diff --git a/STATE.md b/STATE.md
index 8fe1565..f0db5f8 100644
--- a/STATE.md
+++ b/STATE.md
@@ -1,4 +1,4 @@
-Last updated: 1791816155 (2026-10-12T14:42:35Z)
+Last updated: 1791839203 (2026-10-12T21:06:43Z)
 
 # State
 
@@ -40,6 +40,7 @@ Take the first step whose status isn't `done` or `blocked`; a blocked step names
 | S29 | open-item follow-ups | done | [comradarr#160](https://github.com/edbfi/comradarr/pull/160); [zimuarr#34](https://github.com/edbfi/zimuarr/pull/34); [EasyHDR#182](https://github.com/edbfi/EasyHDR/pull/182); [zondarr#301](https://github.com/edbfi/zondarr/pull/301); [poyo-studio#108](https://github.com/edbfi/poyo-studio/pull/108); [#68](https://github.com/edbfi/edbfi-ci/pull/68), [#69](https://github.com/edbfi/edbfi-ci/pull/69), [#70](https://github.com/edbfi/edbfi-ci/pull/70) |
 | S30 | open-item follow-ups: dependabot-A2 closed, stale EasyHDR advisory ignores, Dependabot alerts on the out-of-scope repos | done | [EasyHDR#183](https://github.com/edbfi/EasyHDR/pull/183); [#71](https://github.com/edbfi/edbfi-ci/pull/71) |
 | S31 | open-item follow-ups: homebrew-taps' admin-only deploy-key push verified with a probe cask; B7 and hotio/base#30 no longer tracked | done | [homebrew-taps#47](https://github.com/edbfi/homebrew-taps/pull/47), [homebrew-taps#48](https://github.com/edbfi/homebrew-taps/pull/48); [#72](https://github.com/edbfi/edbfi-ci/pull/72) |
+| S32 | homebrew-taps' cask updater runs one job per cask on per-cask timeouts, verified with two probe casks | done | [homebrew-taps#49](https://github.com/edbfi/homebrew-taps/pull/49), [homebrew-taps#50](https://github.com/edbfi/homebrew-taps/pull/50), [homebrew-taps#51](https://github.com/edbfi/homebrew-taps/pull/51), [homebrew-taps#52](https://github.com/edbfi/homebrew-taps/pull/52); [#73](https://github.com/edbfi/edbfi-ci/pull/73) |
 
 ## Repos
 
@@ -65,7 +66,7 @@ Each repo's core rollout state is in the table below [V, 2026-10-09]; `—` mean
 | printlab-project | Python | S11 | live; push CI verified | live | active | live; no Dependabot PR yet (nothing outdated) | — | — |
 | EasyHDR | Native | S12, S18 | live; push CI verified (Windows tests, smoke, cargo-deny and the `fuzz/` check on the one workspace lockfile [V, 2026-10-12]); nightly audit, weekly Miri, release (verified end to end with a deleted test prerelease) and profiling workflows live | live | active | live; Dependabot merges observed ([#177](https://github.com/edbfi/EasyHDR/pull/177), [#178](https://github.com/edbfi/EasyHDR/pull/178)) | — | — |
 | github-stats | Native | S12, S17 | live on `master`; push CI verified; daily stats generator live | live | active | live; Dependabot merge observed ([#32](https://github.com/edbfi/github-stats/pull/32)) | — | — |
-| homebrew-taps | Native | S12, S19 | live; push CI verified (formulae on x86_64 and ARM64, macOS casks); cask updater live | live | active (admin role only; the deploy key passes it, D16) | live; Dependabot merge observed ([#41](https://github.com/edbfi/homebrew-taps/pull/41)) | — | — |
+| homebrew-taps | Native | S12, S19, S32 | live; push CI verified (formulae on x86_64 and ARM64, macOS casks); cask updater live, one job per cask [V, 2026-10-12] | live | active (admin role only; the deploy key passes it, D16) | live; Dependabot merge observed ([#41](https://github.com/edbfi/homebrew-taps/pull/41)) | — | — |
 | pelican-eggs | Shell | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#37](https://github.com/edbfi/pelican-eggs/pull/37)) | — | — |
 | mover-status | Shell | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#60](https://github.com/edbfi/mover-status/pull/60)) | — | — |
 | comradarr | Content | S13 | live; push CI verified | live | active | live; Dependabot merge observed ([#159](https://github.com/edbfi/comradarr/pull/159)) | — | — |
diff --git a/design/d8.md b/design/d8.md
index df2948f..395a53c 100644
--- a/design/d8.md
+++ b/design/d8.md
@@ -17,11 +17,11 @@
 
 ### homebrew-taps updater
 
-8. It MUST run every six hours, serialised, committing updates straight to main without PRs and without force-pushes, pushing with the repo's deploy key (rule 12, D16).
-9. Job 1 (unprivileged, macOS) MUST fetch the app, compute the checksum, generate and validate the recipe, and output only the version and checksum. For qBittorrent, a valid latest stable release without `qbittorrent-X.Y.Z.dmg` (the `_lt20` DMG doesn't count) MUST end the run as a logged no-update with jobs 2-4 skipped; malformed metadata, duplicate matches and lookup errors MUST fail.
+8. It MUST run every six hours, serialised, committing updates straight to main without PRs and without force-pushes, pushing with the repo's deploy key (rule 12, D16). Jobs 1-4 MUST each run one cask per job, on that cask's own timeout, so no timeout depends on the number of casks and a failing cask stops no other.
+9. Job 1 (unprivileged, macOS) MUST fetch the app, compute the checksum, generate and validate the recipe, and output only the version and checksum. For qBittorrent, a valid latest stable release without `qbittorrent-X.Y.Z.dmg` (the `_lt20` DMG doesn't count) MUST end that cask's update as a logged no-update with its jobs 2-4 skipped; malformed metadata, duplicate matches and lookup errors MUST fail.
 10. Job 2 (privileged) MUST run the repo's own discovery script from main, require job 1's version to equal the latest and be newer than the cask's current one (`sort -V`), fetch the app itself, require the checksum to match, and publish the release from its own copy.
 11. Job 3 (unprivileged) MUST run the checks that need the published download.
-12. Job 4 (privileged) MUST rewrite only the cask's `version` and `sha256`, and push as a plain fast-forward over SSH with the deploy key: a mode-600 temp key, `IdentitiesOnly=yes`, and `known_hosts` built from GitHub's published host keys, never `StrictHostKeyChecking=no`.
+12. Job 4 (privileged) MUST run one cask at a time, rewrite only the cask's `version` and `sha256`, and push as a plain fast-forward over SSH with the deploy key: a mode-600 temp key, `IdentitiesOnly=yes`, and `known_hosts` built from GitHub's published host keys, never `StrictHostKeyChecking=no`.
 13. A retry after a failed run MUST finish what that run left undone: the release, or the recipe push after it. A retry is a new run: a re-run would reuse an attempt's artifacts, so the privileged jobs refuse it.
 14. Linux formulae (D13): changed formulae MUST be built and tested natively on x86_64 and ARM64, feeding `ci-ok`.
 15. homebrew-taps MUST publish Linux bottles only for the formulae in `pipelines/bottles.json`; publication is deferred ([homebrew-taps#44](https://github.com/edbfi/homebrew-taps/issues/44)).
@@ -47,6 +47,7 @@
 - A homebrew-taps deploy-key push to main is accepted by the ruleset and starts `push` CI ([settings.md](settings.md#parameters)).
 - In homebrew-taps' `update-casks.yml`, `privileged-jobs` passes and the `publish` and `push` jobs have no `uses:` lines. The hook covers only `push`: `publish` holds `contents: write` but no secret and has no PR trigger, so [security.md](security.md#contract) rule 1 doesn't count it as privileged.
 - homebrew-taps: a new run after a failed recipe push publishes nothing twice and pushes the recipe [V, 2026-10-09, playground].
+- homebrew-taps with eight casks and unchanged timeouts: two casks updating in one run publish in parallel and push one after the other, each a deploy-key fast-forward logged as `bypass` with push CI passing; a failing publish stops only its own cask, and a run without updates skips jobs 2-4 [V, 2026-10-12, homebrew-taps probe casks, runs 38306466691, 38306834966 and 38306986072].
 - poyo-studio: removing one media tool fails the macOS job.
 
 ## Open