@@ -274,26 +274,26 @@ effectcraft-media = { git = "https://github.com/ymote/effectcraft.git", rev = "d
 effectcraft-expr = { git = "https://github.com/ymote/effectcraft.git", rev = "d60cb71e297a4bb76851b27b48c0014b56ccab69" }
 effectcraft-model = { git = "https://github.com/ymote/effectcraft.git", rev = "d60cb71e297a4bb76851b27b48c0014b56ccab69" }
 # The vectorcraft vector engine (ADR 0013): the pinned ymote fork, one revision.
-vectorcraft-engine = { git = "https://github.com/ymote/vectorcraft.git", rev = "85dcb28e411db4271f3b726d6502b78e1375cbba" }
-vectorcraft-render = { git = "https://github.com/ymote/vectorcraft.git", rev = "85dcb28e411db4271f3b726d6502b78e1375cbba" }
+vectorcraft-engine = { git = "https://github.com/ymote/vectorcraft.git", rev = "2cd3a1ca8fbcc5b2e40de47588194798a9f8e497" }
+vectorcraft-render = { git = "https://github.com/ymote/vectorcraft.git", rev = "2cd3a1ca8fbcc5b2e40de47588194798a9f8e497" }
 # The vector service's embedded-reference fence (ADR 0013): the engine's own
 # SVG importer, run with a reader that records instead of reads, and its
 # native format, for the links a document carries.
-vectorcraft-svg = { git = "https://github.com/ymote/vectorcraft.git", rev = "85dcb28e411db4271f3b726d6502b78e1375cbba" }
-vectorcraft-format = { git = "https://github.com/ymote/vectorcraft.git", rev = "85dcb28e411db4271f3b726d6502b78e1375cbba" }
+vectorcraft-svg = { git = "https://github.com/ymote/vectorcraft.git", rev = "2cd3a1ca8fbcc5b2e40de47588194798a9f8e497" }
+vectorcraft-format = { git = "https://github.com/ymote/vectorcraft.git", rev = "2cd3a1ca8fbcc5b2e40de47588194798a9f8e497" }
 # The pdfcraft PDF engine (ADR 0013): the pinned ymote fork, one revision;
 # default features off to leave its MCP server out of the build.
-pdfcraft-automation = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9", default-features = false }
+pdfcraft-automation = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3", default-features = false }
 # The pdf service's comment dates: the engine's own object reader and comment
 # reader, which keep `/M` with its zone (the engine's listing drops it).
-pdfcraft-cos = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
-pdfcraft-annot = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
+pdfcraft-cos = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
+pdfcraft-annot = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
 # The pdf service's edit check: the engine's own text editor, run on a copy of
 # the open document to see what an edit would do before PDF Tools makes it.
-pdfcraft-edit = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
+pdfcraft-edit = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
 # The pdf service's tests only: the engine's own scripted XFA form, the
 # hostile fixture of the scripts-off fence (ADR 0013).
-pdfcraft-xfa = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
+pdfcraft-xfa = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
 octosense-mail-service = { path = "apps/mail/host-service" }
 octosense-calendar-service = { path = "apps/calendar/host-service" }
 octosense-news-service = { path = "apps/news/host-service" }
@@ -458,9 +458,12 @@ nix = { git = "https://github.com/octos-org/octos.git", rev = "18fcd3f16e527d2b6
 # interpret APIs the engine uses, lopdf and jbig2 allocation fixes), and
 # [patch] sections do not reach a consumer workspace, so the same five
 # are patched here, pinned to the engine's own ymote/pdfcraft revision
-# (ADR 0013; the rev moves with the pdfcraft-automation pin above).
-hayro = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
-hayro-interpret = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
-hayro-jbig2 = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
-hayro-syntax = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
-lopdf = { git = "https://github.com/ymote/pdfcraft.git", rev = "615ff308173a3dd7c595fc598508b519a895c0e9" }
+# (ADR 0013; the rev moves with the pdfcraft-automation pin above). A
+# patch that loses to a newer crates.io release goes unused and the
+# unhardened crate is built (hayro-jbig2's 0.3.0 had lost to 0.3.1): the
+# pdf service's skill test refuses that.
+hayro = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
+hayro-interpret = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
+hayro-jbig2 = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
+hayro-syntax = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }
+lopdf = { git = "https://github.com/ymote/pdfcraft.git", rev = "51f09eea27c56e8e033f8234fa7f4072ba7846d3" }