@@ -14,12 +14,13 @@ concurrency:
 jobs:
   verify:
     name: Verify Latest Release Attestations
-    # ubuntu-latest, NOT the self-hosted `cachekit` runner: the ARC pods have no `gh`
-    # binary (LAB-899) and unreliable Sigstore (Fulcio/Rekor) egress — the same reason
-    # release.yml's publish job is hosted. `gh attestation verify` is the only tool
-    # that does Sigstore bundle verification, so moving this job back to ARC silently
-    # re-breaks it (LAB-984: every `gh` call exited 127 into `|| echo ""`, and the job
-    # reported green while verifying nothing for weeks).
+    # Must stay GitHub-hosted: this job needs `gh` (preinstalled on ubuntu-latest)
+    # and reliable Sigstore (Fulcio/Rekor) egress. `gh attestation verify` is the
+    # only tool that does Sigstore bundle verification. The whole repo is on
+    # ubuntu-latest (LAB-3501) and runner-guard.yml keeps it there, but the point
+    # is load-bearing here specifically: when this once ran on a self-hosted runner
+    # with no `gh` binary, every `gh` call exited 127 into `|| echo ""` and
+    # the job reported green while verifying nothing for weeks.
     runs-on: ubuntu-latest
     permissions:
       contents: read
 
@@ -8,43 +8,31 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  # cargo's available_parallelism() reads the node's 32 threads, not the pod's
-  # cgroup CPU quota, so a cold (cache-miss) build fans out ~22-way and can
-  # OOM-kill the linker in the 5Gi cachekit runner — the same failure that hit
-  # cachekit-rs (#25/#26). Cap parallel jobs so peak RSS stays under the cap.
-  CARGO_BUILD_JOBS: "4"
-
 jobs:
   test:
     name: ${{ matrix.rust }} / ${{ matrix.os }}
-    runs-on: ${{ matrix.runner }}
+    runs-on: ${{ matrix.os }}
     # Fail fast instead of hanging ~10min to GitHub's heartbeat if a runner wedges.
     timeout-minutes: 20
     continue-on-error: ${{ matrix.rust == 'beta' }}
     strategy:
       fail-fast: false
       matrix:
-        # Full OS matrix for stable only; MSRV and beta on self-hosted only
+        # Full OS matrix for stable only; MSRV and beta on Linux only.
         include:
           # MSRV - ensures we don't use newer Rust features
           - rust: "1.85"
             os: ubuntu-latest
-            runner: cachekit
           # Stable - primary target, all platforms
           - rust: stable
             os: ubuntu-latest
-            runner: cachekit
           - rust: stable
             os: macos-latest
-            runner: macos-latest
           - rust: stable
             os: windows-latest
-            runner: windows-latest
           # Beta - early warning (allowed to fail)
           - rust: beta
             os: ubuntu-latest
-            runner: cachekit
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -76,7 +64,7 @@ jobs:
         run: cargo test --features ffi
 
   security:
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -13,16 +13,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  # cargo's available_parallelism() reads the node's 32 threads, not the pod's
-  # cgroup CPU quota, so the cold release build below can OOM-kill the linker in
-  # the 5Gi cachekit runner (cachekit-rs #25/#26). Cap parallel jobs to fit.
-  CARGO_BUILD_JOBS: "4"
-
 jobs:
   analyze:
     name: Analyze
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       actions: read
 
@@ -21,11 +21,11 @@ concurrency:
 
 jobs:
   # GitHub-hosted: this job inherits contents+PR write and mints an App
-  # installation token. The self-hosted `cachekit` pool shares a writable
-  # hostPath build cache (/cache) across all pods and every cachekit-io repo,
-  # and job-level `permissions:` does not isolate that filesystem — untrusted
-  # build-script/proc-macro code can poison the cache a later credentialed
-  # job runs against (LAB-1040). release-please needs no warm cache anyway.
+  # installation token, so it must not share a writable build cache with other
+  # jobs — job-level `permissions:` does not isolate a filesystem, and untrusted
+  # build-script/proc-macro code could poison a cache a later credentialed job
+  # runs against. A fresh hosted VM has no shared cache to poison, and
+  # release-please needs no warm cache anyway.
   release-please:
     runs-on: ubuntu-latest
     outputs:
@@ -47,8 +47,8 @@ jobs:
       # release PR here. outputs.pr is set whenever the release PR was created
       # OR updated, so this re-runs on every push to main while a release PR is
       # open — adding an already-present assignee is a no-op, so that's safe.
-      # github-script, NOT `gh`: chosen when this job ran on the self-hosted
-      # cachekit runner, which has no gh CLI (LAB-899); it works identically on
+      # github-script, NOT `gh`: chosen when this job ran on a self-hosted
+      # runner without the gh CLI; it works identically on
       # a hosted runner. outputs.pr is passed raw via env and parsed in JS — never
       # through template-position fromJson, which is evaluated even when if: is
       # false and crashes on '' for no-release pushes (LAB-865).
 
@@ -0,0 +1,35 @@
+name: Runner Guard
+
+# Drift protection (LAB-3501): every job in this repo must run on a GitHub-hosted
+# runner. This job fails the workflow if any `runs-on` or matrix `os:`/`runner:`
+# value in .github/workflows/ is not a hosted label — an allow-list, so a NEW
+# self-hosted label nobody has named yet still fails.
+#
+# This is protection against MAINTAINER drift on trusted branches only. It is NOT a
+# fork-PR control: a fork runs its own copy of this file and can delete the guard;
+# the control for that lives in repository and org runner settings, outside this file.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  assert-hosted-runners:
+    name: Assert all runners are GitHub-hosted
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Self-test the guard, then scan every workflow
+        run: |
+          python3 .github/scripts/assert_hosted_runners.py --selftest
+          python3 .github/scripts/assert_hosted_runners.py
@@ -7,12 +7,13 @@ on:
     branches: [main]
   schedule:
     # Saturday 11:07 UTC = Sat 21:07 AEST / 22:07 AEDT (Sydney night, year-round).
-    # Weekly cadence: deep fuzz at 1h/target × 16 targets is ~16 runner-hours, which
-    # drains in a few hours overnight instead of monopolising the shared ARC pool for
-    # ~32h. The full 8h/target run is opt-in via workflow_dispatch (run_deep_fuzz).
-    # PR-time coverage (cargo audit/deny, Cargo Vet, Quick Fuzz, CodeQL) catches
-    # regressions promptly; deep fuzz is for finding bugs, not gating merges.
-    # Off-minute (:07) avoids the cron pile-up that GitHub schedules at :00.
+    # Weekly cadence: deep fuzz at 1h/target × 16 targets. Each matrix target is a
+    # separate GitHub-hosted job, so they run in parallel (bounded by GitHub's
+    # concurrency limit) rather than serialising on shared runners — and hosted minutes
+    # are free for public repos. The longer opt-in run is via workflow_dispatch
+    # (run_deep_fuzz). PR-time coverage (cargo audit/deny, Cargo Vet, Quick Fuzz,
+    # CodeQL) catches regressions promptly; deep fuzz is for finding bugs, not
+    # gating merges. Off-minute (:07) avoids the cron pile-up GitHub schedules at :00.
     - cron: '7 11 * * 6'
   # Deliberately no `release:` trigger. It existed only for an SBOM job that
   # attached a release asset, and that can never work here: immutable releases
@@ -29,13 +30,13 @@ on:
   workflow_dispatch:
     inputs:
       run_deep_fuzz:
-        description: "Run the full deep-fuzz matrix (heavy — occupies the ARC pool)"
+        description: "Run the full deep-fuzz matrix (heavy — one hosted job per target)"
         type: boolean
         default: false
       fuzz_seconds:
-        description: "Seconds per target for an on-demand deep fuzz (default 8h)"
+        description: "Seconds per target for an on-demand deep fuzz (default 5h; hard cap 18000s to fit GitHub's 6h job limit)"
         type: string
-        default: "28800"
+        default: "18000"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -44,16 +45,11 @@ concurrency:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
-  # Cap cargo parallelism so cold builds (incl. ASAN fuzz-target builds) don't
-  # OOM-kill the linker in the 5Gi cachekit runner — see cachekit-rs #25/#26.
-  # NOTE: -j bounds parallel codegen, not ASAN's absolute footprint; it's a
-  # strong mitigation for the fuzz builds, a full fix for normal cargo builds.
-  CARGO_BUILD_JOBS: "4"
 
 jobs:
   fast-security:
     name: Fast Security Checks
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event_name == 'pull_request'
     steps:
       - name: Checkout code
@@ -98,7 +94,7 @@ jobs:
 
   quick-fuzz:
     name: Quick Fuzz (Corpus Only)
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event_name == 'pull_request'
     strategy:
       fail-fast: false
@@ -160,13 +156,13 @@ jobs:
 
   deep-fuzz:
     name: Deep Fuzzing
-    runs-on: cachekit
-    # Scheduled weekly run is light (1h/target) so it can't monopolise the shared
-    # ARC pool. The full 8h/target run is opt-in via workflow_dispatch (run_deep_fuzz).
+    runs-on: ubuntu-latest
+    # Scheduled weekly run is light (1h/target). The longer on-demand run is opt-in
+    # via workflow_dispatch (run_deep_fuzz) and clamped to fit the hosted 6h cap.
     if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_deep_fuzz)
-    # 540min cap accommodates the on-demand 8h path; the inner timeout governs the
-    # actual scheduled (1h) vs dispatched (configurable) duration.
-    timeout-minutes: 540
+    # 360min = GitHub's hosted job cap. The inner timeout governs the actual
+    # scheduled (1h) vs dispatched (<=5h, clamped below) duration.
+    timeout-minutes: 360
     strategy:
       fail-fast: false
       matrix:
@@ -214,18 +210,20 @@ jobs:
         run: cargo install cargo-fuzz
 
       - name: Run deep fuzz
-        # Scheduled runs use 1h/target (keeps the ARC pool free for PR CI); a manual
-        # workflow_dispatch can request the full 8h (or any duration) via fuzz_seconds.
+        # Scheduled runs use 1h/target; a manual workflow_dispatch can request a
+        # longer duration (up to the 5h clamp below) via fuzz_seconds.
         env:
           FUZZ_SECONDS: ${{ (github.event_name == 'workflow_dispatch' && inputs.fuzz_seconds) || '3600' }}
         run: |
           # Validate the dispatch-supplied duration before it reaches shell arithmetic
-          # and the fuzzer. Must be a positive integer and within the 540min job cap.
+          # and the fuzzer. Must be a positive integer within the hosted 6h job cap.
+          # Ceiling is 18000s (5h): +180s hang slack (below) still leaves headroom
+          # under timeout-minutes 360 (21600s), so a dispatched job cannot exceed 6h.
           case "$FUZZ_SECONDS" in
             ''|*[!0-9]*) echo "::error::fuzz_seconds must be a positive integer (got '$FUZZ_SECONDS')"; exit 1 ;;
           esac
-          if [ "$FUZZ_SECONDS" -lt 1 ] || [ "$FUZZ_SECONDS" -gt 32400 ]; then
-            echo "::error::fuzz_seconds must be 1..32400 (<= 540min job cap), got $FUZZ_SECONDS"; exit 1
+          if [ "$FUZZ_SECONDS" -lt 1 ] || [ "$FUZZ_SECONDS" -gt 18000 ]; then
+            echo "::error::fuzz_seconds must be 1..18000 (<= 6h hosted job cap), got $FUZZ_SECONDS"; exit 1
           fi
           cd fuzz
           # Build first - fail fast on compile errors
@@ -249,7 +247,7 @@ jobs:
 
   kani:
     name: Kani Formal Verification
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     permissions:
       contents: read # least-privilege: the job only checks out and verifies
@@ -293,7 +291,7 @@ jobs:
 
   cargo-vet:
     name: Cargo Vet (Supply Chain)
-    runs-on: cachekit
+    runs-on: ubuntu-latest
     if: github.event_name == 'schedule' || github.event_name == 'pull_request'
     steps:
       - name: Checkout code
 
@@ -1,6 +1,10 @@
 # Rust build artifacts
 /target/
 
+# Python bytecode from .github/scripts/ (the runner-guard drift check)
+__pycache__/
+*.py[cod]
+
 # Generated files (keep .gitkeep but ignore generated header)
 include/cachekit.h
 
 
@@ -20,10 +20,9 @@
 //! attached to the decision memo on that issue); throughput evidence lives in
 //! the LAB-510 harness (`benches/hot_path.rs`, 64 MiB incompressible group).
 //!
-//! Width boundaries: the fixture's `*_bin` twins all fit in a bin8 header
-//! (`0xc4`, ≤ 255 B). The `width_boundary_*` tests cover the bin16 (`0xc5`)
-//! and bin32 (`0xc6`) headers with real LZ4 output from the real writer, per
-//! the MUST recorded in the decision record.
+//! Width boundaries: the fixture pins both bin8 (`0xc4`) and bin16 (`0xc5`)
+//! twins. The `width_boundary_*` tests additionally cover the bin32 (`0xc6`)
+//! header with real LZ4 output from the real writer, per the decision record.
 
 #![cfg(all(feature = "compression", feature = "checksum", feature = "messagepack"))]
 
@@ -123,27 +122,29 @@ fn dual_decode_matrix_against_legacy_vectors() {
             v.name
         );
         assert_eq!(
-            // 0xc4 = msgpack bin8. Every pinned twin's compressed_data is small
-            // enough to be bin8; a wider marker here is a width-selection
-            // regression that would break cross-SDK byte-identity.
             new_wire[1],
-            0xc4,
-            "[{}] compressed_data not bin8-encoded: 0x{:02x}",
+            match new_from_old.compressed_data.len() {
+                0..=255 => 0xc4,
+                256..=65_535 => 0xc5,
+                _ => 0xc6,
+            },
+            "[{}] compressed_data does not use the shortest bin marker: 0x{:02x}",
             v.name,
             new_wire[1]
         );
         // Documented micro-regression: bin costs at most +1 B, and only on the
         // smallest envelopes. A <=15 B compressed_data goes from a 1 B fixarray
         // header to a 2 B bin8 header (+1); any array >=16 B already carried a
-        // 3 B array16 header, so bin8's 2 B header shrinks it. Measured worst
-        // case on the pinned set is exactly +1 (`empty`, 25 -> 26 B); every
-        // other vector ties or shrinks. This +1 B ceiling is the micro-
+        // 3 B array16 header, so bin8's 2 B header shrinks it. The bin16 tier
+        // uses the same three-byte header as array16, so it cannot grow either.
+        // Measured worst case on the pinned set is exactly +1 (`empty`, 25 ->
+        // 26 B); every other vector ties or shrinks. This +1 B ceiling is the micro-
         // regression contract accepted by the writer flip (LAB-764/LAB-866),
         // so keep it tight — a +2/+3 bloat regression must not slip through
         // green.
         assert!(
             new_wire.len() <= old_wire.len() + 1,
-            "[{}] new wire exceeds the +1 B bin8-header ceiling",
+            "[{}] new wire exceeds the +1 B bin-header ceiling",
             v.name
         );
 
@@ -212,9 +213,8 @@ fn assert_width_tier(name: &str, payload_len: usize, expected_marker: u8) {
     assert_all_readers_decode(name, &wire, &payload);
 }
 
-/// bin8/bin16 boundary: the fixture twins never leave bin8 territory (all
-/// compressed_data <= 255 B), so sweep real LZ4 outputs across the 255/256 B
-/// boundary and prove both header widths decode through every reader shape.
+/// bin8/bin16 boundary: the fixture pins one bin16 twin, and this sweep covers
+/// real LZ4 outputs across the 255/256 B boundary through every reader shape.
 /// LZ4 adds a few bytes of literal-run overhead on incompressible input, so
 /// the sweep brackets the boundary regardless of the exact overhead.
 #[test]