diff --git a/docs/integrations/pkg-configkit.md b/docs/integrations/pkg-configkit.md
index 6528daf9..84125c31 100644
--- a/docs/integrations/pkg-configkit.md
+++ b/docs/integrations/pkg-configkit.md
@@ -2,7 +2,7 @@
 
 Notarius uses the public root package
 [`gitea.maximumdirect.net/eric/ConfigKit`](https://gitea.maximumdirect.net/eric/ConfigKit)
-at v0.4.0 for version 5 configuration acquisition, imports, overlays, explicit
+at v0.4.1 for version 5 configuration acquisition, imports, overlays, explicit
 overrides, diagnostics, and safe inspection rendering.
 
 Notarius owns the typed document, domain defaults and validation, runtime
@@ -11,3 +11,8 @@ paths, and command discovery. It uses only ConfigKit's public path, result,
 diagnostic, and resolution-source APIs. Upstream documentation owns general
 ConfigKit semantics; [Configuration](../config.md) owns Notarius's file and
 operator contract.
+
+ConfigKit's [LGPL-3.0-or-later grant](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/0adb94f59e44827908eff401d4381a398fe17107/COPYRIGHT)
+and [combined LGPLv3 and GPLv3 text](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/0adb94f59e44827908eff401d4381a398fe17107/LICENSE)
+are maintained upstream. The v0.4.1 patch changes licensing documentation, not
+configuration behavior or the public API.
diff --git a/docs/integrations/pkg-promptkit.md b/docs/integrations/pkg-promptkit.md
index 90751f92..305375b1 100644
--- a/docs/integrations/pkg-promptkit.md
+++ b/docs/integrations/pkg-promptkit.md
@@ -1,11 +1,11 @@
 # PromptKit Integration
 
 Notarius pins
-[`gitea.maximumdirect.net/eric/promptkit` v0.11.0](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0)
+[`gitea.maximumdirect.net/eric/promptkit` v0.11.1](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1)
 as its in-process prompt engine. The upstream
-[Go package consumer guide](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/docs/consumers/pkg-promptkit.md)
+[Go package consumer guide](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1/docs/consumers/pkg-promptkit.md)
 owns the public engine API, and the upstream
-[format reference](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/docs/formats.md)
+[format reference](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1/docs/formats.md)
 owns prompt, profile, and schema file contracts.
 
 ## Supported Boundary
@@ -27,7 +27,7 @@ Notarius relies on the root `promptkit` package to:
   admission exhaustion through `ErrCapacityExceeded`.
 
 The pinned
-[`BackendLocal`, `LocalBackend`, and `WithBackend` API](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/backends.go)
+[`BackendLocal`, `LocalBackend`, and `WithBackend` API](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1/backends.go)
 owns the registration and backend-capacity contract.
 
 For one completion, the adapter calls `PrepareExecution`, takes a
@@ -72,7 +72,7 @@ PromptKit capacity rejection into the provider-neutral Notarius
 `ErrLLMCapacityExceeded` contract. It may include the normalized selected
 backend ID in safe diagnostic context, without exposing PromptKit's capacity
 error type. PromptKit's built-in client retries eligible transient HTTP failures
-with its v0.11.0 default of two additional attempts per generation; Notarius
+with its v0.11.1 default of two additional attempts per generation; Notarius
 keeps pipeline-stage retries outside that completion boundary.
 
 The adapter projects built-in generation failures as the application-owned
@@ -94,7 +94,7 @@ configuration and deployment workflow are defined in
 [Operations](../operations.md#promptkit-profile-deployment).
 
 PromptKit owns `base_profile` resolution under its
-[pinned format rules](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/docs/formats.md).
+[pinned format rules](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1/docs/formats.md).
 Notarius records the selected leaf identity and resolved target without parsing
 or merging inheritance. An unset filesystem `api_key_env` is optional and may
 reach the provider without authorization, which can result in a 401 or 403.
@@ -133,7 +133,7 @@ PromptKit's opt-in `promptkit-openrouter-standard` and
 `promptkit-openrouter-auto` names provide name continuity within its
 selected-and-tested dependency scope, not a fixed model or provider availability
 guarantee. See the upstream
-[catalog compatibility policy](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/docs/policy/release.md#catalog-profile-compatibility).
+[catalog compatibility policy](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.1/docs/policy/release.md#catalog-profile-compatibility).
 
 Use a complete operator-owned profile with explicit backend or endpoint, model,
 and settings when those choices must remain operator-controlled. The embedded
@@ -141,7 +141,7 @@ and settings when those choices must remain operator-controlled. The embedded
 external catalog profile. An upgrade updates Notarius's compiled-in catalog
 checkpoint identity so prior profile-source checkpoints are not reused.
 
-Notarius supports this boundary against PromptKit v0.11.0. Its fallback source,
+Notarius supports this boundary against PromptKit v0.11.1. Its fallback source,
 prepared-execution, inspection, and typed capacity APIs are used as public
 upstream contracts; other PromptKit APIs or file-format behavior are not
 implicitly supported. A dependency upgrade requires reviewing the adapter,
@@ -171,8 +171,11 @@ production prompts use PromptKit's bounded structural-repair contract; their
 current declaration is one additional repair attempt. Notarius retains the
 transport-neutral boundary and does not expose PromptKit types to modules.
 
-PromptKit v0.11.0 is licensed under
-[LGPL-3.0-or-later](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/LICENSE).
-Its accompanying [GPLv3 notice](https://gitea.maximumdirect.net/eric/promptkit/src/tag/v0.11.0/COPYING)
-is incorporated by that license. This dependency change does not alter
-Notarius's source license or distribution workflow.
+PromptKit's [LGPL-3.0-or-later grant](https://gitea.maximumdirect.net/eric/promptkit/src/commit/15e40679546f2e21b6f51cc84b6f0a087a8486db/COPYRIGHT)
+and [combined LGPLv3 and GPLv3 text](https://gitea.maximumdirect.net/eric/promptkit/src/commit/15e40679546f2e21b6f51cc84b6f0a087a8486db/LICENSE)
+are maintained upstream. The v0.11.1 patch changes licensing documentation and
+updates both backend catalogs to MIT-licensed v2.20260926.0 releases; it does not
+change runtime APIs or profile settings. See the upstream
+[dependency attribution](https://gitea.maximumdirect.net/eric/promptkit/src/commit/15e40679546f2e21b6f51cc84b6f0a087a8486db/docs/oss/attribution.md)
+for catalog notices. Notarius's source license and distribution workflow are
+unchanged.
diff --git a/docs/operations.md b/docs/operations.md
index ae055968..bc7c1edf 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -371,7 +371,7 @@ Provider execution settings and the generation timeout come from the selected
 PromptKit profile. The invocation-only **--reasoning-effort** and
 **--clear-reasoning-effort** controls may replace or clear that profile setting
 for all LLM-backed calls in one run without changing the profile. PromptKit
-v0.11.0 also retries eligible transient HTTP failures with its built-in default
+also retries eligible transient HTTP failures with its built-in default
 of two additional attempts per generation. This retry work is separate from
 structural output repair, which happens within one structured-completion call. Its
 effective `structured_output_repair_attempts` limit is resolved from the
diff --git a/docs/policy/agents.md b/docs/policy/agents.md
index baa25cfd..3606b4a4 100644
--- a/docs/policy/agents.md
+++ b/docs/policy/agents.md
@@ -2,9 +2,7 @@
 
 **Base Policy Version:** 1.1
 
-**Last Updated**: 2026-09-25
-
-**Upstream Source:** `policy` commit `45591a79004c6811950f14dca554f6ff69b7f58e`.
+**Last Updated**: 2026-09-26
 
 Notarius adaptations preserve operator choice, existing explicit contracts, and
 the deployment-permissions example below.
diff --git a/docs/policy/architecture.md b/docs/policy/architecture.md
index 3f7d5454..bc102273 100644
--- a/docs/policy/architecture.md
+++ b/docs/policy/architecture.md
@@ -2,9 +2,7 @@
 
 **Base Policy Version:** 1.1
 
-**Last Updated**: 2026-09-25
-
-**Upstream Source:** `policy` commit `45591a79004c6811950f14dca554f6ff69b7f58e`.
+**Last Updated**: 2026-09-26
 
 Notarius adapts the base template to its fixed pipeline, artifact families,
 external adapters, state boundaries, and source-only distribution.
diff --git a/docs/policy/documentation.md b/docs/policy/documentation.md
index 11ac9ca1..dd0e8a73 100644
--- a/docs/policy/documentation.md
+++ b/docs/policy/documentation.md
@@ -2,9 +2,7 @@
 
 **Base Policy Version:** 1.3
 
-**Last Updated**: 2026-09-25
-
-**Upstream Source:** `policy` commit `45591a79004c6811950f14dca554f6ff69b7f58e`.
+**Last Updated**: 2026-09-26
 
 Notarius retains subprocess-consumer ownership, the distinction between
 descriptive behavior and policy, and no placeholders for absent interfaces.
diff --git a/docs/policy/release.md b/docs/policy/release.md
index aa701365..c15760ba 100644
--- a/docs/policy/release.md
+++ b/docs/policy/release.md
@@ -2,9 +2,7 @@
 
 **Base Policy Version:** 1.1
 
-**Last Updated**: 2026-09-25
-
-**Upstream Source:** `policy` commit `45591a79004c6811950f14dca554f6ff69b7f58e`.
+**Last Updated**: 2026-09-26
 
 Notarius adaptations: source-only delivery, lightweight tags, branch-before-tag
 publication, no prereleases, and the justified native command check below.
diff --git a/docs/policy/testing.md b/docs/policy/testing.md
index 61776a5d..55c975c1 100644
--- a/docs/policy/testing.md
+++ b/docs/policy/testing.md
@@ -2,9 +2,7 @@
 
 **Base Policy Version:** 1.1
 
-**Last Updated**: 2026-09-25
-
-**Upstream Source:** `policy` commit `45591a79004c6811950f14dca554f6ff69b7f58e`.
+**Last Updated**: 2026-09-26
 
 Adopted without substantive deviations; Notarius's established contracts remain
 subject to [Agent Policy](agents.md).
diff --git a/docs/roadmap/policy.md b/docs/roadmap/policy.md
index 28d45712..5c0c7334 100644
--- a/docs/roadmap/policy.md
+++ b/docs/roadmap/policy.md
@@ -2,7 +2,7 @@
 
 ## Purpose
 
-Align Notarius with the upstream licensing-documentation standards while
+Adopt the licensing-documentation conventions defined below while
 preserving its deliberate policy adaptations, existing project grant, and
 source-only release process. This is a documentation and policy work set, not
 a relicensing, runtime, or release-automation project.
@@ -12,22 +12,20 @@ not implement the policy or authorize release publication.
 
 ## Reviewed Baseline
 
-Reviewed on 2026-09-26 against upstream `policy` commit
-`dafa823981004d4d58a5eb1b59a84ffebbd979da`, available in `../policy`.
-Notarius's existing policies record upstream baseline
-`45591a79004c6811950f14dca554f6ff69b7f58e`.
+Reviewed on 2026-09-26 against Notarius's current policy documents and pinned
+dependencies. The table records the selected policy-version targets; repository
+documentation must remain self-contained.
 
-| Policy | Current Notarius baseline | Target upstream baseline | Required change |
+| Policy | Current Notarius baseline | Target version | Required change |
 | --- | --- | --- | --- |
 | `docs/policy/oss.md` | Absent | 1.2 | Adopt the licensing and attribution policy with Notarius-specific adaptation. |
 | `docs/policy/documentation.md` | 1.3 | 1.5 | Merge licensing ownership and discoverability rules. |
 | `docs/policy/release.md` | 1.1 | 1.2 | Add prospective release-footer guidance without new publication gates. |
-| Agents, architecture, testing | 1.1 | 1.1 | Retain; these upstream templates have not changed since the recorded baseline. |
+| Agents, architecture, testing | 1.1 | 1.1 | Retain existing substantive rules. |
 
 `COPYRIGHT` already identifies Notarius, its copyright statement, and the
 `GPL-3.0-or-later` grant, including the warranty disclaimer and third-party
-material statement. `LICENSE` contains the matching GPLv3 text. Comparison with
-upstream's reference text found only a missing final newline; no substantive
+material statement. `LICENSE` contains the matching GPLv3 text. No substantive
 license-text change is required.
 
 Current gaps are the absent `docs/oss/` attribution materials, missing README
@@ -40,14 +38,12 @@ inventory.
 
 ### Policy Alignment Without Policy Replacement
 
-Adopt the upstream OSS House Format and maintenance rules in
-`docs/policy/oss.md`. Remove template-adoption instructions and adapt or replace
-template-only example/reference links so the adopted document has no broken
-links or dependencies on an adjacent checkout. There is no need to import the
-template's example project directories.
+Adopt the OSS House Format and maintenance rules defined below in
+`docs/policy/oss.md`, adapted to Notarius. All links must resolve within this
+repository or to public authoritative sources; no adjacent checkout is required.
 
 Identify Notarius as an application with its already selected
-`GPL-3.0-or-later` grant. Preserve the upstream distinction between licensing
+`GPL-3.0-or-later` grant. Preserve the distinction between licensing
 defaults and explicit author choices: adopting the policy does not change
 existing grants, infer different licenses for internal packages, automatically
 advance copyright years, or assume ownership of third-party contributions.
@@ -59,10 +55,9 @@ Preserve subprocess-consumer ownership, prospective/current documentation
 boundaries, immutable accepted ADRs, and the distinction between descriptive
 implementation details and adopted policy.
 
-Changed or newly adopted policies must record their actual upstream template
-version, the upstream commit above, and the actual adoption date. Unchanged
-policies need no version or date churn merely because the upstream repository
-has advanced.
+Changed or newly adopted policies must record their base policy version and
+actual adoption date. Do not add private provenance headers, links, or attribution
+entries. Unchanged policies need no version or date churn.
 
 ### Canonical Licensing Documentation
 
@@ -90,12 +85,12 @@ tools do not automatically require entries merely because maintainers use them.
 
 The current module declarations identify these starting points:
 
-- ConfigKit v0.4.0 and PromptKit v0.11.0;
+- ConfigKit v0.4.1 and PromptKit v0.11.1;
 - `github.com/santhosh-tekuri/jsonschema/v6` v6.0.2;
 - `golang.org/x/text` v0.40.0;
 - `gopkg.in/yaml.v3` v3.0.1 and `go.yaml.in/yaml/v4` v4.0.0-rc.6;
 - PromptKit's OpenRouter and Rakestrawhome backend catalogs at their pinned
-  v2.20260922.1 and v2.20260922.0 revisions, respectively.
+  v2.20260926.0 revisions (now MIT licensed).
 
 This list is an inspection starting point, not a pre-approved license inventory.
 Verify each relevant component's terms, notices, and exact source revision at
@@ -110,8 +105,8 @@ Each attribution entry follows the five-field House Format:
 4. License and notice links.
 5. Corresponding source repository link.
 
-Copy only applicable standard license texts from the upstream reference
-collection, or an authoritative source if the collection lacks a needed text.
+Copy only applicable standard license texts from public authoritative sources,
+such as the license publisher or the verified dependency release.
 Preserve them verbatim and keep explanations outside the texts. Shared standard
 texts may serve multiple entries. Include directly reachable companion texts;
 for example, an LGPLv3 entry must link to both LGPLv3 and GPLv3 texts.
@@ -122,8 +117,8 @@ authoritative module/VCS metadata; do not guess them. Classify upstream files
 by their contents: `LICENSE` or `COPYING` can contain project-specific statements
 as well as standard wording.
 
-Follow upstream's adopted interpretation that direct links to project-specific
-notices satisfy its notice-reproduction convention. Do not add local copies or
+Use the selected convention that direct links to project-specific
+notices satisfy the notice-reproduction format. Do not add local copies or
 repeated approval requirements solely because license language refers to
 reproduction or inclusion. Preserve notices already present in incorporated
 source. Concrete obligations or unresolved rights questions outside this
@@ -164,7 +159,7 @@ source during preparation; an unpublished tag need not resolve remotely yet.
 
 Notarius continues publishing source through lightweight Git tags and checked-in
 release notes. It has no hosted release objects or separate download pages, so
-the upstream hosted-page provision is currently inapplicable. Do not create
+hosted-page guidance is currently inapplicable. Do not create
 another publication channel to satisfy it. Preserve branch-before-tag order,
 the existing validation command, and successful tag push as release completion.
 
@@ -189,8 +184,9 @@ not by changing published history.
 
 - The adopted OSS policy, documentation policy 1.5, and release policy 1.2 agree
   on canonical ownership and preserve Notarius's deliberate adaptations.
-- Policy metadata identifies the reviewed upstream baseline and actual adoption
-  date; unchanged policies retain their existing metadata.
+- Policy metadata identifies the base policy version and actual adoption
+  date, without private provenance; unchanged policies retain their existing
+  metadata.
 - Project licensing statements remain consistent with `GPL-3.0-or-later`.
 - Attribution covers the relevant incorporated components identified by the
   inventory, including applicable transitive dependencies and copied material.
diff --git a/go.mod b/go.mod
index 6599e3e2..05654f7d 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module gitea.maximumdirect.net/eric/notarius
 go 1.25.5
 
 require (
-	gitea.maximumdirect.net/eric/ConfigKit v0.4.0
-	gitea.maximumdirect.net/eric/promptkit v0.11.0
+	gitea.maximumdirect.net/eric/ConfigKit v0.4.1
+	gitea.maximumdirect.net/eric/promptkit v0.11.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -12,7 +12,7 @@ require (
 require golang.org/x/text v0.40.0
 
 require (
-	gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260922.1 // indirect
-	gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260922.0 // indirect
+	gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260926.0 // indirect
+	gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260926.0 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
 )
diff --git a/go.sum b/go.sum
index d119cb88..3ff1f4bb 100644
--- a/go.sum
+++ b/go.sum
@@ -1,11 +1,11 @@
-gitea.maximumdirect.net/eric/ConfigKit v0.4.0 h1:fo+vKff3zTGeWqJIA38NtT84b6OUP//9ZmBH3lFuKgk=
-gitea.maximumdirect.net/eric/ConfigKit v0.4.0/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
-gitea.maximumdirect.net/eric/promptkit v0.11.0 h1:x7JguOUiInPVXK0GEitjyoRFqqvcuSTjYUvqJ+whtik=
-gitea.maximumdirect.net/eric/promptkit v0.11.0/go.mod h1:0zEBVlJJC+ldDdXazAgybYBXNSe74vwFx5dyOuSos/w=
-gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260922.1 h1:S2/Q/JDE+m8Ca3pDhAjVbfYrdlEhs9blj0STgNopHo0=
-gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260922.1/go.mod h1:a3VBbh9oaGXD6ruxhtwHj+AWW6DY/SSyby1QtMmYSUo=
-gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260922.0 h1:Y0EXc3eh12eKW2NrOviVqdk3oBo6UUjopt1YAa1B3Oc=
-gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260922.0/go.mod h1:mtgD1E0SGm0e/I8Ffhz+AYX7GN7RKUWJXehNFIKHs4Y=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.1 h1:Rl2eaP5NgDgUQt8QZe0DYxF8GFc/6cnkUTLRSf5dcCU=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.1/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
+gitea.maximumdirect.net/eric/promptkit v0.11.1 h1:fSDLdrijUi0ya4P8N4Z1g31p9LPZWVrLHVFogahUkqQ=
+gitea.maximumdirect.net/eric/promptkit v0.11.1/go.mod h1:onm/FBPUKQ8/NSPwTEk26Ut+dVX2iXcq8vEseB+g/0E=
+gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260926.0 h1:wdab+R+lgMZxzYwhbAuCrW7zdSQ1cW9ovBR6UzLmZR4=
+gitea.maximumdirect.net/eric/promptkit-backend-openrouter/v2 v2.20260926.0/go.mod h1:a3VBbh9oaGXD6ruxhtwHj+AWW6DY/SSyby1QtMmYSUo=
+gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260926.0 h1:baCCIB6Ee5t0S4Zc++NTBIPcJEv5UPS6DlSrpZfykwg=
+gitea.maximumdirect.net/eric/promptkit-backend-rakestrawhome/v2 v2.20260926.0/go.mod h1:mtgD1E0SGm0e/I8Ffhz+AYX7GN7RKUWJXehNFIKHs4Y=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
diff --git a/internal/framework/llm/promptkit_profile_fingerprint.go b/internal/framework/llm/promptkit_profile_fingerprint.go
index 5ef6e092..a0b5b9b9 100644
--- a/internal/framework/llm/promptkit_profile_fingerprint.go
+++ b/internal/framework/llm/promptkit_profile_fingerprint.go
@@ -17,7 +17,7 @@ const (
 	promptKitLocalBackendMarker          = "notarius:promptkit-local-backend:v1"
 	// The built-in profile catalog is compiled into this pinned PromptKit
 	// release. Update this identity when the dependency is upgraded.
-	promptKitBuiltinProfileCatalogID = "promptkit:v0.11.0:builtin-profiles"
+	promptKitBuiltinProfileCatalogID = "promptkit:v0.11.1:builtin-profiles"
 )
 
 func promptKitProfileFingerprint(profileDir, profileFile, fallbackProfileDigest string) (CheckpointFingerprint, error) {