Fresh-audit tick on crate-workspace.md: shape, contracts, binaries, and gate tiers verify; the binding core dependency edge omitted toml (plots catalog, per plots.md) and blake3 (canonical save fingerprint), both landed with Defenses. The edge list and rationale now name both. Defense: the page declares its edge list binding; omitting sanctioned dependencies sends auditors hunting phantom contamination. The code is right; the page catches up.