diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b09d989..273f1b35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.59 Hono dependency security patch (#248)
+
+- Pin the API's transitive Hono override exactly to 4.13.11, the smallest
+  patched release for GHSA-5r4p-p66f-jhc7 / CVE-2026-111757 (Medium).
+  The patch was published 2026-09-29T06:15:49Z and became seven-day eligible
+  2026-10-06T06:15:49Z. No quarantine exception or registry change is needed.
+- Reserve 0.55.59 for the shipped dependency change; API and web product
+  versions move together. The existing public-registry CI workflow owns both
+  lockfiles. Bootstrap checks on the old installation do not prove the patch.
+  The actual locked dependency regression first fails on Hono 4.13.7.
+- The frozen 0.55.58 image contains Hono despite its `devOptional` lock flag.
+  This is runtime-presence evidence, not proof of exploitability or absence
+  of reachable vulnerable middleware. No application or UI behavior changes.
+  The restored private installation now proves Hono 4.13.11 in both actual
+  Prisma dependency routes. Final protected publication and hosted review
+  remain separate checks.
+- Historical bootstrap publication was blocked before CI-only regeneration. Three normal
+  Fast pushes publish nothing: C13 README badge mismatch (fixed), an unchanged
+  HTTP `ENOBUFS` failure (57/57 focused rerun), then the unchanged nested
+  non-UTC Node/Jest timestamp probe's 30,119ms `ETIMEDOUT` (6,209/6,210 units).
+  The last attempt passes all 23 preceding static gates. Both lockfiles remain
+  unchanged from master, Hono remains installed/locked at 4.13.7, and no
+  patched GREEN, PR, exact-tip CI or review was claimed at that checkpoint.
+- The separate prerequisite #252 is now normally merged at `fc962a65`, after
+  exact-tip checks and hosted review 5628884972 (COMMENTED, no findings;
+  not human GitHub approval). Its authoritative merged-source CI run
+  39962553306 passes, with test-image digest
+  `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
+  Merge master ordinarily into this preserved four-commit Hono branch before
+  retrying its protected bootstrap. This old-dependency image is not Hono proof.
+- The ordinary master merge `62bf4d1e` preserves all four Hono commits.
+  Its normal bootstrap push passes all 25 Fast gates in 783.4 seconds:
+  6,210 unit tests / 213 suites and 2,514 HTTP tests / 118 passing suites,
+  with 42 existing backend skips. Those checks still used old dependencies.
+- CI regeneration run `39965730441`, source `62bf4d1e`, produces artifact
+  `12506119257`, ZIP SHA-256
+  `f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58`.
+  The entire artifact was authenticated and compared: only Hono changes
+  (4.13.7 -> 4.13.11), plus the intended API/web 0.55.59 version metadata.
+  Every package retains public-registry URLs and sha512. The sole changed
+  package was 24.3217 days old at CI verification; no unrelated churn.
+- Approved-registry `npm ci` installs the patch without rewriting the API
+  lockfile. Permanent pin-checker tests now assert the actual committed
+  Hono occurrences and advisory boundary: 19 -> 21 cases. Before applying
+  the artifact, the real lock guard fails on 4.13.7; after restoration, all
+  21 pin tests plus all 21 inherited freshness tests pass (42 total).
+  Whole-unit expectation is 6,210 -> 6,212; final owning-hook/CI results
+  must be read from their receipts, not inferred from this focused pass.
+- Fresh API audit: zero vulnerabilities. Unchanged web dependency graph:
+  three Moderate affected Vitest packages, zero High/Critical; audit exit 1
+  is retained, not relabeled clean. Separate triage is recorded in the policy.
+- Existing performance admission failure, customer migration, operational
+  dispositions, cleanup verification and target-specific human visual
+  observation remain outstanding. No Hono merge, deployment or performance rerun.
+
 ### Test-only prerequisite: standalone non-UTC freshness probe
 
 - Backport only the two relevant test-file changes from reviewed
@@ -23,8 +78,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   fixture syntax PASS. Full protected-gate and exact-tip review evidence belong
   to the prerequisite PR, not the old isolated PASS.
 - No product/version/lockfile, application/UI, performance runner, quota or
-  admission change. The preserved Hono branch remains blocked until this
-  separate prerequisite is reviewed and normally merged.
+  admission change in #252. Its normal merge and merged-source checks are
+  recorded above; only that prerequisite is merged, not #251 or this Hono patch.
 
 ### 0.55.58 consolidation onto token-lifetime master
 
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
index d6eeb025..c6332959 100644
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 
diff --git a/README.md b/README.md
index 7a9e061b..1f0d98a0 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
@@ -15,7 +15,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.58-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.59-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()
diff --git a/Session_starter.md b/Session_starter.md
index 1e46626b..869c1128 100644
--- a/Session_starter.md
+++ b/Session_starter.md
@@ -2,6 +2,63 @@
 
 **Last verified:** 2026-10-23
 
+### Independent Hono remediation (2026-10-23)
+
+Branch `chore/regen-lockfile-hono-security-20261023` starts from fresh
+`origin/master` e1070ba28825afee46c953e1e2d5d518863303f2, not PR #251.
+It now ordinarily incorporates prerequisite merge `fc962a65` / #252. Fresh
+master remains 0.55.58, so the reserved next patch 0.55.59 is still correct.
+Reserve 0.55.59 for exact Hono 4.13.11 (#248). The actual lock dependency
+regression was RED on 4.13.7. CI-only regeneration and a private restored
+installation now prove exact Hono 4.13.11; final publication/review remain
+required. The preserved qualification branch stays at f6f03a52.
+Frozen 0.55.58 image presence is not new-candidate qualification.
+No original deleted transcript was restored. No Hono merge or deployment.
+The unchanged 39875689201 A/A p99 failure (ratio 1.23928982, limit 1.10),
+customer migration receipt, operational dispositions, 403 cleanup verification
+and actual target-specific human visual observation remain holds.
+
+| Date | Summary |
+|---|---|
+| 2026-10-23 | Independent exact Hono remediation started from master; dependency RED confirmed; runtime-presence lesson retained. |
+| 2026-10-23 | Normally merge prerequisite #252 and verify its authoritative merged-source CI/artifact, then preserve both contexts in the ordinary Hono/master merge. |
+| 2026-10-23 | Protected bootstrap 25/25 PASS; authenticate minimal CI artifact 12506119257/run 39965730441 and prove actual installed+locked Hono 4.13.11 with 42 focused tests. |
+
+- [x] ✅ COMPLETED: Verify handoff receipts, fresh base and actual locked RED.
+- [x] ✅ COMPLETED: Normally merge reviewed prerequisite #252, verify merged
+  source CI and ordinarily incorporate master without rewriting Hono history.
+- [x] ✅ COMPLETED: Publish bootstrap through ordinary hooks, 25/25 PASS
+  (783.4 seconds); CI-only regeneration at exact source `62bf4d1e`.
+- [x] ✅ COMPLETED: Verify downloaded ZIP, all lock entries/ages and minimal
+  diff, apply only intended locks, restore via approved-registry `npm ci`
+  without lock rewrites, prove actual installed/locked Hono 4.13.11.
+- [x] ✅ COMPLETED: Permanent actual-lock guard RED then GREEN; pin checker
+  19 -> 21 cases, plus 21 inherited freshness cases, 42/42 PASS.
+- [ ] Final patched-tree protected push, exact-tip CI and hosted Hono review.
+
+**Historical publication blockers:** three ordinary Fast pushes published
+nothing. The first caught a stale README version badge (fixed). The second
+passed 24 gates but failed one unchanged HTTP test with `ENOBUFS`; its focused
+rerun passed 57/57. The third passed 23 static gates but failed the unchanged
+`endpoint-cache-freshness.spec.ts` non-UTC nested Node/Jest probe at 30,119ms,
+`ETIMEDOUT` (6,209 passed, one failed). That baseline tooling issue was
+isolated in prerequisite #252, not imported as unrelated #251 tooling.
+No hook bypass, timeout
+change or favorable retry is claimed as the historical GREEN. The separate
+prerequisite and ordinary merge now unblock publication, as recorded above.
+Retained local evidence: `test-results/hono-security-20261023/`.
+
+**Current dependency receipts:** artifact run `39965730441` / ID `12506119257`,
+ZIP SHA-256 `f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58`.
+Only Hono changes; web package entries are unchanged, with version metadata
+only. API lock SHA-256 `ee7c44126acd1ef5949320f5c181c5e1291794cb41920f6c1324ab3689f7b4fc`.
+Fresh API audit is zero; web audit exits 1 with three unchanged Moderate
+Vitest packages (zero High/Critical), tracked separately in the policy.
+This is private dependency proof, not deployment or new performance admission.
+
+**Design disposition: accepted.** An exact transitive patch uses existing
+override/provenance seams; adding an application abstraction is speculative.
+
 ### Separate timezone-harness prerequisite (2026-10-23)
 
 Branch `test/timezone-leaf-prerequisite-20261023` starts from verified master
@@ -18,7 +75,13 @@ No product bump (still 0.55.58), Hono, lockfile or performance-tooling change.
 
 - [x] ✅ COMPLETED: Confirm actual full-hook spawn-timeout RED and focused
   real-leaf outcome/launcher controls, without relaxing deadlines.
-- [ ] Publish via ordinary hook, exact-tip CI and hosted review; do not merge.
+- [x] ✅ COMPLETED: Ordinary protected push passes all 25 gates; exact-tip
+  CI and hosted review 5628884972 report no findings at `5a42eb09`.
+- [x] ✅ COMPLETED: Operator-authorized normal merge #252 at `fc962a65`;
+  authoritative merged-source Build Test Image 39962553306 and CodeQL
+  39962437032 PASS. The bot review is COMMENTED, not human GitHub approval.
+  Immutable test image:
+  `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
 
 Preserve Hono branch `chore/regen-lockfile-hono-security-20261023` at
 `e18d32c04855e8acf88c8a3e02c9ec7b447cfb21` and qualification branch at
diff --git a/api/package-lock.json b/api/package-lock.json
index b2663eae..b12b1c68 100644
--- a/api/package-lock.json
+++ b/api/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.58",
+  "version": "0.55.59",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "scimserver-api",
-      "version": "0.55.58",
+      "version": "0.55.59",
       "license": "MIT",
       "dependencies": {
         "@nestjs/common": "^11.1.27",
@@ -5169,9 +5169,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
-      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
+      "version": "4.13.11",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.11.tgz",
+      "integrity": "sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
diff --git a/api/package.json b/api/package.json
index e8874977..cccf58ca 100644
--- a/api/package.json
+++ b/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.58",
+  "version": "0.55.59",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",
@@ -85,7 +85,7 @@
     "defu": "6.1.5",
     "effect": "3.20.0",
     "fast-uri": "4.1.5",
-    "hono": "4.13.7",
+    "hono": "4.13.11",
     "multer": "2.4.0",
     "deepmerge-ts": "8.0.0",
     "mysql2": "3.23.1",
diff --git a/api/src/scripts/check-dependency-pins.spec.ts b/api/src/scripts/check-dependency-pins.spec.ts
index cae878dc..4cf0a155 100644
--- a/api/src/scripts/check-dependency-pins.spec.ts
+++ b/api/src/scripts/check-dependency-pins.spec.ts
@@ -29,6 +29,53 @@ import {
   type PackageAdvisory,
 } from './check-dependency-pins';
 import fs from 'fs/promises';
+import { resolve } from 'node:path';
+
+describe('Hono security remediation (GHSA-5r4p-p66f-jhc7)', () => {
+  const vulnerableRange = '>= 4.12.4, < 4.13.11';
+
+  it('recognizes the affected range and recommends the minimal exact patch', () => {
+    expect(satisfiesGhsaRange('4.12.3', vulnerableRange)).toBe(false);
+    expect(satisfiesGhsaRange('4.13.7', vulnerableRange)).toBe(true);
+    expect(satisfiesGhsaRange('4.13.11', vulnerableRange)).toBe(false);
+    const findings = evaluatePins(
+      { hono: '4.13.7' },
+      [{
+        packageName: 'hono',
+        ghsaId: 'GHSA-5r4p-p66f-jhc7',
+        cveId: 'CVE-2026-111757',
+        severity: 'medium',
+        summary: 'serveStatic double decoding can bypass protected static-prefix middleware',
+        vulnerableRanges: [vulnerableRange],
+        firstPatchedVersions: ['4.13.11'],
+      }],
+    );
+    expect(findings).toHaveLength(1);
+    expect(findings[0].recommendedVersion).toBe('4.13.11');
+  });
+
+  it('locks every actual Hono occurrence to the exact patched override with public provenance', async () => {
+    const manifest = JSON.parse(
+      await fs.readFile(resolve(__dirname, '../../package.json'), 'utf8'),
+    ) as { overrides: { hono: string } };
+    const lock = JSON.parse(
+      await fs.readFile(resolve(__dirname, '../../package-lock.json'), 'utf8'),
+    ) as {
+      packages: Record<string, { version: string; resolved?: string; integrity?: string }>;
+    };
+    const entries = Object.entries(lock.packages).filter(([name]) =>
+      /(?:^|\/)node_modules\/hono$/.test(name),
+    );
+    expect(manifest.overrides.hono).toBe('4.13.11');
+    expect(entries.length).toBeGreaterThan(0);
+    for (const [, entry] of entries) {
+      expect(entry.version).toBe(manifest.overrides.hono);
+      expect(satisfiesGhsaRange(entry.version, vulnerableRange)).toBe(false);
+      expect(entry.resolved).toMatch(/^https:\/\/registry\.npmjs\.org\/hono\/-\//);
+      expect(entry.integrity).toMatch(/^sha512-[A-Za-z0-9+/]+=*$/);
+    }
+  });
+});
 
 describe('compareVersions', () => {
   it('orders by numeric segment, not lexically', () => {
diff --git a/docs/AUTHENTICATION_GUIDE.md b/docs/AUTHENTICATION_GUIDE.md
index 3725d2b1..09021dee 100644
--- a/docs/AUTHENTICATION_GUIDE.md
+++ b/docs/AUTHENTICATION_GUIDE.md
@@ -1,6 +1,6 @@
 # Authentication Guide
 
-> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 >
 > **The captured protocol examples below were measured against a running server.** Request and response bodies are verbatim wire captures. Status codes and `reason_code` values are what the server actually returned. The reason-code table in [Section 8](#8-troubleshooting) is generated from [auth-reason-catalog.ts](../api/src/oauth/auth-reason-catalog.ts), so it cannot drift from the implementation.
 >
diff --git a/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md b/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
index e4c899d3..b422face 100644
--- a/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
+++ b/docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md
@@ -1,8 +1,8 @@
 # Azure Deployment & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** June 3, 2026
+> **Version:** 0.55.59 - **Updated:** June 3, 2026
 > **Source of truth:** [deploy.ps1](../deploy.ps1), [scripts/deploy-azure.ps1](../scripts/deploy-azure.ps1), [infra/](../infra/)
 
 ---
diff --git a/docs/COMPLETE_API_REFERENCE.md b/docs/COMPLETE_API_REFERENCE.md
index 1c671f5e..d919e11a 100644
--- a/docs/COMPLETE_API_REFERENCE.md
+++ b/docs/COMPLETE_API_REFERENCE.md
@@ -1,8 +1,8 @@
 # Complete API Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** 2026-10-16
+> **Version:** 0.55.59 - **Updated:** 2026-10-16
 > **Current release:** [Release notes, upgrade steps and validation limits](RELEASE_NOTES.md). Earlier isolated P1-P9 receipts remain historical; the correctness consolidation is included in the deployed release.
 > **Base URL:** `http://localhost:{PORT}/scim` (configurable via `API_PREFIX` env var)
 > **121 route handlers** across 33 controllers (includes 2 dashboard analytics routes and the web SPA catch-all). Counted from the `@Get`/`@Post`/`@Put`/`@Patch`/`@Delete`/`@Sse` decorators in `api/src/**/*.controller.ts` with comments stripped; the count is enforced by `node scripts/audit-doc-content.mjs`.
diff --git a/docs/CONTEXT_INSTRUCTIONS.md b/docs/CONTEXT_INSTRUCTIONS.md
index 85f9713b..b448e447 100644
--- a/docs/CONTEXT_INSTRUCTIONS.md
+++ b/docs/CONTEXT_INSTRUCTIONS.md
@@ -1,22 +1,50 @@
 # SCIMServer - Context Instructions for AI Assistants
 
 > **Purpose**: This file provides complete project context for AI coding assistants (GitHub Copilot, etc.) to enable productive sessions without re-discovery of architecture, patterns, and decisions.
-> **Version**: 0.55.58
+> **Version**: 0.55.59
 > **Last Updated**: October 21, 2026
-> **Last verified:** 2026-10-22
+> **Last verified:** 2026-10-23
 
 ---
 
 ## Active Delivery Process
 
+**2026-10-23 dependency remediation:** 0.55.59 reserves an independent exact
+Hono 4.13.11 patch for #248, based on master e1070ba2. CI-only lockfiles,
+final protected publication and hosted review remain required.
+Historical bootstrap publication was blocked: three ordinary Fast attempts published
+nothing. The final attempt fails the unchanged non-UTC nested Node/Jest
+timestamp probe at its existing 30-second limit (ETIMEDOUT, 6,209 units pass).
+Prerequisite #252 is now normally merged at `fc962a65`, with authoritative
+merged-source CI 39962553306 and CodeQL 39962437032 PASS. Its immutable
+test-image digest is `sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
+This is not patched-Hono proof. Ordinarily merge master into the preserved
+Hono branch; do not import other #251 tooling or bypass hooks. Ordinary merge
+`62bf4d1e` preserves all four Hono commits. Its protected bootstrap passes
+25/25 gates (6,210 units; 2,514 HTTP passes plus 42 backend skips), but those
+old-installation checks are not patched proof.
+CI-only regeneration 39965730441 / artifact 12506119257 is authenticated:
+only Hono 4.13.7 -> 4.13.11 plus 0.55.59 API/web metadata changes, public URLs,
+sha512 and a 24.3217-day publication age. Approved-registry `npm ci` preserves
+the lockfile and actual installed routes now contain 4.13.11.
+The permanent actual-lock guard was RED on 4.13.7 and is now GREEN; 21 pin
+and 21 inherited freshness cases pass. Final full patched gates/PR review
+are separate receipts. API audit is zero; unchanged web Vitest packages
+have three Moderate audit findings (zero High/Critical), not a clean audit.
+Frozen 0.55.58 runtime-presence evidence is not new-candidate proof.
+Do not absorb #251 tooling, rerun performance or alter its failed admission,
+customer migration, operational, cleanup or human visual verification holds.
+
 **2026-10-23 test-harness prerequisite:** a separate master-based branch ports
 only the real-leaf timezone tests from reviewed `84d11af7`, with runtime
 entrypoint/loader receipt checks. Original 30-second child/35-second parent
 limits remain. All 21 focused cases pass; former nested launcher and actual
 UTC-conversion negative controls fail as expected, with production restored.
 No product bump, Hono/lockfile change or performance-tooling import.
-The Hono branch stays preserved at e18d32c0 until this prerequisite is reviewed
-and normally merged. No merge, deployment or new performance admission.
+The Hono branch's four original commits through e18d32c0 stay preserved.
+Hosted review 5628884972 recommends approval with no findings but remains
+COMMENTED, not human GitHub approval. Only #252 is normally merged; no Hono
+merge, deployment or new performance admission is authorized.
 
 **2026-10-22 review follow-up:** hosted Copilot review succeeds after billing
 selection and identifies a real shared-cache binding collision. The generic
diff --git a/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md b/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
index 79aa2a57..bda2f633 100644
--- a/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
+++ b/docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md
@@ -9,7 +9,7 @@ or fetching them. See [minimal-schema validation](GOOGLE_MINIMAL_GROUP_MEMBERSHI
 [reference persistence and compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 > **P7a behavior, included since 0.55.36:** [Profile validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > adds declaration/type/cardinality checks, required extension enforcement,
diff --git a/docs/DOCKER_GUIDE_AND_TEST_REPORT.md b/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
index f1d00f3c..473364d6 100644
--- a/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
+++ b/docs/DOCKER_GUIDE_AND_TEST_REPORT.md
@@ -1,8 +1,8 @@
 # Docker Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** June 3, 2026
+> **Version:** 0.55.59 - **Updated:** June 3, 2026
 > **Source of truth:** [Dockerfile](../Dockerfile), [docker-compose.yml](../docker-compose.yml)
 
 ---
diff --git a/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md b/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
index 4b391a31..89f7940f 100644
--- a/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
+++ b/docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md
@@ -1,8 +1,8 @@
 # Endpoint Configuration Flags Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** September 29, 2026
+> **Version:** 0.55.59 - **Updated:** September 29, 2026
 > **Source of truth:** [endpoint-profile.types.ts](../api/src/modules/scim/endpoint-profile/endpoint-profile.types.ts) (`ProfileSettings`)
 > 39 registered settings in the unreleased lifetime port: 20 boolean + 16 numeric (11 runtime-egress overrides + 3 active-credential caps + 2 token lifetimes) + 3 other typed values. `PersistRequestSecrets` is inert and `CredentialSecretVisibility` supports only `always`. See the [behavioral evidence and explicit coverage gaps](SCIM_SETTINGS_BEHAVIOR_EVIDENCE.md) and [Entra compatibility guide](SCIM_ENTRA_COMPATIBILITY.md). Registry membership is not evidence of enforcement.
 > 6 value types: `boolean`, `logLevel`, `primaryEnforcement`, `credentialVisibility`, `structured`, and `number` (the last added for the runtime JWKS-fetch egress knobs).
diff --git a/docs/ENDPOINT_CREATION_WIKI.md b/docs/ENDPOINT_CREATION_WIKI.md
index 085fd881..b5d16953 100644
--- a/docs/ENDPOINT_CREATION_WIKI.md
+++ b/docs/ENDPOINT_CREATION_WIKI.md
@@ -1,8 +1,8 @@
 # Create Your Own SCIM Endpoint - Self-Service Wiki
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** 2026-10-16
+> **Version:** 0.55.59 - **Updated:** 2026-10-16
 > Beginner-friendly, copy-paste guide for standing up a SCIM endpoint in minutes.
 > **Source of truth:** [endpoint.controller.ts](../api/src/modules/endpoint/controllers/endpoint.controller.ts) - [built-in-presets.ts](../api/src/modules/scim/endpoint-profile/built-in-presets.ts)
 
diff --git a/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md b/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
index 4f4656d4..7047ffd9 100644
--- a/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
+++ b/docs/ENDPOINT_LIFECYCLE_AND_USAGE.md
@@ -1,8 +1,8 @@
 # Endpoint Lifecycle & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** June 3, 2026
+> **Version:** 0.55.59 - **Updated:** June 3, 2026
 > Quick-start recipes for common SCIMServer operations
 
 ---
diff --git a/docs/ENDPOINT_PROFILE_ARCHITECTURE.md b/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
index 0f1f6c43..577f7e71 100644
--- a/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
+++ b/docs/ENDPOINT_PROFILE_ARCHITECTURE.md
@@ -1,6 +1,6 @@
 # Endpoint Profile Architecture
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 
 > **Updated:** 2026-10-17
 > **Source of truth:** [endpoint-profile/](../api/src/modules/scim/endpoint-profile/) and [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
diff --git a/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md b/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
index 1184e4fd..0d3013a2 100644
--- a/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
+++ b/docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md
@@ -1,6 +1,6 @@
 # Global navigation and workflow context
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 See [current release notes](RELEASE_NOTES.md) for deployment and acceptance
 boundaries. Endpoints now uses available window height, Dashboard uses compact
diff --git a/docs/INDEX.md b/docs/INDEX.md
index 4ac3eed4..222f3a49 100644
--- a/docs/INDEX.md
+++ b/docs/INDEX.md
@@ -1,8 +1,8 @@
 # SCIMServer Documentation Index
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** 2026-10-21
+> **Version:** 0.55.59 - **Updated:** 2026-10-21
 > 6 presets - **39 endpoint settings controls** in the unreleased lifetime port (20 boolean flags + 3 other typed settings + 16 numerics) - profile-driven User, Group, and custom ResourceType forms
 
 **Unreleased preparation:** [endpoint token lifetime integration and original
diff --git a/docs/LOGGING_AND_OBSERVABILITY.md b/docs/LOGGING_AND_OBSERVABILITY.md
index ca9043ec..2216b709 100644
--- a/docs/LOGGING_AND_OBSERVABILITY.md
+++ b/docs/LOGGING_AND_OBSERVABILITY.md
@@ -1,6 +1,6 @@
 # Logging & Observability Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 **Current UI presentation:** absolute timestamps in Logs, Activity, Operations
 and live/detail drawers include full UTC date/time and milliseconds. Copy
diff --git a/docs/MULTI_ENDPOINT_GUIDE.md b/docs/MULTI_ENDPOINT_GUIDE.md
index edfb37c4..b37b6974 100644
--- a/docs/MULTI_ENDPOINT_GUIDE.md
+++ b/docs/MULTI_ENDPOINT_GUIDE.md
@@ -1,8 +1,8 @@
 # Multi-Endpoint Architecture Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** June 3, 2026
+> **Version:** 0.55.59 - **Updated:** June 3, 2026
 > **Source of truth:** [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
 
 ---
diff --git a/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md b/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
index 6ccf7908..f69d04d5 100644
--- a/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
+++ b/docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md
@@ -1,6 +1,6 @@
 # Observability, Traceability, Correlation IDs, Logging, Error Handling and Diagnostics
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 **Current operator presentation:** all absolute UI timestamps carry complete
 UTC date/time, milliseconds and timezone; invalid expiry values are explicit,
diff --git a/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md b/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
index facd9dc8..cb11dfdf 100644
--- a/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
+++ b/docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md
@@ -11,7 +11,7 @@ rejected later operation saves no earlier mutation. See
 [reference persistence and rollback compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [current release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 > Comprehensive, source-verified reference for every PATCH option, mode, setting, path form, verb, and persistence outcome across Users, Groups, custom extensions, and custom resource types - grounded in RFC 7644 / RFC 7643 and the SCIMServer implementation.
 
diff --git a/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md b/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
index bd342954..3114475a 100644
--- a/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
+++ b/docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md
@@ -1,8 +1,8 @@
 # Prod -> Dev mirroring + synthetic shape-coverage fixtures
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58  -  **Date:** May 6, 2026
+> **Version:** 0.55.59  -  **Date:** May 6, 2026
 > **Scope:** dev-tooling, no API surface change
 > **Affects:** [api/src/scripts/mirror-prod-to-dev.ts](../api/src/scripts/mirror-prod-to-dev.ts), [api/src/scripts/seed-shape-coverage.ts](../api/src/scripts/seed-shape-coverage.ts), [scripts/mirror-prod-to-dev.ps1](../scripts/mirror-prod-to-dev.ps1)
 
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 8ed15975..80ed3a8a 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -1,6 +1,6 @@
 # SCIMServer release notes
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.59`
 
 These curated notes explain what changes for operators and integrators, how to
 upgrade, and what remains limited. The [engineering changelog](../CHANGELOG.md)
@@ -15,6 +15,40 @@ notes rather than assuming that a patch label makes every rollback lossless.
 
 ## Unreleased
 
+### 0.55.59 Hono security dependency patch
+
+This pending patch pins transitive Hono to exactly 4.13.11 for
+[GHSA-5r4p-p66f-jhc7](https://github.com/advisories/GHSA-5r4p-p66f-jhc7)
+([issue #248](https://github.com/pranems/SCIMServer/issues/248)).
+The Medium advisory affects Hono >=4.12.4 and <4.13.11: `serveStatic` can
+decode a routed path again and bypass middleware protecting a static prefix.
+It is not traversal outside the configured root.
+
+The existing frozen 0.55.58 image demonstrably includes Hono 4.13.7 through
+Prisma tooling, despite `devOptional` lockfile classification. No direct
+application import was found, but that does not prove unreachability.
+The eligible patch uses the existing CI-only lockfile process; bootstrap
+checks against the old installation are not patch validation.
+There is no application/UI change, deployment, new image qualification or
+performance admission claim. Existing release holds remain unchanged.
+The historical non-UTC nested-Jest timeout was corrected in separate,
+normally merged prerequisite #252 without changing either deadline. The
+Hono branch preserves all four original commits and merges master normally.
+Its protected bootstrap passes, then exact-source CI regeneration
+`39965730441` produces only the Hono patch and coordinated version metadata,
+with public-registry URLs, sha512 and a verified publication age over 24 days.
+The actual restored private dependency tree and lockfile both contain 4.13.11;
+42 focused pin/freshness tests pass. This is not a deployed release or new
+performance qualification. Final protected publication, exact-tip CI and
+hosted Hono review remain separate checks.
+
+Fresh API dependency audit reports zero vulnerabilities. The unchanged web
+dependency graph reports three Moderate affected Vitest packages, zero
+High/Critical, from GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp. This patch
+does not silently upgrade that unrelated toolchain or claim its audit is
+clean; separate triage is tracked in the
+[supply-chain policy](strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md).
+
 ### 0.55.58 correction, validated privately and awaiting reviewed merge
 
 The pending correction preserves the merged 0.55.57 endpoint token-lifetime
diff --git a/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md b/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
index ff4278e4..4a76c1bf 100644
--- a/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
+++ b/docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md
@@ -1,6 +1,6 @@
 # Remote Debugging & Diagnosis Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.59`
 
 > **Version:** 3.2 - **Source-verified against:** v0.55.36 - **Updated:** 2026-10-01
 > Request-history identity and authenticated stream transport re-verified against v0.55.36 on 2026-10-01; the full line-by-line pass dates from v0.53.0.
diff --git a/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md b/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
index dba8a55f..525216c2 100644
--- a/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
+++ b/docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md
@@ -1,6 +1,6 @@
 # Schema Attribute Customization Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.59`
 
 > **Version**: 1.1 - **Date**: 2026-08-04 - **Status**: Complete (PATCH merge semantics re-verified against `mergeProfilePartial()` on 2026-08-04; the full line-by-line source pass dates from v0.40.0)  
 > **Audience**: Operators, ISV admins, Entra ID integration engineers  
diff --git a/docs/SCHEMA_CUSTOMIZATION_GUIDE.md b/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
index 7ca96cb0..1d33e72b 100644
--- a/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
+++ b/docs/SCHEMA_CUSTOMIZATION_GUIDE.md
@@ -10,7 +10,7 @@ effective mutability and response projection. See
 [reference persistence and migration compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
 > **P7a correctness, included since 0.55.36:** [Declaration and POST/PUT validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > documents the source changes below, with owned PostgreSQL/InMemory evidence.
diff --git a/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md b/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
index aa78b018..484ecd8c 100644
--- a/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
+++ b/docs/SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md
@@ -1,8 +1,8 @@
 # SCIMServer - Sovereign & Government Cloud Deployment Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.59`
 
-> **Version:** 0.55.58 - **Updated:** April 28, 2026
+> **Version:** 0.55.59 - **Updated:** April 28, 2026
 > Covers: Azure Government (US), Azure China (21Vianet), Azure BLEU (France), Azure Germany, and custom sovereign environments
 
 ---
diff --git a/docs/UI_GUIDE.md b/docs/UI_GUIDE.md
index f34da522..a459a5f0 100644
--- a/docs/UI_GUIDE.md
+++ b/docs/UI_GUIDE.md
@@ -1,8 +1,8 @@
 # SCIMServer Web Admin UI Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.58`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.59`
 
-> **Status:** Active | **Last Updated:** 2026-10-16 | **Version:** 0.55.58
+> **Status:** Active | **Last Updated:** 2026-10-16 | **Version:** 0.55.59
 > Single-page React + Fluent UI v9 admin console. Nine pages, one shared app shell, live SSE log stream.
 > **Endpoint/profile/authentication flows:** [PORTABLE_ENDPOINT_PROFILE_AUTHENTICATION_AND_DISCOVERY_DESIGN.md](PORTABLE_ENDPOINT_PROFILE_AUTHENTICATION_AND_DISCOVERY_DESIGN.md) distinguishes the current Create, Discovery, Connect, endpoint Settings, and global Settings surfaces from the target profile-import workflow.
 > **Screenshot provenance:** every image below was re-captured on **2026-07-31** from the live **dev** estate (then `scimserver-dev.proudbush-ae90986e.eastus.azurecontainerapps.io`) running **v0.55.6 / Node v24.18.1**, at a pinned 1440x900 viewport, using:
diff --git a/docs/strategy/ENGINEERING_LESSONS_AND_PATTERNS.md b/docs/strategy/ENGINEERING_LESSONS_AND_PATTERNS.md
index 578c0c18..4266a184 100644
--- a/docs/strategy/ENGINEERING_LESSONS_AND_PATTERNS.md
+++ b/docs/strategy/ENGINEERING_LESSONS_AND_PATTERNS.md
@@ -16,6 +16,19 @@
 
 ## 1. The self-improvement loop (how this doc is fed and used)
 
+### Dependency classification is not deployed package inventory
+
+The #248 Hono remediation found an affected `devOptional` transitive package
+inside the exact frozen 0.55.58 runtime image, alongside Prisma tooling.
+Lockfile development/optional flags and an absent direct source import do
+not prove production absence or unreachability. Inspect the actual immutable
+artifact with a metadata-only, offline, read-only entrypoint; never start the
+application or connect a database just to inventory packages.
+Keep the resulting claim narrow: package presence is not exploitability,
+and an old digest's receipt does not qualify a new candidate. Pair a minimal
+exact override with a regression over every actual locked occurrence, then
+check the restored installation after CI-only regeneration.
+
 ### A real-timezone regression should launch one real leaf, not another suite
 
 A real child process is necessary to test Node's non-UTC date interpretation;
diff --git a/docs/strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md b/docs/strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md
index e8029649..bc64d74d 100644
--- a/docs/strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md
+++ b/docs/strategy/NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md
@@ -9,6 +9,137 @@
 
 ## 0. Provenance, and the limits of this document
 
+### 2026-10-23 Hono exact-patch remediation (#248)
+
+Hono 4.13.11 fixes the Medium GHSA-5r4p-p66f-jhc7 / CVE-2026-111757.
+Approved-proxy metadata records publication 2026-09-29T06:15:49Z and
+seven-day eligibility 2026-10-06T06:15:49Z. The client setting
+`min-release-age=undefined` does not establish absence of proxy quarantine.
+No registry/control change, waiver or local lockfile generation is authorized.
+Use the existing public-registry regeneration workflow, inspect its exact
+source tip and every changed entry, then restore with `npm ci` without
+rewriting lockfiles. Reject unrelated dependency churn.
+
+The frozen 0.55.58 image at digest
+`sha256:f57b765aab497d2cf2861a3d8a3b6906df8abe075320a454c0ad7e193fbecb82`
+contains Hono 4.13.7, @hono/node-server 1.19.15, @prisma/dev 0.24.3 and
+Prisma 7.8.0. Offline read-only package metadata inspection started no API
+or database. `devOptional` and absence of direct imports are not absence
+proof. This receipt belongs only to that frozen image, not a new candidate.
+
+The actual locked dependency assertion fails on 4.13.7 before the change.
+Bootstrap publication validates the old installation only; final dependency
+GREEN requires the CI artifact and a fresh installation. Product 0.55.59
+is reserved for this patch without absorbing #251 or altering its holds.
+**Self-improvement: applied.** Verify actual runtime contents rather than
+inferring them from dependency flags. **Design disposition: accepted.**
+The existing exact override and regeneration route need no new abstraction.
+
+**Execution issue (Low, release-document coupling):** the first protected
+bootstrap push stopped at doc-content C13: the header freshness fixer updated
+the product header but not README's shields.io version badge (0.55.58 versus
+0.55.59). No branch was published. Updating the badge removes the actual
+mismatch. The independent doc-content gate caught it at the earliest static
+stage; run that existing gate after the freshness fixer on future bumps.
+No new abstraction or relaxed gate is needed.
+
+**Execution issue (Medium, shared-host environment):** the next normal Fast
+push passed 24 gates but its unchanged InMemory HTTP suite hit
+`connect ENOBUFS 127.0.0.1` in profile-combinations' custom SPC discovery test.
+The result was 2,513 passed, one failed and 42 genuine backend skips.
+No patched dependencies had been installed. A serialized focused rerun of
+that unchanged file passed all 57 tests; a read-only socket snapshot showed
+813 TIME_WAIT connections. This supports transient host socket pressure,
+not a demonstrated application defect. No other process was stopped and
+no host network setting, assertion, exclusion or timeout was changed.
+The original failure remains retained; a fresh ordinary hook is required
+before publication. The transport-level failure was detected by the first
+applicable HTTP gate; the focused rerun is not a substitute for that gate.
+
+**Historical blocker (Medium, baseline test harness):** the third ordinary Fast
+push passes all 23 static gates, then fails
+`endpoint-cache-freshness.spec.ts`'s real non-UTC child probe:
+`spawnSync node.exe ETIMEDOUT`, 30,119ms, null status, SIGTERM. Units report
+6,209 passed and one failed across 213 suites; no HTTP gate runs after that
+failure. This is the unchanged nested Node/Jest harness on master, not an
+installed Hono change. The earlier attempt passed all 6,210 units, so that
+pass is retained but is not substituted for the current failure.
+The failure is detected by the first unit gate; importing #251 tooling,
+increasing a timeout, bypassing a hook or retrying until a favorable pass
+would have crossed the then-authorized remediation scope. Execution stopped
+with that blocker. At that checkpoint no branch or regeneration workflow was
+published, both tracked lockfiles were unchanged, and no patched dependency
+GREEN or reviewed Hono PR existed.
+
+**Authorized prerequisite resolution:** #252 isolates the two relevant test
+files from reviewed `84d11af7`; no other #251 tooling or checkpoint053
+Linux/finalization changes enter the dependency branch. Normal merge
+`fc962a65e03b2a0cb1ad86b96b88c473d6d07b7d` follows exact-tip checks and
+hosted review 5628884972, which is COMMENTED with approval recommended and
+no findings, not human GitHub approval. Authoritative merged-source
+Build Test Image 39962553306 and CodeQL 39962437032 pass. Its immutable
+test-image digest is
+`sha256:93ab5bd73465bdd215eeb2e3471022188d854d97a730d50b752c17e00eb238b0`.
+The 30-second child and 35-second parent deadlines are unchanged. Actual
+former-launcher and UTC-conversion negative controls discriminate the fix.
+This is the earliest unit-level correction of the harness escape, not a
+favorable retry or relaxation of the retained failed full-hook receipt.
+
+The ordinary Hono/master merge `62bf4d1e` preserves all four original Hono
+commits. Four documentation-prepend conflicts were resolved by preserving
+both contexts, not taking either side wholesale. The subsequent normal Fast
+bootstrap passes 25/25 gates in 783.4 seconds, including 6,210 units and 2,514
+HTTP tests with 42 existing backend skips. This still uses old dependencies.
+
+**Verified CI artifact and private dependency GREEN:**
+
+| Claim | Observed evidence |
+|---|---|
+| Exact source and existing route | Regenerate lockfile run `39965730441`, push source `62bf4d1e13781653e3619215240ddd1865a1166c`, unchanged workflow, API+web selection |
+| Authenticated artifact | ID `12506119257`, ZIP SHA-256 `f2e318928b7aa6e672983ba1acb492bcbd8a73066db5a50355b06e9521b6bf58`; downloaded bytes match GitHub's digest |
+| Entire lockfile comparison | Hono 4.13.7 -> 4.13.11 is the only changed package. Both workspaces change only intended 0.55.58 -> 0.55.59 version metadata otherwise. No root artifact or unrelated web package churn is imported. |
+| Provenance and age | All 684 API and 395 web package entries retain public URLs and sha512. The only age-report row is Hono, published 2026-09-29T06:15:49.676Z, age 24.321723 days at 2026-10-23T13:59:06.549Z. |
+| Independent metadata | Approved-proxy Hono dist integrity matches the CI-generated sha512. Its proxy tarball URL is not copied into either lockfile; no registry setting is changed. |
+| API lockfile | SHA-256 `ee7c44126acd1ef5949320f5c181c5e1291794cb41920f6c1324ab3689f7b4fc`, byte-identical before and after approved-registry `npm ci --no-audit --no-fund` |
+| Web lockfile | SHA-256 `047012e291c72a6c5d7f4a8dc6a5c2e1185152c131ad14e3cd9e96f5928e0d9e`; package graph unchanged, version metadata only, so no unnecessary local web restore |
+| Actual installed routes | `prisma@7.8.0 -> @prisma/dev@0.24.3 -> hono@4.13.11`, also through `@hono/node-server@1.19.15`; `npm ls` exits 0 |
+| Permanent actual-lock RED/GREEN | Pin checker adds two cases (19 -> 21), including every actual locked Hono occurrence, exact override/provenance and advisory boundary. Real pre-artifact failure receives 4.13.7 versus expected 4.13.11; after restoration all 21 pin plus 21 inherited freshness cases pass (42 total). |
+| Audit | API `npm audit --json` exits 0 with zero vulnerabilities; unchanged web audit exits 1 with three Moderate affected packages, zero High/Critical, described below. |
+
+Full protected publication and exact-tip hosted CI/review are independent
+remaining claims at this authoring checkpoint. Whole-unit expectation is
+6,210 -> 6,212; focused GREEN does not certify that total. No old or new image
+inventory is relabeled as deployed patched-Hono proof, and no performance
+admission is retried.
+
+**Separate web triage (Medium, existing dependency advisory):** the fresh web
+audit reports `@vitest/mocker`, `vitest` and `@vitest/coverage-v8` as Moderate
+affected packages through
+[GHSA-qxg6-89mg-rqv8](https://github.com/advisories/GHSA-qxg6-89mg-rqv8) and
+[GHSA-xp26-3454-mjgp](https://github.com/advisories/GHSA-xp26-3454-mjgp).
+The entire web package map is unchanged from the exact bootstrap baseline,
+so these are not introduced by the Hono patch. The proposed 4.1.12 toolchain
+fix needs its own approved-proxy age check and bounded rollback unit; no
+eligibility or runtime-unreachability claim is inferred here.
+Owner: repository maintainer. Target: 2026-10-30 for separate eligibility and
+exposure triage. The audit detects them at the earliest dependency-check
+stage; there are zero High/Critical blockers and no waiver is applied.
+Retain the nonzero web audit exit rather than reporting all audits clean.
+
+**Evidence completeness:** the original three execution issues and this
+continuation's merge/artifact/install/audit outcomes were reconciled against
+the actual retained command logs in this fresh continuation, not a restored
+or reconstructed deleted transcript. Expected HTTP error-path log messages
+were not counted as test failures; only the Jest failing-test summaries and
+gate exits above are causal. **Design disposition: accepted.** The dependency
+patch remains cohesive; the directly coupled harness correction was separately
+reviewed and merged, not mixed with unrelated tooling. The two compact
+dependency tests use existing checker/lockfile seams and need no application
+abstraction. **Self-improvement: applied.** Preserve a
+blocked bootstrap as blocked; never infer patched-tree assurance from static
+success or a previous run's test pass. Keep the permanent actual-lock guard,
+the authenticated full-artifact comparison and actual installed-tree receipt.
+
 ### 2026-10-21 Vite security prerequisite
 
 The unchanged 0.55.56 web lockfile reports a High Vite advisory through the
diff --git a/web/package-lock.json b/web/package-lock.json
index 633cfd54..e1f19ae6 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "scimserver-web",
-  "version": "0.55.58",
+  "version": "0.55.59",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "scimserver-web",
-      "version": "0.55.58",
+      "version": "0.55.59",
       "dependencies": {
         "@fluentui/react-components": "^9.74.2",
         "@fluentui/react-icons": "^2.0.331",
diff --git a/web/package.json b/web/package.json
index 3ab61f4b..9fbc060c 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "scimserver-web",
   "private": true,
-  "version": "0.55.58",
+  "version": "0.55.59",
   "type": "module",
   "scripts": {
     "dev": "vite",