release: fix FreeBSD jpkg tool dispatch

ober

54f83e95753492eac5bc42d3524dd1cc60c1d569

diff --git a/.builds/ci-freebsd.yml b/.builds/ci-freebsd.yml
index 480d3c0..f26a052 100644
--- a/.builds/ci-freebsd.yml
+++ b/.builds/ci-freebsd.yml
@@ -8,7 +8,7 @@ packages:
 - gmake
 
 sources:
-- https://git.sr.ht/~lisp/jerboa
+- https://git.jerboa.sh/ober/jerboa
 
 tasks:
 - capsicum-platform-tests: |
diff --git a/.builds/ci.yml b/.builds/ci.yml
index 82f072f..35c418d 100644
--- a/.builds/ci.yml
+++ b/.builds/ci.yml
@@ -11,7 +11,7 @@ packages:
 - pkg-config
 - tar
 sources:
-- https://git.sr.ht/~lisp/jerboa
+- https://git.jerboa.sh/ober/jerboa
 tasks:
 - build-and-test: |
     umask 022
diff --git a/.builds/release-freebsd-amd64.yml b/.builds/release-freebsd-amd64.yml
index 532be99..61e39e1 100644
--- a/.builds/release-freebsd-amd64.yml
+++ b/.builds/release-freebsd-amd64.yml
@@ -6,17 +6,10 @@ packages:
 - curl
 - git
 - gmake
-- hut
-oauth: git.sr.ht/OBJECTS:RW
-submitter:
-  git.sr.ht:
-    allow-refs:
-    - refs/tags/v*
 environment:
   release_target: freebsd-amd64
-  sourcehut_repo: ~lisp/jerboa
 sources:
-- https://git.sr.ht/~lisp/jerboa
+- https://git.jerboa.sh/ober/jerboa
 tasks:
 - build: |
     cd jerboa
@@ -26,17 +19,6 @@ tasks:
     esac
     gmake jerboa
     gmake release-artifact RELEASE_VERSION="$version" RELEASE_TARGET="$release_target"
-- upload-if-tag: |
-    cd jerboa
-    case "${GIT_REF:-}" in
-      refs/tags/*)
-        tag=${GIT_REF#refs/tags/}
-        gmake release-upload RELEASE_VERSION="$tag" RELEASE_REPO="$sourcehut_repo"
-        ;;
-      *)
-        echo "not a tag build; skipping SourceHut git artifact upload"
-        ;;
-    esac
 artifacts:
 - jerboa/dist/release/jerboa-freebsd-amd64.tar.gz
 - jerboa/dist/release/jerboa-freebsd-amd64.tar.gz.sha256
diff --git a/.builds/release-linux-amd64.yml b/.builds/release-linux-amd64.yml
index 642798b..0871189 100644
--- a/.builds/release-linux-amd64.yml
+++ b/.builds/release-linux-amd64.yml
@@ -7,18 +7,11 @@ packages:
 - curl
 - file
 - git
-- hut
 - tar
-oauth: git.sr.ht/OBJECTS:RW
-submitter:
-  git.sr.ht:
-    allow-refs:
-    - refs/tags/v*
 environment:
   release_target: linux-amd64
-  sourcehut_repo: ~lisp/jerboa
 sources:
-- https://git.sr.ht/~lisp/jerboa
+- https://git.jerboa.sh/ober/jerboa
 tasks:
 - build: |
     cd jerboa
@@ -28,17 +21,6 @@ tasks:
     esac
     make jerboa
     make release-artifact RELEASE_VERSION="$version" RELEASE_TARGET="$release_target"
-- upload-if-tag: |
-    cd jerboa
-    case "${GIT_REF:-}" in
-      refs/tags/*)
-        tag=${GIT_REF#refs/tags/}
-        make release-upload RELEASE_VERSION="$tag" RELEASE_REPO="$sourcehut_repo"
-        ;;
-      *)
-        echo "not a tag build; skipping SourceHut git artifact upload"
-        ;;
-    esac
 artifacts:
 - jerboa/dist/release/jerboa-linux-amd64.tar.gz
 - jerboa/dist/release/jerboa-linux-amd64.tar.gz.sha256
diff --git a/.builds/release-linux-arm64.yml b/.builds/release-linux-arm64.yml
index cf7a1ef..eed31fb 100644
--- a/.builds/release-linux-arm64.yml
+++ b/.builds/release-linux-arm64.yml
@@ -7,18 +7,11 @@ packages:
 - curl
 - file
 - git
-- hut
 - tar
-oauth: git.sr.ht/OBJECTS:RW
-submitter:
-  git.sr.ht:
-    allow-refs:
-    - refs/tags/v*
 environment:
   release_target: linux-arm64
-  sourcehut_repo: ~lisp/jerboa
 sources:
-- https://git.sr.ht/~lisp/jerboa
+- https://git.jerboa.sh/ober/jerboa
 tasks:
 - build: |
     cd jerboa
@@ -28,17 +21,6 @@ tasks:
     esac
     make jerboa
     make release-artifact RELEASE_VERSION="$version" RELEASE_TARGET="$release_target"
-- upload-if-tag: |
-    cd jerboa
-    case "${GIT_REF:-}" in
-      refs/tags/*)
-        tag=${GIT_REF#refs/tags/}
-        make release-upload RELEASE_VERSION="$tag" RELEASE_REPO="$sourcehut_repo"
-        ;;
-      *)
-        echo "not a tag build; skipping SourceHut git artifact upload"
-        ;;
-    esac
 artifacts:
 - jerboa/dist/release/jerboa-linux-arm64.tar.gz
 - jerboa/dist/release/jerboa-linux-arm64.tar.gz.sha256
diff --git a/data/anti-patterns.sexp b/data/anti-patterns.sexp
index 08a5c7c..80ec136 100644
--- a/data/anti-patterns.sexp
+++ b/data/anti-patterns.sexp
@@ -5910,7 +5910,7 @@
      "jerboa_security_scan"))
  (("advice"
     .
-    "Download official release artifacts exclusively from versioned SourceHut tag URLs. Reserve alternate base URLs only for explicit local test fixtures or separate fork tooling, never as an automatic fallback.")
+    "Download official release artifacts exclusively from versioned git.jerboa.sh release URLs. Reserve alternate base URLs only for explicit local test fixtures or separate fork tooling, never as an automatic fallback.")
    ("avoid"
      .
      "Do not add a mirror or fallback download path to the official Jerboa release installer.")
diff --git a/data/cookbooks.sexp b/data/cookbooks.sexp
index c2fab5e..8b0d28b 100644
--- a/data/cookbooks.sexp
+++ b/data/cookbooks.sexp
@@ -6217,7 +6217,7 @@
      "Use quiet mux redraws and explicit forced repaint recovery"))
  (("code"
     .
-    "# Makefile\nJERBUILD ?= jerbuild\nJH := $(shell $(JERBUILD) --jerboa-home 2>/dev/null)\nVENDOR_DEP_URL ?= https://git.sr.ht/~lisp/jerboa-yubikey\nVENDOR_DEP_DIR := vendor/jerboa-yubikey\nVENDOR_DEP_LIB := $(VENDOR_DEP_DIR)/lib\nJEXEC := $(JERBUILD) exec --libdirs $(CURDIR)/$(VENDOR_DEP_LIB):$(CURDIR)/scheme:$(JH)/lib\n\nvendor-yubikey:\n\tsh support/ensure-vendor.sh jerboa-yubikey \"$(VENDOR_DEP_URL)\"\n\t@test -f \"$(VENDOR_DEP_LIB)/yubikey/auth.sls\" || \\\n\t  { echo \"ERROR: missing $(VENDOR_DEP_LIB)/yubikey/auth.sls\" >&2; exit 1; }\n\nbinary: vendor-yubikey\n\t$(JERBUILD) build\n\n# .jerbuild\n(entry \"scheme/main.ss\")\n(output \"my-program\")\n(libdirs \"vendor/jerboa-yubikey/lib\" \"scheme\")\n(pre-build \"sh support/ensure-vendor.sh jerboa-yubikey https://git.sr.ht/~lisp/jerboa-yubikey\")\n\n# support/ensure-vendor.sh\n#!/bin/sh\nset -eu\nname=\"$1\"\nurl=\"$2\"\ncase \"$url\" in https://*|git://*|ssh://*|git@*:*) ;; *) echo \"absolute Git URL required\" >&2; exit 2;; esac\ndir=\"vendor/$name\"\nif [ -d \"$dir\" ] && { [ -f \"$dir/README.md\" ] || [ -f \"$dir/Makefile\" ]; }; then exit 0; fi\nrm -rf \"$dir\"\nmkdir -p vendor\ntmp=\"vendor/.$name.tmp.$$\"\ntrap 'rm -rf \"$tmp\"' EXIT INT TERM\ngit clone --depth 1 \"$url\" \"$tmp\"\nrm -rf \"$tmp/.git\"\nmv \"$tmp\" \"$dir\"") ("id" . "jerbuild-vendor-dependency-prebuild") ("imports")
+    "# Makefile\nJERBUILD ?= jerbuild\nJH := $(shell $(JERBUILD) --jerboa-home 2>/dev/null)\nVENDOR_DEP_URL ?= https://git.jerboa.sh/ober/jerboa-yubikey\nVENDOR_DEP_DIR := vendor/jerboa-yubikey\nVENDOR_DEP_LIB := $(VENDOR_DEP_DIR)/lib\nJEXEC := $(JERBUILD) exec --libdirs $(CURDIR)/$(VENDOR_DEP_LIB):$(CURDIR)/scheme:$(JH)/lib\n\nvendor-yubikey:\n\tsh support/ensure-vendor.sh jerboa-yubikey \"$(VENDOR_DEP_URL)\"\n\t@test -f \"$(VENDOR_DEP_LIB)/yubikey/auth.sls\" || \\\n\t  { echo \"ERROR: missing $(VENDOR_DEP_LIB)/yubikey/auth.sls\" >&2; exit 1; }\n\nbinary: vendor-yubikey\n\t$(JERBUILD) build\n\n# .jerbuild\n(entry \"scheme/main.ss\")\n(output \"my-program\")\n(libdirs \"vendor/jerboa-yubikey/lib\" \"scheme\")\n(pre-build \"sh support/ensure-vendor.sh jerboa-yubikey https://git.jerboa.sh/ober/jerboa-yubikey\")\n\n# support/ensure-vendor.sh\n#!/bin/sh\nset -eu\nname=\"$1\"\nurl=\"$2\"\ncase \"$url\" in https://*|git://*|ssh://*|git@*:*) ;; *) echo \"absolute Git URL required\" >&2; exit 2;; esac\ndir=\"vendor/$name\"\nif [ -d \"$dir\" ] && { [ -f \"$dir/README.md\" ] || [ -f \"$dir/Makefile\" ]; }; then exit 0; fi\nrm -rf \"$dir\"\nmkdir -p vendor\ntmp=\"vendor/.$name.tmp.$$\"\ntrap 'rm -rf \"$tmp\"' EXIT INT TERM\ngit clone --depth 1 \"$url\" \"$tmp\"\nrm -rf \"$tmp/.git\"\nmv \"$tmp\" \"$dir\"") ("id" . "jerbuild-vendor-dependency-prebuild") ("imports")
    ("notes"
      .
      "Put the vendored libdir before local source libdirs if the project previously carried a copied module tree; otherwise the stale local copy can shadow the canonical dependency. Use an absolute Git URL in the pre-build hook, not a developer-local path such as ~/mine/.... Exclude build artifacts from package and Podman contexts.")
@@ -6619,12 +6619,12 @@
      "Choose a writable build temp directory on Termux"))
  (("code"
     .
-    "# Makefile target detection\nHOST_UNAME_O := $(shell uname -o 2>/dev/null || true)\nRELEASE_TARGET ?= $(shell host=\"$(HOST_UNAME_S)-$(HOST_UNAME_M)\"; if [ \"$(HOST_UNAME_O)\" = Android ] && { [ \"$(HOST_UNAME_M)\" = aarch64 ] || [ \"$(HOST_UNAME_M)\" = arm64 ]; }; then echo android-arm64; elif [ \"$$host\" = Linux-aarch64 ] || [ \"$$host\" = Linux-arm64 ]; then echo linux-arm64; else echo unknown; fi)\n\n# Stage the native Termux-built multicall binary\njerboa-android-arm64: jerboa\n\t@case \"$(HOST_UNAME_O)-$(HOST_UNAME_M)\" in Android-aarch64|Android-arm64) ;; *) exit 1 ;; esac\n\t@mkdir -p dist/android-arm64\n\t@cp -f dist/jerboa dist/android-arm64/jerboa\n\n# Package and upload\nmake jerboa-android-arm64\nmake release-artifact RELEASE_VERSION=v0.2.4 RELEASE_TARGET=android-arm64\nmake release-upload RELEASE_VERSION=v0.2.4") ("id" . "android-arm64-sourcehut-release-artifact")
+    "# Makefile target detection\nHOST_UNAME_O := $(shell uname -o 2>/dev/null || true)\nRELEASE_TARGET ?= $(shell host=\"$(HOST_UNAME_S)-$(HOST_UNAME_M)\"; if [ \"$(HOST_UNAME_O)\" = Android ] && { [ \"$(HOST_UNAME_M)\" = aarch64 ] || [ \"$(HOST_UNAME_M)\" = arm64 ]; }; then echo android-arm64; elif [ \"$$host\" = Linux-aarch64 ] || [ \"$$host\" = Linux-arm64 ]; then echo linux-arm64; else echo unknown; fi)\n\n# Stage the native Termux-built multicall binary\njerboa-android-arm64: jerboa\n\t@case \"$(HOST_UNAME_O)-$(HOST_UNAME_M)\" in Android-aarch64|Android-arm64) ;; *) exit 1 ;; esac\n\t@mkdir -p dist/android-arm64\n\t@cp -f dist/jerboa dist/android-arm64/jerboa\n\n# Package and upload\nmake jerboa-android-arm64\nmake release-artifact RELEASE_VERSION=v0.2.4 RELEASE_TARGET=android-arm64\nmake release-upload RELEASE_VERSION=v0.2.4") ("id" . "android-arm64-forgejo-release-artifact")
    ("imports")
    ("notes"
      .
      "Termux reports uname -s as Linux and uname -o as Android, so release installers must distinguish Android ARM64 from generic Linux ARM64. Package validation should look for an ELF aarch64 binary with Android in file(1) output. Build and package this target on Termux rather than with the normal Linux musl cross target.")
-   ("tags" "release" "sourcehut" "termux" "android" "arm64"
+   ("tags" "release" "forgejo" "termux" "android" "arm64"
      "install")
    ("title"
      .
diff --git a/docs/chez-fork.md b/docs/chez-fork.md
index 4e3acb6..1785c85 100644
--- a/docs/chez-fork.md
+++ b/docs/chez-fork.md
@@ -15,7 +15,7 @@ record of everything that differs from cisco. Read this doc for orientation;
 drill into the patches for specifics.
 
 > **History note.** This Chez was previously developed in a standalone fork
-> repo (`git.sr.ht/~lisp/ChezScheme`, working tree `~/mine/ChezScheme`) and
+> repo (`git.jerboa.sh/ober/ChezScheme`, working tree `~/mine/ChezScheme`) and
 > vendored in as a flat snapshot. That fork is **retired**; the changes now
 > live and evolve here in-tree. Older references to that separate repo are
 > historical.
diff --git a/docs/jpkg-guide.md b/docs/jpkg-guide.md
index 0216eb4..b5f13bb 100644
--- a/docs/jpkg-guide.md
+++ b/docs/jpkg-guide.md
@@ -125,6 +125,16 @@ Bare package names (without `@scope/`) are auto-prefixed with the
 default scope `@ober`. Override with `JPKG_DEFAULT_SCOPE=@other`, or
 always use the explicit form `jpkg add @ober/jerboa-ssh`.
 
+Install a published executable globally by its bare package name. `jpkg`
+detects the host operating system and architecture and selects the matching
+artifact automatically:
+
+```sh
+jpkg install jerboa-code
+```
+
+Do not append an operating system or architecture to the package name.
+
 Suppress the built-in default with `JPKG_NO_DEFAULT_REGISTRY=1` (e.g.
 to enforce that only your own registries are visible).
 
diff --git a/docs/release-artifacts.md b/docs/release-artifacts.md
index 46debf2..c633d14 100644
--- a/docs/release-artifacts.md
+++ b/docs/release-artifacts.md
@@ -128,6 +128,7 @@ chmod 0755 install.sh
 export PATH="$HOME/.local/bin:$PATH"
 jerboa version
 jerbuild --version
+jpkg install jerboa-code
 ```
 
 Replace `vX.Y.Z` with the exact release tag you intend to install; the tag must
diff --git a/support/container-dependencies.lock b/support/container-dependencies.lock
index ebc850e..5cfdf55 100644
--- a/support/container-dependencies.lock
+++ b/support/container-dependencies.lock
@@ -13,18 +13,18 @@ cargo-tool	cargo-audit	https://crates.io/crates/cargo-audit	0.22.2	registry-auth
 
 # First-party repositories are pinned to reviewed remote commits.  The SHA-256
 # is over `git archive --format=tar COMMIT`.
-git	jerboa-ssh	https://git.sr.ht/~lisp/jerboa-ssh	bcb2dcdb3e193bc9bca1f214e2e71b16c059567c	15576f20f2320331272240e36279e36529cb60e0d854eacd8273bf1bfedfbe48	/build/mine/jerboa-ssh
-git	jerboa-sqlite	https://git.sr.ht/~lisp/jerboa-sqlite	13275c9baf1114839c17a290bf188aacfb1f2408	5c3c5829c60ec66bfa51809219d9a6c692666e6013b76fd21e7746ec03d82aaf	/build/mine/jerboa-sqlite
-git	jerboa-crypto	https://git.sr.ht/~lisp/jerboa-crypto	0b598377a0a57a35c6f8e614ef4a45d05e7b1a59	7bea6426ada6e35c4f25c9c14663a4b3dc15fa6a62b4768ea8bb6e53d97d237a	/build/mine/jerboa-crypto
-git	jerboa-ssl	https://git.sr.ht/~lisp/jerboa-ssl	84919450f00d7e893d94defb7bd62bf9055184cd	9277f1ebee29ba6729d814a8aa1ea407d0aec97fad08e657ca3c9d57d5d92ffb	/build/mine/jerboa-ssl
-git	jerboa-https	https://git.sr.ht/~lisp/jerboa-https	c2832f94865a343b6b6d73bde8c2cbbc8617ce3a	4b6a2ed94f0b051ea538b3e738077b27712f9f86fde66910ba891f12cfd9952f	/build/mine/jerboa-https
-git	jerboa-awk	https://git.sr.ht/~lisp/jerboa-awk	b2a5c3b18e89c136946b65ab6cc8d0f2f8454616	1ea90b66d61ca76d3bb1ce21b6bfc2fa135134162006e4043db4cd1412eeee2c	/build/mine/jerboa-awk
-git	jerboa-sed	https://git.sr.ht/~lisp/jerboa-sed	d0d1f3241f2cfde008ef2cbfef9e0abe947b91fd	a30bda1d80f876ecded3d316d21bf2e71e4f25f1980a39c19aa38d218ddfd9be	/build/mine/jerboa-sed
-git	jerboa-aws	https://git.sr.ht/~lisp/jerboa-aws	6aaed8fd95674584cf0448faa0f24386cdc29ff2	db190d3d77487b094fd78b8153394cccd1eb4ccf727c277ad508c1339de6cfb1	/build/mine/jerboa-aws
-git	jerboa-fuse	https://git.sr.ht/~lisp/jerboa-fuse	7a51f44b68c681f59f21a918770c48268cb3d82f	93bbfd3c4c74e7915027fbb13d84664bee5939ebec13e5d85650697ffbf9e1ed	/build/mine/jerboa-fuse
-git	jerboa-scintilla	https://git.sr.ht/~lisp/jerboa-scintilla	94431eab4cb20104fb66add18c0988681c672566	72bf2bc08fb884c38ac95e6ee36832ae9fe339f863e19edf6446b532fe63d30d	/build/mine/jerboa-scintilla
-git	jerboa-pcre2	https://git.sr.ht/~lisp/jerboa-pcre2	00ed6cba49c8b6a477da575e8acd1eea993c911e	157dcbd80992fb2944020ec395d5a5dd872aacaef4886e5d9d65c2a8b4c201c9	/build/mine/jerboa-pcre2
-git	jerboa-shell	https://git.sr.ht/~lisp/jerboa-shell	e5f8689c582c304b3dd3623e418d6b8d3b27a173	0ea57dffe4437ca1453c7db770fcdf6d6c8a3600ae4c691eb18a5cf726f29d10	/tmp/jerboa-shell
+git	jerboa-ssh	https://git.jerboa.sh/ober/jerboa-ssh	bcb2dcdb3e193bc9bca1f214e2e71b16c059567c	15576f20f2320331272240e36279e36529cb60e0d854eacd8273bf1bfedfbe48	/build/mine/jerboa-ssh
+git	jerboa-sqlite	https://git.jerboa.sh/ober/jerboa-sqlite	13275c9baf1114839c17a290bf188aacfb1f2408	5c3c5829c60ec66bfa51809219d9a6c692666e6013b76fd21e7746ec03d82aaf	/build/mine/jerboa-sqlite
+git	jerboa-crypto	https://git.jerboa.sh/ober/jerboa-crypto	0b598377a0a57a35c6f8e614ef4a45d05e7b1a59	7bea6426ada6e35c4f25c9c14663a4b3dc15fa6a62b4768ea8bb6e53d97d237a	/build/mine/jerboa-crypto
+git	jerboa-ssl	https://git.jerboa.sh/ober/jerboa-ssl	84919450f00d7e893d94defb7bd62bf9055184cd	9277f1ebee29ba6729d814a8aa1ea407d0aec97fad08e657ca3c9d57d5d92ffb	/build/mine/jerboa-ssl
+git	jerboa-https	https://git.jerboa.sh/ober/jerboa-https	c2832f94865a343b6b6d73bde8c2cbbc8617ce3a	4b6a2ed94f0b051ea538b3e738077b27712f9f86fde66910ba891f12cfd9952f	/build/mine/jerboa-https
+git	jerboa-awk	https://git.jerboa.sh/ober/jerboa-awk	b2a5c3b18e89c136946b65ab6cc8d0f2f8454616	1ea90b66d61ca76d3bb1ce21b6bfc2fa135134162006e4043db4cd1412eeee2c	/build/mine/jerboa-awk
+git	jerboa-sed	https://git.jerboa.sh/ober/jerboa-sed	d0d1f3241f2cfde008ef2cbfef9e0abe947b91fd	a30bda1d80f876ecded3d316d21bf2e71e4f25f1980a39c19aa38d218ddfd9be	/build/mine/jerboa-sed
+git	jerboa-aws	https://git.jerboa.sh/ober/jerboa-aws	6aaed8fd95674584cf0448faa0f24386cdc29ff2	db190d3d77487b094fd78b8153394cccd1eb4ccf727c277ad508c1339de6cfb1	/build/mine/jerboa-aws
+git	jerboa-fuse	https://git.jerboa.sh/ober/jerboa-fuse	7a51f44b68c681f59f21a918770c48268cb3d82f	93bbfd3c4c74e7915027fbb13d84664bee5939ebec13e5d85650697ffbf9e1ed	/build/mine/jerboa-fuse
+git	jerboa-scintilla	https://git.jerboa.sh/ober/jerboa-scintilla	94431eab4cb20104fb66add18c0988681c672566	72bf2bc08fb884c38ac95e6ee36832ae9fe339f863e19edf6446b532fe63d30d	/build/mine/jerboa-scintilla
+git	jerboa-pcre2	https://git.jerboa.sh/ober/jerboa-pcre2	00ed6cba49c8b6a477da575e8acd1eea993c911e	157dcbd80992fb2944020ec395d5a5dd872aacaef4886e5d9d65c2a8b4c201c9	/build/mine/jerboa-pcre2
+git	jerboa-shell	https://git.jerboa.sh/ober/jerboa-shell	e5f8689c582c304b3dd3623e418d6b8d3b27a173	0ea57dffe4437ca1453c7db770fcdf6d6c8a3600ae4c691eb18a5cf726f29d10	/tmp/jerboa-shell
 
 # Third-party TUI inputs selected from the versions used by this Podman graph.
 archive	scintilla	https://scintilla.org/scintilla558.tgz	558	d1a7d4d2228fedf94306baf674c847bdb7639cdb56508aff8f178b95c72b5a67	/build/sci-vendor
diff --git a/support/multicall-main.c b/support/multicall-main.c
index d69d542..8701a6f 100644
--- a/support/multicall-main.c
+++ b/support/multicall-main.c
@@ -591,7 +591,14 @@ static int self_exe_path(char *buf, size_t n) {
 #elif defined(__FreeBSD__)
     int mib[4] = { CTL_KERN, KERN_PROC, KERN_PROC_PATHNAME, -1 };
     size_t sz = n;
-    return sysctl(mib, 4, buf, &sz, NULL, 0);
+    char tmp[1024];
+    if (sysctl(mib, 4, tmp, &sz, NULL, 0) != 0) return -1;
+    tmp[sizeof tmp - 1] = '\0';
+    if (!realpath(tmp, buf)) {
+        strncpy(buf, tmp, n - 1);
+        buf[n - 1] = '\0';
+    }
+    return 0;
 #else /* Linux and other /proc systems */
     ssize_t r = readlink("/proc/self/exe", buf, n - 1);
     if (r < 0) return -1;
diff --git a/tests/test-supply-chain-policy.sh b/tests/test-supply-chain-policy.sh
index 2e7e2b8..d7e593e 100755
--- a/tests/test-supply-chain-policy.sh
+++ b/tests/test-supply-chain-policy.sh
@@ -131,21 +131,13 @@ if grep -Eq 'sum_url|tar[[:space:]]+-xzf|curl' support/ensure-jerboa.sh; then
     fail 'project-local bootstrap bypasses the authenticated installer'
 fi
 
-# Versioned Jerboa toolchains are published only as SourceHut git-tag
-# artifacts.  Keep the delivery path for macOS, Linux amd64, and FreeBSD amd64
-# free of GitHub release URLs and publication commands.
-must_contain support/sourcehut-release-upload.sh 'hut git -r "$repo" artifact upload "$file" --rev "$version"'
-for release_build in \
-    .builds/release-linux-amd64.yml \
-    .builds/release-freebsd-amd64.yml; do
-    must_contain "$release_build" 'make release-upload'
-    if grep -Eiq 'github.*release|releases/download|gh[[:space:]]+release' "$release_build"; then
-        fail "$release_build retains a GitHub release path"
-    fi
-done
-if grep -Eiq 'github.*release|releases/download|gh[[:space:]]+release' \
-    support/install.sh support/sourcehut-release-upload.sh; then
-    fail 'Jerboa release delivery retains a GitHub release path'
+# Versioned Jerboa toolchains are published only through git.jerboa.sh.
+# Keep delivery free of legacy SourceHut and GitHub release paths.
+must_contain support/forgejo-release-upload.sh '$api/repos/$owner/$repo/releases'
+must_contain support/install.sh 'https://git.jerboa.sh'
+if grep -Eiq 'git\.sr\.ht|sourcehut|github.*release|github\.com/.*/releases|gh[[:space:]]+release' \
+    support/install.sh support/forgejo-release-upload.sh; then
+    fail 'Jerboa release delivery retains a non-canonical release path'
 fi
 
 # Exercise the complete signed-manifest path with an ephemeral consumer key.
diff --git a/vendor/ChezScheme/UPSTREAM.md b/vendor/ChezScheme/UPSTREAM.md
index 50c5202..40e7e7c 100644
--- a/vendor/ChezScheme/UPSTREAM.md
+++ b/vendor/ChezScheme/UPSTREAM.md
@@ -29,7 +29,7 @@ This file (UPSTREAM.md) records *provenance* only.
 
 > This tree was originally developed in a standalone fork repo and vendored in
 > as a flat snapshot. That fork is **retired** — the source of truth is now
-> this directory. Earlier references to `git.sr.ht/~lisp/ChezScheme` are
+> this directory. Earlier references to the pre-migration ChezScheme fork are
 > historical provenance, not a live remote.
 
 ### Submodule pins (also flattened, `.git` stripped)