diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 91d0306..e133c95 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -113,6 +113,8 @@ jobs:
         include:
           - features: ''                    # default: offline, zero-network build
             cache-suffix: default
+          - features: http                  # exact feature set used by bridge-gate consumers
+            cache-suffix: http
           - features: http,sarif             # Patch Bridge + SARIF
             # A cache key may not contain a comma (Swatinem/rust-cache rejects
             # it at startup of the step), so the matrix carries its own label.
diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml
index 21491f0..de374a0 100644
--- a/.machine_readable/6a2/STATE.a2ml
+++ b/.machine_readable/6a2/STATE.a2ml
@@ -108,3 +108,9 @@ layer-1-0-closure = "stripIsIdentityOnStrippedBody — closes slash-slash induct
 layer-1-0-block-strings = "Stripping_Block.idr + Stripping_Strings.idr + Stripping_Composition.idr + Stripping_PositionPreservation.idr (PROOF-PROGRAMME row 1 remaining)"
 hypatia-rule-wiring = "Hypatia ingestion of test_context / ffi_kind / jit_context metadata; ContextSuppressed bucket distinct from RuleSuppressed"
 gitbot-panicbot-wiring = "gitbot-fleet panicbot translator: surface test_context + suppression-reason in fleet-side reports"
+
+[repair-2026-11-06-toml-dependency]
+change = "toml_edit is required by unconditional assail configuration analysis; remove optional=true"
+regression = "Verify matrix adds exact http-only downstream feature combination alongside default and http,sarif"
+validation = "TOML/YAML structure and dependency declarations checked locally; Rust toolchain unavailable; compilation and full suite await CI"
+status = "candidate; not a verified estate resolution"
diff --git a/Cargo.toml b/Cargo.toml
index 60016c4..b309b59 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,8 @@ hex = "0.4"
 getrandom = "0.4"
 walkdir = "2.5"
 same-file = "1.0"  # assail: refuse a KYAML copy that aliases the sealed JSON report
-toml_edit = { version = "0.23", default-features = false, features = ["parse"], optional = true }
+# Configuration analysis always parses TOML, including offline/default builds.
+toml_edit = { version = "0.25", default-features = false, features = ["parse"] }
 dirs = "7.0"
 ed25519-dalek = { version = "3.0", optional = true }
 ureq = { version = "3.3", optional = true }