diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index abeb145..9b7eefe 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -14,7 +14,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sanitizer: [address, undefined]
+        # `undefined` is NOT a valid cargo-fuzz sanitizer. cargo-fuzz accepts
+        # only address/leak/memory/thread/none, so the UBSan leg failed at
+        # "Build Fuzzers (undefined)" every week from at least 2026-06-07 to
+        # 2026-07-26 with:
+        #   error: invalid value 'undefined' for '--sanitizer <SANITIZER>'
+        # It is schedule-triggered, so it never showed on the main-branch
+        # board. cflite_pr.yml was already corrected; this file was missed.
+        sanitizer: [address]
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 38339e9..c61745b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,12 +39,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.28.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
deleted file mode 100644
index 2a95f5d..0000000
--- a/.github/workflows/push-email-notify.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Dormant push-email notification. ARMED by setting the repo variable
-# PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
-# sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
-# new repos from the template; placed on existing repos by the farm sweep.
-name: Push email notification
-on:
-  push: {}
-permissions:
-  contents: read
-jobs:
-  notify:
-    name: Email on push
-    if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send push notification email
-        uses: dawidd6/action-send-mail@12335b969ae3fb71bee5f2c6b829744261aec34c # pinned
-        with:
-          server_address: ${{ secrets.SMTP_HOST }}
-          server_port: ${{ secrets.SMTP_PORT }}
-          secure: true
-          username: ${{ secrets.SMTP_USER }}
-          password: ${{ secrets.SMTP_PASS }}
-          from: "GitHub Push <${{ secrets.SMTP_USER }}>"
-          to: "jonathan.jewell@gmail.com j.d.a.jewell@open.ac.uk"
-          subject: "[${{ github.repository }}] push to ${{ github.ref_name }} by ${{ github.actor }}"
-          body: |
-            Repository: ${{ github.repository }}
-            Branch:     ${{ github.ref_name }}
-            Pusher:     ${{ github.actor }}
-            Compare:    ${{ github.event.compare }}
-            Head msg:   ${{ github.event.head_commit.message }}
diff --git a/.gitignore b/.gitignore
index 896e6e5..3415090 100644
--- a/.gitignore
+++ b/.gitignore
@@ -114,3 +114,19 @@ ai-cli-crash-capture/
 # Fuzz harness build artifacts
 fuzz/target/
 rust-core/fuzz/target/
+
+# Local database files
+*.db
+*.db-journal
+*.db-shm
+*.db-wal
+
+# Local caches and agent worktrees
+.cache/
+.claude/
+
+# Local export and build outputs
+/exports/*.json
+/exports/*.lgt
+composer/*.beam
+composer/build/
diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml
index 51b8167..b994475 100644
--- a/audits/assail-classifications.a2ml
+++ b/audits/assail-classifications.a2ml
@@ -30,7 +30,7 @@
   ;; inside `try { } catch` returning result<_, VeriSimError.t>. The
   ;; graceful degradation the finding asks for is already present.
   (classification
-    (file "connectors/clients/rescript/src/VeriSimVql.res")
+    (file "connectors/clients/rescript/src/VeriSimVcl.res")
     (category "UnsafeDeserialization")
     (audit "try-wrapped stringify→parseExn round-trips")
     (rationale "parse of self-stringified JSON inside try; cannot throw on external input"))