diff --git a/Cargo.lock b/Cargo.lock
index 6d468378..f6fd2b48 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -104,7 +104,8 @@ dependencies = [
 [[package]]
 name = "agent-experimental"
 version = "0.1.3"
-source = "git+https://gitlab.com/anonymous-28282828282/agent-experimental.git?branch=master#afe3a70e02ef844a092385859ab8f5f3ab8a039e"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97aea8b8172e409c8bd5529db18741715338e0c8df9e409b9cb253c44b837fbd"
 dependencies = [
  "anyhow",
  "reqwest",
@@ -511,7 +512,8 @@ dependencies = [
 [[package]]
 name = "blitz-control-protocol"
 version = "0.1.0"
-source = "git+https://github.com/pathscale/tauri-runtime-blitz.git?branch=master#330cbb0963f93f5be85771cabad7fa73117535ab"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eca443ea23955ca693e482cb00f2051b47c6ca18aad324340aff8c6127eacff"
 dependencies = [
  "endpoint-libs",
  "serde",
@@ -6848,7 +6850,8 @@ dependencies = [
 [[package]]
 name = "tauri-runtime-blitz"
 version = "0.1.0"
-source = "git+https://github.com/pathscale/tauri-runtime-blitz.git?branch=master#330cbb0963f93f5be85771cabad7fa73117535ab"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9faa026183d612fbd9fd0a869ab91932a41226158b4786274ca216c60ab805ad"
 dependencies = [
  "blitz-control-protocol",
  "endpoint-libs",
@@ -9002,7 +9005,8 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 [[package]]
 name = "worktable"
 version = "1.0.0-beta.10"
-source = "git+https://github.com/pathscale/WorkTable.git?rev=7ab68d17c31e7dd3e56a364ffbb559dd0819b317#7ab68d17c31e7dd3e56a364ffbb559dd0819b317"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "424244aef8a2162ade170468ada2d4046379538bc42a21cbdf48f528a97f5e94"
 dependencies = [
  "WorkTablesIndex",
  "arctic-wt",
@@ -9033,7 +9037,8 @@ dependencies = [
 [[package]]
 name = "worktable_codegen"
 version = "1.0.0-beta.10"
-source = "git+https://github.com/pathscale/WorkTable.git?rev=7ab68d17c31e7dd3e56a364ffbb559dd0819b317#7ab68d17c31e7dd3e56a364ffbb559dd0819b317"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b741a448603e7a016bf8369b93883f58186554d25cbb70dbaa28b64047d5a5"
 dependencies = [
  "convert_case 0.6.0",
  "indexmap 2.14.0",
@@ -9380,8 +9385,3 @@ checksum = "27bc9d5b815bc103f142aa054f561d9187d191692ec7c2d1e2b4737f8dbd7296"
 dependencies = [
  "zune-core",
 ]
-
-[[patch.unused]]
-name = "usvg"
-version = "0.48.1"
-source = "git+https://github.com/DioxusLabs/resvg?branch=devin%2F1785858271-intrinsic-dimensions#0cca401b4b61f4d033952f903848deee6d5e79ca"
diff --git a/Cargo.toml b/Cargo.toml
index 15a0a961..55d05274 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -105,17 +105,11 @@ incremental = true
 # `blitz-inspector` stays in release builds regardless. It costs size, and it is
 # what made every diagnosis in this codebase's recent history possible.
 
-# `Tree::intrinsic_dimensions` lives on no released usvg and `blitz-dom` calls
-# it. Cargo honours `[patch]` only from the root workspace, so depending on the
-# renderer from here needs the same redirection it applies to itself.
-#
-# The patch is version 0.48.1, so it only covers a dependent asking for ^0.48.
-# One still on ^0.46 silently gets a *second* usvg rather than an error, which
-# surfaces much later as a type error naming two identically-spelled types.
-#
-# Here rather than in `.cargo/config.toml`, which is where it used to sit: it
-# shared a `[patch.crates-io]` table there with paths that existed on one
-# machine, and that coupling is why a file nobody could delete was also a file
-# nobody could safely commit. ps-blitz keeps the same patch in its own manifest.
-[patch.crates-io]
-usvg = { git = "https://github.com/DioxusLabs/resvg", branch = "devin/1785858271-intrinsic-dimensions" }
+# The `[patch.crates-io]` for `usvg` is gone. It redirected at a DioxusLabs
+# branch for `Tree::intrinsic_dimensions`, which lived on no released usvg at
+# the time. The published `ps-anyrender-svg` now depends on `ps-usvg` directly,
+# so nothing in the graph asks for plain `usvg` any more and cargo reported the
+# patch as "not used in the crate graph". A patch that matches nothing is not
+# inert: it is a git source in the manifest, which is what stops this workspace
+# from being publishable and what put a second usvg in the graph when a
+# dependent asked for a range it did not cover.
diff --git a/apps/blitz-preview/Cargo.toml b/apps/blitz-preview/Cargo.toml
index 8a72a2b8..b3162289 100644
--- a/apps/blitz-preview/Cargo.toml
+++ b/apps/blitz-preview/Cargo.toml
@@ -16,7 +16,7 @@ blitz-traits = { path = "../../../blitz-rust/packages/blitz-traits" }
 brotli = { version = "=8.0.4", default-features = false, features = ["std"] }
 png = { version = "=0.18.1", optional = true }
 tauri = { version = "=2.11.5", default-features = false, features = ["compression"] }
-tauri-runtime-blitz = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master" }
+tauri-runtime-blitz = "^0.1.0"
 url = "=2.5.8"
 
 [build-dependencies]
diff --git a/apps/gui/Cargo.toml b/apps/gui/Cargo.toml
index b6e48d50..aeb28631 100644
--- a/apps/gui/Cargo.toml
+++ b/apps/gui/Cargo.toml
@@ -66,14 +66,17 @@ wt-migrate = { path = "../../crates/wt-migrate" }
 agent-abstraction = "0.4.15"
 agency-proxy-client.workspace = true
 agency-proxy-protocol.workspace = true
-agent-experimental = { git = "https://gitlab.com/anonymous-28282828282/agent-experimental.git", branch = "master", default-features = false, optional = true }
+agent-experimental = { version = "^0.1.3", default-features = false, optional = true }
 promptsyntax = "0.1.0"
 shlex = "1.3"
 az-core.workspace = true
-# Pinned rather than tracking master, unlike the engine deps above. Master has
-# moved on to an `arctic-wt` that cargo cannot select alongside this workspace,
-# so `branch = "master"` fails to resolve rather than building something newer.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+# Exact rather than a caret, unlike the engine deps above, and from the
+# registry rather than a git rev. Master has moved on to an `arctic-wt` that
+# cargo cannot select alongside this workspace, so tracking it fails to resolve
+# rather than building something newer. beta.11 is published; moving to it is a
+# storage-engine change and belongs in its own commit with its own testing, not
+# in a dependency-source cleanup.
+worktable = "=1.0.0-beta.10"
 # The `worktable!` macro emits code that names these by bare path rather than
 # through a re-export, so a consumer of the macro has to declare them too.
 # Versions match worktable 1.0 beta's own, since a mismatch produces errors that name
@@ -93,8 +96,11 @@ tauri = { version = "2", default-features = false, features = ["macos-private-ap
 # `macos-private-api` must match the `tauri` dependency above. Tauri's
 # `WindowBuilder` trait declares `transparent` behind that feature, and the
 # runtime gates its implementation behind the same one, so enabling it on only
-# one side makes the trait demand a method the other side compiled out.
-tauri-runtime-blitz = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master", optional = true, features = ["macos-private-api"] }
+# one side makes the trait demand a method the other side compiled out. As of
+# 0.1.0 the runtime's own feature forwards to `tauri` and `tauri-runtime`, so
+# naming it here agrees with that rather than being the only thing holding the
+# two sides together.
+tauri-runtime-blitz = { version = "^0.1.0", optional = true, features = ["macos-private-api"] }
 #
 # The engine by version, not by branch. Same move `chuzz` made, for the same
 # reasons its manifest records.
diff --git a/crates/agency-tools/Cargo.toml b/crates/agency-tools/Cargo.toml
index b4329ff5..0f9f266a 100644
--- a/crates/agency-tools/Cargo.toml
+++ b/crates/agency-tools/Cargo.toml
@@ -10,7 +10,7 @@ publish.workspace = true
 # git rev of that version are one number over two code bases, and reading a
 # store with the wrong one reports "torn or corrupt persisted table" for a
 # table the app reads without complaint.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+worktable = "=1.0.0-beta.10"
 # The `worktable!` macro emits code that names these by bare path rather than
 # through a re-export, so a consumer of the macro has to declare them too.
 # Versions match worktable 1.0 beta's own, since a mismatch produces errors that name
diff --git a/crates/blitz-bench/Cargo.toml b/crates/blitz-bench/Cargo.toml
index 169e2dcb..e90a4e3f 100644
--- a/crates/blitz-bench/Cargo.toml
+++ b/crates/blitz-bench/Cargo.toml
@@ -11,7 +11,7 @@ publish.workspace = true
 # `tauri-runtime-blitz` for the same types would build a browser engine to send
 # a wheel event. `cargo tree -p blitz-bench` is the check.
 [dependencies]
-blitz-control-protocol = { git = "https://github.com/pathscale/tauri-runtime-blitz.git", branch = "master" }
+blitz-control-protocol = "^0.1.0"
 # The same framing the server uses, from the same crate, for the same reason as
 # the protocol types: a hand-rolled length-prefix reader is how the Python
 # client hung on its first malformed frame.
diff --git a/crates/wt-migrate/Cargo.toml b/crates/wt-migrate/Cargo.toml
index 63ff453c..5b7560ab 100644
--- a/crates/wt-migrate/Cargo.toml
+++ b/crates/wt-migrate/Cargo.toml
@@ -13,7 +13,7 @@ libc = "0.2"
 # one number, two code bases. Rows written by this crate then carried an index
 # the app could not read, which presents as "torn or corrupt persisted table"
 # on a table this tool has just written from scratch.
-worktable = { git = "https://github.com/pathscale/WorkTable.git", rev = "7ab68d17c31e7dd3e56a364ffbb559dd0819b317" }
+worktable = "=1.0.0-beta.10"
 # The `worktable!` and `worktable_version!` macros emit code that names these by
 # bare path rather than through a re-export, so a consumer of the macros has to
 # declare them too. Kept identical to the block in agency-tools and apps/gui: the
diff --git a/scripts/check-one-rev-per-git-source.sh b/scripts/check-one-rev-per-git-source.sh
index 3ba03e7c..923b916a 100755
--- a/scripts/check-one-rev-per-git-source.sh
+++ b/scripts/check-one-rev-per-git-source.sh
@@ -22,8 +22,15 @@ set -euo pipefail
 lock="${1:-Cargo.lock}"
 
 # `source = "git+URL?rev=SHA#SHORTSHA"` — strip the fragment, split on `?rev=`.
+#
+# `|| true` on the grep because a lockfile with no git sources at all is the
+# goal, not a failure, and grep exits 1 when it matches nothing. Under
+# `pipefail` that fails the check on precisely the lockfile it most wants to
+# see. That is this workspace today: every dependency comes from the registry,
+# so the empty case is the normal one and the duplicate-rev check below is
+# guarding against a regression rather than describing the status quo.
 duplicates=$(
-    grep -o 'source = "git+[^"]*"' "$lock" |
+    { grep -o 'source = "git+[^"]*"' "$lock" || true; } |
         sed 's/source = "git+//; s/"$//; s/#.*//' |
         sort -u |
         awk -F'\\?rev=' 'NF == 2 { count[$1]++; revs[$1] = revs[$1] "\n    " $2 }
@@ -39,4 +46,8 @@ if [[ -n $duplicates ]]; then
     exit 1
 fi
 
-echo "one rev per git source"
+if grep -q 'source = "git+' "$lock"; then
+    echo "one rev per git source"
+else
+    echo "no git sources"
+fi