diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index 35303a25c..a54a8c69f 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -2,8 +2,6 @@ name: beta
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 * * * *"
 
 jobs:
   sync:
diff --git a/.github/workflows/branding-check.yml b/.github/workflows/branding-check.yml
index ea0220bf0..065d23c04 100644
--- a/.github/workflows/branding-check.yml
+++ b/.github/workflows/branding-check.yml
@@ -4,8 +4,7 @@ on:
   push:
     branches:
       - main
-      - dev
-  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/close-issues.yml b/.github/workflows/close-issues.yml
index b8a2e3f57..e0220add6 100644
--- a/.github/workflows/close-issues.yml
+++ b/.github/workflows/close-issues.yml
@@ -1,8 +1,6 @@
 name: close-issues
 
 on:
-  schedule:
-    - cron: "0 2 * * *" # Daily at 2:00 AM
   workflow_dispatch:
 
 jobs:
diff --git a/.github/workflows/close-prs.yml b/.github/workflows/close-prs.yml
index a1e603a88..3131a08d4 100644
--- a/.github/workflows/close-prs.yml
+++ b/.github/workflows/close-prs.yml
@@ -1,8 +1,6 @@
 name: close-prs
 
 on:
-  schedule:
-    - cron: "0 22 * * *" # Daily at 10:00 PM UTC
   workflow_dispatch:
     inputs:
       dry-run:
diff --git a/.github/workflows/compliance-close.yml b/.github/workflows/compliance-close.yml
index 14e68701e..aae8ea6ff 100644
--- a/.github/workflows/compliance-close.yml
+++ b/.github/workflows/compliance-close.yml
@@ -1,9 +1,6 @@
 name: compliance-close
 
 on:
-  schedule:
-    # Run every 30 minutes to check for expired compliance windows
-    - cron: "*/30 * * * *"
   workflow_dispatch:
 
 permissions:
diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index 15bf07831..a99e8df6b 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -3,7 +3,7 @@ name: containers
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - packages/containers/**
       - .github/workflows/containers.yml
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 73b79b76b..f79098a1b 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -3,8 +3,7 @@ name: deploy
 on:
   push:
     branches:
-      - dev
-      - production
+      - main
   workflow_dispatch:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index e95d8e742..36217650e 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -9,14 +9,10 @@ name: desktop-build
 # Linux packages are unsigned here.
 
 on:
+  # Only the dev->main merge (push to main); ad-hoc runs via workflow_dispatch.
   push:
     branches:
       - main
-      # W-01 §2.2.6 trigger extension: exercise the Windows packaging path on
-      # the dev mainline too (windows targets only, no release publishing — the
-      # release job stays main-only), so NSIS + Trusted Signing + the packaged
-      # smoke regress on every dev push instead of only at release time.
-      - dev
   workflow_dispatch:
     inputs:
       channel:
diff --git a/.github/workflows/docs-locale-sync.yml b/.github/workflows/docs-locale-sync.yml
index 1a8104959..573c46948 100644
--- a/.github/workflows/docs-locale-sync.yml
+++ b/.github/workflows/docs-locale-sync.yml
@@ -3,7 +3,7 @@ name: docs-locale-sync
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - packages/web/src/content/docs/*.mdx
 
diff --git a/.github/workflows/docs-update.yml b/.github/workflows/docs-update.yml
index ffc95c840..8d0702b65 100644
--- a/.github/workflows/docs-update.yml
+++ b/.github/workflows/docs-update.yml
@@ -1,8 +1,6 @@
 name: docs-update
 
 on:
-  schedule:
-    - cron: "0 */12 * * *"
   workflow_dispatch:
 
 env:
diff --git a/.github/workflows/duplicate-issues.yml b/.github/workflows/duplicate-issues.yml
index 7ee900bc0..5cbcc39ae 100644
--- a/.github/workflows/duplicate-issues.yml
+++ b/.github/workflows/duplicate-issues.yml
@@ -1,8 +1,7 @@
 name: duplicate-issues
 
 on:
-  issues:
-    types: [opened, edited]
+  workflow_dispatch:
 
 jobs:
   check-duplicates:
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 18baa4fc9..c90614d9f 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -3,7 +3,8 @@ name: generate
 on:
   push:
     branches:
-      - dev
+      - main
+  workflow_dispatch:
 
 jobs:
   generate:
diff --git a/.github/workflows/nix-eval.yml b/.github/workflows/nix-eval.yml
index f2402ab40..c989b6eb8 100644
--- a/.github/workflows/nix-eval.yml
+++ b/.github/workflows/nix-eval.yml
@@ -2,9 +2,7 @@ name: nix-eval
 
 on:
   push:
-    branches: [dev]
-  pull_request:
-    branches: [dev]
+    branches: [main]
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/nix-hashes.yml b/.github/workflows/nix-hashes.yml
index 0e13462ae..2ff8285bd 100644
--- a/.github/workflows/nix-hashes.yml
+++ b/.github/workflows/nix-hashes.yml
@@ -6,7 +6,7 @@ permissions:
 on:
   workflow_dispatch:
   push:
-    branches: [dev, beta]
+    branches: [main]
     paths:
       - "bun.lock"
       - "package.json"
diff --git a/.github/workflows/pr-management.yml b/.github/workflows/pr-management.yml
index d96fe905a..26c3218ce 100644
--- a/.github/workflows/pr-management.yml
+++ b/.github/workflows/pr-management.yml
@@ -1,8 +1,7 @@
 name: pr-management
 
 on:
-  pull_request_target:
-    types: [opened]
+  workflow_dispatch:
 
 jobs:
   add-contributor-label:
diff --git a/.github/workflows/pr-routing.yml b/.github/workflows/pr-routing.yml
index 0791d334f..eb0e591cd 100644
--- a/.github/workflows/pr-routing.yml
+++ b/.github/workflows/pr-routing.yml
@@ -1,8 +1,7 @@
 name: pr-routing
 
 on:
-  pull_request_target:
-    types: [opened, reopened, edited, synchronize, ready_for_review]
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/pr-standards.yml b/.github/workflows/pr-standards.yml
index 2faf3a478..0a39250b2 100644
--- a/.github/workflows/pr-standards.yml
+++ b/.github/workflows/pr-standards.yml
@@ -1,8 +1,7 @@
 name: pr-standards
 
 on:
-  pull_request_target:
-    types: [opened, edited, synchronize]
+  workflow_dispatch:
 
 jobs:
   check-standards:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 96ee12779..51314b732 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,13 +2,11 @@ name: publish
 run-name: "${{ format('release {0}', inputs.bump) }}"
 
 on:
+  # Only the dev->main merge (push to main) builds; releases themselves are
+  # workflow_dispatch with an explicit version.
   push:
     branches:
-      - ci
-      - dev
-      - beta
-      - fix/npm-native-binary-install
-      - snapshot-*
+      - main
   workflow_dispatch:
     inputs:
       bump:
diff --git a/.github/workflows/release-github-action.yml b/.github/workflows/release-github-action.yml
index 833c13331..6ca535d85 100644
--- a/.github/workflows/release-github-action.yml
+++ b/.github/workflows/release-github-action.yml
@@ -3,7 +3,7 @@ name: release-github-action
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - "github/**"
 
diff --git a/.github/workflows/stats.yml b/.github/workflows/stats.yml
index ba8557288..e35c4a677 100644
--- a/.github/workflows/stats.yml
+++ b/.github/workflows/stats.yml
@@ -1,9 +1,7 @@
 name: stats
 
 on:
-  schedule:
-    - cron: "0 12 * * *" # Run daily at 12:00 UTC
-  workflow_dispatch: # Allow manual trigger
+  workflow_dispatch:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
diff --git a/.github/workflows/storybook.yml b/.github/workflows/storybook.yml
index 1e652104d..ddea0c282 100644
--- a/.github/workflows/storybook.yml
+++ b/.github/workflows/storybook.yml
@@ -2,15 +2,7 @@ name: storybook
 
 on:
   push:
-    branches: [dev]
-    paths:
-      - ".github/workflows/storybook.yml"
-      - "package.json"
-      - "bun.lock"
-      - "packages/storybook/**"
-      - "packages/ui/**"
-  pull_request:
-    branches: [dev]
+    branches: [main]
     paths:
       - ".github/workflows/storybook.yml"
       - "package.json"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 29e8034a0..ce658d5a5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,8 +3,7 @@ name: test
 on:
   push:
     branches:
-      - dev
-  pull_request:
+      - main
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
index 03128b4db..9a696aa35 100644
--- a/.github/workflows/typecheck.yml
+++ b/.github/workflows/typecheck.yml
@@ -2,10 +2,8 @@ name: typecheck
 
 on:
   push:
-    branches: [dev]
-  # Gate every PR regardless of target branch: the typecheck baseline is easily polluted by stale
-  # worktrees/generated files, so keep it required and branch-agnostic.
-  pull_request:
+    branches:
+      - main
   workflow_dispatch:
 
 jobs:
diff --git a/packages/deepagent-code/src/mcp/index.ts b/packages/deepagent-code/src/mcp/index.ts
index 147fc873c..781ebec41 100644
--- a/packages/deepagent-code/src/mcp/index.ts
+++ b/packages/deepagent-code/src/mcp/index.ts
@@ -37,6 +37,7 @@ import { InstanceState } from "@/effect/instance-state"
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process"
 import { CrossSpawnSpawner } from "@deepagent-code/core/cross-spawn-spawner"
 import { applyEdits, modify, parse } from "jsonc-parser"
+import { Filesystem } from "@/util/filesystem"
 
 const log = Log.create({ service: "mcp" })
 const DEFAULT_TIMEOUT = 30_000
@@ -48,16 +49,17 @@ const TolerantListToolsResultSchema = ListToolsResultSchema.extend({
 // Replace one server entry in a jsonc config file in place, keeping comments and sibling keys
 // intact. Returns false when the file is absent or no longer declares that server (raced removal
 // or a shadowed origin) so the caller can surface that the plaintext may still live there.
+// Filesystem (node:fs) rather than Bun.file: this module is also bundled into the desktop's
+// Node sidecar, whose build fails on any Bun-only runtime API.
 export async function rewriteMcpEntry(origin: string, server: string, entry: ConfigMCPV1.Info): Promise<boolean> {
-  const file = Bun.file(origin)
-  if (!(await file.exists())) return false
-  const text = await file.text()
+  if (!(await Filesystem.exists(origin))) return false
+  const text = await Filesystem.readText(origin)
   const parsed = parse(text) as { mcp?: Record<string, unknown> } | undefined
   if (!parsed || typeof parsed !== "object" || !parsed.mcp || !(server in parsed.mcp)) return false
   const edits = modify(text, ["mcp", server], structuredClone(entry), {
     formattingOptions: { tabSize: 2, insertSpaces: true },
   })
-  await Bun.file(origin).write(applyEdits(text, edits))
+  await Filesystem.write(origin, applyEdits(text, edits))
   return true
 }