@@ -202,12 +202,22 @@ jobs:
       #
       # Every upload names its language and lane in `flags`, so Codecov can report each on its own. The two
       # DeepSource uploads carry `runner.os == 'Linux'`, for the one-report-per-key reason given on the job.
+      #
+      # `disable_search` keeps each upload to the one report it names. With search on, the action also sends every
+      # coverage-looking file in the workspace, including the unfiltered intermediates the coverage tasks leave
+      # under target/ (`agent-cov/all.lcov`, `agent-cov/cov-server.lcov`, `pic-viewer-cov/all.lcov`,
+      # `wasi-cov/wasi.lcov`). Their records for files the tasks deliberately drop land on the real sources, which
+      # showed as hits and misses on blank and doc-comment lines of services/ws-web-runner/src/runtime.rs at commit
+      # https://github.com/edge-toolkit/core/commit/e2f650920e0179f4ff877fc2faf704e0b7a02684, upload log
+      # `Found 10 coverage files to report` at
+      # https://github.com/edge-toolkit/core/actions/runs/39376279480/job/118475035669.
       - name: Upload Rust coverage to Codecov (OIDC)
         if: ${{ !cancelled() && hashFiles('lcov.info') != '' }}
         uses: codecov/codecov-action@v7
         with:
           use_oidc: true
           files: lcov.info
+          disable_search: true
           flags: rust,${{ matrix.os_flag }}
           fail_ci_if_error: true
 
@@ -217,6 +227,7 @@ jobs:
         with:
           use_oidc: true
           files: coverage-python.xml
+          disable_search: true
           flags: python,${{ matrix.os_flag }}
           fail_ci_if_error: true
 
 
@@ -219,6 +219,19 @@ jobs:
         uses: $/.github/actions/install-mise-tools
         timeout-minutes: 60
 
+      # Restore the portable MSVC + Windows SDK that prefetch:msvc stages, so a hit never reaches Microsoft.
+      # The stage is a pure function of config.msvc.toml -- the pinned script and its version flags live there --
+      # so that file's hash is the key and any edit to it restages. Only target/msvc/msvc is cached: the task
+      # renders msvc.env and the two junctions on every run. actions/cache saves only from a successful job, so a
+      # partial stage is never stored. The licence does not allow republishing these files, which is why this is
+      # a runner cache and not an upstream-cache mirror.
+      - name: Cache portable MSVC
+        if: matrix.compiler == 'msvc'
+        uses: actions/cache@v6
+        with:
+          path: target/msvc/msvc
+          key: portable-msvc-${{ hashFiles('.mise/config.msvc.toml') }}
+
       - name: Prefetch dependencies
         timeout-minutes: 20
         env:
 
@@ -31,9 +31,18 @@ version = "{{ vars.rust_nightly }}-x86_64-pc-windows-gnullvm"
 [vars]
 # portable-msvc script pin: gist id + revision (immutable content address) + sha256 of that revision.
 # Bump all three together after reviewing a new upstream revision.
+# The floor is the revision that matches SDK payload names with either path separator. The Visual Studio
+# manifest moved them from `Installers\\` to `Installers/`, so older revisions find no SDK package, download
+# none, and die at their `versions` step:
+#
+#     sdkv = first((OUTPUT / "Windows Kits/10/bin").glob("*")).name
+#     AttributeError: 'NoneType' object has no attribute 'name'
+#
+# Seen on commit https://github.com/edge-toolkit/core/commit/fc2e5639cb63d541269501663973a94d3138ea5f at
+# https://github.com/edge-toolkit/core/actions/runs/39527031634/job/118983994353.
 a_pmsvc_gist = "7f3162ec2988e81e56d5c4e22cde9977"
-a_pmsvc_rev = "ba48b0a3d9ea05c6caa5e583eda60fa7510da4bc"
-a_pmsvc_sha = "295a6d7e3e6a7132199ec51224216b07c54af29df9c8ba9bf01166ce12451c0a"
+a_pmsvc_rev = "49b58850aa5e5c1e65f090d4651ee76607883e11"
+a_pmsvc_sha = "1791cccca594ff083ce8d3e0a139e6156d2c312e24332a909e608010f0230a51"
 # Clear config.windows.toml's et-ws-web-runner exclusion.
 cargo_ws_excludes = ""
 # et-cli lands under the msvc target dir once CARGO_BUILD_TARGET below is flipped.
@@ -65,11 +74,13 @@ run = """
 base="{{ vars.msvc_base }}"
 coreutils mkdir -p "$base"
 script="$base/portable-msvc.py"
-if [ ! -f "$script" ]; then
+sha() { coreutils sha256sum -b "$script" | coreutils cut -c1-64; }
+# Fetched when absent or left over from a previous pin, so a bump takes effect on an existing checkout.
+if [ ! -f "$script" ] || [ "$(sha)" != "{{ vars.a_pmsvc_sha }}" ]; then
   src=":http:mmozeiko/{{ vars.a_pmsvc_gist }}/raw/{{ vars.a_pmsvc_rev }}/portable-msvc.py"
   rclone copyto "$src" "$script" --http-url https://gist.githubusercontent.com --progress
 fi
-actual=$(coreutils sha256sum -b "$script" | coreutils cut -c1-64)
+actual=$(sha)
 [ "$actual" = "{{ vars.a_pmsvc_sha }}" ] || {
   echo "portable-msvc.py checksum mismatch: $actual" >&2
   exit 1
@@ -78,7 +89,10 @@ actual=$(coreutils sha256sum -b "$script" | coreutils cut -c1-64)
 # The rendered msvc.env tracks whatever is installed, so a bump only needs these two flags changed and a
 # re-run after deleting target/msvc/msvc.
 py="{{ vars.py3_win_fwd }}"
-if [ ! -d "$base/msvc/VC" ]; then
+# A stage counts as complete only with both halves, so one missing its SDK is wiped and staged again.
+# The script writes the MSVC half before it unpacks the SDK, so a run that fails in between leaves `VC` behind.
+if [ ! -d "$base/msvc/VC" ] || [ ! -d "$base/msvc/Windows Kits/10/bin" ]; then
+  coreutils rm -rf "$base/msvc"
   (cd "$base" && "$py" portable-msvc.py --accept-license --msvc-version 14.51 --sdk-version 26100)
 fi
 "$py" - "$base/msvc" "$base/msvc.env" <<'PY'
 
@@ -10,7 +10,7 @@
 
 # Browser wasm-pack builds are coverage-instrumented when ET_TEST_COVERAGE is set.
 # The web_cov_wrapper RUSTC_WORKSPACE_WRAPPER (built by build-wasm-cov-wrapper) instruments only workspace
-# crates -- never the dependency cdylibs (tracing-wasm, wasm-streams) that don't link minicov's
+# crates -- never dependency cdylibs such as wasm-streams that don't link minicov's
 # __llvm_profile_runtime -- while web_cov_feat enables et-web/coverage to supply minicov's runtime. et-web's
 # __et_capture_coverage export (folded by wasm-bindgen into every module's glue) lets the web-runner pull each
 # module's .profraw for wasm-cov.
 
@@ -39,6 +39,7 @@ Changelog 1.1.0.
 ### Changed
 
 - The workspace requires actix-web 4.17.
+- **Breaking:** the minimum supported Rust version is 1.99.0, up from 1.91.1, for every published crate.
 - **Breaking:** an agent's IP address is always known. `AgentSummary::last_known_ip` and
   `AgentRecord::last_known_ip` are `IpAddr` rather than `Option<String>`, and `AgentRegistry::connect_agent` takes
   an `IpAddr`. On the wire, `last_known_ip` in an `et-list-agents-response` is a required IP string, never null,
 
@@ -4,7 +4,7 @@
 - **Tools:** 47
 - **Shell-script checks:** 10
 - **Checks with a repair pass:** 21
-- **Rules:** 342 custom local rules, or non-default strict linter settings
+- **Rules:** 343 custom local rules, or non-default strict linter settings
 
 Every check is listed across every `MISE_ENV`, filed under the tool it runs. Each entry names the env whose config
 declares it, the aggregate that runs it as part of `mise run check`, the `fix` or `fmt` pass that repairs what it
@@ -42,6 +42,9 @@ Rules, from `config/ast-grep/rules`:
   status -- a raw `std` `Command`'s `.status()` / `.output()` / `.spawn()` errors carry none of that. If a call
   genuinely needs the raw outcome (e.g. a test that asserts a non-zero exit, or an exit-code proxy), fully-qualify
   `std::process::Command` at the call site instead of importing it, so this rule does not apply.
+- `const-at-top` -- Declare module-level `const` and `static` items at the top of the file, after the `use` lines and
+  before any type, trait, `impl` or function. A reader then meets the module's fixed values before the code that uses
+  them.
 - `derive-attribute-order` -- Put `#[derive(...)]` before every inert or helper attribute on the same item --
   `#[non_exhaustive]`, `#[repr]`, `#[cfg_attr]`, and derive helpers such as `#[serde]`, `#[command]`, `#[strum]` or
   `#[asyncapi]`. Only doc comments, `#[cfg]`, `#[expect]` and attribute macros that must see the item before the derive