diff --git a/Cargo.lock b/Cargo.lock
index f93dcea121d..d58a1eadb88 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2091,9 +2091,9 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "serde"
@@ -2740,9 +2740,9 @@ checksum = "2c591d83f69777866b9126b24c6dd9a18351f177e49d625920d19f989fd31cf8"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "unicode-bom"
diff --git a/issues/the-tree-resolves-in-five-cargo-locks-not-one.md b/issues/the-tree-resolves-in-five-cargo-locks-not-one.md
new file mode 100644
index 00000000000..2c7255852e8
--- /dev/null
+++ b/issues/the-tree-resolves-in-five-cargo-locks-not-one.md
@@ -0,0 +1,59 @@
+---
+status: assigned
+kind: track
+opened: 2026-10-04
+---
+
+# The tree resolves in five Cargo locks, not one
+
+The root, `kernel/`, `bootloader/`, `userland/` and `toyos/` are five
+Cargo resolutions with five locks, and four of them declare their own
+`[profile.toyos]`. A
+crate two of them share is tested on the host against the root's lock and
+shipped from another's, and the locks disagree on versions: on `main` at
+`c4ab2b1e1`, 35 registry pairs sit below the highest version another of the
+five locks carries in the same semver range (userland 24, loader 8, root 2,
+kernel 1).
+
+**The owner ruled on 2026-10-04.** Asked "Merge everything into one Cargo
+workspace (after small version-alignment steps; proven by byte-identical
+kernel and loader)?", he chose "Yes, one workspace (Recommended)": "One
+lockfile, one profile, shared crates tested as shipped; about 35 version
+alignments land first."
+
+**Owner:** the orchestrator. Everything below is the orchestrator's plan and
+its measurements, not the ruling.
+
+**Exit:** one workspace and one lock at the root replace the five. The step
+that merges them moves no version: its lock's name and version pairs are the
+union of the aligned locks, and the kernel and the loader, both arches, are
+byte-identical to the build of the last alignment before it. The alignments
+land first, each in today's workspace; pull request #724, the root and
+kernel locks, is the first.
+
+**Constraints, measured** on a scratch workspace seeded from the five locks
+at `8b4f88446`, by type-check and one loader link, with no boot:
+
+- One lock holds one version per semver range, so every pair below its
+  range's maximum moves up to it. At `8b4f88446` that was 35: the 29 below
+  the maximum then (userland 18, loader 7, root 3, kernel 1), the 3 that
+  userland's moves pull with them (`ureq-proto`, `utf-8`, `zeroize_derive`),
+  and the root's registry `getrandom` 0.2, 0.3 and 0.4, which become the forks
+  userland patches in at the same versions. Those three move no version: they
+  follow from the root `[patch]` and land with it. What the pairs added since
+  (userland's `autocfg`, `crossbeam-utils`, `defmt`, `defmt-macros`,
+  `once_cell` and `rustix`, and the loader's `libc`) pull with them is not
+  measured.
+- Every fork commit the five locks pin stays pinned, and the crypto
+  pre-releases (`ed25519-dalek 3.0.0-pre.6`, `pkcs5 0.8.0-rc.13`) are only in
+  `userland/Cargo.lock` and stay.
+- The loader's `[profile.toyos]` has no `strip = "debuginfo"`; a loader built
+  with and without it differs in 247,720 of 328,192 bytes. One profile is a
+  loader byte change, made before the merge.
+- `[patch]` is workspace-wide. `tests/toyos-rust-tests` patches memmap2,
+  `tests/toyos-rust-tests/tls-cranelift`, a resolution with its own lock,
+  patches target-lexicon, and `tests/ssh-client-host` takes upstream tokio,
+  so all three stay outside the workspace.
+- The guest triples' flags stay per triple: with no
+  `[target.x86_64-unknown-uefi]` table, `curve25519-dalek-derive` enters the
+  x86_64 loader's graph.
diff --git a/kernel/Cargo.lock b/kernel/Cargo.lock
index 20a78b0a455..0a1d9db926e 100644
--- a/kernel/Cargo.lock
+++ b/kernel/Cargo.lock
@@ -64,9 +64,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "rustc-demangle"