diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e35ff9ec..38a479a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,9 +28,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - uses: actions-rust-lang/setup-rust-toolchain@a188e68d0fd2bd36ad51dccb2b07ba6e75105f30  # v2.0.1
-        with:
-          toolchain: stable
-          components: rustfmt, clippy
+        # No `toolchain:` input: setup-rust-toolchain reads rust-toolchain.toml,
+        # so CI and local builds use the same pinned compiler. A floating
+        # `stable` turned main red when 1.100 added manifest lints under
+        # CARGO_BUILD_WARNINGS=deny (2026-11-13).
 
 
       - name: format
@@ -64,7 +65,9 @@ jobs:
             grep -oP '\d+(?= passed)' | \
             python3 -c "import sys; print(sum(int(l) for l in sys.stdin if l.strip()))")
           echo "test count: $count"
-          FLOOR=470
+          # Raised 470 -> 900 on 2026-11-13 after a full green run measured 907
+          # under the pinned toolchain. The ratchet only moves up.
+          FLOOR=900
           if [ "$count" -lt "$FLOOR" ]; then
             echo "FAIL: test count $count below floor $FLOOR — tests removed or skipping"; exit 1
           fi
diff --git a/Cargo.lock b/Cargo.lock
index 466dda4f..f63370d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1600,16 +1600,6 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
-[[package]]
-name = "metrics"
-version = "0.24.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
-dependencies = [
- "portable-atomic",
- "rapidhash",
-]
-
 [[package]]
 name = "mimalloc"
 version = "0.1.52"
@@ -1738,7 +1728,6 @@ dependencies = [
  "clap",
  "libc",
  "libmimalloc-sys",
- "metrics",
  "mimalloc",
  "ocserve-core",
  "ocserve-http",
@@ -1753,7 +1742,6 @@ dependencies = [
  "serde_json",
  "sha1 0.11.0",
  "tempfile",
- "thiserror",
  "tokio",
  "toml",
  "tracing",
@@ -1778,7 +1766,6 @@ dependencies = [
  "serde_json",
  "sha2",
  "tempfile",
- "thiserror",
  "tokio",
  "tracing",
 ]
@@ -1798,7 +1785,6 @@ dependencies = [
  "http-body-util",
  "libc",
  "libmimalloc-sys",
- "metrics",
  "ocserve-core",
  "ocserve-llm",
  "ocserve-mcp",
@@ -1822,7 +1808,6 @@ dependencies = [
  "serde_json",
  "sha2",
  "tempfile",
- "thiserror",
  "tokio",
  "tower",
  "tracing",
@@ -1840,7 +1825,6 @@ dependencies = [
  "serde",
  "serde_json",
  "tempfile",
- "thiserror",
  "tracing",
 ]
 
@@ -1861,7 +1845,6 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "thiserror",
  "tokio",
  "tracing",
 ]
@@ -1877,7 +1860,6 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "thiserror",
  "tokio",
  "tracing",
 ]
@@ -1901,7 +1883,6 @@ dependencies = [
  "serde_json",
  "sha2",
  "tempfile",
- "thiserror",
  "tokio",
  "tracing",
 ]
@@ -1929,12 +1910,10 @@ dependencies = [
  "hex",
  "parking_lot",
  "rusqlite",
- "rustc-hash",
  "serde",
  "serde_json",
  "sha2",
  "tempfile",
- "thiserror",
  "tracing",
  "zstd",
 ]
@@ -1952,7 +1931,6 @@ dependencies = [
  "serde_json",
  "similar",
  "tempfile",
- "thiserror",
  "tokio",
  "tracing",
  "windows-sys 0.61.2",
@@ -2656,12 +2634,6 @@ dependencies = [
  "thiserror",
 ]
 
-[[package]]
-name = "portable-atomic"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
-
 [[package]]
 name = "postcard"
 version = "1.1.3"
@@ -2845,15 +2817,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rapidhash"
-version = "4.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5da7e78a036ce858e8d55b7e7dc8ba3a88b78350fd2155d3591bbd966b58589e"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "rayon"
 version = "1.12.0"
diff --git a/Cargo.toml b/Cargo.toml
index c07a2e85..bf4a0258 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,6 @@ edition = "2024"
 license = "MIT"
 rust-version = "1.98"
 repository = "https://github.com/Reliary/ocserve"
-homepage = "https://github.com/Reliary/ocserve"
 keywords = ["opencode", "server", "sqlite", "sse", "api"]
 categories = ["web-programming::http-server", "database-implementations", "development-tools"]
 
@@ -56,7 +55,6 @@ ocserve-ui-v2-d = { path = "crates/ocserve-ui-v2-d", version = "0.7.2" }
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "sync", "time", "fs", "io-util", "net"] }
 axum = { version = "0.8", features = ["json", "ws"] }
 tower = "0.5"
-hyper = "1"
 bytes = "1"
 
 # storage
@@ -74,7 +72,6 @@ libc = "0.2"
 # Already in the tree transitively; this makes the direct use explicit.
 rustix = { version = "1", features = ["fs", "process"] }
 anyhow = "1"
-thiserror = "2"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 clap = { version = "4", features = ["derive"] }
@@ -85,11 +82,8 @@ base64 = "0.23"
 hex = "0.4"
 futures-util = "0.3"
 parking_lot = "0.13"
-rustc-hash = "2"
 
 # metrics
-metrics = "0.24"
-metrics-exporter-prometheus = "0.16"
 
 [profile.release]
 opt-level = 3
diff --git a/TRACEABILITY.md b/TRACEABILITY.md
index 1748264a..b5f79eeb 100644
--- a/TRACEABILITY.md
+++ b/TRACEABILITY.md
@@ -262,6 +262,7 @@ no-inflation correct), PASS cost (−58.9% weighted) + score (median 1.0 both)
 | K-FREEZE-1195 | the v1 freeze must be adopted through the pipeline, not by hand, and every artifact that embeds the tag must move with it | Moved 1.18.31 -> 1.19.5 with `bump.sh v1`. Contract: 188 operations over the same 162 paths (byte-diff: 2 schema descriptions, 1 additive `reasoning_options` property, `x-codeSamples` added to every operation). Prompt/tool text for everything the server sends is byte-identical (`tool/shell/shell.txt` unchanged, `bashCommandSection` unchanged); `plan-enter.txt` was DELETED upstream and is removed here. ARITY rules identical. Two live capture timings were also fixed: `acquire-freeze` printed success while `cp` failed on the root-owned vendored path (step 2 then booted the OLD binary), and `extract-prompts` had no remote fallback. | `capdiff` GREEN with the provider-header oracle enabled: it found the two real deltas (composite UA runtime segment `bun/1.3.14 -> 1.4.4`; `x-opencode-session-id` now sent to EVERY provider, not just `opencode*`), both fixed; replay 26/0; pair 18 compared / 0 divergent, 52 schema checks / 0 violations; `render_check` (prompt parity) green; `global_health` golden now `1.19.5`; test `composite_ua_matches_the_captured_artifact` pins the UA to a captured file, so a hand-written literal cannot drift again | green |
 | K-MUTANTS | mutation baseline + gate (Phase 2) | `snapshot::tests::non_git_directory_is_inactive` made hermetic (fixture plants a bogus `.git` boundary — the test falsely passed only when TMPDIR sat outside any repo; the mutants harness sets TMPDIR inside the repo, aborting the baseline). **Full-scope baseline (i9, 2330 mutants, 34 min): 939 caught / 1221 missed / 24 timeout / 146 unviable = 43.5 % score** — `bench/mutants/BASELINE.md` + `baseline-outcomes.json`; zero env-gated skips verified (1 intentional ignore). `scripts/check-mutants.py` gates missed count against ceiling 1221 (ratchet-down-only; selftest red/green proven); `scripts/merge-mutants.py` combines `--shard` files with a duplicate guard (selftest red/green proven). Method corrected on evidence: `additional_cargo_test_args=["--lib"]` removed (drops store integration binaries → 933 false survivors, and lands `--lib` on the test binary). Acceleration: `.cargo/mutants.toml` profile=mutants/debug=none + 45s timeout floor; runs on the i9 (`-j8`, mold, sccache, tmpfs) | green |
 
+| K-CI-PIN | CI must fail for repository changes, not for a Rust release rolling onto the stable channel | On 2026-11-13 every workflow on `main` and on all fork PRs failed within two minutes with zero tests run. rustc 1.100.0 had landed on the runner and introduced cargo manifest lints (`unused_dependencies`, `unused_workspace_dependencies`, `redundant_homepage`); `CARGO_BUILD_WARNINGS=deny` turned them fatal. Reproduced locally under 1.100.0 with the same env (exit 101) and green under 1.99.0, proving the trigger was the compiler, not the code. Fixed by pinning `rust-toolchain.toml` to 1.100.0 (a floating channel makes `main` hostage to a release) and removing the declarations the lint proved unused (workspace `hyper`, `metrics`, `metrics-exporter-prometheus`, `thiserror`; per-crate `thiserror`, `rustc-hash`, `metrics`) plus the duplicated `homepage`. Also replaced the `current_exe()` binary walk in three process tests with `CARGO_BIN_EXE_ocserve`, which is what CI and remote builds actually need; the walk only worked when the test exe sat beside the bin. | `rust-toolchain.toml` pin; `cargo +1.100.0 clippy --workspace --all-targets -- -D warnings` under `CARGO_BUILD_WARNINGS=deny` clean; 907 tests pass on the build box; guards 110/110, matrix, docs green | green |
 ## Test design techniques coverage (TESTING §4)
 
 | Technique | Applied | Where |
diff --git a/crates/ocserve-cli/Cargo.toml b/crates/ocserve-cli/Cargo.toml
index 80a4bc75..8cf9d325 100644
--- a/crates/ocserve-cli/Cargo.toml
+++ b/crates/ocserve-cli/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -20,7 +19,6 @@ path = "src/main.rs"
 libc.workspace = true
 axum.workspace = true
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
 serde.workspace = true
@@ -37,7 +35,6 @@ ocserve-metrics.workspace = true
 ocserve-importer.workspace = true
 rusqlite.workspace = true
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "blocking"] }
-metrics.workspace = true
 
 sha1 = "0.11"
 
diff --git a/crates/ocserve-cli/tests/drain_budget.rs b/crates/ocserve-cli/tests/drain_budget.rs
index 6527d6db..1d0757be 100644
--- a/crates/ocserve-cli/tests/drain_budget.rs
+++ b/crates/ocserve-cli/tests/drain_budget.rs
@@ -34,12 +34,13 @@ fn hold_sse(port: u16) -> (std::sync::mpsc::Receiver<()>, std::thread::JoinHandl
 }
 
 fn bin() -> std::path::PathBuf {
-    let mut p = std::env::current_exe().expect("test exe");
-    p.pop();
-    if p.ends_with("deps") {
-        p.pop();
-    }
-    p.join("ocserve")
+    // CARGO_BIN_EXE_<name> is set by cargo for integration tests of the same
+    // package and points at the real binary whatever the profile/target dir
+    // is. The previous `current_exe()` walk assumed the test executable sat in
+    // the same directory as the binary, which is false under a custom
+    // CARGO_TARGET_DIR + separate build of the bin target (and under the CI
+    // `cargo test --workspace` ordering that builds tests first).
+    std::path::PathBuf::from(env!("CARGO_BIN_EXE_ocserve"))
 }
 
 #[test]
diff --git a/crates/ocserve-cli/tests/shutdown.rs b/crates/ocserve-cli/tests/shutdown.rs
index df2860fb..24a2f0f4 100644
--- a/crates/ocserve-cli/tests/shutdown.rs
+++ b/crates/ocserve-cli/tests/shutdown.rs
@@ -14,13 +14,9 @@ use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
 fn bin() -> std::path::PathBuf {
-    // The integration test binary lives in target/<profile>/deps/…
-    let mut p = std::env::current_exe().expect("test exe");
-    p.pop();
-    if p.ends_with("deps") {
-        p.pop();
-    }
-    p.join("ocserve")
+    // Cargo-provided path to the same-package binary: independent of profile,
+    // target dir, and which targets built first. See drain_budget.rs.
+    std::path::PathBuf::from(env!("CARGO_BIN_EXE_ocserve"))
 }
 
 #[test]
diff --git a/crates/ocserve-cli/tests/shutdown_race.rs b/crates/ocserve-cli/tests/shutdown_race.rs
index b2b690d3..d210bc21 100644
--- a/crates/ocserve-cli/tests/shutdown_race.rs
+++ b/crates/ocserve-cli/tests/shutdown_race.rs
@@ -14,12 +14,9 @@ use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
 fn bin() -> std::path::PathBuf {
-    let mut p = std::env::current_exe().expect("test exe");
-    p.pop();
-    if p.ends_with("deps") {
-        p.pop();
-    }
-    p.join("ocserve")
+    // Cargo-provided path to the same-package binary: independent of profile,
+    // target dir, and which targets built first. See drain_budget.rs.
+    std::path::PathBuf::from(env!("CARGO_BIN_EXE_ocserve"))
 }
 
 #[test]
diff --git a/crates/ocserve-core/Cargo.toml b/crates/ocserve-core/Cargo.toml
index 59889230..4029f984 100644
--- a/crates/ocserve-core/Cargo.toml
+++ b/crates/ocserve-core/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -13,7 +12,6 @@ description = "Session domain: inbox admission, agent loop, event bus, permissio
 
 [dependencies]
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/ocserve-http/Cargo.toml b/crates/ocserve-http/Cargo.toml
index 2cde56a7..4b380639 100644
--- a/crates/ocserve-http/Cargo.toml
+++ b/crates/ocserve-http/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -16,7 +15,6 @@ regex = "1"
 ocserve-pty = { workspace = true }
 rusqlite = { workspace = true }
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -40,7 +38,6 @@ ocserve-ui-v2-d.workspace = true
 ocserve-metrics.workspace = true
 ocserve-plugin.workspace = true
 futures-util.workspace = true
-metrics.workspace = true
 parking_lot.workspace = true
 sha2.workspace = true
 base64.workspace = true
diff --git a/crates/ocserve-importer/Cargo.toml b/crates/ocserve-importer/Cargo.toml
index cc25738a..96ff47c4 100644
--- a/crates/ocserve-importer/Cargo.toml
+++ b/crates/ocserve-importer/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -13,7 +12,6 @@ description = "Streaming read-only session importer (opencode.db to ocserve)"
 
 [dependencies]
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/ocserve-llm/Cargo.toml b/crates/ocserve-llm/Cargo.toml
index 5724a26c..ab3b3d69 100644
--- a/crates/ocserve-llm/Cargo.toml
+++ b/crates/ocserve-llm/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -27,7 +26,6 @@ http-body-util = "0.1"
 hyper-boring = "5.4"
 boring = "5.4"
 ocserve-metrics.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/ocserve-mcp/Cargo.toml b/crates/ocserve-mcp/Cargo.toml
index 8a3228d1..cda0750f 100644
--- a/crates/ocserve-mcp/Cargo.toml
+++ b/crates/ocserve-mcp/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -14,7 +13,6 @@ description = "MCP client: stdio + StreamableHTTP + legacy SSE; OAuth token stor
 [dependencies]
 ocserve-store = { workspace = true }
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/ocserve-metrics/Cargo.toml b/crates/ocserve-metrics/Cargo.toml
index 8e0e2573..0da755b3 100644
--- a/crates/ocserve-metrics/Cargo.toml
+++ b/crates/ocserve-metrics/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
diff --git a/crates/ocserve-plugin/Cargo.toml b/crates/ocserve-plugin/Cargo.toml
index f0981dfe..6f7dd491 100644
--- a/crates/ocserve-plugin/Cargo.toml
+++ b/crates/ocserve-plugin/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -13,7 +12,6 @@ description = "opencode plugin host: hook dispatcher with full upstream name tab
 
 [dependencies]
 anyhow.workspace = true
-thiserror.workspace = true
 hex.workspace = true
 tracing.workspace = true
 serde.workspace = true
diff --git a/crates/ocserve-pty/Cargo.toml b/crates/ocserve-pty/Cargo.toml
index 7831e3c0..93c751d3 100644
--- a/crates/ocserve-pty/Cargo.toml
+++ b/crates/ocserve-pty/Cargo.toml
@@ -6,7 +6,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 
 [dependencies]
 ocserve-core = { workspace = true }
diff --git a/crates/ocserve-store/Cargo.toml b/crates/ocserve-store/Cargo.toml
index e6405353..7c53f952 100644
--- a/crates/ocserve-store/Cargo.toml
+++ b/crates/ocserve-store/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -19,12 +18,10 @@ serde.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 sha2.workspace = true
 hex.workspace = true
 parking_lot.workspace = true
-rustc-hash.workspace = true
 
 [dev-dependencies]
 tempfile = "3"
diff --git a/crates/ocserve-tools/Cargo.toml b/crates/ocserve-tools/Cargo.toml
index ac3c3061..14bd0f84 100644
--- a/crates/ocserve-tools/Cargo.toml
+++ b/crates/ocserve-tools/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 readme = "README.md"
@@ -13,7 +12,6 @@ description = "bash, read, write, edit, glob, grep, webfetch, task, question, to
 
 [dependencies]
 anyhow.workspace = true
-thiserror.workspace = true
 tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/ocserve-ui-v1-a/Cargo.toml b/crates/ocserve-ui-v1-a/Cargo.toml
index 78ded2f2..5ae46007 100644
--- a/crates/ocserve-ui-v1-a/Cargo.toml
+++ b/crates/ocserve-ui-v1-a/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (1.19.5, part a) for ocserve"
diff --git a/crates/ocserve-ui-v1-b/Cargo.toml b/crates/ocserve-ui-v1-b/Cargo.toml
index 3765121b..ad2a9eb7 100644
--- a/crates/ocserve-ui-v1-b/Cargo.toml
+++ b/crates/ocserve-ui-v1-b/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (1.19.5, part b) for ocserve"
diff --git a/crates/ocserve-ui-v2-a/Cargo.toml b/crates/ocserve-ui-v2-a/Cargo.toml
index 9d0be177..dfd8ce8f 100644
--- a/crates/ocserve-ui-v2-a/Cargo.toml
+++ b/crates/ocserve-ui-v2-a/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (2.2.5, part a) for ocserve"
diff --git a/crates/ocserve-ui-v2-b/Cargo.toml b/crates/ocserve-ui-v2-b/Cargo.toml
index d8dbfd73..9245ce2d 100644
--- a/crates/ocserve-ui-v2-b/Cargo.toml
+++ b/crates/ocserve-ui-v2-b/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (2.2.5, part b) for ocserve"
diff --git a/crates/ocserve-ui-v2-c/Cargo.toml b/crates/ocserve-ui-v2-c/Cargo.toml
index 59f34f37..862976c5 100644
--- a/crates/ocserve-ui-v2-c/Cargo.toml
+++ b/crates/ocserve-ui-v2-c/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (2.2.5, part c) for ocserve"
diff --git a/crates/ocserve-ui-v2-d/Cargo.toml b/crates/ocserve-ui-v2-d/Cargo.toml
index efc75c47..29520785 100644
--- a/crates/ocserve-ui-v2-d/Cargo.toml
+++ b/crates/ocserve-ui-v2-d/Cargo.toml
@@ -5,7 +5,6 @@ edition.workspace = true
 license.workspace = true
 rust-version.workspace = true
 repository.workspace = true
-homepage.workspace = true
 keywords.workspace = true
 categories.workspace = true
 description = "Embedded web-UI pack part (2.2.5, part d) for ocserve"
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 00000000..d013b554
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,13 @@
+[toolchain]
+# Pinned deliberately. CI gates on `-D warnings`, and cargo's manifest lints
+# (`unused_dependencies`, `unused_workspace_dependencies`, `redundant_homepage`)
+# are version-dependent: rustc 1.100.0 introduced them and turned every job red
+# on a stable-channel roll with no repository change. A floating channel makes
+# `main` hostage to a Rust release; bump this file on purpose instead.
+#
+# Bump procedure: change `channel`, run
+#   cargo +<ver> clippy --workspace --all-targets -- -D warnings
+#   cargo +<ver> test --workspace
+# then commit the pin with the fixes the new lints/semantics require.
+channel = "1.100.0"
+components = ["rustfmt", "clippy"]