diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4affc427..bcea8a83 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,30 @@
 version: 2
+
+# Grouping note
+# ─────────────
+# Every ecosystem below groups its minor+patch updates into ONE pull request.
+# Before this, each bump arrived as its own PR: the 2026-09 batch produced six
+# open PRs (#49 memmap2, #51 tokenizers, #52 mimalloc, #53 windows, #64
+# System.Text.Json, #69 log) plus three more against /Deploy. They then sat
+# long enough to fall 61 commits behind main, and each carried its own stale
+# Cargo.lock. Replaying those lockfiles individually would have reverted the
+# quinn-proto 0.11.17 fix for alert #28 that landed on main in the meantime.
+#
+# One grouped PR per ecosystem resolves a single lockfile against current main
+# and is gated once. Major bumps stay ungrouped so they keep an individual,
+# reviewable PR -- those are the ones that break APIs.
+
 updates:
-  # Rust dependencies (pcai_core workspace)
+  # ── Rust: pcai_core workspace ────────────────────────────────
   - package-ecosystem: "cargo"
     directory: "/Native/pcai_core"
     schedule:
       interval: "weekly"
       day: "tuesday"
     open-pull-requests-limit: 5
+    groups:
+      cargo-pcai-core:
+        update-types: ["minor", "patch"]
     labels:
       - "dependencies"
       - "rust"
@@ -15,13 +33,35 @@ updates:
     commit-message:
       prefix: "chore(deps):"
 
-  # Rust dependencies (FunctionGemma workspace)
+  # ── Rust: FunctionGemma workspace ────────────────────────────
+  # NOTE: no CI job builds this workspace. rust-guidelines.yml has it
+  # commented out ("FunctionGemma workspaces require CUDA bindgen"), so
+  # nothing here is gated. Bumps must be verified locally in a VS
+  # developer environment before merging.
   - package-ecosystem: "cargo"
     directory: "/Deploy"
     schedule:
       interval: "weekly"
       day: "tuesday"
     open-pull-requests-limit: 3
+    groups:
+      cargo-deploy:
+        update-types: ["minor", "patch"]
+    ignore:
+      # The candle stack is pinned to 0.9.2 to match the vendored CUDA
+      # kernels under Deploy/vendor/ (candle-kernels-0.9.2,
+      # candle-flash-attn-0.9.2), which the workspace [patch] table points
+      # at. Dependabot raised candle-transformers 0.9.2 -> 0.11.0 (#66) on
+      # its own, which would have left rust-functiongemma-core depending on
+      # candle-core 0.9.2 and candle-transformers 0.11.0 at the same time --
+      # two semver-incompatible copies of Tensor in one crate, a guaranteed
+      # compile error. Moving candle requires re-vendoring the kernels too,
+      # so it is a deliberate coordinated change, not a dependabot bump.
+      - dependency-name: "candle-core"
+      - dependency-name: "candle-nn"
+      - dependency-name: "candle-transformers"
+      - dependency-name: "candle-flash-attn"
+      - dependency-name: "candle-kernels"
     labels:
       - "dependencies"
       - "rust"
@@ -30,13 +70,38 @@ updates:
     commit-message:
       prefix: "chore(deps):"
 
-  # .NET dependencies (PcaiNative)
+  # ── .NET ─────────────────────────────────────────────────────
+  # PcaiServiceHost and both test projects were previously absent from this
+  # file, so nothing ever raised a PR for them. PcaiServiceHost had drifted
+  # to System.Text.Json 10.0.7 while PcaiNative (which IS covered) sat at
+  # 10.0.9 -- two versions of one package in a single solution, invisible
+  # because only half the projects were watched.
   - package-ecosystem: "nuget"
     directory: "/Native/PcaiNative"
     schedule:
       interval: "weekly"
       day: "tuesday"
     open-pull-requests-limit: 3
+    groups:
+      nuget-pcainative:
+        update-types: ["minor", "patch"]
+    labels:
+      - "dependencies"
+      - "dotnet"
+    reviewers:
+      - "David-Martel"
+    commit-message:
+      prefix: "chore(deps):"
+
+  - package-ecosystem: "nuget"
+    directory: "/Native/PcaiServiceHost"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 3
+    groups:
+      nuget-servicehost:
+        update-types: ["minor", "patch"]
     labels:
       - "dependencies"
       - "dotnet"
@@ -45,13 +110,49 @@ updates:
     commit-message:
       prefix: "chore(deps):"
 
-  # .NET dependencies (PcaiChatTui)
   - package-ecosystem: "nuget"
     directory: "/Native/PcaiChatTui"
     schedule:
       interval: "weekly"
       day: "tuesday"
     open-pull-requests-limit: 2
+    groups:
+      nuget-chattui:
+        update-types: ["minor", "patch"]
+    labels:
+      - "dependencies"
+      - "dotnet"
+    reviewers:
+      - "David-Martel"
+    commit-message:
+      prefix: "chore(deps):"
+
+  - package-ecosystem: "nuget"
+    directory: "/Native/PcaiNative.Tests"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 2
+    groups:
+      nuget-pcainative-tests:
+        update-types: ["minor", "patch"]
+    labels:
+      - "dependencies"
+      - "dotnet"
+    reviewers:
+      - "David-Martel"
+    commit-message:
+      prefix: "chore(deps):"
+
+  - package-ecosystem: "nuget"
+    directory: "/Native/PcaiChatTui.Tests"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 2
+    groups:
+      nuget-chattui-tests:
+        update-types: ["minor", "patch"]
     labels:
       - "dependencies"
       - "dotnet"
@@ -60,13 +161,16 @@ updates:
     commit-message:
       prefix: "chore(deps):"
 
-  # GitHub Actions versions
+  # ── GitHub Actions ───────────────────────────────────────────
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "tuesday"
     open-pull-requests-limit: 5
+    groups:
+      github-actions:
+        update-types: ["minor", "patch"]
     labels:
       - "dependencies"
       - "ci"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a3fb001c..8430019d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,9 @@ name: CI
 
 on:
   pull_request:
-    branches: [main, develop]
+    branches: [main]
   push:
-    branches: [develop]
+    branches: [main]
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -352,6 +352,60 @@ jobs:
               }
           }
 
+  # ──────────────────────────────────────────────────────────────
+  # .NET
+  # ──────────────────────────────────────────────────────────────
+  # No job built any .NET project before this one. dependabot watches all five
+  # csproj files (.github/dependabot.yml), so a bump to PcaiServiceHost or to
+  # either test project could satisfy every gate while leaving that project
+  # unable to restore or compile -- nothing compiled it. The only .NET build
+  # that ever ran was in portable-ci.yml, which built PcaiNative alone, on
+  # Linux, and turned failures into warnings.
+  dotnet-build:
+    name: .NET Build
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      # Both SDKs: four projects target net8.0, but PcaiChatTui.Tests targets
+      # net10.0 -- a test project on a newer TFM than the code it exercises.
+      # That builds locally where the 10.x SDK is installed and would fail on a
+      # runner given only 8.0.x, which is part of why this gap went unnoticed.
+      # Installing both makes the gate work today; aligning the TFMs is a
+      # separate decision.
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            8.0.x
+            10.0.x
+      - name: Build every .NET project
+        shell: pwsh
+        run: |
+          $projects = @(Get-ChildItem -Path Native -Recurse -Filter *.csproj |
+              Where-Object { $_.FullName -notmatch '[\\/](bin|obj)[\\/]' })
+          # Positive control: a discovery glob that silently matches nothing is
+          # not a gate. Fail loudly if the project set shrinks unexpectedly.
+          if ($projects.Count -lt 5) {
+              throw "Expected at least 5 .csproj files under Native/, found $($projects.Count)"
+          }
+          Write-Host "Building $($projects.Count) projects" -ForegroundColor Cyan
+          foreach ($p in $projects) {
+              Write-Host "== $($p.Name)" -ForegroundColor Cyan
+              dotnet build $p.FullName -c Release --nologo -v minimal
+              if ($LASTEXITCODE -ne 0) { throw "dotnet build failed: $($p.Name)" }
+          }
+      - name: Run .NET test projects
+        shell: pwsh
+        run: |
+          $tests = @(Get-ChildItem -Path Native -Recurse -Filter *.Tests.csproj |
+              Where-Object { $_.FullName -notmatch '[\\/](bin|obj)[\\/]' })
+          if ($tests.Count -lt 1) { throw "Expected at least 1 .NET test project, found 0" }
+          foreach ($t in $tests) {
+              Write-Host "== $($t.Name)" -ForegroundColor Cyan
+              dotnet test $t.FullName -c Release --nologo -v minimal
+              if ($LASTEXITCODE -ne 0) { throw "dotnet test failed: $($t.Name)" }
+          }
+
   # ──────────────────────────────────────────────────────────────
   # Gate (required status check for branch protection)
   # ──────────────────────────────────────────────────────────────
@@ -370,6 +424,7 @@ jobs:
       - powershell-test
       - build-llamacpp
       - integration-tests
+      - dotnet-build
     steps:
       - name: Evaluate Results
         shell: pwsh
@@ -382,7 +437,8 @@ jobs:
             '${{ needs.rust-test.result }}',
             '${{ needs.powershell-test.result }}',
             '${{ needs.build-llamacpp.result }}',
-            '${{ needs.integration-tests.result }}'
+            '${{ needs.integration-tests.result }}',
+            '${{ needs.dotnet-build.result }}'
           )
           # 'success' only. No job here carries an `if:`, so the only way a
           # gated job skips is an upstream `needs` failing -- and that upstream
@@ -394,4 +450,4 @@ jobs:
             Write-Host "Non-success results: $($failed -join ', ')" -ForegroundColor Red
             exit 1
           }
-          Write-Host "CI Gate PASSED - all 8 checks succeeded" -ForegroundColor Green
+          Write-Host "CI Gate PASSED - all 9 checks succeeded" -ForegroundColor Green
diff --git a/.github/workflows/nvidia-validation.yml b/.github/workflows/nvidia-validation.yml
index 5310b93a..a6dd976b 100644
--- a/.github/workflows/nvidia-validation.yml
+++ b/.github/workflows/nvidia-validation.yml
@@ -5,7 +5,7 @@ name: NVIDIA Stack Validation
 # on every PR.
 on:
   pull_request:
-    branches: [main, develop]
+    branches: [main]
     paths:
       - 'Modules/PC-AI.Gpu/**'
       - 'Config/nvidia-software-registry.json'
@@ -14,7 +14,7 @@ on:
       - 'Tools/Sync-NvidiaDriverVersion.ps1'
       - 'Tools/Initialize-CudaEnvironment.ps1'
   push:
-    branches: [develop]
+    branches: [main]
     paths:
       - 'Modules/PC-AI.Gpu/**'
       - 'Config/nvidia-software-registry.json'
diff --git a/.github/workflows/portable-ci.yml b/.github/workflows/portable-ci.yml
deleted file mode 100644
index 5a7b095a..00000000
--- a/.github/workflows/portable-ci.yml
+++ /dev/null
@@ -1,179 +0,0 @@
-name: Portable CI (Linux)
-
-# Validates that the codebase compiles and passes quality checks on Ubuntu.
-# Primary consumers: Jules and other remote AI agents that run on Linux runners.
-# This workflow is intentionally kept dependency-light — no CUDA, no native DLLs,
-# no Windows-only APIs.  All checks must pass before the main CI gate runs.
-
-on:
-  pull_request:
-    branches: [main, develop]
-  workflow_dispatch: {}
-
-concurrency:
-  group: portable-ci-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_BACKTRACE: 1
-  # Disable sccache — not available on Ubuntu runners without extra setup
-  RUSTC_WRAPPER: ""
-
-jobs:
-  # ──────────────────────────────────────────────────────────────
-  # Single job.
-  #
-  # The "~4-6 min total" this comment used to claim was never measured. A
-  # dispatched run on 2026-09-07 spent over 40 minutes in `Rust Tests` alone,
-  # because `cargo test --workspace` builds all seven crates including the
-  # candle-based media crates. With no timeout-minutes the job inherited
-  # GitHub's 6-hour default, so a genuine hang would burn six hours of runner
-  # time before anyone noticed.
-  #
-  # MEASURED 2026-09-07 (run on 447d838): with the full workspace this job was
-  # KILLED by the 60-minute cap -- so "over an hour" is the real figure, not an
-  # estimate. Two changes below address the cause rather than the symptom:
-  # Swatinem/rust-cache for a cache that actually restores, and excluding the
-  # three candle-based pcai-media* crates from the Rust steps. The 60-minute
-  # cap is deliberately left in place as a backstop; once a run completes,
-  # lower it to something near the real duration so a hang is caught early.
-  # ──────────────────────────────────────────────────────────────
-
-  portable-tests:
-    name: Cross-Platform Quality Gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    defaults:
-      run:
-        working-directory: .
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      # ── Rust toolchain ────────────────────────────────────────
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-
-      # Swatinem/rust-cache rather than a hand-rolled actions/cache: it keys on
-      # the lockfile AND the toolchain, prunes stale artefacts instead of
-      # growing without bound, and skips caching the workspace crates' own
-      # build output (which must be rebuilt anyway). The hand-rolled version it
-      # replaces cached `target/` wholesale, which restores slowly and can
-      # exceed the cache size limit.
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: Native/pcai_core
-
-      # ── .NET toolchain ────────────────────────────────────────
-      - uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '8.0.x'
-
-      # ── PowerShell modules ────────────────────────────────────
-      # Install before the Rust steps so both can run concurrently in later PRs.
-      - name: Install PowerShell modules
-        shell: pwsh
-        run: |
-          Set-PSRepository PSGallery -InstallationPolicy Trusted
-          # -MinimumVersion pins nothing: it installs the NEWEST version at or
-          # above the floor, and Pester 6 is published. This job was running
-          # Pester 6 against a suite that declares ModuleVersion 5.0.0, so
-          # PC-AI.Robustness and PC-AI.Router died at discovery with
-          # "A 'break' or 'continue' statement ... escaped from your code",
-          # taking whole files at once. Same fix as ci.yml (4b45f2b); this call
-          # site was missed.
-          Install-Module -Name Pester -MinimumVersion 5.6.1 -MaximumVersion 5.99.99 -Force -Scope CurrentUser
-          Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser
-
-      # ── Rust: format ──────────────────────────────────────────
-      - name: Rust Format Check
-        working-directory: Native/pcai_core
-        run: cargo fmt --all --check
-
-      # ── Rust: clippy ──────────────────────────────────────────
-      # -A clippy::type_complexity suppresses the one lint that trips on generated
-      # FFI struct layouts where a complex type is unavoidable.
-      #
-      # The three pcai-media* crates are excluded from BOTH Rust steps here.
-      # They pull the candle stack (candle-core/nn/transformers + tokenizers),
-      # which this job then compiles twice -- once for clippy, once for the test
-      # binaries. That is what pushed the job past an hour: the 2026-09-07 run
-      # on 447d838 was killed by the 60-minute cap with the full workspace.
-      # They are GPU/CUDA-oriented and not what a Linux portability gate is
-      # for, and they are NOT going unchecked -- rust-guidelines.yml and
-      # ci.yml's `Build.ps1 -Component lint` both cover the whole workspace on
-      # Windows. If this job ever needs to cover them, give them their own job
-      # so a slow media build cannot mask a portability regression.
-      - name: Rust Clippy
-        working-directory: Native/pcai_core
-        run: >
-          cargo clippy --workspace --all-targets --no-deps
-          --exclude pcai-media --exclude pcai-media-model --exclude pcai-media-server
-          -- -D warnings -A clippy::type_complexity
-
-      # ── Rust: unit tests (no GPU, no backend) ─────────────────
-      # Uses the same feature set as the Windows CI to keep coverage comparable.
-      - name: Rust Tests
-        working-directory: Native/pcai_core
-        run: >
-          cargo test --workspace --no-default-features --features server,ffi --lib
-          --exclude pcai-media --exclude pcai-media-model --exclude pcai-media-server
-
-      # ── C#: build (best-effort, DLLs not present on Linux) ────
-      # Deliberately non-blocking: Windows-only APIs fail to resolve without
-      # the native DLLs. `|| true` alone made the outcome invisible, so a
-      # regression here looked identical to a pass. Now it still does not fail
-      # the gate, but a failure is reported as an annotation.
-      - name: C# Build
-        run: |
-          if dotnet build Native/PcaiNative/PcaiNative.csproj --nologo -v q; then
-            echo "C# build succeeded on Linux."
-          else
-            echo "::warning::C# build failed on Linux (non-blocking: Windows-only APIs are expected to be unresolvable here)."
-          fi
-
-      # ── C#: P/Invoke signature tests ──────────────────────────
-      # Cross-platform reflection tests — no native DLLs loaded. Same reasoning
-      # as above: kept non-blocking, but no longer silent.
-      - name: C# P/Invoke Signature Tests
-        run: |
-          if dotnet test Native/PcaiNative.Tests/PcaiNative.Tests.csproj \
-              --nologo --logger "console;verbosity=normal"; then
-            echo "P/Invoke signature tests passed."
-          else
-            echo "::warning::P/Invoke signature tests failed on Linux (non-blocking). These are pure reflection tests, so a failure here is most likely a real signature mismatch."
-          fi
-
-      # ── PowerShell: static analysis ───────────────────────────
-      # Emit warnings rather than failing the gate so Linux-specific false
-      # positives (e.g. Windows-only CIM cmdlets) don't block PRs.
-      - name: PSScriptAnalyzer
-        shell: pwsh
-        run: |
-          $results = Invoke-ScriptAnalyzer `
-            -Path Modules/ -Recurse `
-            -Settings PSScriptAnalyzerSettings.psd1 `
-            -Severity Warning,Error
-          if ($results) {
-            $results | Format-Table -AutoSize
-            Write-Host "::warning::PSScriptAnalyzer found $($results.Count) issues"
-          } else {
-            Write-Host "PSScriptAnalyzer: clean"
-          }
-
-      # ── PowerShell: portable Pester tests ─────────────────────
-      # Only tests tagged [Portable] run here — they must not depend on Windows
-      # APIs, native DLLs, hardware, or Administrator privileges.
-      - name: Portable Pester Tests
-        shell: pwsh
-        run: |
-          $config = New-PesterConfiguration
-          $config.Filter.Tag = @('Portable')
-          $config.Run.Path = @('Tests/Unit/')
-          $config.Output.Verbosity = 'Detailed'
-          $config.Run.Exit = $true
-          Invoke-Pester -Configuration $config
diff --git a/.github/workflows/rust-guidelines.yml b/.github/workflows/rust-guidelines.yml
index 17884b39..70132134 100644
--- a/.github/workflows/rust-guidelines.yml
+++ b/.github/workflows/rust-guidelines.yml
@@ -2,13 +2,13 @@ name: Rust Guidelines
 
 on:
   pull_request:
-    branches: [main, develop]
+    branches: [main]
     paths:
       - '**.rs'
       - '**/Cargo.toml'
       - '**/Cargo.lock'
   push:
-    branches: [develop]
+    branches: [main]
     paths:
       - '**.rs'
       - '**/Cargo.toml'
diff --git a/CLAUDE.md b/CLAUDE.md
index 5e995742..d07eb4f0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -427,10 +427,18 @@ git push origin v1.0.0
 - SM 89: Ada Lovelace (RTX 40 series, RTX 2000 Ada)
 - SM 120: Blackwell (RTX 50 series)
 
+**Platform scope — Windows only, by design.** This repo targets Windows/PC and is
+aggressively optimized for it. Cross-platform portability is **not a goal**, and the
+PowerShell modules, tests, and diagnostics are free to depend on Windows-only cmdlets
+(`Get-CimInstance`, `Get-PnpDevice`, registry providers, drive letters). Linux is used
+only where a Docker/WSL build, test, or deploy requirement demands it — never as a
+general portability target. Do not add cross-platform gates or "fix" tests to run on
+Linux; a Linux CI job that runs the PowerShell suite is a misconfiguration, not coverage.
+
 **CI/CD Workflows (`.github/workflows/`):**
 | Workflow | Trigger |
 |----------|---------|
-| `ci.yml` | PR/push to develop — unified gate: security, lint, Rust+PS test, build |
+| `ci.yml` | PR/push to main — unified gate: security, lint, Rust+PS test, build |
 | `release-cuda.yml` | Tag push (`v*`) — builds 4 CUDA/CPU release ZIPs |
 | `release.yml` | Tag push — PowerShell module release package |
 | `maintenance.yml` | Weekly Monday — security scan, dep health, PS 5.1 + MSRV compat |
@@ -439,7 +447,6 @@ git push origin v1.0.0
 | `tooling-automation.yml` | Manual — doc/FG/LLM tooling |
 | `rust-guidelines.yml` | PR/push (Rust files) — format, clippy, test, audit for .rs/Cargo changes |
 | `nvidia-validation.yml` | PR/push (GPU files) — NVIDIA stack validation for PC-AI.Gpu changes |
-| `portable-ci.yml` | PR to main/develop — Portable CI (Linux) cross-platform gate |
 | `jules-review.yml` | Weekly Monday 06:00 UTC + manual — Jules automated review |
 
 ## Diagnostic Categories
@@ -543,7 +550,7 @@ Test-Path "$env:USERPROFILE\Desktop\Hardware-Diagnostics-Report.txt"
 
 ### Git Hooks (lefthook)
 
-Pre-commit hooks are managed via `lefthook.yml`. Install: `lefthook install`. On staged Rust files the hooks run `cargo fmt --all --check` (`pcai-rust-fmt`, rooted at `Native/pcai_core/`) plus an ast-grep scan and a TODO-expect check. They do **not** run clippy — that is enforced in CI only (portable-ci, rust-guidelines, nvidia-validation, and `ci.yml` via `Build.ps1 -Component lint`). See `.qa-gate.conf` for why the git-guard Rust gate is off in this repo.
+Pre-commit hooks are managed via `lefthook.yml`. Install: `lefthook install`. On staged Rust files the hooks run `cargo fmt --all --check` (`pcai-rust-fmt`, rooted at `Native/pcai_core/`) plus an ast-grep scan and a TODO-expect check. They do **not** run clippy — that is enforced in CI only (rust-guidelines, nvidia-validation, and `ci.yml` via `Build.ps1 -Component lint`). See `.qa-gate.conf` for why the git-guard Rust gate is off in this repo.
 
 ### PowerShell Requirements
 
diff --git a/Native/PcaiNative/PcaiNative.csproj b/Native/PcaiNative/PcaiNative.csproj
index c3d5692b..5489c997 100644
--- a/Native/PcaiNative/PcaiNative.csproj
+++ b/Native/PcaiNative/PcaiNative.csproj
@@ -44,7 +44,7 @@
 
   <ItemGroup>
     <PackageReference Include="System.Management.Automation" Version="7.4.6" />
-    <PackageReference Include="System.Text.Json" Version="10.0.9" />
+    <PackageReference Include="System.Text.Json" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/Native/PcaiServiceHost/PcaiServiceHost.csproj b/Native/PcaiServiceHost/PcaiServiceHost.csproj
index 1804abab..902dc852 100644
--- a/Native/PcaiServiceHost/PcaiServiceHost.csproj
+++ b/Native/PcaiServiceHost/PcaiServiceHost.csproj
@@ -14,10 +14,17 @@
 
   <ItemGroup>
     <PackageReference Include="System.Management.Automation" Version="7.4.6" />
-    <PackageReference Include="System.Text.Json" Version="10.0.7" />
+    <PackageReference Include="System.Text.Json" Version="10.0.11" />
   </ItemGroup>
 
   <ItemGroup>
-    <None Include="..\PcaiNative\pcai_core_lib.dll" CopyToOutputDirectory="PreserveNewest" />
+    <!-- Condition matches PcaiNative.csproj, which already guards its identical
+         copies. Without it this project hard-required a Rust build artifact
+         that is not in git: MSB3030 "Could not copy ... pcai_core_lib.dll
+         because it was not found" on any clean checkout. It only ever built on
+         machines that happened to have run the Rust build first, which is why
+         nothing noticed until a CI job actually compiled this project. The DLL
+         is still copied whenever it is present. -->
+    <None Include="..\PcaiNative\pcai_core_lib.dll" CopyToOutputDirectory="PreserveNewest" Condition="Exists('..\PcaiNative\pcai_core_lib.dll')" />
   </ItemGroup>
 </Project>
diff --git a/Native/pcai_core/Cargo.lock b/Native/pcai_core/Cargo.lock
index 9ec2d137..e65ece0b 100644
--- a/Native/pcai_core/Cargo.lock
+++ b/Native/pcai_core/Cargo.lock
@@ -602,7 +602,7 @@ dependencies = [
  "gemm 0.19.0",
  "half",
  "libm",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "num-traits",
  "num_cpus",
  "rand 0.9.3",
@@ -628,7 +628,7 @@ dependencies = [
  "gemm 0.19.0",
  "half",
  "libm",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "num-traits",
  "num_cpus",
  "rand 0.9.3",
@@ -1186,6 +1186,12 @@ dependencies = [
  "libloading 0.9.0",
 ]
 
+[[package]]
+name = "daachorse"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5614204febbc33cc07a2806aa6440b904ac012b68eecc37f4493ea4a76455a3d"
+
 [[package]]
 name = "darling"
 version = "0.11.0"
@@ -1508,7 +1514,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1690,7 +1696,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2663,7 +2669,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core 0.58.0",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -3102,9 +3108,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libmimalloc-sys"
-version = "0.1.47"
+version = "0.1.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d1eacfa31c33ec25e873c136ba5669f00f9866d0688bea7be4d3f7e43067df6"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
 dependencies = [
  "cc",
 ]
@@ -3255,9 +3261,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "loop9"
@@ -3405,9 +3411,9 @@ dependencies = [
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
  "stable_deref_trait",
@@ -3415,9 +3421,9 @@ dependencies = [
 
 [[package]]
 name = "mimalloc"
-version = "0.1.50"
+version = "0.1.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3627c4272df786b9260cabaa46aec1d59c93ede723d4c3ef646c503816b0640"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
 dependencies = [
  "libmimalloc-sys",
 ]
@@ -3692,7 +3698,7 @@ dependencies = [
  "half",
  "hf-hub 0.4.3",
  "lazy_static",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "paste",
  "rayon",
  "regex",
@@ -3858,7 +3864,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4269,7 +4275,7 @@ dependencies = [
  "candle-transformers 0.10.2",
  "hf-hub 0.5.0",
  "image",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "ort",
  "pcai-media-model",
  "pcai_core_lib",
@@ -4279,7 +4285,7 @@ dependencies = [
  "serde_json",
  "tempfile",
  "thiserror 2.0.18",
- "tokenizers 0.22.2",
+ "tokenizers 0.23.2",
  "tokio",
  "tower-http",
  "tracing",
@@ -4360,7 +4366,7 @@ dependencies = [
  "ignore",
  "libc",
  "log",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "num_cpus",
  "nvml-wrapper",
  "parking_lot",
@@ -4377,7 +4383,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "walkdir",
- "windows 0.58.0",
+ "windows 0.62.2",
  "windows-sys 0.61.2",
  "winreg",
 ]
@@ -4644,7 +4650,7 @@ dependencies = [
  "byteorder",
  "candle-core 0.9.2",
  "candle-nn 0.9.2",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "peft-rs",
  "serde",
  "serde_json",
@@ -4721,7 +4727,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5226,7 +5232,7 @@ dependencies = [
  "candle-transformers 0.9.2",
  "clap",
  "itertools 0.14.0",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "mimalloc",
  "rand 0.8.6",
  "rust-functiongemma-core",
@@ -5300,7 +5306,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5359,7 +5365,7 @@ dependencies = [
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6292,7 +6298,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -6523,6 +6529,39 @@ dependencies = [
  "esaxx-rs",
  "fancy-regex 0.14.0",
  "getrandom 0.3.4",
+ "itertools 0.14.0",
+ "log",
+ "macro_rules_attribute 0.2.2",
+ "monostate",
+ "onig",
+ "paste",
+ "rand 0.9.3",
+ "rayon",
+ "rayon-cond 0.4.0",
+ "regex",
+ "regex-syntax 0.8.8",
+ "serde",
+ "serde_json",
+ "spm_precompiled",
+ "thiserror 2.0.18",
+ "unicode-normalization-alignments",
+ "unicode-segmentation",
+ "unicode_categories",
+]
+
+[[package]]
+name = "tokenizers"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7afbf6e88718afcc138bad01d6ccc3051dbbc3b2ce9793d8b8a3aeb610969cfc"
+dependencies = [
+ "ahash",
+ "compact_str",
+ "daachorse",
+ "dary_heap",
+ "derive_builder 0.20.2",
+ "esaxx-rs",
+ "getrandom 0.3.4",
  "indicatif 0.18.3",
  "itertools 0.14.0",
  "log",
@@ -6878,7 +6917,7 @@ dependencies = [
  "gemm 0.18.2",
  "half",
  "libloading 0.8.9",
- "memmap2 0.9.10",
+ "memmap2 0.9.11",
  "num",
  "num-traits",
  "num_cpus",
@@ -7411,7 +7450,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7420,16 +7459,6 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
-[[package]]
-name = "windows"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
-dependencies = [
- "windows-core 0.58.0",
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows"
 version = "0.61.3"
@@ -7473,27 +7502,14 @@ dependencies = [
  "windows-core 0.62.2",
 ]
 
-[[package]]
-name = "windows-core"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
-dependencies = [
- "windows-implement 0.58.0",
- "windows-interface 0.58.0",
- "windows-result 0.2.0",
- "windows-strings 0.1.0",
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-core"
 version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
- "windows-implement 0.60.2",
- "windows-interface 0.59.3",
+ "windows-implement",
+ "windows-interface",
  "windows-link 0.1.3",
  "windows-result 0.3.4",
  "windows-strings 0.4.2",
@@ -7505,8 +7521,8 @@ version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
- "windows-implement 0.60.2",
- "windows-interface 0.59.3",
+ "windows-implement",
+ "windows-interface",
  "windows-link 0.2.1",
  "windows-result 0.4.1",
  "windows-strings 0.5.1",
@@ -7534,17 +7550,6 @@ dependencies = [
  "windows-threading 0.2.1",
 ]
 
-[[package]]
-name = "windows-implement"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "windows-implement"
 version = "0.60.2"
@@ -7556,17 +7561,6 @@ dependencies = [
  "syn 2.0.114",
 ]
 
-[[package]]
-name = "windows-interface"
-version = "0.58.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "windows-interface"
 version = "0.59.3"
@@ -7621,15 +7615,6 @@ dependencies = [
  "windows-strings 0.5.1",
 ]
 
-[[package]]
-name = "windows-result"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.3.4"
@@ -7648,16 +7633,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "windows-strings"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
-dependencies = [
- "windows-result 0.2.0",
- "windows-targets 0.52.6",
-]
-
 [[package]]
 name = "windows-strings"
 version = "0.4.2"
diff --git a/Native/pcai_core/pcai_core_lib/Cargo.toml b/Native/pcai_core/pcai_core_lib/Cargo.toml
index f5140d0f..487fd232 100644
--- a/Native/pcai_core/pcai_core_lib/Cargo.toml
+++ b/Native/pcai_core/pcai_core_lib/Cargo.toml
@@ -45,7 +45,7 @@ nvml = ["dep:nvml-wrapper"]
 
 [target.'cfg(windows)'.dependencies]
 winreg.workspace = true
-windows = { version = "0.58", features = [
+windows = { version = "0.62.2", features = [
     "Win32_Foundation",
     "Win32_System_SystemInformation",
     "Win32_System_Performance",
diff --git a/Native/pcai_core/pcai_media/Cargo.toml b/Native/pcai_core/pcai_media/Cargo.toml
index 47e5a445..132695cc 100644
--- a/Native/pcai_core/pcai_media/Cargo.toml
+++ b/Native/pcai_core/pcai_media/Cargo.toml
@@ -24,7 +24,7 @@ candle-core = { version = "0.10" }
 candle-nn = "0.10"
 candle-transformers = "0.10"
 safetensors = "0.7"
-tokenizers = "0.22"
+tokenizers = "0.23.2"
 image = "0.25"
 rand = "0.9"
 # Disable ureq (sync HTTP client) to eliminate the ring crate dependency.