diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 039169a..f45eeda 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
       matrix:
         node: ["20.19.0", "22.23.1", "24.18.0"]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
@@ -43,7 +43,7 @@ jobs:
     needs: node
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
           name: package-contract
diff --git a/.github/workflows/l9-lint-test-node.yml b/.github/workflows/l9-lint-test-node.yml
deleted file mode 100644
index 5efa2e4..0000000
--- a/.github/workflows/l9-lint-test-node.yml
+++ /dev/null
@@ -1,156 +0,0 @@
-# L9 consumer lint + test workflow for Node.js / TypeScript
-#
-# Copied from Quantum-L9/l9-ci-core docs/templates/l9-lint-test-node.yml.
-# Node counterpart to l9-lint-test.yml (Python). Provides the TypeScript/Node
-# hygiene half that v1's pr-pipeline never covered.
-#
-# Three independent gates (each surfaces as its own required check):
-#   lint       -> eslint .          lint / style / correctness (your eslint config)
-#   typecheck  -> tsc --noEmit      type-check the whole tree against the type
-#                                   system (honors tsconfig, e.g. strict: true).
-#                                   NO compiled output; it proves the types are
-#                                   sound, it does not run the code.
-#   test       -> vitest run        one-shot, non-interactive run of *.test.ts.
-#                                   `run` is mandatory in CI — bare `vitest` is
-#                                   watch mode and would hang the job forever.
-#
-# v2 conventions: immutable event-revision checkout, contents: read only (no
-# write scopes). Node comes preinstalled on ubuntu-latest; see the optional
-# setup-node block to pin a specific version. Package manager auto-detected
-# from the lockfile (npm / pnpm / yarn).
-name: L9 Lint and Test (Node)
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: l9-lint-test-node-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-# ── Reusable anchors kept inline per job (templates must stay copy-paste-able).
-# Each job: immutable checkout -> install deps -> run one gate.
-
-jobs:
-  lint:
-    name: ESLint
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout immutable event revision
-        env:
-          REPOSITORY: ${{ github.repository }}
-          REVISION: ${{ github.sha }}
-          TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git init .
-          git remote add origin \
-            "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git"
-          git -c protocol.version=2 fetch --depth=1 origin "${REVISION}"
-          git checkout --detach FETCH_HEAD
-          git remote set-url origin "https://github.com/${REPOSITORY}.git"
-      # OPTIONAL — pin Node. ubuntu-latest ships Node 20+, used as-is. To pin,
-      # uncomment and set a full 40-char SHA you trust for actions/setup-node:
-      # - uses: actions/setup-node@<full-40-char-sha>  # v4.x
-      #   with:
-      #     node-version-file: package.json   # or .nvmrc, or node-version: "20"
-      - name: Install dependencies
-        run: |
-          set -euo pipefail
-          corepack enable || true
-          if [ -f pnpm-lock.yaml ]; then
-            corepack prepare pnpm@latest --activate && pnpm install --frozen-lockfile
-          elif [ -f yarn.lock ]; then
-            corepack prepare yarn@stable --activate && yarn install --immutable
-          elif [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
-            npm ci
-          else
-            npm install
-          fi
-      - name: ESLint
-        run: npx --no-install eslint . || npx eslint .
-
-  typecheck:
-    name: tsc --noEmit
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout immutable event revision
-        env:
-          REPOSITORY: ${{ github.repository }}
-          REVISION: ${{ github.sha }}
-          TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git init .
-          git remote add origin \
-            "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git"
-          git -c protocol.version=2 fetch --depth=1 origin "${REVISION}"
-          git checkout --detach FETCH_HEAD
-          git remote set-url origin "https://github.com/${REPOSITORY}.git"
-      - name: Install dependencies
-        run: |
-          set -euo pipefail
-          corepack enable || true
-          if [ -f pnpm-lock.yaml ]; then
-            corepack prepare pnpm@latest --activate && pnpm install --frozen-lockfile
-          elif [ -f yarn.lock ]; then
-            corepack prepare yarn@stable --activate && yarn install --immutable
-          elif [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
-            npm ci
-          else
-            npm install
-          fi
-      - name: Type-check (tsc --noEmit)
-        run: npx --no-install tsc --noEmit || npx tsc --noEmit
-
-  test:
-    name: Vitest
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout immutable event revision
-        env:
-          REPOSITORY: ${{ github.repository }}
-          REVISION: ${{ github.sha }}
-          TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          git init .
-          git remote add origin \
-            "https://x-access-token:${TOKEN}@github.com/${REPOSITORY}.git"
-          git -c protocol.version=2 fetch --depth=1 origin "${REVISION}"
-          git checkout --detach FETCH_HEAD
-          git remote set-url origin "https://github.com/${REPOSITORY}.git"
-      - name: Install dependencies
-        run: |
-          set -euo pipefail
-          corepack enable || true
-          if [ -f pnpm-lock.yaml ]; then
-            corepack prepare pnpm@latest --activate && pnpm install --frozen-lockfile
-          elif [ -f yarn.lock ]; then
-            corepack prepare yarn@stable --activate && yarn install --immutable
-          elif [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
-            npm ci
-          else
-            npm install
-          fi
-      - name: Vitest (one-shot, non-interactive)
-        env:
-          CI: "true"
-        run: npx --no-install vitest run || npx vitest run
-        # For coverage, install @vitest/coverage-v8 and use:
-        #   npx vitest run --coverage
diff --git a/.github/workflows/l9-node-ts-monorepo.yml b/.github/workflows/l9-node-ts-monorepo.yml
deleted file mode 100644
index 1be6ba5..0000000
--- a/.github/workflows/l9-node-ts-monorepo.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-# Quantum-L9 org starter — Node/TypeScript monorepo pipeline.
-# Inline jobs for install/typecheck/test/publish-dry-run.
-# Security and Scorecard delegate to l9-ci-core kernels; do not add logic to those jobs.
-name: "L9 Node/TS Monorepo Pipeline"
-on:
-  pull_request:
-    branches: [main, 'release/**']
-  push:
-    branches: [main]
-
-jobs:
-  install-and-typecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: "20"
-          cache: "npm"
-      - name: Install dependencies
-        run: npm ci
-      - name: Type-check
-        run: |
-          if node -e "const s=(require('./package.json').scripts||{});process.exit(s.typecheck?0:1)"; then
-            npm run typecheck
-          elif node -e "const s=(require('./package.json').scripts||{});process.exit(s['verify:types']?0:1)"; then
-            npm run verify:types
-          else
-            npx tsc --noEmit
-          fi
-
-  test-by-segment:
-    needs: install-and-typecheck
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: "20"
-          cache: "npm"
-      - name: Install dependencies
-        run: npm ci
-      - name: Run tests (Vitest)
-        run: npx vitest run
-
-  publish-dry-run:
-    needs: test-by-segment
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: "20"
-          cache: "npm"
-      - name: Install dependencies
-        run: npm ci
-      - name: Publish dry-run (all public packages)
-        run: |
-          dirs="."
-          if [ -d "packages" ]; then
-            dirs="packages/*/"
-          fi
-          for pkg_dir in $dirs; do
-            pkg_json="${pkg_dir%/}/package.json"
-            if [ ! -f "$pkg_json" ]; then continue; fi
-            private=$(node -e "const p=require('./$pkg_json'); console.log(p.private === true)")
-            if [ "$private" = "false" ]; then
-              echo "--- Dry-run: $pkg_dir ---"
-              (cd "$pkg_dir" && npm publish --dry-run)
-            else
-              echo "--- Skipping private package: $pkg_dir ---"
-            fi
-          done
-
-  security:
-    uses: Quantum-L9/l9-ci-core/.github/workflows/security.yml@v1
-    secrets: inherit
-    with:
-      python-version: "3.12"
-      run-npm-audit: true
-
-  scorecard:
-    uses: Quantum-L9/l9-ci-core/.github/workflows/scorecard.yml@v1
-    secrets: inherit
diff --git a/.github/workflows/l9-release.yml b/.github/workflows/l9-release.yml
deleted file mode 100644
index 579d78d..0000000
--- a/.github/workflows/l9-release.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-# Quantum-L9 org starter — Versioned release build and PyPI publish. Calls l9-ci-core kernel; do not add logic here.
-name: "L9 Release"
-on:
-  push:
-    tags: ['v*.*.*']
-
-jobs:
-  l9_release:
-    uses: Quantum-L9/l9-ci-core/.github/workflows/release-publish.yml@v1
-    secrets: inherit
-    with:
-      python-version: "3.12"
-      publish-to-pypi: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index abcbdf8..33c033b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -9,7 +9,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.18.0
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 0ae9565..3771136 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -9,7 +9,7 @@ jobs:
   sbom:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 24.18.0
diff --git a/tools/pr-remediation/README.md b/tools/pr-remediation/README.md
new file mode 100644
index 0000000..0d7ec3d
--- /dev/null
+++ b/tools/pr-remediation/README.md
@@ -0,0 +1,32 @@
+# PR Remediation Tooling (Historical)
+
+These scripts were used to rebuild and push a stacked chain of pack-remediation
+commits across a set of open pull requests against `Quantum-L9/LLM-Router`
+(referenced PR numbers: 2, 8-17, 18). They fix historical defects such as:
+
+- `fix-boundary-chain.sh` — adds the provider-boundary ESLint rule to PR stages
+  that lacked it.
+- `fix-eslint-chain.sh` — patches `eslint.config.js` so the required `eslint .`
+  check passes on affected stages.
+- `fix-lockfile-chain.sh` — fixes CI steps on stages missing `package-lock.json`.
+- `fix-pin-prs.sh` — maps PR numbers to branch names for the transplant chain.
+- `fix-readfile-chain.sh` — removes an unused `readFile` import from
+  `scripts/verify-package.mjs`.
+- `fix-sha-chain.sh` — fixes truncated `actions/upload-artifact` SHA pins in
+  `ci.yml` / `supply-chain.yml`.
+- `push-remediation.sh`, `push-transplants.sh` — push remediation/transplant
+  branches to their live PR head branches.
+- `s4036-fix.sh` — fixes SonarCloud rule `javascript:S4036` in
+  `scripts/verify-package.mjs`.
+- `sonar-fix.sh` — applies SonarCloud remediation per PR branch.
+- `transplant.sh` — rebuilds the canonical transplant-commit chain onto `main`.
+- `push-results.txt` — recorded outcome of one push run (mixed
+  success/failure across PR branches).
+
+Relocated from the repository root (2026-07-28) per the L9 repository
+instantiation audit and remediation plan: these files had no consumer in
+`package.json`, GitHub Actions workflows, or documentation, and their
+presence at root implied they were part of the shipped project surface.
+They are retained here, out of the package root, pending confirmation that
+all referenced pull requests are merged or closed, at which point they can
+be deleted.
diff --git a/fix-boundary-chain.sh b/tools/pr-remediation/fix-boundary-chain.sh
similarity index 100%
rename from fix-boundary-chain.sh
rename to tools/pr-remediation/fix-boundary-chain.sh
diff --git a/fix-eslint-chain.sh b/tools/pr-remediation/fix-eslint-chain.sh
similarity index 100%
rename from fix-eslint-chain.sh
rename to tools/pr-remediation/fix-eslint-chain.sh
diff --git a/fix-lockfile-chain.sh b/tools/pr-remediation/fix-lockfile-chain.sh
similarity index 100%
rename from fix-lockfile-chain.sh
rename to tools/pr-remediation/fix-lockfile-chain.sh
diff --git a/fix-pin-prs.sh b/tools/pr-remediation/fix-pin-prs.sh
similarity index 100%
rename from fix-pin-prs.sh
rename to tools/pr-remediation/fix-pin-prs.sh
diff --git a/fix-readfile-chain.sh b/tools/pr-remediation/fix-readfile-chain.sh
similarity index 100%
rename from fix-readfile-chain.sh
rename to tools/pr-remediation/fix-readfile-chain.sh
diff --git a/fix-sha-chain.sh b/tools/pr-remediation/fix-sha-chain.sh
similarity index 100%
rename from fix-sha-chain.sh
rename to tools/pr-remediation/fix-sha-chain.sh
diff --git a/push-remediation.sh b/tools/pr-remediation/push-remediation.sh
similarity index 100%
rename from push-remediation.sh
rename to tools/pr-remediation/push-remediation.sh
diff --git a/push-results.txt b/tools/pr-remediation/push-results.txt
similarity index 100%
rename from push-results.txt
rename to tools/pr-remediation/push-results.txt
diff --git a/push-transplants.sh b/tools/pr-remediation/push-transplants.sh
similarity index 100%
rename from push-transplants.sh
rename to tools/pr-remediation/push-transplants.sh
diff --git a/s4036-fix.sh b/tools/pr-remediation/s4036-fix.sh
similarity index 100%
rename from s4036-fix.sh
rename to tools/pr-remediation/s4036-fix.sh
diff --git a/sonar-fix.sh b/tools/pr-remediation/sonar-fix.sh
similarity index 100%
rename from sonar-fix.sh
rename to tools/pr-remediation/sonar-fix.sh
diff --git a/transplant.sh b/tools/pr-remediation/transplant.sh
similarity index 100%
rename from transplant.sh
rename to tools/pr-remediation/transplant.sh