@@ -49,12 +49,6 @@ DONT-MERGE/
 web/vendor/face-detection/*.binarypb
 web/vendor/face-detection/*.tflite
 web/vendor/face-detection/*.wasm
-# A retired local artifact, not a vendored file: the avatar model is fetched by
-# the browser now and nothing puts it here any more. Ignored so that a checkout
-# predating that change keeps its leftover copy invisible to git until
-# scripts/fetch-vendor.sh removes it. Delete this line once no such checkout is
-# plausible.
-web/vendor/avatar/jim.vrm
 # Same rule for Pyodide, pinned in web/vendor/pyodide/SHA256SUMS: 13.7 MB of
 # interpreter, glue and stdlib, none of which changes without a version bump.
 web/vendor/pyodide/*.js
 
@@ -31,9 +31,8 @@ not packaged as widely, so the gate falls back to its container image, pinned to
 the version the workflow installs, whenever the binary is absent and a docker
 daemon answers. CI installs all three, so what is optional locally is enforced
 on a pull request — the summary exists so that a contributor knows which of the
-two they are looking at. One lane needs `javac` 16 or newer and is skipped on an
-older JDK; that is the Java class-harness fixture and nothing else depends on
-it.
+two they are looking at. One lane needs working `javac` and `java`; the Java
+class-harness fixture uses Java 8 syntax, and nothing else depends on it.
 
 Where the time goes, measured on this repo rather than guessed, because the
 answer is not the one a first look gives. Warm, the two Rust lanes are seconds:
 
@@ -65,8 +65,7 @@ rest.
 - `tests/web.rs`: `responses_carry_baseline_security_headers`,
   `production_policy_names_no_loopback_origins`, and
   `the_recording_template_is_reachable_under_a_policy_that_permits_its_room`
-  all pass. Each asserts with `contains`, and this change only adds entries, so
-  no existing assertion moved.
+  all pass.
 - `cargo fmt --check` and `cargo clippy --lib` clean.
 - Confirmed against the live symptom: the CSP refusal disappeared from the
   browser console and the request reached LiveKit.
 
@@ -14,8 +14,11 @@ VENDOR="$ROOT/web/vendor"
 
 [ -d "$VENDOR" ] || exit 0
 
-# Releases no longer embed or serve this model; browser Cache API owns it now.
-# Remove the ignored file left by pre-migration checkouts on their next build.
+# The avatar model used to be pinned here and fetched like everything else; it
+# is loaded from its own origin into the browser cache now. A checkout from
+# before that still has the file, nothing pins it any more, and
+# `verify-vendor.sh` refuses an unpinned file in this tree, so the first build
+# after upgrading fails on a leftover this script is the one placed to clear.
 rm -f "$VENDOR/avatar/jim.vrm"
 
 download()
 
@@ -9,7 +9,7 @@ set -u
 
 remote=${1:-}
 
-# From the repository, not from $0: git invokes the hook through the symlink in
+# From the repository, not from $0: git invokes the hook through the wrapper in
 # .git/hooks, so dirname of $0 names that directory and not scripts/. Hooks run
 # with the working tree root as the working directory.
 script_dir=$(git rev-parse --show-toplevel)/scripts
 
@@ -32,23 +32,9 @@ ours()
     [ -f "$1" ] && wrapper "$2" | cmp -s - "$1"
 }
 
-# Before wrappers, this installer made absolute links into a worktree. Accept
-# only one that names a worktree Git says belongs to this repository, so an
-# unrelated local hook remains untouched while an upgrade fixes the old link.
-legacy_ours()
-{
-    [ -L "$1" ] || return 1
-    link=$(readlink "$1") || return 1
-    base=${link%/scripts/git-"$2".sh}
-    [ "$base" != "$link" ] && [ -d "$base" ] || return 1
-    worktree=$(git -C "$base" rev-parse --show-toplevel 2> /dev/null) || return 1
-    git worktree list --porcelain | grep -Fqx "worktree $worktree"
-}
-
 if [ "$mode" = uninstall ]; then
     for target in "$hooks"/*; do
-        ours "$target" "${target##*/}" \
-            || legacy_ours "$target" "${target##*/}" || continue
+        ours "$target" "${target##*/}" || continue
         rm -f "$target"
         printf '  RM      %s\n' "${target##*/}"
     done
@@ -70,11 +56,6 @@ for hook in "$ROOT"/scripts/git-*.sh; do
         # nothing runs.
         chmod +x "$target" || failed=1
         printf '  OK      %s\n' "$name"
-    elif legacy_ours "$target" "$name" \
-        && rm -f "$target" \
-        && wrapper "$name" > "$target" \
-        && chmod +x "$target"; then
-        printf '  HOOK    %s\n' "$name"
     elif [ -e "$target" ] || [ -L "$target" ]; then
         printf '  KEEP    %s already exists; remove it to install ours\n' "$target"
     elif wrapper "$name" > "$target" && chmod +x "$target"; then
 
@@ -212,13 +212,9 @@ git worktree add -q -b linked "$work/linked" || exit 1
     && cp scripts/git-*.sh scripts/install-git-hooks.sh "$work/linked/scripts/") \
     || exit 1
 rm -f "$hooks/pre-commit"
-ln -s "$PWD/scripts/git-pre-commit.sh" "$hooks/pre-commit" || exit 1
 (cd "$work/linked" && ./scripts/install-git-hooks.sh > "$work/linked.out") || exit 1
-absent "linked installer keeps no hook from another worktree" "$work/linked.out" "KEEP"
+contains "linked installer installs its hook" "$work/linked.out" "HOOK    pre-commit"
 cases=$((cases + 1))
-if [ -L "$hooks/pre-commit" ]; then
-    fail "linked installer did not replace the old link"
-fi
 printf '#!/bin/sh\nexit 1\n' > scripts/git-pre-commit.sh
 (cd "$work/linked" \
     && printf '#!/bin/sh\n\necho staged\n' > linked.sh \
 
@@ -42,8 +42,7 @@ status=0
 # Every vendored file needs a line in the SHA256SUMS beside it. `basename` is
 # what the sums files record, matching the `cd && sha256sum -c` convention.
 # README and LICENSE are provenance, not bytes the browser runs, so they are the
-# only things allowed to be unpinned. The ignored legacy model is no longer
-# shipped or served, but can remain in pre-migration worktrees.
+# only things allowed to be unpinned.
 #
 # Collected rather than piped into the loop, for two reasons. A pipeline reports
 # the status of its last command, so `find | while` skips a subtree it cannot
@@ -54,7 +53,7 @@ status=0
 # The `||` has to stay out here rather than move into a helper the two walks
 # share: `exit` inside `$(...)` leaves the substitution, not the script, and the
 # silent pass is back.
-files=$(find "$VENDOR" -type f ! -path "$VENDOR/avatar/jim.vrm" ! -name SHA256SUMS ! -name FETCH ! -name 'README*' ! -name 'LICENSE*') \
+files=$(find "$VENDOR" -type f ! -name SHA256SUMS ! -name FETCH ! -name 'README*' ! -name 'LICENSE*') \
     || {
         echo "verify-vendor: cannot scan ${VENDOR#"$ROOT"/}" >&2
         exit 1
 
@@ -193,18 +193,6 @@ fn static_candidates(path: &str) -> Option<Vec<String>> {
         .collect::<Vec<_>>()
         .join("/");
 
-    // `jim.vrm` used to be fetched into checkouts and disk assets override the
-    // embedded store. It is now browser-cached from its pinned source, so
-    // refuse the retired URL even when an old ignored file remains on disk.
-    //
-    // Case-insensitively, because the comparison has to be at least as
-    // forgiving as the filesystem underneath it. macOS and Windows both resolve
-    // `JIM.VRM` to the leftover file, so an exact match refused one spelling
-    // and served 10.9 MB for every other. ASCII is the whole alphabet a
-    // vendored filename may use, which `is_refused_segment` already enforces.
-    if clean.eq_ignore_ascii_case("vendor/avatar/jim.vrm") {
-        return None;
-    }
     if clean.is_empty() {
         return Some(vec!["index.html".to_string()]);
     }
 
@@ -66,9 +66,7 @@ test("avatar vendor manifest pins every redistributed file", () => {
   // SHA256SUMS cannot pin itself, and licenses are provenance rather than bytes
   // the browser runs, which is the same carve-out scripts/verify-vendor.sh
   // makes. Nothing in this directory is fetched any more, so there is no FETCH.
-  // Old checkouts can retain the once-fetched model. It is neither served nor
-  // embedded now, and verify-vendor likewise ignores that retired local path.
-  const exempt = new Set(["SHA256SUMS", "README.md", "LICENSE-three.txt", "LICENSE-three-vrm.txt", "LICENSE-jim-vrm.txt", "jim.vrm"]);
+  const exempt = new Set(["SHA256SUMS", "README.md", "LICENSE-three.txt", "LICENSE-three-vrm.txt", "LICENSE-jim-vrm.txt"]);
   assert.deepEqual(vendored.filter((name) => !hashed.has(name) && !exempt.has(name)), []);
   for (const license of ["LICENSE-three.txt", "LICENSE-three-vrm.txt"]) {
     assert.match(read(`web/vendor/avatar/${license}`), /MIT/, `${license} must carry its terms`);
@@ -108,9 +106,11 @@ test("avatar vendor manifest pins every redistributed file", () => {
   assert.match(read("Makefile"), /verify-vendor:\n\t@\.\/scripts\/verify-vendor\.sh/);
   // And the checker must find directories by glob, not by name, or a new
   // vendor directory is unpinned and silent about it.
-  assert.match(read("scripts/verify-vendor.sh"), /find "\$VENDOR" -name SHA256SUMS/);
-  assert.match(read("scripts/verify-vendor.sh"), /! -path "\$VENDOR\/avatar\/jim\.vrm"/);
-  assert.doesNotMatch(read("scripts/verify-vendor.sh"), /face-detection/);
+  const verifier = read("scripts/verify-vendor.sh");
+  assert.match(verifier, /find "\$VENDOR" -name SHA256SUMS/);
+  assert.match(verifier, /find "\$VENDOR" -type f ! -name SHA256SUMS/);
+  assert.doesNotMatch(verifier, /! -path/);
+  assert.doesNotMatch(verifier, /face-detection/);
 });
 
 test("avatar dom contract", () => {