diff --git a/.kanon-ci.toml b/.kanon-ci.toml
index 5e919c9..885b53d 100644
--- a/.kanon-ci.toml
+++ b/.kanon-ci.toml
@@ -6,12 +6,15 @@
 #
 # Prepends the public Phase A contract check to the hardcoded default Rust
 # gate (fmt → check → clippy → nextest → lint), then pins per-stage build and
-# test concurrency to 8. Without this
-# cap, cargo defaults to num_cpus (64 on this Threadripper) and parallel
-# rustc + nextest processes peak well over 100GB of RSS — enough to OOM
-# menos when any other fleet work is running. 8 is the budget that keeps
-# a single CI run under ~25GB peak, low enough that serial drains don't
-# OOM even with aletheia.service and the dispatch fleet resident.
+# test concurrency to 8. The pin is a memory bound, not a speed knob: this
+# workspace's parallel rustc and nextest processes are RSS-heavy and peak
+# memory scales with the job count. 8 is the calibrated value that holds a
+# single run under ~25GB peak, which is what leaves headroom for anything
+# else resident on the build machine. Raise it and peak RSS climbs past that
+# bar; delete it and the job count follows cargo's num_cpus default — a
+# property of whichever machine runs CI rather than of this build — and on a
+# wide enough host the peak clears that bar by a multiple, enough to OOM the
+# run and whatever else is resident alongside it.
 #
 # Keep in sync with `crates/archeion/src/ci_config.rs::default_rust_gate`
 # when the upstream default changes — only the `--jobs` / `--test-threads`
diff --git a/.kanon-orchestration-exceptions.toml b/.kanon-orchestration-exceptions.toml
index 651d8bf..56467f9 100644
--- a/.kanon-orchestration-exceptions.toml
+++ b/.kanon-orchestration-exceptions.toml
@@ -2,4 +2,4 @@
 # Format: "<40-hex-sha>" = "<one-line justification>" — justification required.
 
 [main_worktree_commit]
-94a77ebb2a38a031c21b57c411a65e7e5509a628 = "T0 operator-session lockfile-only security fix (RUSTSEC-2026-0190, #56) authored during the 2026-07 boxless window before the worktree convention was re-established on metis; follow-ups on this branch are worktree-authored."
+94a77ebb2a38a031c21b57c411a65e7e5509a628 = "T0 lockfile-only security fix (RUSTSEC-2026-0190, #56) authored directly on main in 2026-07, before the worktree convention was re-established; follow-ups on this branch are worktree-authored."
diff --git a/CLAUDE.md b/CLAUDE.md
index 6a0b85f..1eb769c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,6 +1,6 @@
 <!--
 scope: hamma repo conventions (pure-Rust mesh networking targeting Tailscale compatibility: dictyon, mitos, future histos)
-defers_to: ~/menos-ops/CLAUDE.md for machine topology; ~/.claude/CLAUDE.md for operator principles; kanon standards for universal engineering policy
+defers_to: kanon standards for universal engineering policy; host and environment conventions live outside this repository
 tightens: no-unsafe/no-unwrap discipline, data plane gated behind contracts/phase-a.toml
 -->
 
diff --git a/Cargo.lock b/Cargo.lock
index c181b6b..141609a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1161,9 +1161,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.43"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
@@ -1185,9 +1185,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/standards/README.md b/standards/README.md
index fddd946..5f4aa3f 100644
--- a/standards/README.md
+++ b/standards/README.md
@@ -1,3 +1,3 @@
 # Standards
 
-Canonical fleet standards live in kanon at `~/dev/kanon/crates/basanos/standards/STANDARDS.md`. This pointer file replaces the per-repo standards copy that was drifting (D-049, kanon backlog).
+Canonical fleet standards live in the kanon repository at `crates/basanos/standards/STANDARDS.md`. This pointer file replaces the per-repo standards copy that was drifting (D-049, kanon backlog).