@@ -3,11 +3,11 @@ name: CI
 on:
   pull_request:
   push:
-    # `dev` is here because the `tag` job below runs inside this workflow
-    # and is gated on `needs: [...]` plus this push trigger for main/dev.
-    # Without it, pushes to dev run no CI at all and the tag job silently
+    # `nightly` is here because the `tag` job below runs inside this workflow
+    # and is gated on `needs: [...]` plus this push trigger for main/nightly.
+    # Without it, pushes to nightly run no CI at all and the tag job silently
     # never fires.
-    branches: [main, dev]
+    branches: [main, nightly]
 
 # A new push to the same PR supersedes the previous run. Scoped to pull_request
 # only: on `main`, cancelling the previous commit's in-progress run because a
@@ -678,7 +678,7 @@ jobs:
           }
 
   # Cuts release tags from the commits themselves, once every other job in this
-  # run has passed. `dev` cuts release candidates for whichever version the
+  # run has passed. `nightly` cuts release candidates for whichever version the
   # batch is heading toward (v0.1.0rc1, v0.1.0rc2, ...) and `main` promotes that
   # same target to its final release, so they order correctly at both ends:
   #
@@ -710,7 +710,7 @@ jobs:
     # pull_request, where tagging would be actively wrong.
     if: >-
       github.event_name == 'push' &&
-      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/nightly')
     # This workflow declares contents: read at the top level. This job alone
     # needs write, to push a tag and create a release.
     permissions:
@@ -745,12 +745,12 @@ jobs:
         id: bump
         run: |
           set -euo pipefail
-          # main cuts the final release; dev cuts a candidate for the same
+          # main cuts the final release; nightly cuts a candidate for the same
           # target. tools/next_version.py owns the decision entirely.
           if [ "$GITHUB_REF" = "refs/heads/main" ]; then
             channel=stable
           else
-            channel=dev
+            channel=nightly
           fi
           new_tag=$(python3 tools/next_version.py --channel "$channel")
           echo "Channel: $channel; tag: ${new_tag:-<nothing to tag>}"
@@ -781,9 +781,9 @@ jobs:
             git push origin "refs/tags/$NEW_TAG"
           fi
 
-      # Only main publishes. Dev candidate tags exist to make builds
+      # Only main publishes. Nightly candidate tags exist to make builds
       # addressable and to give hatch-vcs a version; they are deliberately not
-      # releases, so nothing ranking releases ever sees a candidate as latest.
+      # releases, so nothing ranking releases ever sees a nightly as latest.
       - name: Create GitHub release
         if: steps.bump.outputs.channel == 'stable'
         env:
 
@@ -172,15 +172,15 @@ automatically** — a breaking marker counts as a feature, because an automatic
 major is an irreversible published mistake waiting for one mistyped subject
 line. Push a major by hand and `release.yml` will publish it.
 
-`dev` cuts candidates for the version the batch is heading toward
+`nightly` cuts candidates for the version the batch is heading toward
 (`v0.1.0rc1`, `v0.1.0rc2`, …) and `main` promotes that same target to its final
 release. Aiming candidates one version *forward* is what makes them sort
 correctly: `0.0.0 < 0.1.0rc1 < 0.1.0 < 0.2.0rc1 < 0.2.0`. This makes conventional
 commit subjects load-bearing — a `feat:` typo'd as `fix:` ships as a patch.
 
 The tagging lives in a `tag` job **inside `ci.yml`**, gated on
 `needs: [test, test-legacy, lint, bandit, nse-root, workflow-lint, build]` and
-on `github.event_name == 'push'` for `main`/`dev` only. It is deliberately
+on `github.event_name == 'push'` for `main`/`nightly` only. It is deliberately
 not a separate `workflow_run`-triggered workflow, which is how this was first
 built: zizmor — a required job in this same file — rates `workflow_run` an
 error-level dangerous trigger and exits 14, because it is the standard
@@ -192,7 +192,7 @@ head SHA. Do not reintroduce `workflow_run` here.
 Things that fail silently rather than loudly, all guarded by
 `tests/test_release_versioning.py`:
 
-- **`ci.yml` must run on pushes to `dev`.** Otherwise the tag job never runs
+- **`ci.yml` must run on pushes to `nightly`.** Otherwise the tag job never runs
   there and no candidate is ever cut, with no error anywhere.
 - **The `tag` job must keep every validating job in `needs`.** Drop one and a
   tag can land on a commit that failed it.
@@ -209,10 +209,10 @@ Version arithmetic belongs in `tools/next_version.py`, where it is unit-tested,
 never in a workflow step. hate_crack carried ~70 lines of `cut -d.` duplicated
 across two YAML files before extracting this module; do not reintroduce it here.
 
-**`main` must contain `dev`'s commits as ancestors — merge or fast-forward
-`dev` into `main`, never squash.** `tools/next_version.py` computes
+**`main` must contain `nightly`'s commits as ancestors — merge or fast-forward
+`nightly` into `main`, never squash.** `tools/next_version.py` computes
 `git log <last-tag>..HEAD` from whichever branch is tagging. A squash merge
-collapses `dev`'s already-released commits into one commit unreachable
+collapses `nightly`'s already-released commits into one commit unreachable
 from any prior tag, so that range re-lists them on `main` on every subsequent
 push, forever. This fails quietly, not loudly: versions stay monotonic (the
 squash commit itself is still "since the last release"), so nothing errors —
 
@@ -35,19 +35,19 @@ produced it.
 `nmap` against `127.0.0.1`. Keep it that way — no test in this repo may send a
 packet to an address it does not own.
 
-## Target `dev`, not `main`
+## Target `nightly`, not `main`
 
 `main` is the default branch, so GitHub will preselect it — **change the base to
-`dev`.** `main` holds the last released state and receives work only through a
-batch integration merge from `dev`. A pull request landing on `main` directly
-breaks that and creates cleanup for the maintainers.
+`nightly`.** `main` holds the last released state and receives work only
+through a batch integration merge from `nightly`. A pull request landing on
+`main` directly breaks that and creates cleanup for the maintainers.
 
 ```bash
 git clone https://github.com/<you>/spoonmap
 cd spoonmap
-git checkout -b my-change origin/dev
+git checkout -b my-change origin/nightly
 # ... work ...
-git push -u origin my-change     # then open a PR with base: dev
+git push -u origin my-change     # then open a PR with base: nightly
 ```
 
 Branch names follow a `type/short-description` pattern matching the prefixes
@@ -59,10 +59,10 @@ immediately. Say so in the PR body.
 `CLAUDE.md` describes the same flow from the maintainer side under "Release
 Versioning", and it is worth reading if you want the reasoning. The mechanic you
 do not need to do anything about, but should know exists: maintainers integrate
-`dev` into `main` with a **merge or a fast-forward, never a squash**. CI derives
-every release version from the commits themselves, and a squash merge collapses
-already-released commits into one that no prior tag can reach, which silently
-corrupts every version computed afterward.
+`nightly` into `main` with a **merge or a fast-forward, never a squash**. CI
+derives every release version from the commits themselves, and a squash merge
+collapses already-released commits into one that no prior tag can reach, which
+silently corrupts every version computed afterward.
 
 ## Every bug fix needs a regression test
 
 
@@ -218,7 +218,7 @@ run from jumpboxes inside client networks where an unprompted call out to
 performs a single check on demand. To enable the check at every startup, set
 `"check_for_updates": true` in `config.json`; the key defaults to `false` and
 omitting it entirely means `false`. Only stable releases are reported —
-pre-release candidates are never advertised as updates.
+nightly release candidates are never advertised as updates.
 
 For a summary of every flag, use `--help` (or `-h`):
 
 
@@ -7339,7 +7339,7 @@ def _tool_version():
 
 
 # Latest *release* specifically: GitHub's /releases/latest excludes
-# pre-releases, so the vX.Y.ZrcN candidates cut on `dev` are never
+# pre-releases, so the vX.Y.ZrcN candidates cut on `nightly` are never
 # advertised to an operator as an available update.
 _RELEASE_API_URL = (
     'https://api.github.com/repos/trustedsec/spoonmap/releases/latest'
 
@@ -1,7 +1,7 @@
 """Tests for tools/next_version.py -- the release policy itself.
 
 The policy is ordinary semver with the bump derived from the batch: the second
-component moves only for features, `dev` cuts release candidates for the
+component moves only for features, `nightly` cuts release candidates for the
 version the batch is heading toward, and `main` cuts the final of that same
 target.
 
@@ -43,7 +43,7 @@
         ("v2.20.0+g1234567", None),
         ("2.20.0", None),
         ("v2.20", None),
-        ("dev", None),
+        ("nightly", None),
     ],
 )
 def test_only_released_versions_are_baseline_candidates(tag, expected):
@@ -69,7 +69,7 @@ def test_latest_final_compares_numerically_not_lexically():
 
 def test_no_tags_at_all_starts_from_zero():
     assert latest_final([]) == (0, 0, 0)
-    assert latest_final(["dev", "some-marker"]) == (0, 0, 0)
+    assert latest_final(["nightly", "some-marker"]) == (0, 0, 0)
 
 
 # --- feature detection ------------------------------------------------------
@@ -148,7 +148,7 @@ def test_an_empty_batch_has_no_target():
     than invent a version."""
     assert target_version((2, 20, 0), []) is None
     assert compute("stable", ["v2.20.0"], []) is None
-    assert compute("dev", ["v2.20.0"], []) is None
+    assert compute("nightly", ["v2.20.0"], []) is None
 
 
 # --- candidate numbering ----------------------------------------------------
@@ -180,14 +180,14 @@ def test_candidate_numbering_survives_a_deleted_tag():
 # --- the two channels, and the ordering that motivates the whole design -----
 
 
-def test_dev_cuts_a_candidate_for_the_next_version():
+def test_nightly_cuts_a_candidate_for_the_next_version():
     tags = ["v2.20.0"]
-    assert compute("dev", tags, ["fix: a"]) == "v2.20.1rc1"
-    assert compute("dev", tags, ["feat: a"]) == "v2.21.0rc1"
+    assert compute("nightly", tags, ["fix: a"]) == "v2.20.1rc1"
+    assert compute("nightly", tags, ["feat: a"]) == "v2.21.0rc1"
 
 
 def test_main_cuts_the_final_of_the_same_target():
-    """Merging dev down promotes the candidate rather than inventing a
+    """Merging nightly down promotes the candidate rather than inventing a
     different number: the fix-only cycle above ends at 2.20.1, not 2.21.0."""
     tags = ["v2.20.0", "v2.20.1rc1", "v2.20.1rc2"]
     assert compute("stable", tags, ["fix: a"]) == "v2.20.1"
@@ -201,9 +201,9 @@ def test_candidates_sort_above_the_previous_release_and_below_their_own():
     it becomes. Asserted end to end across a whole fix-only cycle.
     """
     shipped = parse("2.20.0")
-    rc1 = parse(compute("dev", ["v2.20.0"], ["fix: a"]).lstrip("v"))
+    rc1 = parse(compute("nightly", ["v2.20.0"], ["fix: a"]).lstrip("v"))
     rc2 = parse(
-        compute("dev", ["v2.20.0", "v2.20.1rc1"], ["fix: a", "fix: b"]).lstrip("v")
+        compute("nightly", ["v2.20.0", "v2.20.1rc1"], ["fix: a", "fix: b"]).lstrip("v")
     )
     final = parse(
         compute("stable", ["v2.20.0", "v2.20.1rc1", "v2.20.1rc2"], ["fix: a"]).lstrip(
@@ -220,7 +220,7 @@ def test_a_feature_cycle_also_orders_correctly_against_the_fix_cycle():
     """2.20.1 < 2.21.0rc1 < 2.21.0 -- a candidate for the next minor must not
     look older than the patch release that preceded it."""
     patch_release = parse("2.20.1")
-    rc = parse(compute("dev", ["v2.20.1"], ["feat: a"]).lstrip("v"))
+    rc = parse(compute("nightly", ["v2.20.1"], ["feat: a"]).lstrip("v"))
     final = parse(compute("stable", ["v2.20.1", "v2.21.0rc1"], ["feat: a"]).lstrip("v"))
     assert patch_release < rc < final
 
@@ -301,9 +301,9 @@ def test_commit_messages_since_baseline_excludes_the_baseline_itself(tmp_path):
 
 
 def test_baseline_need_not_be_reachable_from_head(tmp_path):
-    """main's release tag can sit on a commit dev does not contain.
+    """main's release tag can sit on a commit nightly does not contain.
 
-    A reachability-restricted baseline would compute the next dev from a
+    A reachability-restricted baseline would compute the next nightly from a
     stale release and hand out a version below what already shipped.
     """
     repo = tmp_path / "repo"
@@ -320,24 +320,24 @@ def test_baseline_need_not_be_reachable_from_head(tmp_path):
     _git("commit", "-qm", "fix: released on main", cwd=repo)
     _git("tag", "v2.20.1", cwd=repo)
 
-    _git("checkout", "-q", "-b", "dev", "v2.20.0", cwd=repo)
-    (repo / "f.txt").write_text("dev\n")
+    _git("checkout", "-q", "-b", "nightly", "v2.20.0", cwd=repo)
+    (repo / "f.txt").write_text("nightly\n")
     _git("add", "-A", cwd=repo)
-    _git("commit", "-qm", "fix: on the dev branch", cwd=repo)
+    _git("commit", "-qm", "fix: on the nightly branch", cwd=repo)
 
     tags = [t for t in _git("tag", cwd=repo).splitlines() if t.strip()]
     assert latest_final(tags) == (2, 20, 1), "baseline must see main's release tag"
 
     messages = commit_messages(str(repo), (2, 20, 1))
-    got = compute("dev", tags, messages)
+    got = compute("nightly", tags, messages)
     assert got == "v2.20.2rc1", (
-        f"the next dev must sort above the release that already shipped, got {got}"
+        f"the next nightly must sort above the release that already shipped, got {got}"
     )
     assert parse("2.20.1") < parse(got.lstrip("v"))
 
 
-def test_main_prints_candidate_for_dev(tmp_path, capsys):
-    """main(["--channel", "dev", "--repo-dir", str(repo)]) returns 0 and
+def test_main_prints_candidate_for_nightly(tmp_path, capsys):
+    """main(["--channel", "nightly", "--repo-dir", str(repo)]) returns 0 and
     prints a candidate tag matching ^v\\d+\\.\\d+\\.\\d+rc\\d+$."""
     repo = tmp_path / "repo"
     repo.mkdir()
@@ -348,10 +348,10 @@ def test_main_prints_candidate_for_dev(tmp_path, capsys):
 
     from tools.next_version import main
 
-    result = main(["--channel", "dev", "--repo-dir", str(repo)])
+    result = main(["--channel", "nightly", "--repo-dir", str(repo)])
     assert result == 0
     captured = capsys.readouterr()
-    assert captured.out.strip(), "dev must print a tag"
+    assert captured.out.strip(), "nightly must print a tag"
     assert captured.out.strip().startswith("v")
     # Verify format: v0.0.1rc1
     import re
@@ -429,4 +429,4 @@ def test_a_repository_with_no_tags_cuts_the_first_patch():
 def test_a_first_batch_containing_a_feature_cuts_the_first_minor():
     """The whole history is one batch on the first run, so a single `feat`
     anywhere in it takes the first release to 0.1.0 rather than 0.0.1."""
-    assert compute("dev", [], ["fix: a", "feat: b", "docs: c"]) == "v0.1.0rc1"
+    assert compute("nightly", [], ["fix: a", "feat: b", "docs: c"]) == "v0.1.0rc1"
@@ -71,10 +71,10 @@ def _normalize_yaml_expr(expr):
 
 
 def test_ci_runs_on_pushes_to_both_release_branches():
-    """A push to `dev` that runs no CI would never reach the tag job, and
+    """A push to `nightly` that runs no CI would never reach the tag job, and
     no candidate would ever be cut. Nothing errors; tags just stop appearing."""
     branches = _triggers(_load('ci.yml'))['push']['branches']
-    assert 'dev' in branches
+    assert 'nightly' in branches
     assert 'main' in branches
 
 
@@ -116,7 +116,7 @@ def test_the_tag_job_never_runs_on_pull_requests():
     # Must assert the full expression to catch && → || mutations
     expected = _normalize_yaml_expr(
         "github.event_name == 'push' && "
-        "(github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')"
+        "(github.ref == 'refs/heads/main' || github.ref == 'refs/heads/nightly')"
     )
     assert normalized == expected, f'Expected: {expected}\nGot: {normalized}'
 
@@ -230,17 +230,17 @@ def test_exactly_one_call_to_the_policy_module():
 
 
 def test_both_channels_are_reachable():
-    """main cuts the final release, dev cuts a candidate for the same
+    """main cuts the final release, nightly cuts a candidate for the same
     target. A job that only ever computed one channel would silently tag
-    dev builds as releases, or never cut a release at all."""
+    nightly builds as releases, or never cut a release at all."""
     script = _step_script(_job('ci.yml', 'tag'), 'Compute tag')
     assert 'channel=stable' in script
-    assert 'channel=dev' in script
+    assert 'channel=nightly' in script
 
 
 @pytest.mark.parametrize('branch,expected_channel', [
     ('refs/heads/main', 'stable'),
-    ('refs/heads/dev', 'dev'),
+    ('refs/heads/nightly', 'nightly'),
 ])
 def test_compute_tag_step_assigns_correct_channel(branch, expected_channel, tmp_path):
     """The Compute tag step must actually WRITE the channel and new_tag outputs
@@ -287,11 +287,11 @@ def test_compute_tag_step_assigns_correct_channel(branch, expected_channel, tmp_
 
     # Validate new_tag value shape without guarding. Empty is legitimate when HEAD
     # sits exactly on a tag (no new commits). Non-empty must match the channel's
-    # tag format: stable uses v0.1.0, dev uses v0.1.0rc1.
+    # tag format: stable uses v0.1.0, nightly uses v0.1.0rc1.
     new_tag = parsed['new_tag']
     if expected_channel == 'stable':
         tag_pattern = r'^v\d+\.\d+\.\d+$'
-    else:  # dev
+    else:  # nightly
         tag_pattern = r'^v\d+\.\d+\.\d+rc\d+$'
 
     # Assert value is either empty or matches the channel-appropriate format.
@@ -333,7 +333,7 @@ def test_no_shell_version_arithmetic():
 
 
 def test_only_stable_publishes_a_release():
-    """Dev candidates exist to make builds addressable, not to be releases.
+    """Nightly candidates exist to make builds addressable, not to be releases.
     Publishing them would make anything ranking releases see a candidate as
     latest. Assert the full if condition, not fragments."""
     release_steps = [
@@ -401,7 +401,7 @@ def test_create_tag_pushes_the_tag(repo_with_remote):
     # also push any branch refs the local repo happens to carry) would leave
     # the tag assertion above passing while silently also moving/creating a
     # branch on the remote -- something this job has no business doing; only
-    # main and dev themselves are supposed to advance, and only by a real
+    # main and nightly themselves are supposed to advance, and only by a real
     # merge, never by this tagging step.
     branches_after = set(_git(remote, 'branch').split())
     assert branches_after == branches_before, (
@@ -435,7 +435,7 @@ def test_the_policy_module_agrees_with_this_repository():
     test would see."""
     result = subprocess.run(
         ['python3', os.path.join(REPO_ROOT, 'tools', 'next_version.py'),
-         '--channel', 'dev', '--repo-dir', REPO_ROOT],
+         '--channel', 'nightly', '--repo-dir', REPO_ROOT],
         capture_output=True, text=True,
     )
     assert result.returncode == 0, result.stderr