diff --git a/.github/workflows/cross-build.yml b/.github/workflows/cross-build.yml
index 5040b37..2a84dc3 100644
--- a/.github/workflows/cross-build.yml
+++ b/.github/workflows/cross-build.yml
@@ -170,16 +170,22 @@ jobs:
           key: cross-${{ matrix.target }}-${{ hashFiles('Cargo.lock') }}
 
       # Windows via cargo-zigbuild - pure Linux cross-compile, no MSVC needed.
+      # Zig comes from the hash-pinned ziglang wheel (x86_64 manylinux, the only
+      # zigbuild runner), which cargo-zigbuild runs as `python -m ziglang`.
       - name: Install zig
         if: matrix.zigbuild
-        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
-        with:
-          version: 0.15.1
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv "${RUNNER_TEMP}/zig"
+          printf '%s\n' 'ziglang==0.15.1 --hash=sha256:4e45994a0e608d9b16ecad255698f5557a2e24de0bd7ba9efb156ab3f3683d9a' > "${RUNNER_TEMP}/zig-requirements.txt"
+          "${RUNNER_TEMP}/zig/bin/python" -m pip install --no-deps --require-hashes -r "${RUNNER_TEMP}/zig-requirements.txt"
+          echo "CARGO_ZIGBUILD_PYTHON_PATH=${RUNNER_TEMP}/zig/bin/python" >> "${GITHUB_ENV}"
 
       - name: Install cargo-zigbuild
         if: matrix.zigbuild
         shell: bash
-        run: cargo install --locked cargo-zigbuild
+        run: cargo install --locked cargo-zigbuild --version 0.23.4
 
       - name: Build (native)
         if: ${{ !matrix.zigbuild }}
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 19c4d6b..f7713d6 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -308,10 +308,12 @@ jobs:
           owner: hyperi-io
           repositories: homebrew-tap
 
-      # Best-effort: fails (and is skipped) until scoop-bucket exists and the
-      # app is installed on it. Does not gate the job.
+      # Off until scoop-bucket exists and the app is installed on it: set the
+      # repo variable SCOOP_BUCKET_ENABLED=true then. Best-effort once on, so a
+      # bucket problem never takes the homebrew push down with it.
       - name: Mint scoop-bucket token
         id: bucket-token
+        if: vars.SCOOP_BUCKET_ENABLED == 'true'
         continue-on-error: true
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
@@ -357,9 +359,9 @@ jobs:
           fi
 
       - name: Push to scoop-bucket
-        # Skipped, not failed, while the bucket token could not be minted --
-        # scoop is EXPERIMENTAL and the bucket repo is not created yet. The
-        # rendered manifest still lands on R2 for manual bucket setup.
+        # Skipped, not failed, unless the bucket token was minted -- scoop is
+        # EXPERIMENTAL and off until the bucket exists. The rendered manifest
+        # still lands on R2 for manual bucket setup.
         if: steps.bucket-token.outcome == 'success'
         shell: bash
         env:
diff --git a/.hyperi-ci.yaml b/.hyperi-ci.yaml
index 91aab2b..602b09e 100644
--- a/.hyperi-ci.yaml
+++ b/.hyperi-ci.yaml
@@ -29,7 +29,6 @@ build:
   rust:
     features: all
     targets: []
-publish:
+release:
   enabled: true
-  target: oss
   channel: release
diff --git a/.releaserc.yaml b/.releaserc.yaml
deleted file mode 100644
index 9549088..0000000
--- a/.releaserc.yaml
+++ /dev/null
@@ -1,80 +0,0 @@
-# Project:   macbash
-# File:      .releaserc.yaml
-# Purpose:   Semantic release configuration
-#
-# License:   Apache-2.0
-# Copyright: (c) 2026 HYPERI PTY LIMITED
-
-branches:
-- main
-tagFormat: v${version}
-plugins:
-- - '@semantic-release/commit-analyzer'
-  - preset: conventionalcommits
-    releaseRules:
-    - breaking: true
-      release: major
-    - type: feat
-      release: minor
-    - type: fix
-      release: patch
-    - type: perf
-      release: patch
-    - type: sec
-      release: patch
-    - type: hotfix
-      release: patch
-    - type: security
-      release: patch
-    - type: docs
-      release: false
-    - type: test
-      release: false
-    - type: refactor
-      release: false
-    - type: style
-      release: false
-    - type: build
-      release: false
-    - type: ci
-      release: false
-    - type: chore
-      release: false
-    - type: deps
-      release: false
-    - type: revert
-      release: false
-    - type: wip
-      release: false
-    - type: cleanup
-      release: false
-    - type: data
-      release: false
-    - type: debt
-      release: false
-    - type: design
-      release: false
-    - type: infra
-      release: false
-    - type: meta
-      release: false
-    - type: ops
-      release: false
-    - type: review
-      release: false
-    - type: spike
-      release: false
-    - type: ui
-      release: false
-- '@semantic-release/release-notes-generator'
-- - '@semantic-release/changelog'
-  - changelogFile: CHANGELOG.md
-- - '@semantic-release/exec'
-  - prepareCmd: python3 scripts/release-prepare.py ${nextRelease.version}
-- - '@semantic-release/git'
-  - assets:
-    - CHANGELOG.md
-    - VERSION
-    - Cargo.toml
-    - Cargo.lock
-    message: 'chore: version ${nextRelease.version} [skip ci]'
diff --git a/Cargo.lock b/Cargo.lock
index b10bf5b..58eae52 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11,6 +11,17 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "annotate-snippets"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1"
+dependencies = [
+ "anstyle",
+ "memchr",
+ "unicode-width",
+]
+
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -67,6 +78,12 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "assert_cmd"
 version = "2.2.2"
@@ -88,6 +105,12 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "bitflags"
 version = "2.13.1"
@@ -183,6 +206,12 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -225,10 +254,27 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
 [[package]]
-name = "equivalent"
-version = "1.0.2"
+name = "encoding_rs"
+version = "0.8.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22"
+dependencies = [
+ "encoding_rs",
+]
 
 [[package]]
 name = "errno"
@@ -267,10 +313,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "hashbrown"
-version = "0.17.1"
+name = "granit-parser"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+checksum = "da55feca5d1625466bae068f9fd4b87892caeae70c3fe671ddb0f50d41aebf37"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+]
 
 [[package]]
 name = "heck"
@@ -287,16 +337,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
 [[package]]
 name = "insta"
 version = "1.48.0"
@@ -347,8 +387,8 @@ dependencies = [
  "regex",
  "rust-embed",
  "serde",
+ "serde-saphyr",
  "serde_json",
- "serde_yaml_ng",
  "tempfile",
  "thiserror",
 ]
@@ -375,6 +415,18 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"
@@ -534,10 +586,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "ryu"
+name = "rustversion"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "same-file"
@@ -548,6 +600,12 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -558,6 +616,23 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde-saphyr"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a253edfdea34032da21af84e16fcc94f4c7a6ba237f9f3bc2dbf43cea8535c44"
+dependencies = [
+ "annotate-snippets",
+ "base64",
+ "encoding_rs_io",
+ "granit-parser",
+ "nohash-hasher",
+ "num-traits",
+ "serde_core",
+ "smallvec",
+ "zmij",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.229"
@@ -591,19 +666,6 @@ dependencies = [
  "zmij",
 ]
 
-[[package]]
-name = "serde_yaml_ng"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
-dependencies = [
- "indexmap",
- "itoa",
- "ryu",
- "serde",
- "unsafe-libyaml",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -615,12 +677,24 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "similar"
 version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 
+[[package]]
+name = "smallvec"
+version = "1.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -707,10 +781,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
-name = "unsafe-libyaml"
-version = "0.2.11"
+name = "unicode-width"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
 [[package]]
 name = "utf8parse"
diff --git a/Cargo.toml b/Cargo.toml
index e6b6fcd..bdc142c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,7 +28,7 @@ regex = "1.10"
 rust-embed = { version = "8", features = ["debug-embed"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-serde_yaml_ng = "0.10"
+serde-saphyr = "2.0.0"
 thiserror = "2"
 
 [dev-dependencies]
diff --git a/action.yml b/action.yml
index fd85779..d9d53a4 100644
--- a/action.yml
+++ b/action.yml
@@ -49,6 +49,9 @@ runs:
       shell: bash
       env:
         MACBASH_VERSION: ${{ inputs.version }}
+      # Risk accepted: install.sh comes over TLS from the host that serves the
+      # binary, so fetching it first adds no integrity check; #10 tracks one.
+      # nosemgrep: yaml.github-actions.security.gha-curl-pipe-shell.gha-curl-pipe-shell
       run: |
         set -euo pipefail
         case "${RUNNER_OS:-}" in
diff --git a/docs/release.md b/docs/release.md
index bfb11a6..a10c8d2 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -85,11 +85,10 @@ cross-build.
 
 ## Versioning
 
-semantic-release owns the version. [.releaserc.yaml](../.releaserc.yaml) maps
-conventional-commit types to bumps: `feat` minor, `fix`/`perf`/`security`
-patch, everything else no release. `scripts/release-prepare.py` syncs the
-version into `VERSION`, `Cargo.toml` and `Cargo.lock` during the prepare step,
-and those files plus `CHANGELOG.md` are committed back.
+semantic-release owns the version, on its default conventional-commit rules:
+`feat` minor, `fix`/`perf` patch, everything else no release. hyperi-ci stamps
+the version into `VERSION`, `Cargo.toml` and `Cargo.lock` before the build, and
+those files plus `CHANGELOG.md` are committed back.
 
 Never hand-edit `CHANGELOG.md` or bump a version manually -- both are
 generated.
@@ -113,7 +112,7 @@ HTTP/2 200
 
 Then check the installer path end to end:
 
-```console
-$ curl -fsSL https://downloads.hyperi.io/macbash/install.sh | sh -s -- --user
-$ macbash --version
+```sh
+curl -fsSL https://downloads.hyperi.io/macbash/install.sh | sh -s -- --user
+macbash --version
 ```
diff --git a/docs/rules.md b/docs/rules.md
index 4ccec32..bbaea2b 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -214,7 +214,7 @@ scripts.
 
 Verify any rule change with:
 
-```console
-$ cargo test
-$ cargo run -- --severity info tests/fixtures/deploy-script.sh
+```sh
+cargo test
+cargo run -- --severity info tests/fixtures/deploy-script.sh
 ```
diff --git a/packaging/README.md b/packaging/README.md
index f6ff484..9fddc1c 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -79,7 +79,7 @@ framework changes required.
 
 The rendered installers expect binaries at this URL layout:
 
-```
+```text
 ${PKG_DOWNLOAD_BASE}/${VERSION}/${PKG_BINARY}-${os}-${arch}        # unix
 ${PKG_DOWNLOAD_BASE}/${VERSION}/${PKG_BINARY}-${os}-${arch}.exe    # windows
 ${PKG_DOWNLOAD_BASE}/${VERSION}/checksums.sha256                   # optional
diff --git a/scripts/release-prepare.py b/scripts/release-prepare.py
deleted file mode 100644
index 93d7c83..0000000
--- a/scripts/release-prepare.py
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/usr/bin/env python3
-#  Project:   macbash
-#  File:      scripts/release-prepare.py
-#  Purpose:   Stamp VERSION / Cargo.toml / Cargo.lock with a release version.
-#             Invoked by .releaserc.yaml's @semantic-release/exec prepareCmd.
-#  Language:  Python 3
-#
-#  License:   Apache-2.0
-#  Copyright: (c) 2025-2026 HYPERI PTY LIMITED
-"""Stamp a release version into VERSION, Cargo.toml, and Cargo.lock.
-
-Reads the workspace member name from Cargo.toml so the same script works
-for any project that drops it in - no name hardcoded.
-"""
-
-from __future__ import annotations
-
-import re
-import sys
-from pathlib import Path
-
-
-def main() -> None:
-    if len(sys.argv) != 2:
-        sys.exit("usage: release-prepare.py <version>")
-    version = sys.argv[1]
-
-    Path("VERSION").write_text(f"{version}\n")
-
-    cargo_toml = Path("Cargo.toml")
-    ct = cargo_toml.read_text()
-    name_match = re.search(r'^name\s*=\s*"([^"]+)"', ct, flags=re.MULTILINE)
-    if not name_match:
-        sys.exit("release-prepare: could not find name in Cargo.toml")
-    name = name_match.group(1)
-
-    ct = re.sub(
-        r'^version\s*=\s*"[^"]*"',
-        f'version = "{version}"',
-        ct,
-        count=1,
-        flags=re.MULTILINE,
-    )
-    cargo_toml.write_text(ct)
-
-    lock_path = Path("Cargo.lock")
-    if lock_path.exists():
-        lock = lock_path.read_text()
-        # Cargo.lock entries look like:
-        #   [[package]]
-        #   name = "macbash"
-        #   version = "1.5.2"
-        # Match exactly that block and bump only the version field.
-        pattern = (
-            r'(\[\[package\]\]\nname = "' + re.escape(name) + r'"\nversion = ")'
-            r'[^"]+(")'
-        )
-        new_lock, count = re.subn(pattern, rf"\g<1>{version}\g<2>", lock, count=1)
-        if count == 0:
-            print(
-                f"release-prepare: warning - no Cargo.lock entry found for "
-                f"package {name!r}; lockfile unchanged",
-                file=sys.stderr,
-            )
-        else:
-            lock_path.write_text(new_lock)
-
-    print(f"release-prepare: stamped {version} (package={name})")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/src/rules/loader.rs b/src/rules/loader.rs
index cba6f50..3b59b5f 100644
--- a/src/rules/loader.rs
+++ b/src/rules/loader.rs
@@ -33,8 +33,9 @@ pub enum LoadError {
     #[error("parsing YAML from {source_name}")]
     Parse {
         source_name: String,
+        // Boxed: serde_saphyr::Error alone would make every Result<_, LoadError> 136+ bytes.
         #[source]
-        source: serde_yaml_ng::Error,
+        source: Box<serde_saphyr::Error>,
     },
     #[error("invalid rule {id} in {source_name}: {reason}")]
     Invalid {
@@ -72,11 +73,27 @@ pub fn load_from_file(path: &Path) -> Result<RuleSet, LoadError> {
     parse_ruleset(&data, &path.display().to_string())
 }
 
+/// Parser options for every rule pack, builtin and custom alike.
+fn yaml_options() -> serde_saphyr::Options {
+    serde_saphyr::options! {
+        // Unemitted comments sit outside the 32-event comment budget, so a long
+        // comment block in a rule pack cannot fail the parse.
+        emit_comments: false,
+        // Only `true` and `false` are booleans; YAML 1.1 `yes`/`no`/`on`/`off` are refused.
+        strict_booleans: true,
+        // The error carries its line and column; the source name is LoadError's.
+        with_snippet: false,
+    }
+}
+
 fn parse_ruleset(bytes: &[u8], source_name: &str) -> Result<RuleSet, LoadError> {
-    let mut rs: RuleSet = serde_yaml_ng::from_slice(bytes).map_err(|e| LoadError::Parse {
-        source_name: source_name.to_string(),
-        source: e,
-    })?;
+    let mut rs: RuleSet =
+        serde_saphyr::from_slice_with_options(bytes, yaml_options()).map_err(|e| {
+            LoadError::Parse {
+                source_name: source_name.to_string(),
+                source: Box::new(e),
+            }
+        })?;
     for r in &mut rs.rules {
         validate_rule(r, source_name)?;
     }
@@ -246,6 +263,20 @@ mod tests {
         assert_eq!(rs.rules[0].severity, Severity::Warning);
     }
 
+    #[test]
+    fn load_from_file_accepts_a_comment_block_past_the_comment_budget() {
+        // Comments the parser holds while it decides whether `rules:` opens an
+        // indentless sequence; 40 is past serde-saphyr's 32-event buffer.
+        let notes: String = (0..40).map(|i| format!("# note {i}\n")).collect();
+        let body = format!(
+            "version: \"1.0\"\nrules:\n{notes}- id: commented\n  name: Commented\n  pattern: 'x'\n"
+        );
+        let dir = write_temp("commented.yaml", &body);
+        let rs = load_from_file(&dir.path().join("commented.yaml")).unwrap();
+        assert_eq!(rs.rules.len(), 1);
+        assert_eq!(rs.rules[0].id, "commented");
+    }
+
     #[test]
     fn load_from_file_rejects_invalid_yaml() {
         let dir = write_temp("invalid.yaml", "this is not: valid: yaml: syntax");
diff --git a/src/rules/types.rs b/src/rules/types.rs
index 383ad1e..737d06c 100644
--- a/src/rules/types.rs
+++ b/src/rules/types.rs
@@ -133,30 +133,30 @@ mod tests {
 
     #[test]
     fn severity_deserialises_lowercase() {
-        let s: Severity = serde_yaml_ng::from_str("error").unwrap();
+        let s: Severity = serde_saphyr::from_str("error").unwrap();
         assert_eq!(s, Severity::Error);
-        let s: Severity = serde_yaml_ng::from_str("warning").unwrap();
+        let s: Severity = serde_saphyr::from_str("warning").unwrap();
         assert_eq!(s, Severity::Warning);
-        let s: Severity = serde_yaml_ng::from_str("info").unwrap();
+        let s: Severity = serde_saphyr::from_str("info").unwrap();
         assert_eq!(s, Severity::Info);
     }
 
     #[test]
     fn fix_type_deserialises_lowercase() {
-        let f: FixType = serde_yaml_ng::from_str("replace").unwrap();
+        let f: FixType = serde_saphyr::from_str("replace").unwrap();
         assert_eq!(f, FixType::Replace);
-        let f: FixType = serde_yaml_ng::from_str("suggest").unwrap();
+        let f: FixType = serde_saphyr::from_str("suggest").unwrap();
         assert_eq!(f, FixType::Suggest);
-        let f: FixType = serde_yaml_ng::from_str("transform").unwrap();
+        let f: FixType = serde_saphyr::from_str("transform").unwrap();
         assert_eq!(f, FixType::Transform);
-        let f: FixType = serde_yaml_ng::from_str("function").unwrap();
+        let f: FixType = serde_saphyr::from_str("function").unwrap();
         assert_eq!(f, FixType::Function);
     }
 
     #[test]
     fn rule_deserialises_minimal_yaml() {
         let yaml = "id: test-rule\nname: Test\ndescription: A test\nseverity: error\npattern: 'foo'\nfix_type: suggest\n";
-        let r: Rule = serde_yaml_ng::from_str(yaml).unwrap();
+        let r: Rule = serde_saphyr::from_str(yaml).unwrap();
         assert_eq!(r.id, "test-rule");
         assert_eq!(r.severity, Severity::Error);
         assert_eq!(r.fix_type, FixType::Suggest);
@@ -165,7 +165,7 @@ mod tests {
     #[test]
     fn rule_defaults_severity_warning_when_missing() {
         let yaml = "id: r\nname: R\npattern: 'x'\n";
-        let r: Rule = serde_yaml_ng::from_str(yaml).unwrap();
+        let r: Rule = serde_saphyr::from_str(yaml).unwrap();
         assert_eq!(r.severity, Severity::Warning);
         assert_eq!(r.fix_type, FixType::Suggest);
     }
@@ -173,7 +173,7 @@ mod tests {
     #[test]
     fn ruleset_deserialises_with_version_and_rules() {
         let yaml = "version: \"1.0\"\nrules:\n  - id: r1\n    name: One\n    description: d\n    severity: warning\n    pattern: 'x'\n    fix_type: suggest\n";
-        let rs: RuleSet = serde_yaml_ng::from_str(yaml).unwrap();
+        let rs: RuleSet = serde_saphyr::from_str(yaml).unwrap();
         assert_eq!(rs.version, "1.0");
         assert_eq!(rs.rules.len(), 1);
     }
@@ -187,7 +187,7 @@ mod tests {
     #[test]
     fn severity_as_str_round_trip() {
         for s in [Severity::Error, Severity::Warning, Severity::Info] {
-            assert_eq!(serde_yaml_ng::from_str::<Severity>(s.as_str()).unwrap(), s);
+            assert_eq!(serde_saphyr::from_str::<Severity>(s.as_str()).unwrap(), s);
         }
     }
 
@@ -199,14 +199,14 @@ mod tests {
             FixType::Function,
             FixType::Transform,
         ] {
-            assert_eq!(serde_yaml_ng::from_str::<FixType>(f.as_str()).unwrap(), f);
+            assert_eq!(serde_saphyr::from_str::<FixType>(f.as_str()).unwrap(), f);
         }
     }
 
     #[test]
     fn rule_examples_optional() {
         let yaml = "id: r\nname: R\npattern: 'x'\nexamples:\n  bad: 'no'\n  good: 'yes'\n";
-        let r: Rule = serde_yaml_ng::from_str(yaml).unwrap();
+        let r: Rule = serde_saphyr::from_str(yaml).unwrap();
         assert_eq!(r.examples.bad, "no");
         assert_eq!(r.examples.good, "yes");
     }
@@ -214,7 +214,7 @@ mod tests {
     #[test]
     fn rule_test_cases_optional() {
         let yaml = "id: r\nname: R\npattern: 'x'\ntest_cases:\n  should_match:\n    - 'a'\n  should_not_match:\n    - 'b'\n";
-        let r: Rule = serde_yaml_ng::from_str(yaml).unwrap();
+        let r: Rule = serde_saphyr::from_str(yaml).unwrap();
         assert_eq!(r.test_cases.should_match, vec!["a"]);
         assert_eq!(r.test_cases.should_not_match, vec!["b"]);
     }