkdir 2.5.0` | `Unlicense/MIT` | `29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b` | `01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f`<br>`0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f`<br>`7e12e5df4bae12cb21581ba157ced20e1986a0508dd10d0e8a4ab9a4cf94e85c` |
 | `want 0.3.1` | `MIT` | `bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e` | `a65f5d0a945d267751344c95665945b90c030ea107faf5c85d518929886187da` |
 | `wasi 0.11.1+wasi-snapshot-preview1` | `Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT` | `ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b` | `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`<br>`268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5`<br>`23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3` |
@@ -1378,44 +1378,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 </pre>
 
-### `0c72574d90753e1eda1f21a83c1a04990e67b26bb56e01acf3ce241140518156`
-
-Packages: aotuv_lancer_vorbis_sys 0.1.6, vorbis_rs 0.5.6<br>
-Source filenames: repository-license/aotuv_lancer_vorbis_sys-0.1.6/vorbis_vendor/COPYING, vorbis_vendor/COPYING
-
-<pre>
-aoTuV - Copyright (c) 2003-2021 Aoyumi
-Copyright (c) 2002-2020 Xiph.org Foundation
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-- Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-
-- Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-
-- Neither the name of the Xiph.org Foundation nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION
-OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-</pre>
-
 ### `0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594`
 
 Packages: alsa 0.11.0, miniz_oxide 0.8.9, num-conv 0.2.2, pin-project-lite 0.2.17, simdutf8 0.1.5, sync_wrapper 1.0.2, time 0.3.55, time-core 0.1.9, time-macros 0.2.32<br>
@@ -2202,53 +2164,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-</pre>
-
-### `1f6c6b6397d86d20968d7856d6945591b89e4cb64e5fc1ec8b992811f6a65ed8`
-
-Packages: aotuv_lancer_vorbis_sys 0.1.6, vorbis_rs 0.5.6<br>
-Source filenames: repository-license/aotuv_lancer_vorbis_sys-0.1.6/vorbis_vendor/debian/copyright, vorbis_vendor/debian/copyright
-
-<pre>
-This package was debianized by Christopher L Cheney &lt;ccheney@debian.org&gt; on
-Tue, 31 Oct 2000 15:08:22 -0600.
-
-It was downloaded from https://downloads.xiph.org/releases/vorbis/
-
-Upstream Author: Monty &lt;monty@xiph.org&gt;
-
-Copyright:
-
-Copyright (c) 2020, Xiph.org Foundation
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-- Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-
-- Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-
-- Neither the name of the Xiph.org Foundation nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR
-CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
-EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
-PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
-LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
-NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
 </pre>
 
 ### `1fd983eabb98b4f818bfcef344a2b2faf040d5c4b6bf6a826afeff4e26de485f`
@@ -2503,32 +2418,6 @@ DEALINGS IN THE SOFTWARE.
 
 </pre>
 
-### `23d608079a47693a26dfc8a5cb01894ad0136a50714d46221d9380aa4a4b4423`
-
-Packages: block2 0.6.2, objc2 0.6.4, objc2-encode 4.1.0, objc2-foundation 0.3.2<br>
-Source filenames: repository-license/objc2-foundation-0.3.2/src/tests/copying.rs, src/tests/copying.rs
-
-<pre>
-#![cfg(feature = "NSString")]
-use objc2::{rc::Retained, runtime::ProtocolObject};
-use objc2_foundation::{NSCopying, NSMutableCopying, NSString};
-
-#[test]
-fn copy() {
-    let obj = NSString::new();
-    let protocol_object: &amp;ProtocolObject&lt;dyn NSCopying&gt; = ProtocolObject::from_ref(&amp;*obj);
-    let _: Retained&lt;ProtocolObject&lt;dyn NSCopying&gt;&gt; = protocol_object.copy();
-}
-
-#[test]
-fn copy_mutable() {
-    let obj = NSString::new();
-    let protocol_object: &amp;ProtocolObject&lt;dyn NSMutableCopying&gt; = ProtocolObject::from_ref(&amp;*obj);
-    let _: Retained&lt;ProtocolObject&lt;dyn NSMutableCopying&gt;&gt; = protocol_object.mutableCopy();
-}
-
-</pre>
-
 ### `23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3`
 
 Packages: adler2 2.0.1, atomic-waker 1.1.2, curve25519-dalek-derive 0.1.1, displaydoc 0.2.7, fastrand 2.5.0, group 0.13.0, itoa 1.0.18, linux-raw-sys 0.12.1, minimal-lexical 0.2.1, num_enum 0.7.6, num_enum_derive 0.7.6, once_cell 1.21.4, pin-project-lite 0.2.17, prettyplease 0.2.37, proc-macro-crate 3.5.0, proc-macro2 1.0.107, quote 1.0.47, rustc-hash 2.1.3, rustix 1.1.4, rustversion 1.0.23, semver 1.0.28, serde 1.0.229, serde_core 1.0.229, serde_derive 1.0.229, serde_json 1.0.151, simd_cesu8 1.2.0, syn 2.0.119, syn 3.0.3, thiserror 1.0.69, thiserror 2.0.20, thiserror-impl 1.0.69, thiserror-impl 2.0.20, unicode-ident 1.0.24, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-streams 0.5.0, wit-bindgen 0.57.1, zmij 1.0.23<br>
@@ -2683,256 +2572,6 @@ SOFTWARE.
 
 </pre>
 
-### `259b22f571b54fed25f68ec5abd8eda223e7b0547a806f13ba797a0eabecd64f`
-
-Packages: block2 0.6.2, objc2 0.6.4, objc2-encode 4.1.0, objc2-foundation 0.3.2<br>
-Source filenames: repository-license/objc2-foundation-0.3.2/src/copying.rs, src/copying.rs
-
-<pre>
-use objc2::extern_protocol;
-use objc2::rc::Retained;
-use objc2::runtime::NSZone;
-use objc2::runtime::ProtocolObject;
-use objc2::Message;
-
-/// A helper type for implementing [`NSCopying`].
-///
-/// `NSCopying` and `NSMutableCopying` do not in their signatures describe the
-/// result type from the copying operation. This is problematic, as it means
-/// that using them ends up falling back to [`AnyObject`], which makes copying
-/// much less useful and ergonomic.
-///
-/// To properly describe this, we need an associated type which describes the
-/// actual result type from a copy. The associated type can't be present
-/// directly on the protocol traits themselves, however, since we want to use
-/// them as e.g. `ProtocolObject&lt;dyn NSCopying&gt;`, so we introduce this helper
-/// trait instead. See [`MutableCopyingHelper`] for the mutable variant.
-///
-/// We might be able to get rid of this hack once [associated type defaults]
-/// are stabilized.
-///
-/// [`AnyObject`]: objc2::runtime::AnyObject
-/// [associated type defaults]: https://github.com/rust-lang/rust/issues/29661
-///
-///
-/// # Safety
-///
-/// The [`Result`] type must be correct.
-///
-/// [`Result`]: Self::Result
-pub unsafe trait CopyingHelper: Message {
-    /// The immutable counterpart of the type, or `Self` if the type has no
-    /// immutable counterpart.
-    ///
-    /// The implementation for `NSString` has itself (`NSString`) here, while
-    /// `NSMutableString` instead has `NSString`.
-    type Result: Message;
-}
-
-/// A helper type for implementing [`NSMutableCopying`].
-///
-/// See [`CopyingHelper`] for the immutable variant, and more details in
-/// general. These traits are split to allow implementing
-/// `MutableCopyingHelper` only when the mutable class is available.
-///
-///
-/// # Safety
-///
-/// The [`Result`] type must be correct.
-///
-/// [`Result`]: Self::Result
-pub unsafe trait MutableCopyingHelper: Message {
-    /// The mutable counterpart of the type, or `Self` if the type has no
-    /// mutable counterpart.
-    ///
-    /// The implementation for `NSString` has `NSMutableString` here, while
-    /// `NSMutableString` has itself (`NSMutableString`).
-    type Result: Message;
-}
-
-// SAFETY: Superclasses are not in general required to implement the same
-// traits as their subclasses, but we're not dealing with normal classes and
-// arbitrary protocols, we're dealing with with immutable/mutable class
-// counterparts, and the `NSCopying`/`NSMutableCopying` protocols, which
-// _will_ be implemented on superclasses.
-unsafe impl&lt;P: ?Sized&gt; CopyingHelper for ProtocolObject&lt;P&gt; {
-    type Result = Self;
-}
-
-// SAFETY: Subclasses are required to always implement the same traits as
-// their superclasses, so a mutable subclass is required to implement the same
-// traits too.
-unsafe impl&lt;P: ?Sized&gt; MutableCopyingHelper for ProtocolObject&lt;P&gt; {
-    type Result = Self;
-}
-
-extern_protocol!(
-    /// A protocol to provide functional copies of objects.
-    ///
-    /// This is similar to Rust's [`Clone`] trait, along with sharing a few
-    /// similarities to the [`std::borrow::ToOwned`] trait with regards to the
-    /// output type.
-    ///
-    /// To allow using this in a meaningful way in Rust, we have to "enrich"
-    /// the implementation by also specifying the resulting type, see
-    /// [`CopyingHelper`] for details.
-    ///
-    /// See also [Apple's documentation][apple-doc].
-    ///
-    /// [apple-doc]: https://developer.apple.com/documentation/foundation/nscopying
-    ///
-    ///
-    /// # Examples
-    ///
-    /// Implement `NSCopying` for an externally defined class.
-    ///
-    /// ```
-    /// use objc2::extern_class;
-    /// use objc2_foundation::{CopyingHelper, NSCopying, NSObject};
-    ///
-    /// extern_class!(
-    ///     #[unsafe(super(NSObject))]
-    ///     # #[name = "NSData"]
-    ///     struct ExampleClass;
-    /// );
-    ///
-    /// unsafe impl NSCopying for ExampleClass {}
-    ///
-    /// // Copying ExampleClass returns another ExampleClass.
-    /// unsafe impl CopyingHelper for ExampleClass {
-    ///     type Result = Self;
-    /// }
-    /// ```
-    ///
-    /// Implement `NSCopying` for a custom class.
-    ///
-    /// ```
-    /// use objc2::{define_class, msg_send, AnyThread, DefinedClass};
-    /// use objc2::rc::Retained;
-    /// use objc2::runtime::NSZone;
-    /// use objc2_foundation::{CopyingHelper, NSCopying, NSObject};
-    ///
-    /// define_class!(
-    ///     #[unsafe(super(NSObject))]
-    ///     struct CustomClass;
-    ///
-    ///     unsafe impl NSCopying for CustomClass {
-    ///         #[unsafe(method_id(copyWithZone:))]
-    ///         fn copyWithZone(&amp;self, _zone: *const NSZone) -&gt; Retained&lt;Self&gt; {
-    ///             // Create new class, and transfer ivars
-    ///             let new = Self::alloc().set_ivars(self.ivars().clone());
-    ///             unsafe { msg_send![super(new), init] }
-    ///         }
-    ///     }
-    /// );
-    ///
-    /// // Copying CustomClass returns another CustomClass.
-    /// unsafe impl CopyingHelper for CustomClass {
-    ///     type Result = Self;
-    /// }
-    /// ```
-    #[allow(clippy::missing_safety_doc)]
-    pub unsafe trait NSCopying {
-        /// Returns a new instance that's a copy of the receiver.
-        ///
-        /// The output type is the immutable counterpart of the object, which
-        /// is usually `Self`, but e.g. `NSMutableString` returns `NSString`.
-        #[unsafe(method(copy))]
-        #[unsafe(method_family = copy)]
-        #[optional]
-        fn copy(&amp;self) -&gt; Retained&lt;Self::Result&gt;
-        where
-            Self: CopyingHelper;
-
-        /// Returns a new instance that's a copy of the receiver.
-        ///
-        /// This is only used when implementing `NSCopying`, call
-        /// [`copy`][NSCopying::copy] instead.
-        ///
-        ///
-        /// # Safety
-        ///
-        /// The zone pointer must be valid or NULL.
-        #[unsafe(method(copyWithZone:))]
-        #[unsafe(method_family = copy)]
-        unsafe fn copyWithZone(&amp;self, zone: *mut NSZone) -&gt; Retained&lt;Self::Result&gt;
-        where
-            Self: CopyingHelper;
-    }
-);
-
-extern_protocol!(
-    /// A protocol to provide mutable copies of objects.
-    ///
-    /// Only classes that have an “immutable vs. mutable” distinction should
-    /// adopt this protocol. Use the [`MutableCopyingHelper`] trait to specify
-    /// the return type after copying.
-    ///
-    /// See [Apple's documentation][apple-doc] for details.
-    ///
-    /// [apple-doc]: https://developer.apple.com/documentation/foundation/nsmutablecopying
-    ///
-    ///
-    /// # Example
-    ///
-    /// Implement [`NSCopying`] and [`NSMutableCopying`] for a class pair like
-    /// `NSString` and `NSMutableString`.
-    ///
-    /// ```ignore
-    /// // Immutable copies return NSString
-    ///
-    /// unsafe impl NSCopying for NSString {}
-    /// unsafe impl CopyingHelper for NSString {
-    ///     type Result = NSString;
-    /// }
-    /// unsafe impl NSCopying for NSMutableString {}
-    /// unsafe impl CopyingHelper for NSMutableString {
-    ///     type Result = NSString;
-    /// }
-    ///
-    /// // Mutable copies return NSMutableString
-    ///
-    /// unsafe impl NSMutableCopying for NSString {}
-    /// unsafe impl MutableCopyingHelper for NSString {
-    ///     type Result = NSMutableString;
-    /// }
-    /// unsafe impl NSMutableCopying for NSMutableString {}
-    /// unsafe impl MutableCopyingHelper for NSMutableString {
-    ///     type Result = NSMutableString;
-    /// }
-    /// ```
-    #[allow(clippy::missing_safety_doc)]
-    pub unsafe trait NSMutableCopying {
-        /// Returns a new instance that's a mutable copy of the receiver.
-        ///
-        /// The output type is the mutable counterpart of the object. E.g. both
-        /// `NSString` and `NSMutableString` return `NSMutableString`.
-        #[unsafe(method(mutableCopy))]
-        #[unsafe(method_family = mutableCopy)]
-        #[optional]
-        fn mutableCopy(&amp;self) -&gt; Retained&lt;Self::Result&gt;
-        where
-            Self: MutableCopyingHelper;
-
-        /// Returns a new instance that's a mutable copy of the receiver.
-        ///
-        /// This is only used when implementing `NSMutableCopying`, call
-        /// [`mutableCopy`][NSMutableCopying::mutableCopy] instead.
-        ///
-        ///
-        /// # Safety
-        ///
-        /// The zone pointer must be valid or NULL.
-        #[unsafe(method(mutableCopyWithZone:))]
-        #[unsafe(method_family = mutableCopy)]
-        unsafe fn mutableCopyWithZone(&amp;self, zone: *mut NSZone) -&gt; Retained&lt;Self::Result&gt;
-        where
-            Self: MutableCopyingHelper;
-    }
-);
-
-</pre>
-
 ### `268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5`
 
 Packages: linux-raw-sys 0.12.1, rustix 1.1.4, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wit-bindgen 0.57.1<br>
@@ -6154,36 +5793,6 @@ limitations under the License.
 
 </pre>
 
-### `58545fed1565e42d687aecec6897d35c6d37ccb71479a137c0deb2203e125c79`
-
-Packages: tracing-core 0.1.36<br>
-Source filenames: src/spin/LICENSE
-
-<pre>
-The MIT License (MIT)
-
-Copyright (c) 2014 Mathijs van de Nes
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-</pre>
-
 ### `5b460f37be48ac4cf2181596181cc6cae432fc2caae05944873f380730829a4b`
 
 Packages: dimpl 0.7.2, is 0.11.0, str0m 0.22.0, str0m-proto 0.7.0, str0m-rust-crypto 0.6.0<br>
@@ -6295,44 +5904,6 @@ The published crate archive contains no discoverable top-level license/notice fi
 
 </pre>
 
-### `5f787c1dee3c56547f09ccc2906ab5f5293c4d8dd6c8654e573216c38e908dbd`
-
-Packages: skia-bindings 0.99.0, skia-safe 0.99.0, skia-svg-macros 0.1.0<br>
-Source filenames: repository-license/skia-bindings-0.99.0/skia/LICENSE, skia/LICENSE
-
-<pre>
-Copyright (c) 2011 Google Inc. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-  * Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer.
-
-  * Redistributions in binary form must reproduce the above copyright
-    notice, this list of conditions and the following disclaimer in
-    the documentation and/or other materials provided with the
-    distribution.
-
-  * Neither the name of the copyright holder nor the names of its
-    contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-</pre>
-
 ### `615f39d3be6ff90d956c6b490b1f967a8995e88c109384895740748cb197fd87`
 
 Packages: objc2-core-graphics 0.3.2<br>
@@ -7479,7 +7050,7 @@ The published crate archive contains no discoverable top-level license/notice fi
 ### `728536b4160e051f86d7c9c388f704866b3d512cd7df97ac3516c65279523c4e`
 
 Packages: aws-lc-sys 0.44.0<br>
-Source filenames: LICENSE, aws-lc/LICENSE
+Source filenames: LICENSE
 
 <pre>
 AWS Libcrypto (AWS-LC)
@@ -7892,72 +7463,6 @@ conditions.
 
 </pre>
 
-### `74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3`
-
-Packages: regex-syntax 0.8.11<br>
-Source filenames: src/unicode_tables/LICENSE-UNICODE
-
-<pre>
-UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
-
-Unicode Data Files include all data files under the directories
-http://www.unicode.org/Public/, http://www.unicode.org/reports/,
-http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
-http://www.unicode.org/utility/trac/browser/.
-
-Unicode Data Files do not include PDF online code charts under the
-directory http://www.unicode.org/Public/.
-
-Software includes any source code published in the Unicode Standard
-or under the directories
-http://www.unicode.org/Public/, http://www.unicode.org/reports/,
-http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
-http://www.unicode.org/utility/trac/browser/.
-
-NOTICE TO USER: Carefully read the following legal agreement.
-BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
-DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
-YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
-TERMS AND CONDITIONS OF THIS AGREEMENT.
-IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
-THE DATA FILES OR SOFTWARE.
-
-COPYRIGHT AND PERMISSION NOTICE
-
-Copyright © 1991-2018 Unicode, Inc. All rights reserved.
-Distributed under the Terms of Use in http://www.unicode.org/copyright.html.
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Unicode data files and any associated documentation
-(the "Data Files") or Unicode software and any associated documentation
-(the "Software") to deal in the Data Files or Software
-without restriction, including without limitation the rights to use,
-copy, modify, merge, publish, distribute, and/or sell copies of
-the Data Files or Software, and to permit persons to whom the Data Files
-or Software are furnished to do so, provided that either
-(a) this copyright and permission notice appear with all copies
-of the Data Files or Software, or
-(b) this copyright and permission notice appear in associated
-Documentation.
-
-THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
-WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT OF THIRD PARTY RIGHTS.
-IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
-NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
-DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
-DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
-TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THE DATA FILES OR SOFTWARE.
-
-Except as contained in this notice, the name of a copyright holder
-shall not be used in advertising or otherwise to promote the sale,
-use or other dealings in these Data Files or Software without prior
-written authorization of the copyright holder.
-
-</pre>
-
 ### `751963a8b88c0e3a9f27e98933079fbcf09b9998b2c13ac49c2e4d58444520d6`
 
 Packages: reqwest 0.13.4<br>
@@ -10756,8 +10261,8 @@ DEALINGS IN THE SOFTWARE.
 
 ### `9eacbcb81be660840c714a560a9d65ba07913db98dd4baf969f78dd499fdd60f`
 
-Packages: fiat-crypto 0.2.9, ring 0.17.14<br>
-Source filenames: LICENSE-APACHE, third_party/fiat/LICENSE
+Packages: fiat-crypto 0.2.9<br>
+Source filenames: LICENSE-APACHE
 
 <pre>
 The Apache License, Version 2.0 (Apache-2.0)
@@ -10978,8 +10483,8 @@ DEALINGS IN THE SOFTWARE.
 
 ### `a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2`
 
-Packages: arrayvec 0.7.8, asn1-rs 0.7.2, asn1-rs-derive 0.6.0, asn1-rs-impl 0.2.0, atomic-waker 1.1.2, autocfg 1.5.1, base64 0.22.1, bitflags 2.13.1, bumpalo 3.20.3, cc 1.4.2, cexpr 0.6.0, cfg-if 1.0.4, cmake 0.1.58, core-foundation 0.10.1, core-foundation-sys 0.8.7, coreaudio-rs 0.14.2, curve25519-dalek-derive 0.1.1, der-parser 10.0.0, displaydoc 0.2.7, either 1.17.0, equivalent 1.0.2, errno 0.3.14, fastrand 2.5.0, filetime 0.2.29, find-msvc-tools 0.1.10, flate2 1.1.9, form_urlencoded 1.2.2, glob 0.3.4, group 0.13.0, hashbrown 0.17.1, heck 0.5.0, httparse 1.10.1, hyper-rustls 0.27.9, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.0, is 0.11.0, itertools 0.13.0, jobserver 0.1.35, js-sys 0.3.104, lazy_static 1.5.0, linux-raw-sys 0.12.1, log 0.4.33, num-bigint 0.4.8, num-derive 0.4.2, num-integer 0.1.46, num-traits 0.2.19, oid-registry 0.8.1, once_cell 1.21.4, openssl-probe 0.2.1, percent-encoding 2.3.2, pkg-config 0.3.33, plain 0.2.3, regex 1.13.1, regex-automata 0.4.18, regex-syntax 0.8.11, roxmltree 0.21.1, rustc_version 0.4.1, rusticata-macros 4.1.0, rustix 1.1.4, rustls 0.23.43, rustls-native-certs 0.8.4, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.15.2, socket2 0.6.5, stable_deref_trait 1.2.1, str0m 0.22.0, str0m-proto 0.7.0, str0m-rust-crypto 0.6.0, tar 0.4.46, url 2.5.8, uuid 1.24.0, version_check 0.9.5, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.127, wasm-bindgen-futures 0.4.77, wasm-bindgen-macro 0.2.127, wasm-bindgen-macro-support 0.2.127, wasm-bindgen-shared 0.2.127, web-sys 0.3.104, wit-bindgen 0.57.1, x509-parser 0.18.1, xattr 1.6.1, yasna 0.6.0<br>
-Source filenames: LICENSE-APACHE, repository-license/asn1-rs-0.7.2/LICENSE-APACHE, repository-license/str0m-0.22.0/src/packet/LICENSE-APACHE.txt, src/packet/LICENSE-APACHE.txt
+Packages: arrayvec 0.7.8, asn1-rs 0.7.2, asn1-rs-derive 0.6.0, asn1-rs-impl 0.2.0, atomic-waker 1.1.2, autocfg 1.5.1, base64 0.22.1, bitflags 2.13.1, bumpalo 3.20.3, cc 1.4.2, cexpr 0.6.0, cfg-if 1.0.4, cmake 0.1.58, core-foundation 0.10.1, core-foundation-sys 0.8.7, coreaudio-rs 0.14.2, curve25519-dalek-derive 0.1.1, der-parser 10.0.0, displaydoc 0.2.7, either 1.17.0, equivalent 1.0.2, errno 0.3.14, fastrand 2.5.0, filetime 0.2.29, find-msvc-tools 0.1.10, flate2 1.1.9, form_urlencoded 1.2.2, glob 0.3.4, group 0.13.0, hashbrown 0.17.1, heck 0.5.0, httparse 1.10.1, hyper-rustls 0.27.9, idna 1.1.0, idna_adapter 1.2.2, indexmap 2.14.0, itertools 0.13.0, jobserver 0.1.35, js-sys 0.3.104, lazy_static 1.5.0, linux-raw-sys 0.12.1, log 0.4.33, num-bigint 0.4.8, num-derive 0.4.2, num-integer 0.1.46, num-traits 0.2.19, oid-registry 0.8.1, once_cell 1.21.4, openssl-probe 0.2.1, percent-encoding 2.3.2, pkg-config 0.3.33, plain 0.2.3, regex 1.13.1, regex-automata 0.4.18, regex-syntax 0.8.11, roxmltree 0.21.1, rustc_version 0.4.1, rusticata-macros 4.1.0, rustix 1.1.4, rustls 0.23.43, rustls-native-certs 0.8.4, security-framework 3.7.0, security-framework-sys 2.17.0, signal-hook-registry 1.4.8, simd_cesu8 1.2.0, smallvec 1.15.2, socket2 0.6.5, stable_deref_trait 1.2.1, tar 0.4.46, url 2.5.8, uuid 1.24.0, version_check 0.9.5, wasi 0.11.1+wasi-snapshot-preview1, wasip2 1.0.4+wasi-0.2.12, wasm-bindgen 0.2.127, wasm-bindgen-futures 0.4.77, wasm-bindgen-macro 0.2.127, wasm-bindgen-macro-support 0.2.127, wasm-bindgen-shared 0.2.127, web-sys 0.3.104, wit-bindgen 0.57.1, x509-parser 0.18.1, xattr 1.6.1, yasna 0.6.0<br>
+Source filenames: LICENSE-APACHE, repository-license/asn1-rs-0.7.2/LICENSE-APACHE
 
 <pre>
                               Apache License
@@ -14775,43 +14280,6 @@ DEALINGS IN THE SOFTWARE.
 
 </pre>
 
-### `d2ab5758336489da61c12cc5bb757da5339c4ae9001f9bb0562b4370249af814`
-
-Packages: aotuv_lancer_vorbis_sys 0.1.6, ogg_next_sys 0.1.5, vorbis_rs 0.5.6<br>
-Source filenames: ogg_vendor/COPYING, repository-license/aotuv_lancer_vorbis_sys-0.1.6/ogg_vendor/COPYING
-
-<pre>
-Copyright (c) 2002, Xiph.org Foundation
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-- Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-
-- Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-
-- Neither the name of the Xiph.org Foundation nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION
-OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-</pre>
-
 ### `d2e7ec5355c96eeade56b09187ceb48a6a30299da3ce7531a66d3d11405ab963`
 
 Packages: crypto-common 0.2.2<br>
diff --git a/tools/check_milestone_06.py b/tools/check_milestone_06.py
index ee289de..5010ef2 100644
--- a/tools/check_milestone_06.py
+++ b/tools/check_milestone_06.py
@@ -104,11 +104,7 @@ def check_benchmarks_and_ci() -> None:
         if not (crate / "benches" / f"{name}.rs").is_file():
             raise SystemExit(f"missing {name} benchmark source")
 
-    workflows = {
-        "imaging-meshing": ROOT / ".gitea" / "workflows" / "imaging-meshing.yml",
-        "jpeg2000": ROOT / ".gitea" / "workflows" / "jpeg2000.yml",
-        "skia": ROOT / ".gitea" / "workflows" / "skia.yml",
-    }
+    workflows = {"consolidated": ROOT / ".gitea" / "workflows" / "ci.yml"}
     for name, path in workflows.items():
         if not path.is_file():
             raise SystemExit(f"missing {name} native-feature workflow")
@@ -121,6 +117,10 @@ def check_benchmarks_and_ci() -> None:
                 f"{name} workflow must use only ubuntu-latest, found: "
                 + ", ".join(unsupported)
             )
+        text = path.read_text()
+        for marker in ("required-gate", "METACRATE_SKIA_ARCHIVE", "OPENJPEG_PREFIX"):
+            if marker not in text:
+                raise SystemExit(f"{name} workflow is missing {marker}")
 
 
 def main() -> None:
diff --git a/tools/check_milestone_10.py b/tools/check_milestone_10.py
index 276dd0c..90d3160 100644
--- a/tools/check_milestone_10.py
+++ b/tools/check_milestone_10.py
@@ -227,12 +227,11 @@ def check_generation_and_ci() -> None:
     subprocess.run(
         ["python3", "tools/generate_lsl_tables.py", "--check"], cwd=ROOT, check=True
     )
-    workflow = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+    workflow = ROOT / ".gitea" / "workflows" / "ci.yml"
     require_markers(
         workflow,
         (
-            "python3 tools/check_milestone_10.py",
-            "python3 tools/test_milestone_10.py",
+            "required-gate",
             "runs-on: ubuntu-latest",
         ),
     )
diff --git a/tools/check_milestone_10_issue_76.py b/tools/check_milestone_10_issue_76.py
index fd1bd2e..f4666dc 100644
--- a/tools/check_milestone_10_issue_76.py
+++ b/tools/check_milestone_10_issue_76.py
@@ -22,7 +22,7 @@ REFERENCE = (
     / "reference_pipeline.rs"
 )
 DOC = ROOT / "crates" / "libremetaverse-rendering-simple" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
 
 TYPE = "T:LibreMetaverse.Rendering.SimpleRenderer"
@@ -85,7 +85,7 @@ def main() -> None:
         "all four `DetailLevel`", "65,536", "Error::Rendering",
         "source primitive UUID", "MeshFoundry", "prim-local coordinates",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_76.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 76 audit: native prim/sculpt conversion, face metadata, texture mapping, "
         "bounded errors, deterministic evidence, dependency isolation, and docs are present"
diff --git a/tools/check_milestone_10_issue_77.py b/tools/check_milestone_10_issue_77.py
index 6676d31..cc90a69 100644
--- a/tools/check_milestone_10_issue_77.py
+++ b/tools/check_milestone_10_issue_77.py
@@ -19,7 +19,7 @@ BENCH = ROOT / "crates" / "libremetaverse-rendering-mesh-foundry" / "benches" /
 WORKSPACE = ROOT / "Cargo.toml"
 DOC = ROOT / "crates" / "libremetaverse-rendering-mesh-foundry" / "README.md"
 STRUCTURED = ROOT / "crates" / "libremetaverse-structured-data" / "src" / "lib.rs"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
 
 TYPE = "T:LibreMetaverse.Rendering.MeshFoundry"
@@ -98,7 +98,7 @@ def main() -> None:
         "exactly-four-influence", "XOR winding", "64 MiB", "65,536", "6,000,000",
         "source primitive UUID", "57,600-vertex",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_77.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 77 audit: native prim/sculpt/terrain and packed mesh pipelines, bounded LLSD/zlib, "
         "LOD, normals/tangents/UVs, materials, rigging, convex data, tests, benchmark, and docs are present"
diff --git a/tools/check_milestone_10_issue_78.py b/tools/check_milestone_10_issue_78.py
index 3fa7e31..804caef 100644
--- a/tools/check_milestone_10_issue_78.py
+++ b/tools/check_milestone_10_issue_78.py
@@ -15,7 +15,7 @@ GENERATED = ROOT / "crates" / "libremetaverse-rlv" / "src" / "generated.rs"
 TESTS = ROOT / "crates" / "libremetaverse-rlv" / "tests" / "protocol_parsing.rs"
 COMPAT = ROOT / "tests" / "compat" / "tests" / "rlv_common_semantics.rs"
 DOC = ROOT / "crates" / "libremetaverse-rlv" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
 
 TYPES = {
@@ -98,7 +98,7 @@ def main() -> None:
         "side-effect-free", "119 behavior", "56 pinned", "half-open byte span",
         "64 KiB", "128 comma-separated", "does not wait", "ubuntu-latest",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_78.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 78 audit: bounded pure RLV parsing, typed commands/queries/restrictions, "
         "exact aliases, positioned errors, mapped values, mutation evidence, and docs are present"
diff --git a/tools/check_milestone_10_issue_79.py b/tools/check_milestone_10_issue_79.py
index d1a5a9c..e79b60f 100644
--- a/tools/check_milestone_10_issue_79.py
+++ b/tools/check_milestone_10_issue_79.py
@@ -16,7 +16,7 @@ GENERATED = ROOT / "crates" / "libremetaverse-rlv" / "src" / "generated.rs"
 TESTS = ROOT / "crates" / "libremetaverse-rlv" / "tests" / "state_semantics.rs"
 COMPAT = ROOT / "tests" / "compat" / "tests" / "rlv_inventory_map_semantics.rs"
 DOC = ROOT / "crates" / "libremetaverse-rlv" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 CATALOG = ROOT / "api" / "public-api.json"
 STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
 
@@ -111,7 +111,7 @@ def main() -> None:
         "after manager locks are released", "secure and explicit", "no network",
         "ubuntu-latest",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_79.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 79 audit: native restriction state, inventory maps, recursive locks, "
         "camera aggregation, blacklist, permission precedence, concurrency evidence, "
diff --git a/tools/check_milestone_10_issue_80.py b/tools/check_milestone_10_issue_80.py
index 141a8c9..33d91da 100644
--- a/tools/check_milestone_10_issue_80.py
+++ b/tools/check_milestone_10_issue_80.py
@@ -20,7 +20,7 @@ QUERY_TESTS = ROOT / "tests" / "compat" / "tests" / "rlv_query_basics_semantics.
 ACTION_TESTS = ROOT / "tests" / "compat" / "tests" / "rlv_attach_commands_semantics.rs"
 NOTIFY_TESTS = ROOT / "tests" / "compat" / "tests" / "rlv_notify_semantics.rs"
 DOC = ROOT / "crates" / "libremetaverse-rlv" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 CATALOG = ROOT / "api" / "public-api.json"
 STUB_RE = re.compile(r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\(")
 
@@ -136,7 +136,7 @@ def main() -> None:
         "after releasing every manager lock", "completed inventory and agent",
         "616", "ubuntu-latest",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_80.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 80 audit: native callbacks, typed actions and queries, bounded service "
         "dispatch, inventory/agent adapters, cancellation, post-lock notifications, "
diff --git a/tools/check_milestone_10_issue_81.py b/tools/check_milestone_10_issue_81.py
index 7d5be73..0201c84 100644
--- a/tools/check_milestone_10_issue_81.py
+++ b/tools/check_milestone_10_issue_81.py
@@ -18,7 +18,7 @@ COMPAT_TESTS = (
     ROOT / "crates" / "libremetaverse-lsl-tools" / "tests" / "lexer_compat.rs"
 )
 DOC = ROOT / "crates" / "libremetaverse-lsl-tools" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 CATALOG = ROOT / "api" / "public-api.json"
 STUB_RE = re.compile(
     r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\("
@@ -135,7 +135,7 @@ def main() -> None:
         "64 Mi UTF-16", "16 Mi units", "Lexer::iter", "46 focused",
         "No C#, .NET runtime", "ubuntu-latest",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_81.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 81 audit: 22 mapped native types and 188 members, bounded UTF-16 "
         "source handling, comments and line directives, Unicode categories, deterministic "
diff --git a/tools/check_milestone_10_issue_82.py b/tools/check_milestone_10_issue_82.py
index 5d620bb..c83ea19 100644
--- a/tools/check_milestone_10_issue_82.py
+++ b/tools/check_milestone_10_issue_82.py
@@ -16,7 +16,7 @@ GENERATED = ROOT / "crates" / "libremetaverse-lsl-tools" / "src" / "generated.rs
 TESTS = ROOT / "crates" / "libremetaverse-lsl-tools" / "tests" / "parser_compat.rs"
 EXTENSION_TESTS = ROOT / "tests" / "compat" / "tests" / "extension_shims.rs"
 DOC = ROOT / "crates" / "libremetaverse-lsl-tools" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 CATALOG = ROOT / "api" / "public-api.json"
 STUB_RE = re.compile(
     r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\("
@@ -125,7 +125,7 @@ def main() -> None:
         "nonassociative", "1,048,576", "16,777,216", "46 focused",
         "issue 83", "ubuntu-latest",
     ))
-    require_markers(WORKFLOW, ("python3 tools/check_milestone_10_issue_82.py",))
+    require_markers(WORKFLOW, ("required-gate",))
     print(
         "issue 82 audit: 22 native mapped parser types and 215 members, deterministic "
         "LALR tables, precedence conflicts, bounded shifts/reductions, error-token "
diff --git a/tools/check_milestone_10_issue_83.py b/tools/check_milestone_10_issue_83.py
index b4e1b33..c28722f 100644
--- a/tools/check_milestone_10_issue_83.py
+++ b/tools/check_milestone_10_issue_83.py
@@ -19,7 +19,7 @@ GENERATOR = ROOT / "crates" / "libremetaverse-lsl-tools" / "src" / "generator.rs
 GENERATED = ROOT / "crates" / "libremetaverse-lsl-tools" / "src" / "generated.rs"
 TESTS = ROOT / "crates" / "libremetaverse-lsl-tools" / "tests" / "generator_compat.rs"
 DOC = ROOT / "crates" / "libremetaverse-lsl-tools" / "README.md"
-WORKFLOW = ROOT / ".gitea" / "workflows" / "rust-workspace.yml"
+WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
 SCRIPT = ROOT / "tools" / "generate_lsl_tables.py"
 STUB_RE = re.compile(
     r"\b(?:not_implemented|unimplemented_api)\b|\b(?:todo|unimplemented)!\s*\("
@@ -184,8 +184,7 @@ def main() -> None:
     require_markers(
         WORKFLOW,
         (
-            "python3 tools/check_milestone_10_issue_83.py",
-            "python3 tools/generate_lsl_tables.py --check",
+            "required-gate",
         ),
     )
     if "runs-on: ubuntu-latest" not in workflow or re.search(
diff --git a/tools/ci-matrix/src/ci_gate.rs b/tools/ci-matrix/src/ci_gate.rs
new file mode 100644
index 0000000..829ad1c
--- /dev/null
+++ b/tools/ci-matrix/src/ci_gate.rs
@@ -0,0 +1,1341 @@
+//! Consolidated, shell-free routine and release CI command graphs.
+
+use super::{
+    MatrixError, Result, audit, audit_api_surface, audit_dependencies, audit_documentation,
+    audit_provenance, load, write_api_baseline, write_documentation_report,
+};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+use std::ffi::{OsStr, OsString};
+use std::fs::{self, OpenOptions};
+use std::io::{Read as _, Write as _};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
+
+const COVERAGE_PATH: &str = "ci/ci-coverage.json";
+const REQUIRED_WORKFLOW: &str = ".gitea/workflows/ci.yml";
+const RELEASE_WORKFLOW: &str = ".gitea/workflows/release.yml";
+const LEGACY_WORKFLOW_COUNT: usize = 13;
+const LEGACY_WORKFLOWS: [&str; LEGACY_WORKFLOW_COUNT] = [
+    "api-surface.yml",
+    "artifact-audit.yml",
+    "codegen.yml",
+    "concurrency-audit.yml",
+    "documentation.yml",
+    "imaging-meshing.yml",
+    "jpeg2000.yml",
+    "performance.yml",
+    "release-candidate.yml",
+    "release-matrix.yml",
+    "rust-workspace.yml",
+    "skia.yml",
+    "supply-chain.yml",
+];
+const SKIA_ARCHIVE: &str = "skia-binaries-a25a0fdb7d90429aa2d1-aarch64-unknown-linux-gnu-jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe.tar.gz";
+const SKIA_SHA256: &str = "dd127f458a5e67a79f3936a8aa19f822fe90a1d6a11b50b5f84df2b0519d909c";
+const SKIA_SUCCESS: &str = "DOWNLOAD AND INSTALL SUCCEEDED";
+const SKIA_SOURCE_BUILD: &str = "STARTING A FULL BUILD";
+
+#[derive(Debug, Deserialize)]
+struct CoverageManifest {
+    schema: u32,
+    required_workflow: String,
+    release_workflow: String,
+    hard_timeout_minutes: u64,
+    internal_target_seconds: u64,
+    required_checks: Vec<String>,
+    legacy_workflows: Vec<LegacyWorkflow>,
+}
+
+#[derive(Debug, Deserialize)]
+struct LegacyWorkflow {
+    workflow: String,
+    responsibility: String,
+    destination: String,
+    checks: Vec<String>,
+    rationale: String,
+}
+
+#[derive(Debug, Serialize)]
+struct GateEvidence {
+    schema: u32,
+    gate: &'static str,
+    status: &'static str,
+    source_commit: String,
+    recorded_unix_seconds: u64,
+    runner_architecture: String,
+    rust_host: String,
+    rust_target: String,
+    cargo_cache_hit: Option<bool>,
+    native_cache_hit: Option<bool>,
+    tools_cache_hit: Option<bool>,
+    peak_memory_kib: Option<u64>,
+    elapsed_seconds: f64,
+    internal_target_seconds: u64,
+    skia: SkiaEvidence,
+    stages: Vec<StageEvidence>,
+    failure: Option<String>,
+}
+
+#[derive(Debug, Default, Serialize)]
+struct SkiaEvidence {
+    archive: String,
+    sha256: String,
+    target: String,
+    download_and_install_succeeded: bool,
+    source_build_started: bool,
+}
+
+#[derive(Debug, Serialize)]
+struct StageEvidence {
+    id: String,
+    elapsed_seconds: f64,
+    commands: usize,
+    status: &'static str,
+}
+
+#[derive(Clone, Copy)]
+struct CommandSpec {
+    program: &'static str,
+    args: &'static [&'static str],
+}
+
+impl CommandSpec {
+    const fn new(program: &'static str, args: &'static [&'static str]) -> Self {
+        Self { program, args }
+    }
+}
+
+/// Validates the workflow split and the complete legacy-check coverage map.
+///
+/// # Errors
+///
+/// Returns an error when the manifest is incomplete, workflow triggers or
+/// runners violate policy, or Skia can fall back to a source build.
+pub fn audit_consolidated_ci(root: &Path) -> Result<()> {
+    let manifest = coverage(root)?;
+    validate_coverage(&manifest)?;
+    validate_workflows(root, &manifest)?;
+    validate_skia_configuration(root)?;
+    Ok(())
+}
+
+/// Runs the routine code-ready gate and always emits a stage-timing record.
+///
+/// # Errors
+///
+/// Returns an error for an invalid host/native identity, a failed validation
+/// command, stale evidence, or exhaustion of the internal runtime target.
+pub fn run_required_gate(root: &Path, evidence_path: &Path) -> Result<()> {
+    audit_consolidated_ci(root)?;
+    let manifest = coverage(root)?;
+    prepare_new_evidence(evidence_path)?;
+    let started = Instant::now();
+    let rust_host = rust_host(root)?;
+    let expected_host = std::env::var("METACRATE_EXPECTED_HOST")
+        .unwrap_or_else(|_| "aarch64-unknown-linux-gnu".to_owned());
+    let mut evidence = GateEvidence {
+        schema: 1,
+        gate: "required",
+        status: "failed",
+        source_commit: command_line(root, "git", &["rev-parse", "--verify", "HEAD"])
+            .unwrap_or_else(|_| "unknown".to_owned()),
+        recorded_unix_seconds: unix_seconds()?,
+        runner_architecture: std::env::consts::ARCH.to_owned(),
+        rust_host: rust_host.clone(),
+        rust_target: expected_host.clone(),
+        cargo_cache_hit: cache_hit("METACRATE_CARGO_CACHE_HIT"),
+        native_cache_hit: cache_hit("METACRATE_NATIVE_CACHE_HIT"),
+        tools_cache_hit: cache_hit("METACRATE_TOOLS_CACHE_HIT"),
+        peak_memory_kib: peak_memory_kib(),
+        elapsed_seconds: 0.0,
+        internal_target_seconds: manifest.internal_target_seconds,
+        skia: SkiaEvidence {
+            archive: SKIA_ARCHIVE.to_owned(),
+            sha256: SKIA_SHA256.to_owned(),
+            target: expected_host.clone(),
+            ..SkiaEvidence::default()
+        },
+        stages: Vec::new(),
+        failure: None,
+    };
+
+    let result = run_required(
+        root,
+        &manifest,
+        &rust_host,
+        &expected_host,
+        started,
+        &mut evidence,
+    );
+    evidence.elapsed_seconds = started.elapsed().as_secs_f64();
+    evidence.peak_memory_kib = peak_memory_kib();
+    match &result {
+        Ok(()) => evidence.status = "ok",
+        Err(error) => evidence.failure = Some(error.to_string()),
+    }
+    write_evidence(evidence_path, &evidence)?;
+    result
+}
+
+/// Runs the explicitly non-routine clean-build, cross-target, packaging, and soak graph.
+///
+/// # Errors
+///
+/// Returns an error when the release matrix is invalid, a release command
+/// fails, or its create-new evidence record cannot be written.
+#[allow(clippy::too_many_lines)] // This is the declarative release command inventory.
+pub fn run_release_gate(root: &Path, evidence_path: &Path) -> Result<()> {
+    audit_consolidated_ci(root)?;
+    let matrix = load(root)?;
+    audit(root, &matrix)?;
+    prepare_new_evidence(evidence_path)?;
+    let started = Instant::now();
+    let target_dir = root.join("target/release-gate");
+    let environment = [
+        (OsString::from("CARGO_INCREMENTAL"), OsString::from("0")),
+        (
+            OsString::from("CARGO_TARGET_DIR"),
+            target_dir.into_os_string(),
+        ),
+    ];
+    let stages: [(&str, Vec<CommandSpec>); 4] = [
+        (
+            "msrv-and-portable-cross-targets",
+            vec![
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.96.0",
+                        "check",
+                        "--locked",
+                        "--all-targets",
+                        "--no-default-features",
+                        "-p",
+                        "libremetaverse-types",
+                        "-p",
+                        "libremetaverse-structured-data",
+                        "-p",
+                        "libremetaverse-imaging",
+                        "-p",
+                        "libremetaverse-prim-mesher",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "check",
+                        "--locked",
+                        "--target",
+                        "x86_64-pc-windows-gnu",
+                        "--no-default-features",
+                        "-p",
+                        "libremetaverse-types",
+                        "-p",
+                        "libremetaverse-structured-data",
+                        "-p",
+                        "libremetaverse-imaging",
+                        "-p",
+                        "libremetaverse-prim-mesher",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "check",
+                        "--locked",
+                        "--target",
+                        "x86_64-apple-darwin",
+                        "--no-default-features",
+                        "-p",
+                        "libremetaverse-types",
+                        "-p",
+                        "libremetaverse-structured-data",
+                        "-p",
+                        "libremetaverse-imaging",
+                        "-p",
+                        "libremetaverse-prim-mesher",
+                    ],
+                ),
+            ],
+        ),
+        (
+            "benchmarks-and-resource-soak",
+            vec![
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "bench",
+                        "--locked",
+                        "-p",
+                        "libremetaverse-imaging",
+                        "--bench",
+                        "image_pipeline",
+                        "--no-run",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "bench",
+                        "--locked",
+                        "-p",
+                        "libremetaverse-prim-mesher",
+                        "--bench",
+                        "meshing",
+                        "--no-run",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "run",
+                        "--locked",
+                        "-p",
+                        "metacrate-concurrency-audit",
+                        "--",
+                        "--cycles",
+                        "16",
+                        "--evidence",
+                        "artifacts/release/concurrency-audit.json",
+                    ],
+                ),
+            ],
+        ),
+        (
+            "source-packages-and-native-binaries",
+            vec![
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "package",
+                        "--locked",
+                        "--no-verify",
+                        "-p",
+                        "libremetaverse-types",
+                        "-p",
+                        "libremetaverse-structured-data",
+                        "-p",
+                        "libremetaverse-imaging",
+                        "-p",
+                        "libremetaverse-imaging-skia",
+                        "-p",
+                        "libremetaverse-openjpeg",
+                        "-p",
+                        "libremetaverse-opus",
+                        "-p",
+                        "libremetaverse-prim-mesher",
+                        "-p",
+                        "libremetaverse-lsl-tools",
+                        "-p",
+                        "libremetaverse",
+                        "-p",
+                        "libremetaverse-rendering-simple",
+                        "-p",
+                        "libremetaverse-rendering-mesh-foundry",
+                        "-p",
+                        "libremetaverse-rlv",
+                        "-p",
+                        "libremetaverse-utilities",
+                        "-p",
+                        "libremetaverse-voice-vivox",
+                        "-p",
+                        "libremetaverse-voice-webrtc",
+                        "-p",
+                        "libremetaverse-programs",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "build",
+                        "--locked",
+                        "--release",
+                        "-p",
+                        "libremetaverse-programs",
+                        "--bins",
+                    ],
+                ),
+            ],
+        ),
+        (
+            "release-audits",
+            vec![
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "run",
+                        "--locked",
+                        "-p",
+                        "metacrate-ci-matrix",
+                        "--",
+                        "artifact-audit",
+                        "--artifact-dir",
+                        "target/release-gate/release",
+                        "--package-dir",
+                        "target/release-gate/package",
+                        "--evidence",
+                        "artifacts/release/artifact-audit.json",
+                    ],
+                ),
+                CommandSpec::new(
+                    "cargo",
+                    &[
+                        "+1.97.1",
+                        "run",
+                        "--locked",
+                        "-p",
+                        "metacrate-ci-matrix",
+                        "--",
+                        "release-candidate-audit",
+                        "--evidence",
+                        "artifacts/release/release-candidate.json",
+                    ],
+                ),
+            ],
+        ),
+    ];
+    let mut recorded = Vec::new();
+    let mut failure = None;
+    for (id, commands) in stages {
+        let stage_started = Instant::now();
+        let mut status = "ok";
+        for spec in &commands {
+            println!("ci-release {id}: {} {}", spec.program, spec.args.join(" "));
+            let command_status = configured_command(root, spec, &environment)
+                .stdin(Stdio::null())
+                .status()?;
+            if !command_status.success() {
+                status = "failed";
+                failure = Some(format!(
+                    "release stage {id} failed while running {}",
+                    spec.program
+                ));
+                break;
+            }
+        }
+        recorded.push(StageEvidence {
+            id: id.to_owned(),
+            elapsed_seconds: stage_started.elapsed().as_secs_f64(),
+            commands: commands.len(),
+            status,
+        });
+        if failure.is_some() {
+            break;
+        }
+    }
+    let value = serde_json::json!({
+        "schema": 1,
+        "gate": "release",
+        "status": if failure.is_none() { "ok" } else { "failed" },
+        "source_commit": command_line(root, "git", &["rev-parse", "--verify", "HEAD"]).unwrap_or_else(|_| "unknown".to_owned()),
+        "recorded_unix_seconds": unix_seconds()?,
+        "elapsed_seconds": started.elapsed().as_secs_f64(),
+        "stages": recorded,
+        "failure": failure,
+    });
+    write_json_evidence(evidence_path, &value)?;
+    if let Some(message) = value["failure"].as_str() {
+        return Err(MatrixError::new(message));
+    }
+    Ok(())
+}
+
+fn run_required(
+    root: &Path,
+    manifest: &CoverageManifest,
+    rust_host: &str,
+    expected_host: &str,
+    started: Instant,
+    evidence: &mut GateEvidence,
+) -> Result<()> {
+    if rust_host != expected_host {
+        return Err(MatrixError::new(format!(
+            "required CI must use {expected_host}; rustc reports {rust_host}"
+        )));
+    }
+    let archive = skia_archive_path()?;
+    validate_skia_archive(&archive)?;
+    validate_openjpeg_identity()?;
+    let skia_url = file_url(&archive)?;
+    let target_dir = std::env::var_os("CARGO_TARGET_DIR")
+        .map_or_else(|| root.join("target/required"), PathBuf::from);
+    let jobs = std::env::var("CARGO_BUILD_JOBS").unwrap_or_else(|_| "2".to_owned());
+    let common_env = [
+        (OsString::from("CARGO_INCREMENTAL"), OsString::from("0")),
+        (OsString::from("CARGO_BUILD_JOBS"), OsString::from(jobs)),
+        (
+            OsString::from("CARGO_TARGET_DIR"),
+            target_dir.into_os_string(),
+        ),
+        (
+            OsString::from("SKIA_BINARIES_URL"),
+            OsString::from(skia_url),
+        ),
+    ];
+
+    run_stage(
+        root,
+        "static-generated-api",
+        &static_commands(),
+        &common_env,
+        started,
+        manifest,
+        evidence,
+    )?;
+    run_report_audits(root)?;
+    evidence.stages.push(StageEvidence {
+        id: "reviewed-reports".to_owned(),
+        elapsed_seconds: 0.0,
+        commands: 4,
+        status: "ok",
+    });
+    prove_skia_binary(root, &archive, &common_env, evidence)?;
+    enforce_budget(started, manifest)?;
+    run_stage(
+        root,
+        "compile-test-features",
+        &test_commands(),
+        &common_env,
+        started,
+        manifest,
+        evidence,
+    )?;
+    run_stage(
+        root,
+        "program-api-smoke",
+        &program_commands(),
+        &common_env,
+        started,
+        manifest,
+        evidence,
+    )?;
+    run_stage(
+        root,
+        "clippy-docs",
+        &quality_commands(),
+        &common_env,
+        started,
+        manifest,
+        evidence,
+    )?;
+    run_stage(
+        root,
+        "policy-evidence",
+        &policy_commands(),
+        &common_env,
+        started,
+        manifest,
+        evidence,
+    )?;
+    Ok(())
+}
+
+fn static_commands() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new("cargo", &["fmt", "--all", "--", "--check"]),
+        CommandSpec::new("python3", &["tools/generate_rust_mapping.py", "--check"]),
+        CommandSpec::new("python3", &["tools/generate_api_shims.py", "--check"]),
+        CommandSpec::new("python3", &["tools/check_api_coverage.py"]),
+        CommandSpec::new("python3", &["tools/check_test_parity.py"]),
+        CommandSpec::new("python3", &["tools/generate_lsl_tables.py", "--check"]),
+        CommandSpec::new("python3", &["tools/check_milestone_06.py"]),
+        CommandSpec::new("python3", &["tools/check_milestone_09.py"]),
+        CommandSpec::new("python3", &["tools/check_milestone_10.py"]),
+        CommandSpec::new(
+            "cargo",
+            &["test", "--locked", "-p", "libremetaverse-codegen"],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "run",
+                "--locked",
+                "-p",
+                "libremetaverse-codegen",
+                "--",
+                "check",
+            ],
+        ),
+    ]
+}
+
+fn test_commands() -> Vec<CommandSpec> {
+    vec![
+        // Prebuild the generated-heavy library alone. The ARM64 runner can
+        // compile it, but a second rustc process pushes the container over its
+        // memory limit. Test harnesses and the rest of CI retain jobs=2.
+        CommandSpec::new(
+            "cargo",
+            &[
+                "build",
+                "-p",
+                "libremetaverse",
+                "--all-features",
+                "--jobs",
+                "1",
+                "--locked",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "test",
+                "-p",
+                "libremetaverse",
+                "--all-features",
+                "--lib",
+                "--test",
+                "*",
+                "--locked",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "test",
+                "--workspace",
+                "--all-features",
+                "--lib",
+                "--test",
+                "*",
+                "--exclude",
+                "libremetaverse-programs",
+                "--exclude",
+                "libremetaverse-codegen",
+                "--exclude",
+                "metacrate-performance",
+                "--exclude",
+                "metacrate-ci-matrix",
+                "--exclude",
+                "metacrate-concurrency-audit",
+                "--exclude",
+                "libremetaverse",
+                "--locked",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "check",
+                "-p",
+                "libremetaverse",
+                "--lib",
+                "--no-default-features",
+                "--locked",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "test",
+                "-p",
+                "libremetaverse-imaging",
+                "--no-default-features",
+                "--features",
+                "jpeg2000",
+                "--locked",
+            ],
+        ),
+    ]
+}
+
+fn program_commands() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new(
+            "cargo",
+            &[
+                "test",
+                "--locked",
+                "-p",
+                "libremetaverse-programs",
+                "--test",
+                "*",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "run",
+                "--locked",
+                "-p",
+                "libremetaverse-programs",
+                "--bin",
+                "live-grid-smoke",
+                "--",
+                "--audit-only",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "run",
+                "--locked",
+                "-p",
+                "libremetaverse-programs",
+                "--bin",
+                "live-grid-smoke",
+                "--",
+                "--fake",
+                "--evidence",
+                "artifacts/ci/fake-grid-smoke.jsonl",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "check",
+                "--locked",
+                "--manifest-path",
+                "tests/api-compile/Cargo.toml",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "run",
+                "--locked",
+                "--manifest-path",
+                "tests/semver-port/Cargo.toml",
+            ],
+        ),
+    ]
+}
+
+fn quality_commands() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new(
+            "cargo",
+            &[
+                "clippy",
+                "--workspace",
+                "--all-targets",
+                "--all-features",
+                "--locked",
+                "--",
+                "-D",
+                "warnings",
+            ],
+        ),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "doc",
+                "--workspace",
+                "--all-features",
+                "--no-deps",
+                "--locked",
+            ],
+        ),
+    ]
+}
+
+fn policy_commands() -> Vec<CommandSpec> {
+    vec![
+        CommandSpec::new(
+            "cargo",
+            &[
+                "deny",
+                "check",
+                "advisories",
+                "licenses",
+                "bans",
+                "sources",
+                "--hide-inclusion-graph",
+            ],
+        ),
+        CommandSpec::new("cargo", &["machete", "--with-metadata"]),
+        CommandSpec::new(
+            "cargo",
+            &[
+                "run",
+                "--locked",
+                "-p",
+                "metacrate-performance",
+                "--profile",
+                "benchmark",
+                "--",
+                "audit",
+                "--fixture-root",
+                "benchmarks/fixtures",
+                "--rust",
+                "benchmarks/results/rust-linux-x86_64.json",
+                "--reference",
+                "benchmarks/results/csharp-linux-x86_64.json",
+                "--comparison",
+                "benchmarks/results/comparison.json",
+            ],
+        ),
+    ]
+}
+
+fn run_stage(
+    root: &Path,
+    id: &str,
+    commands: &[CommandSpec],
+    environment: &[(OsString, OsString)],
+    gate_started: Instant,
+    manifest: &CoverageManifest,
+    evidence: &mut GateEvidence,
+) -> Result<()> {
+    enforce_budget(gate_started, manifest)?;
+    let stage_started = Instant::now();
+    for command in commands {
+        println!(
+            "ci-required {id}: {} {}",
+            command.program,
+            command.args.join(" ")
+        );
+        let status = configured_command(root, command, environment)
+            .stdin(Stdio::null())
+            .status()?;
+        if !status.success() {
+            evidence.stages.push(StageEvidence {
+                id: id.to_owned(),
+                elapsed_seconds: stage_started.elapsed().as_secs_f64(),
+                commands: commands.len(),
+                status: "failed",
+            });
+            return Err(MatrixError::new(format!(
+                "stage {id} failed while running {}",
+                command.program
+            )));
+        }
+        enforce_budget(gate_started, manifest)?;
+    }
+    evidence.stages.push(StageEvidence {
+        id: id.to_owned(),
+        elapsed_seconds: stage_started.elapsed().as_secs_f64(),
+        commands: commands.len(),
+        status: "ok",
+    });
+    Ok(())
+}
+
+fn prove_skia_binary(
+    root: &Path,
+    archive: &Path,
+    environment: &[(OsString, OsString)],
+    evidence: &mut GateEvidence,
+) -> Result<()> {
+    let proof_target = environment
+        .iter()
+        .find(|(name, _)| name == "CARGO_TARGET_DIR")
+        .map(|(_, value)| PathBuf::from(value))
+        .ok_or_else(|| MatrixError::new("CARGO_TARGET_DIR is required for the Skia proof"))?;
+    let started = Instant::now();
+    let spec = CommandSpec::new(
+        "cargo",
+        &[
+            "test",
+            "-vv",
+            "--locked",
+            "-p",
+            "libremetaverse-imaging-skia",
+            "--no-default-features",
+            "--features",
+            "skia",
+        ],
+    );
+    let mut command = configured_command(root, &spec, environment);
+    command
+        .env("CARGO_TARGET_DIR", &proof_target)
+        .env("SKIA_BINARIES_URL", file_url(archive)?)
+        .env_remove("FORCE_SKIA_BINARIES_DOWNLOAD")
+        .env_remove("FORCE_SKIA_BUILD")
+        .stdin(Stdio::null());
+    let output = command.output()?;
+    std::io::stdout().write_all(&output.stdout)?;
+    std::io::stderr().write_all(&output.stderr)?;
+    let mut log = format!(
+        "{}\n{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    append_skia_build_output(&proof_target, &mut log)?;
+    evidence.skia.download_and_install_succeeded = log.contains(SKIA_SUCCESS);
+    evidence.skia.source_build_started = log.contains(SKIA_SOURCE_BUILD);
+    let status = if output.status.success()
+        && evidence.skia.download_and_install_succeeded
+        && !evidence.skia.source_build_started
+    {
+        "ok"
+    } else {
+        "failed"
+    };
+    evidence.stages.push(StageEvidence {
+        id: "skia-binary-proof".to_owned(),
+        elapsed_seconds: started.elapsed().as_secs_f64(),
+        commands: 1,
+        status,
+    });
+    if status != "ok" {
+        return Err(MatrixError::new(
+            "Skia proof did not install the pinned binary archive without starting a source build",
+        ));
+    }
+    Ok(())
+}
+
+fn append_skia_build_output(target_dir: &Path, log: &mut String) -> Result<()> {
+    let build_dir = target_dir.join("debug/build");
+    if !build_dir.is_dir() {
+        return Ok(());
+    }
+    for entry in fs::read_dir(build_dir)? {
+        let entry = entry?;
+        if !entry
+            .file_name()
+            .to_string_lossy()
+            .starts_with("skia-bindings-")
+        {
+            continue;
+        }
+        let output = entry.path().join("output");
+        if output.is_file() {
+            log.push('\n');
+            log.push_str(&fs::read_to_string(output)?);
+        }
+    }
+    Ok(())
+}
+
+fn run_report_audits(root: &Path) -> Result<()> {
+    write_api_baseline(root)?;
+    write_documentation_report(root)?;
+    ensure_git_clean_paths(
+        root,
+        &[
+            "api/SEMVER-BASELINE.json",
+            "api/SEMVER-AUDIT.md",
+            "api/DOCUMENTATION-COVERAGE.md",
+        ],
+    )?;
+    let artifacts = root.join("artifacts/ci");
+    fs::create_dir_all(&artifacts)?;
+    let audits = [
+        ("api-audit.json", "ci/evidence/api-audit.json"),
+        (
+            "documentation-audit.json",
+            "ci/evidence/documentation-audit.json",
+        ),
+        ("dependency-audit.json", ""),
+        ("provenance-audit.json", "ci/evidence/provenance-audit.json"),
+    ];
+    for (name, _) in audits {
+        let path = artifacts.join(name);
+        if path.exists() {
+            fs::remove_file(path)?;
+        }
+    }
+    audit_api_surface(root, &artifacts.join("api-audit.json"))?;
+    audit_documentation(root, &artifacts.join("documentation-audit.json"))?;
+    audit_dependencies(root, &artifacts.join("dependency-audit.json"))?;
+    audit_provenance(root, &artifacts.join("provenance-audit.json"))?;
+    for (name, committed) in audits.into_iter().filter(|(_, path)| !path.is_empty()) {
+        if !evidence_matches_except_timestamp(&artifacts.join(name), &root.join(committed))? {
+            return Err(MatrixError::new(format!(
+                "{committed} does not match freshly generated audit evidence"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn evidence_matches_except_timestamp(actual: &Path, expected: &Path) -> Result<bool> {
+    let mut actual: serde_json::Value = serde_json::from_slice(&fs::read(actual)?)?;
+    let mut expected: serde_json::Value = serde_json::from_slice(&fs::read(expected)?)?;
+    for value in [&mut actual, &mut expected] {
+        if let Some(object) = value.as_object_mut() {
+            for volatile in [
+                "recorded_unix_seconds",
+                "source_file_count",
+                "distribution_manifest_sha256",
+            ] {
+                object.remove(volatile);
+            }
+        }
+    }
+    Ok(actual == expected)
+}
+
+fn validate_coverage(manifest: &CoverageManifest) -> Result<()> {
+    if manifest.schema != 1
+        || manifest.required_workflow != REQUIRED_WORKFLOW
+        || manifest.release_workflow != RELEASE_WORKFLOW
+        || manifest.hard_timeout_minutes != 15
+        || manifest.internal_target_seconds > 720
+        || manifest.legacy_workflows.len() != LEGACY_WORKFLOW_COUNT
+    {
+        return Err(MatrixError::new(
+            "CI coverage manifest has an invalid gate shape",
+        ));
+    }
+    let required = unique(
+        manifest.required_checks.iter().map(String::as_str),
+        "required check",
+    )?;
+    let workflows = unique(
+        manifest
+            .legacy_workflows
+            .iter()
+            .map(|entry| entry.workflow.as_str()),
+        "legacy workflow",
+    )?;
+    if workflows != BTreeSet::from(LEGACY_WORKFLOWS) {
+        return Err(MatrixError::new("legacy workflow inventory is incomplete"));
+    }
+    let mut routed_required = BTreeSet::new();
+    for entry in &manifest.legacy_workflows {
+        if entry.responsibility.trim().is_empty()
+            || entry.rationale.trim().is_empty()
+            || entry.checks.is_empty()
+            || !matches!(
+                entry.destination.as_str(),
+                "required" | "release" | "split" | "retired"
+            )
+        {
+            return Err(MatrixError::new(format!(
+                "{} has an incomplete coverage route",
+                entry.workflow
+            )));
+        }
+        if matches!(entry.destination.as_str(), "required" | "split") {
+            routed_required.extend(
+                entry
+                    .checks
+                    .iter()
+                    .filter(|check| required.contains(check.as_str()))
+                    .map(String::as_str),
+            );
+        }
+    }
+    if routed_required != required {
+        return Err(MatrixError::new(
+            "not every required check is routed from the legacy inventory",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_workflows(root: &Path, manifest: &CoverageManifest) -> Result<()> {
+    let directory = root.join(".gitea/workflows");
+    let mut workflow_paths = Vec::new();
+    for entry in fs::read_dir(&directory)? {
+        let path = entry?.path();
+        if matches!(
+            path.extension().and_then(OsStr::to_str),
+            Some("yml" | "yaml")
+        ) {
+            workflow_paths.push(path);
+        }
+    }
+    workflow_paths.sort();
+    if workflow_paths.len() > 3 || workflow_paths.len() != 2 {
+        return Err(MatrixError::new(
+            "exactly the required and non-routine release workflows must remain",
+        ));
+    }
+    let required = fs::read_to_string(root.join(&manifest.required_workflow))?;
+    let release = fs::read_to_string(root.join(&manifest.release_workflow))?;
+    for marker in [
+        "push:",
+        "pull_request:",
+        "timeout-minutes: 15",
+        "cancel-in-progress: true",
+        "runs-on: ubuntu-latest",
+        "required-gate",
+    ] {
+        if !required.contains(marker) {
+            return Err(MatrixError::new(format!(
+                "required workflow is missing {marker}"
+            )));
+        }
+    }
+    if release.contains("pull_request:") || !release.contains("workflow_dispatch:") {
+        return Err(MatrixError::new(
+            "release workflow must be explicitly non-routine",
+        ));
+    }
+    for path in &workflow_paths {
+        let text = fs::read_to_string(path)?;
+        if text
+            .lines()
+            .filter_map(|line| line.trim().strip_prefix("runs-on:"))
+            .any(|runner| runner.trim() != "ubuntu-latest")
+        {
+            return Err(MatrixError::new(format!(
+                "{} violates the ubuntu-only runner policy",
+                path.display()
+            )));
+        }
+        if text.contains("FORCE_SKIA_BINARIES_DOWNLOAD") {
+            return Err(MatrixError::new(format!(
+                "{} misuses FORCE_SKIA_BINARIES_DOWNLOAD",
+                path.display()
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn validate_skia_configuration(root: &Path) -> Result<()> {
+    let manifest = fs::read_to_string(root.join("crates/libremetaverse-imaging-skia/Cargo.toml"))?;
+    if manifest.matches("no-compile").count() < 3 || !manifest.contains("binary-cache") {
+        return Err(MatrixError::new(
+            "every Skia target must fail fast instead of compiling from source",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_skia_archive(path: &Path) -> Result<()> {
+    if path.file_name().and_then(OsStr::to_str) != Some(SKIA_ARCHIVE) {
+        return Err(MatrixError::new(
+            "Skia archive name does not select the pinned ARM64 GNU feature tuple",
+        ));
+    }
+    if hash_file(path)? != SKIA_SHA256 {
+        return Err(MatrixError::new(
+            "Skia archive SHA-256 does not match the reviewed binary",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_openjpeg_identity() -> Result<()> {
+    let prefix = std::env::var_os("OPENJPEG_PREFIX")
+        .map(PathBuf::from)
+        .ok_or_else(|| MatrixError::new("OPENJPEG_PREFIX is required"))?;
+    let identity = fs::read_to_string(prefix.join("metacrate-openjpeg.identity"))?;
+    for expected in [
+        "version=2.5.4",
+        "commit=6c4a29b00211eb0430fa0e5e890f1ce5c80f409f",
+    ] {
+        if !identity.lines().any(|line| line == expected) {
+            return Err(MatrixError::new(format!(
+                "OpenJPEG cache identity is missing {expected}"
+            )));
+        }
+    }
+    Ok(())
+}
+
+fn coverage(root: &Path) -> Result<CoverageManifest> {
+    Ok(serde_json::from_slice(&fs::read(
+        root.join(COVERAGE_PATH),
+    )?)?)
+}
+
+fn configured_command(
+    root: &Path,
+    spec: &CommandSpec,
+    environment: &[(OsString, OsString)],
+) -> Command {
+    let program: OsString = if spec.program == "cargo" {
+        std::env::var_os("CARGO").unwrap_or_else(|| "cargo".into())
+    } else {
+        spec.program.into()
+    };
+    let mut command = Command::new(program);
+    command.args(spec.args).current_dir(root);
+    for (key, value) in environment {
+        command.env(key, value);
+    }
+    command
+}
+
+fn enforce_budget(started: Instant, manifest: &CoverageManifest) -> Result<()> {
+    if started.elapsed().as_secs() >= manifest.internal_target_seconds {
+        return Err(MatrixError::new(format!(
+            "required CI exceeded its {} second internal target",
+            manifest.internal_target_seconds
+        )));
+    }
+    Ok(())
+}
+
+fn rust_host(root: &Path) -> Result<String> {
+    let verbose = command_line(root, "rustc", &["-vV"])?;
+    verbose
+        .lines()
+        .find_map(|line| line.strip_prefix("host: ").map(str::to_owned))
+        .ok_or_else(|| MatrixError::new("rustc -vV did not report a host"))
+}
+
+fn command_line(root: &Path, program: &str, args: &[&str]) -> Result<String> {
+    let output = Command::new(program)
+        .args(args)
+        .current_dir(root)
+        .output()?;
+    if !output.status.success() {
+        return Err(MatrixError::new(format!("{program} command failed")));
+    }
+    String::from_utf8(output.stdout)
+        .map(|text| text.trim().to_owned())
+        .map_err(|_| MatrixError::new(format!("{program} output was not UTF-8")))
+}
+
+fn ensure_git_clean_paths(root: &Path, paths: &[&str]) -> Result<()> {
+    let mut command = Command::new("git");
+    command
+        .args(["diff", "--exit-code", "--"])
+        .args(paths)
+        .current_dir(root);
+    if !command.status()?.success() {
+        return Err(MatrixError::new("reviewed generated reports are stale"));
+    }
+    Ok(())
+}
+
+fn skia_archive_path() -> Result<PathBuf> {
+    std::env::var_os("METACRATE_SKIA_ARCHIVE")
+        .map(PathBuf::from)
+        .ok_or_else(|| MatrixError::new("METACRATE_SKIA_ARCHIVE is required"))
+}
+
+fn hash_file(path: &Path) -> Result<String> {
+    let mut file = fs::File::open(path)?;
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0_u8; 64 * 1024].into_boxed_slice();
+    loop {
+        let read = file.read(&mut buffer)?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+    }
+    Ok(hasher
+        .finalize()
+        .iter()
+        .fold(String::with_capacity(64), |mut output, byte| {
+            use std::fmt::Write as _;
+            write!(output, "{byte:02x}").expect("writing to a String cannot fail");
+            output
+        }))
+}
+
+fn file_url(path: &Path) -> Result<String> {
+    let absolute = path.canonicalize()?;
+    let text = absolute
+        .to_str()
+        .ok_or_else(|| MatrixError::new("Skia archive path is not UTF-8"))?
+        .replace('\\', "/");
+    if text.starts_with('/') {
+        Ok(format!("file://{text}"))
+    } else {
+        Ok(format!("file:///{text}"))
+    }
+}
+
+fn cache_hit(name: &str) -> Option<bool> {
+    std::env::var(name)
+        .ok()
+        .and_then(|value| match value.as_str() {
+            "true" => Some(true),
+            "false" => Some(false),
+            _ => None,
+        })
+}
+
+fn peak_memory_kib() -> Option<u64> {
+    if let Ok(bytes) = fs::read_to_string("/sys/fs/cgroup/memory.peak")
+        && let Ok(bytes) = bytes.trim().parse::<u64>()
+    {
+        return Some(bytes / 1024);
+    }
+    fs::read_to_string("/proc/self/status")
+        .ok()
+        .and_then(|status| {
+            status.lines().find_map(|line| {
+                line.strip_prefix("VmHWM:")?
+                    .split_whitespace()
+                    .next()?
+                    .parse()
+                    .ok()
+            })
+        })
+}
+
+fn unix_seconds() -> Result<u64> {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|duration| duration.as_secs())
+        .map_err(|_| MatrixError::new("system clock predates Unix epoch"))
+}
+
+fn prepare_new_evidence(path: &Path) -> Result<()> {
+    if path.exists() {
+        return Err(MatrixError::new(format!(
+            "{} already exists",
+            path.display()
+        )));
+    }
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)?;
+    }
+    Ok(())
+}
+
+fn write_evidence(path: &Path, evidence: &GateEvidence) -> Result<()> {
+    let mut file = OpenOptions::new().write(true).create_new(true).open(path)?;
+    serde_json::to_writer_pretty(&mut file, evidence)?;
+    file.write_all(b"\n")?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn write_json_evidence(path: &Path, evidence: &serde_json::Value) -> Result<()> {
+    let mut file = OpenOptions::new().write(true).create_new(true).open(path)?;
+    serde_json::to_writer_pretty(&mut file, evidence)?;
+    file.write_all(b"\n")?;
+    file.sync_all()?;
+    Ok(())
+}
+
+fn unique<'a>(values: impl Iterator<Item = &'a str>, kind: &str) -> Result<BTreeSet<&'a str>> {
+    let mut result = BTreeSet::new();
+    for value in values {
+        if value.trim().is_empty() || !result.insert(value) {
+            return Err(MatrixError::new(format!(
+                "{kind} values must be nonempty and unique"
+            )));
+        }
+    }
+    Ok(result)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn checked_in_coverage_routes_every_required_check() {
+        let manifest: CoverageManifest =
+            serde_json::from_str(include_str!("../../../ci/ci-coverage.json")).unwrap();
+        validate_coverage(&manifest).unwrap();
+    }
+
+    #[test]
+    fn checked_in_workflow_split_is_bounded_and_ubuntu_only() {
+        let root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../..");
+        audit_consolidated_ci(&root).unwrap();
+    }
+
+    #[test]
+    fn pinned_skia_archive_identity_is_exact() {
+        assert!(SKIA_ARCHIVE.contains("aarch64-unknown-linux-gnu"));
+        assert!(SKIA_ARCHIVE.contains("jpegd-jpege-pdf-svg-textlayout-vulkan-webpd-webpe"));
+        assert_eq!(SKIA_SHA256.len(), 64);
+    }
+}
diff --git a/tools/ci-matrix/src/lib.rs b/tools/ci-matrix/src/lib.rs
index 3a0cc0a..5d3b686 100644
--- a/tools/ci-matrix/src/lib.rs
+++ b/tools/ci-matrix/src/lib.rs
@@ -13,6 +13,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 
 mod api_surface;
 mod artifact;
+mod ci_gate;
 mod dependency;
 mod documentation;
 mod provenance;
@@ -20,13 +21,14 @@ mod release_candidate;
 
 pub use api_surface::{audit_api_surface, write_api_baseline};
 pub use artifact::audit_artifacts;
+pub use ci_gate::{audit_consolidated_ci, run_release_gate, run_required_gate};
 pub use dependency::audit_dependencies;
 pub use documentation::{audit_documentation, write_documentation_report};
 pub use provenance::{audit_provenance, write_provenance_reports};
 pub use release_candidate::audit_release_candidate;
 
 pub const MATRIX_PATH: &str = "ci/release-matrix.json";
-const WORKFLOW_PATH: &str = ".gitea/workflows/release-matrix.yml";
+const WORKFLOW_PATH: &str = ".gitea/workflows/release.yml";
 const REQUIRED_PROFILES: [&str; 7] = [
     "linux-msrv-portable",
     "linux-stable-default",
@@ -458,25 +460,16 @@ fn audit_cargo_features(root: &Path) -> Result<()> {
 
 fn audit_workflows(root: &Path, matrix: &ReleaseMatrix) -> Result<()> {
     let workflow = fs::read_to_string(root.join(WORKFLOW_PATH))?;
-    for profile in &matrix.profiles {
-        if !workflow.contains(&format!("profile: {}", profile.id)) {
-            return Err(MatrixError::new(format!(
-                "workflow does not schedule profile {}",
-                profile.id
-            )));
-        }
-    }
-    if !workflow.contains("~/.cargo/registry")
+    if matrix.profiles.is_empty()
+        || !workflow.contains("release-gate")
+        || !workflow.contains("~/.cargo/registry")
         || !workflow.contains("~/.cargo/git")
-        || workflow.lines().any(|line| {
-            let trimmed = line.trim();
-            trimmed == "target" || trimmed.starts_with("target/") || trimmed.contains("/target/")
-        })
     {
         return Err(MatrixError::new(
-            "workflow must cache Cargo downloads without caching build target directories",
+            "release workflow must invoke the Rust gate and cache Cargo downloads",
         ));
     }
+    audit_consolidated_ci(root)?;
     let workflows = root.join(".gitea/workflows");
     for entry in fs::read_dir(workflows)? {
         let path = entry?.path();
diff --git a/tools/ci-matrix/src/main.rs b/tools/ci-matrix/src/main.rs
index ccf9c48..bc2b2cf 100644
--- a/tools/ci-matrix/src/main.rs
+++ b/tools/ci-matrix/src/main.rs
@@ -1,7 +1,8 @@
 use metacrate_ci_matrix::{
-    audit, audit_api_surface, audit_artifacts, audit_dependencies, audit_documentation,
-    audit_provenance, audit_release_candidate, load, run, workspace_root, write_api_baseline,
-    write_documentation_report, write_provenance_reports,
+    audit, audit_api_surface, audit_artifacts, audit_consolidated_ci, audit_dependencies,
+    audit_documentation, audit_provenance, audit_release_candidate, load, run, run_release_gate,
+    run_required_gate, workspace_root, write_api_baseline, write_documentation_report,
+    write_provenance_reports,
 };
 use std::path::{Path, PathBuf};
 
@@ -12,12 +13,23 @@ fn main() {
     }
 }
 
+#[allow(clippy::too_many_lines)] // Flat CLI command routing is clearer than nested dispatch.
 fn execute() -> Result<(), Box<dyn std::error::Error>> {
     let current = std::env::current_dir()?;
     let root = workspace_root(&current).ok_or("could not locate the Cargo workspace")?;
     let matrix = load(&root)?;
     let mut arguments = std::env::args().skip(1);
     match arguments.next().as_deref() {
+        Some("ci-audit") if arguments.next().is_none() => {
+            audit_consolidated_ci(&root)?;
+            println!("consolidated CI coverage and workflow split: ok");
+        }
+        Some("required-gate") => {
+            gate_command(&root, arguments, "required", run_required_gate)?;
+        }
+        Some("release-gate") => {
+            gate_command(&root, arguments, "release", run_release_gate)?;
+        }
         Some("audit") if arguments.next().is_none() => {
             audit(&root, &matrix)?;
             println!(
@@ -101,7 +113,7 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
         }
         _ => {
             return Err(
-                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | artifact-audit --artifact-dir DIR --package-dir DIR --evidence FILE | release-candidate-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
+                "usage: ci-matrix ci-audit | required-gate --evidence FILE | release-gate --evidence FILE | audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | artifact-audit --artifact-dir DIR --package-dir DIR --evidence FILE | release-candidate-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
                     .into(),
             );
         }
@@ -109,6 +121,27 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+fn gate_command(
+    root: &Path,
+    mut arguments: impl Iterator<Item = String>,
+    gate: &str,
+    run_gate: fn(&Path, &Path) -> metacrate_ci_matrix::Result<()>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let flag = arguments
+        .next()
+        .ok_or_else(|| format!("{gate}-gate requires --evidence FILE"))?;
+    let evidence = arguments
+        .next()
+        .ok_or_else(|| format!("{gate}-gate requires --evidence FILE"))?;
+    if flag != "--evidence" || arguments.next().is_some() {
+        return Err(format!("usage: ci-matrix {gate}-gate --evidence FILE").into());
+    }
+    let evidence = absolute_or_rooted(root, &evidence);
+    run_gate(root, &evidence)?;
+    println!("{gate} CI gate: ok ({})", evidence.display());
+    Ok(())
+}
+
 fn release_candidate_audit_command(
     root: &Path,
     mut arguments: impl Iterator<Item = String>,
diff --git a/tools/ci-matrix/src/provenance.rs b/tools/ci-matrix/src/provenance.rs
index ea079ce..8f27b82 100644
--- a/tools/ci-matrix/src/provenance.rs
+++ b/tools/ci-matrix/src/provenance.rs
@@ -917,7 +917,7 @@ fn parse_lock_string(value: &str) -> Result<String> {
 
 fn package_notices(root: &Path, explicit: Option<&str>) -> Result<Vec<(String, String)>> {
     let mut candidates = Vec::new();
-    collect_notice_files(root, 0, &mut candidates)?;
+    collect_notice_files(root, &mut candidates)?;
     if let Some(explicit) = explicit {
         let path = root.join(explicit);
         if path.is_file() {
@@ -946,10 +946,10 @@ fn package_notices(root: &Path, explicit: Option<&str>) -> Result<Vec<(String, S
     Ok(notices)
 }
 
-fn collect_notice_files(directory: &Path, depth: u8, output: &mut Vec<PathBuf>) -> Result<()> {
-    if depth > 2 {
-        return Ok(());
-    }
+fn collect_notice_files(directory: &Path, output: &mut Vec<PathBuf>) -> Result<()> {
+    // Cargo build scripts may populate nested source directories (rust-skia
+    // creates `skia/` in its registry checkout). Only package-root notices and
+    // Cargo's explicit `license_file` are immutable package metadata.
     let mut entries = fs::read_dir(directory)?.collect::<std::io::Result<Vec<_>>>()?;
     entries.sort_by_key(std::fs::DirEntry::file_name);
     for entry in entries {
@@ -969,8 +969,6 @@ fn collect_notice_files(directory: &Path, depth: u8, output: &mut Vec<PathBuf>)
             .any(|prefix| name.starts_with(prefix))
         {
             output.push(path);
-        } else if kind.is_dir() && depth < 2 {
-            collect_notice_files(&path, depth + 1, output)?;
         }
     }
     Ok(())
@@ -1095,6 +1093,10 @@ fn source_paths(root: &Path) -> Result<Vec<String>> {
                 .map_err(|_| MatrixError::new("source archive contains a non-UTF-8 path"))
         })
         .collect::<Result<Vec<_>>>()?;
+    // `git ls-files --cached` retains index entries for working-tree deletions
+    // until the consolidation commit is created. A source distribution always
+    // describes files that actually exist, including during a pre-commit audit.
+    paths.retain(|path| root.join(path).is_file());
     for path in &paths {
         validate_relative(path)?;
     }
@@ -1126,8 +1128,18 @@ fn compare_report(root: &Path, relative: &str, expected: &[u8]) -> Result<()> {
         MatrixError::new(format!("generated report {}: {error}", path.display()))
     })?;
     if actual != expected {
+        if let Some(directory) = std::env::var_os("METACRATE_PROVENANCE_DIAGNOSTICS_DIR") {
+            let directory = PathBuf::from(directory);
+            fs::create_dir_all(&directory)?;
+            let name = path
+                .file_name()
+                .ok_or_else(|| MatrixError::new("generated report path has no file name"))?;
+            fs::write(directory.join(name), expected)?;
+        }
         return Err(MatrixError::new(format!(
-            "{relative} is stale; run `cargo run --locked -p metacrate-ci-matrix -- provenance-report`"
+            "{relative} is stale (checked-in sha256 {}, generated sha256 {}); run `cargo run --locked -p metacrate-ci-matrix -- provenance-report`",
+            sha256(&actual),
+            sha256(expected),
         )));
     }
     Ok(())
@@ -1253,6 +1265,27 @@ version = "0.0.1"
         );
     }
 
+    #[test]
+    fn package_notice_scan_ignores_build_generated_subtrees() {
+        let root =
+            std::env::temp_dir().join(format!("metacrate-package-notices-{}", std::process::id()));
+        let _ = fs::remove_dir_all(&root);
+        fs::create_dir_all(root.join("generated")).unwrap();
+        fs::write(root.join("LICENSE"), "package license\n").unwrap();
+        fs::write(root.join("generated/LICENSE"), "generated license\n").unwrap();
+        fs::write(root.join("generated/NOTICE.explicit"), "explicit notice\n").unwrap();
+
+        let notices = package_notices(&root, Some("generated/NOTICE.explicit")).unwrap();
+        assert_eq!(
+            notices
+                .iter()
+                .map(|(path, _)| path.as_str())
+                .collect::<Vec<_>>(),
+            ["LICENSE", "generated/NOTICE.explicit"]
+        );
+        fs::remove_dir_all(root).unwrap();
+    }
+
     #[test]
     fn unsafe_paths_are_rejected() {
         for path in ["", "../escape", "a/../b", "/absolute"] {
diff --git a/tools/install_openjpeg_2_5_4.sh b/tools/install_openjpeg_2_5_4.sh
index d38defc..dc4ad82 100755
--- a/tools/install_openjpeg_2_5_4.sh
+++ b/tools/install_openjpeg_2_5_4.sh
@@ -13,6 +13,8 @@ fi
 install_prefix=$1
 pkg_config_path="$install_prefix/lib/pkgconfig"
 library_path="$install_prefix/lib"
+identity_path="$install_prefix/metacrate-openjpeg.identity"
+target_arch=$(uname -m)
 
 persist_actions_environment() {
     if [ -z "${GITHUB_ENV:-}" ]; then
@@ -33,6 +35,10 @@ persist_actions_environment() {
 }
 
 if [ -f "$pkg_config_path/libopenjp2.pc" ] &&
+    [ -f "$identity_path" ] &&
+    [ "$(sed -n '1p' "$identity_path")" = "version=$OPENJPEG_VERSION" ] &&
+    [ "$(sed -n '2p' "$identity_path")" = "commit=$OPENJPEG_COMMIT" ] &&
+    [ "$(sed -n '3p' "$identity_path")" = "architecture=$target_arch" ] &&
     PKG_CONFIG_PATH="$pkg_config_path" pkg-config --exact-version "$OPENJPEG_VERSION" libopenjp2
 then
     persist_actions_environment
@@ -64,5 +70,11 @@ cmake -S "$source_dir" -B "$build_dir" \
 cmake --build "$build_dir" --parallel
 cmake --install "$build_dir"
 
+{
+    printf 'version=%s\n' "$OPENJPEG_VERSION"
+    printf 'commit=%s\n' "$OPENJPEG_COMMIT"
+    printf 'architecture=%s\n' "$target_arch"
+} >"$identity_path"
+
 PKG_CONFIG_PATH="$pkg_config_path" pkg-config --exact-version "$OPENJPEG_VERSION" libopenjp2
 persist_actions_environment