diff --git a/.gitignore b/.gitignore
index 8d2803a..36f7f5b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,3 @@ logs/
 # Runtime files
 *.sock
 *.pid
-
-# Local hygiene notes (not for commit)
-CLAUDE.md
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..d0dfa26
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,50 @@
+# CLAUDE.md — Repo hygiene
+
+Scope: this file covers *repo hygiene* — branching, remotes, CI — plus a
+short map of the binaries. It is not user-facing project documentation.
+
+This repo follows the branch/release workflow documented in `CONTRIBUTING.md`
+— read and follow it for any git, branch, or release work here (the
+single-trunk model, `feature/x`/`fix/x` branch naming, how RC tags work,
+etc). Don't improvise a different workflow. The short version: there is one
+long-lived branch, `main` — no `dev` or `beta` branch exists. `main`
+auto-publishes a dev-track build on every push. "Beta" and "stable" are both
+just tags, not branches: push a `vX.Y.Z-rc.N` tag to publish a beta-track
+build, push a plain `vX.Y.Z` tag to cut the signed stable release.
+"Freezing" for stabilization means pausing pushes to `main`, not moving a
+branch. This replaced an earlier three-branch (`dev`/`beta`/`main`) model
+after `main` was found to have silently rotted out of sync with `dev`/`beta`
+across most repos in this ecosystem.
+
+When starting work on a new feature, create branch `feature/<feature-name>`.
+When working on a bug or issue, create branch `fix/<issue you are fixing>`.
+
+## Remotes
+- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative.
+- `github` — GitHub mirror. Push both when publishing.
+
+## CI
+- `dev-release.yml` triggers on `push: branches: ['main']`.
+- `rc-release.yml` triggers on `vX.Y.Z-rc.N` tag pushes (beta track).
+- `release.yml` triggers on any other `v*` tag push (stable).
+  None of these run on plain commits or PRs beyond what's listed.
+
+## Architecture
+
+Two binaries + a shared lib:
+
+| Crate | Role |
+|---|---|
+| `breadsearch-shared` | XDG paths, config, IPC types, Unix-socket client |
+| `breadmill` | Daemon: walk → extract → chunk → embed → index; serves queries |
+| `breadsearch` | GTK4 layer-shell overlay: ranked document hits from breadmill |
+
+breadsearch is document/meaning search. breadbox is the app launcher. They
+are not the same overlay.
+
+`--screenshot` (`breadsearch/src/screenshot.rs`) captures the search panel
+through `bread-screenshots`; do not rewrite it just to retarget the crate pin.
+
+## Don't
+- Don't embed credentials in remote URLs — SSH or a credential helper only.
+- Don't rewrite `screenshot.rs` as part of pin/docs work.
diff --git a/Cargo.lock b/Cargo.lock
index 0e1c309..e679363 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -181,11 +181,11 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.0"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.3.0#8e82d2d833e992ce939a5b836f910ee109f2e939"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.0",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1)",
  "hex",
  "ort",
  "sha2 0.10.9",
@@ -197,17 +197,17 @@ dependencies = [
 [[package]]
 name = "bread-screenshots"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.1",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e)",
  "tracing",
 ]
 
 [[package]]
 name = "bread-theme"
-version = "0.2.3"
-source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.10#17d1bb85801b9a8c195b64c02d288cd662c9c780"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "dirs",
  "gtk4",
@@ -217,8 +217,8 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.0"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.3.0#8e82d2d833e992ce939a5b836f910ee109f2e939"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "dirs",
  "serde",
@@ -228,7 +228,7 @@ dependencies = [
 [[package]]
 name = "bread-utils"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "dirs",
  "serde",
diff --git a/README.md b/README.md
index af25de7..71663ce 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,8 @@
 
 Semantic document search for Bread OS. Type a concept — not a keyword — and get ranked hits from your documents.
 
+This is **not** [breadbox](https://git.breadway.dev/Breadway/breadbox). breadsearch is document/meaning search over your files; breadbox is the app launcher (fuzzy `.desktop` launch). They are separate overlays with separate binaries, sockets, and keybinds — even though the search panel was originally forked from breadbox's launcher UI.
+
 Two binaries in one Cargo workspace:
 
 - **breadmill** — background daemon. Walks configured directories, extracts text, chunks and embeds documents with [nomic-embed-text-v1.5](https://huggingface.co/nomic-ai/nomic-embed-text-v1.5) (768-dim ONNX), stores vectors in an HNSW index (usearch) backed by SQLite metadata, and serves queries over a Unix socket. Watches for filesystem changes and re-indexes incrementally.
diff --git a/breadmill/Cargo.toml b/breadmill/Cargo.toml
index 9faeae0..bd3a886 100644
--- a/breadmill/Cargo.toml
+++ b/breadmill/Cargo.toml
@@ -42,7 +42,7 @@ breadsearch-shared = { path = "../breadsearch-shared" }
 #   needed for the plain CPU path even in the npu build.
 ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing", "download-binaries", "tls-native", "copy-dylibs", "api-23"] }
 tokenizers = "0"
-bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.3.0" }
+bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1" }
 
 # Surfaces ort's own EP-registration tracing (e.g. a GPU EP silently failing to
 # register and falling back to CPU) as visible log output instead of nowhere.
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 3f31d22..1d2cb0b 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -10,9 +10,10 @@ path = "src/main.rs"
 
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
-bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.10", features = ["gtk"] }
+bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["gtk"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
-bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", branch = "main" }
+# Not on tag v0.7.1 (crate landed after that tag). Rev, not branch=main.
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", rev = "f86e299f4a0ea73ff485cd84923b986ddcc8242e" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"