diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..ecfa67fc
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,35 @@
+# Line-ending policy.
+#
+# `* text=auto` lets git normalise text files to LF in the repository and convert
+# to the platform's native line endings on checkout. That default is fine for
+# .md / .rs / .toml / .py — broken for shell scripts and Dockerfiles, where
+# CRLF on the shebang line causes Linux exec to look for an interpreter named
+# `/bin/sh\r` (or similar) and fail with "no such file or directory".
+#
+# Force LF for anything that ends up executed inside a Linux container or a
+# POSIX shell. This is what prevented the v0.8.0 image from booting at first
+# build until the entrypoint was renormalised.
+* text=auto
+*.sh        text eol=lf
+*.bash      text eol=lf
+verify      text eol=lf
+Dockerfile* text eol=lf
+docker/*    text eol=lf
+scripts/*   text eol=lf
+
+# Binary blobs that should never be touched by text-normalisation.
+*.bin       binary
+*.png       binary
+*.jpg       binary
+*.jpeg      binary
+*.gif       binary
+*.ico       binary
+*.zip       binary
+*.tar       binary
+*.tgz       binary
+*.gz        binary
+*.wasm      binary
+*.rvf       binary
+*.task      binary
+*.csi.jsonl binary
+*.pcap      binary
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 197b6f7c..7fcc3fc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,7 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   regime classification) and `temporal-compare` (DTW pattern matching) as a
   **parallel tap** alongside RuView's existing event pipeline — no replacement,
   no behaviour change to the existing `/ws/sensing` fan-out or `wifi-densepose-signal`
-  DSP. Two new endpoints (off by default, enabled via `--introspection`):
+  DSP. Two new endpoints (always mounted — the tap is cheap enough at 0.041 ms p99
+  per-frame `update()` to ship hot by default):
   - `GET /ws/introspection` — newline-delimited JSON snapshots streamed at the CSI
     frame rate. Each snapshot carries `frame_count`, `regime` (Idle / Periodic /
     Transient / Chaotic / Unknown), `lyapunov_exponent`, `attractor_dim`,
diff --git a/docker/Dockerfile.rust b/docker/Dockerfile.rust
index 018e8dad..cb046265 100644
--- a/docker/Dockerfile.rust
+++ b/docker/Dockerfile.rust
@@ -3,7 +3,11 @@
 # Multi-stage build for minimal final image
 
 # Stage 1: Build
-FROM rust:1.85-bookworm AS builder
+# Rust 1.87+ is required: `hnsw_rs 0.3.4` (transitive via wifi-densepose-ruvector ->
+# ruvector-attn-mincut) uses `u*::is_multiple_of`, stabilised in 1.87. Pinning to a
+# recent stable (1.90) for reproducibility — bump cautiously since reproducible
+# builds rely on this.
+FROM rust:1.90-bookworm AS builder
 
 WORKDIR /build