diff --git a/.github/readme-source.json b/.github/readme-source.json
index 14438ca..6fe366e 100644
--- a/.github/readme-source.json
+++ b/.github/readme-source.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "sha256": "e52e3bea7377b3e32bf78b79a478278dbf46eb14c05c454b8640def214a99d0c",
+  "sha256": "693e46871f6a4831dd8a781de9dc91885be081d5a5d123632882349bdf746da1",
   "history": {
     "forbidden_commits": [
       "5e7eba20575e7194b6cb91a498f3a69d35e1e786"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f3b21e..9a82006 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up development tools
-      uses: nicodes/tools/setup@f7e243524ce2aa29f299e4c79db33001f72f4a30
+      uses: nicodes/tools/setup@0f95a6df60f740b527596ed2c7f4590e3f2d5820
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 5
diff --git a/.github/workflows/dependency-policy.yml b/.github/workflows/dependency-policy.yml
index e8323a0..9212fd7 100644
--- a/.github/workflows/dependency-policy.yml
+++ b/.github/workflows/dependency-policy.yml
@@ -48,7 +48,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
-      uses: nicodes/tools/dependencies@f7e243524ce2aa29f299e4c79db33001f72f4a30
+      uses: nicodes/tools/dependencies@0f95a6df60f740b527596ed2c7f4590e3f2d5820
       with:
         apply: 'true'
         output: ${{ runner.temp }}/dependency-report.json
diff --git a/README.md b/README.md
index 813b597..ea2af5e 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 5e6b52c9ee9608c3a5544efbe25b3f0c9d0297d7876b052c419f9009fddc0c73 -->
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: aee76a8d361a0fbfb82a4416ffe5ba433d946f128459d8f5ea9dca9db7c3d2d2 -->
 
 # fieldsofrevik-web
 
@@ -19,9 +19,11 @@ For contributor verification, prepare the pinned helper source before running na
 
 ```sh
 git clone https://github.com/nicodes/tools.git .ci-tools
-git -C .ci-tools checkout --detach f7e243524ce2aa29f299e4c79db33001f72f4a30
+git -C .ci-tools checkout --detach 0f95a6df60f740b527596ed2c7f4590e3f2d5820
 mise install
 mise run check
 ```
 
 Build commands record source and exact regular output hashes. Declared tests produce evidence from the current verification session in `.artifacts/verification`.
+
+`mise run dev` owns the checkout’s foreground process tree. Dependency preparation and the application use an isolated local environment through the pinned optional ghenv CLI; no account is needed. Startup refuses changes to the native task policy during preparation. `mise run stop` stops only that checkout, and `mise run clean` refuses cleanup while its session is active.
diff --git a/mise.toml b/mise.toml
index 30397ca..bd0b301 100644
--- a/mise.toml
+++ b/mise.toml
@@ -20,10 +20,11 @@ run = ["bash scripts/test-site.sh"]
 depends = ["build"]
 
 [tasks."dev"]
-run = ["bun run dev"]
+run = "python3 \"$TOOLS_ROOT/helpers/dev.py\" run --state .artifacts/dev --prepare '[\"ghenv\",\"local\",\"--\",\"mise\",\"run\",\"install\"]' --policy-input mise.toml -- ghenv local -- python3 \"$TOOLS_ROOT/helpers/static-site.py\""
+tools = {"github:nicodes/ghenv" = "v0.4.0"}
 
 [tasks."clean"]
-run = ["bun -e 'const fs=require('\"'\"'node:fs'\"'\"');for(const p of ['\"'\"'dist'\"'\"','\"'\"'.astro'\"'\"'])fs.rmSync(p,{recursive:true,force:true})'"]
+run = "python3 \"$TOOLS_ROOT/helpers/dev.py\" clean --state .artifacts/dev -- mise run _clean"
 
 [tasks."check"]
 run = [{"task" = "install"}, {"task" = "build"}, {"task" = "artifact-check"}]
@@ -31,3 +32,10 @@ run = [{"task" = "install"}, {"task" = "build"}, {"task" = "artifact-check"}]
 [tasks."_build"]
 run = ["bun run build"]
 hide = true
+
+[tasks."stop"]
+run = "python3 \"$TOOLS_ROOT/helpers/dev.py\" stop --state .artifacts/dev"
+
+[tasks."_clean"]
+run = ["bun -e 'const fs=require('\"'\"'node:fs'\"'\"');for(const p of ['\"'\"'dist'\"'\"','\"'\"'.astro'\"'\"'])fs.rmSync(p,{recursive:true,force:true})'"]
+hide = true