diff --git a/.github/workflows/freebsd-build-lite.yml b/.github/workflows/freebsd-build-lite.yml
index 17df49a..5d04e9b 100644
--- a/.github/workflows/freebsd-build-lite.yml
+++ b/.github/workflows/freebsd-build-lite.yml
@@ -1,7 +1,7 @@
 name: FreeBSD Build (lite)
 
 # Швидкий компайл-чек + юніт-тести: boot + pkg + компіляція + лінк
-# crate(1) + юніт-сюїта (~3-5 хв, стабільно зелений).
+# crate(1)/crated/crate-snmpd + юніт-сюїта (~4 хв, стабільно зелений).
 #
 # Це ЄДИНЕ авто-FreeBSD-покриття: бігає на КОЖЕН пуш (включно з main).
 # Повна збірка (функціональні тести + ci-verify) у freebsd-build.yml
@@ -9,6 +9,13 @@ name: FreeBSD Build (lite)
 # непридатні (per-boot SSH/DNS-флейк + >90 хв на ci-verify); деталі
 # в шапці freebsd-build.yml. Доки full не повернеться (self-hosted
 # раннер), lite gate'ить усе, тож тут НЕ можна ignore'ити main.
+#
+# 1.1.28: мігровано з deprecated `run:`-input екшена на custom shell
+# `shell: cpa.sh {0}` (upstream: "The run parameter is deprecated. Use
+# the custom shell on subsequent steps"). Кожен крок нижче — окрема
+# ssh-сесія у VM: справжні межі кроків у UI, час на крок, і без
+# 130-рядкового heredoc. Env між кроками НЕ переноситься (свіжий shell
+# щоразу) — тому NCPU обчислюється там, де потрібен.
 
 on:
   push:
@@ -37,131 +44,131 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Compile + unit tests on FreeBSD
+      - name: Boot FreeBSD 14.2 VM
         # 2026-06: v0.32.0 -> v1.2.0 — Node 24 readiness (GitHub
         # вимикає Node 20 на раннерах з 16 червня 2026). Деталі —
         # коментар у freebsd-build.yml.
+        # Boot + rsync ~30-60 с; 10 хв — з великим запасом на флейк
+        # завантаження образу (GitHub Releases віддавав 500, run
+        # 34883815954). Загальний ліміт джоби — 35 хв вище.
         uses: cross-platform-actions/action@v1.2.0
-        # Bumped from 20m to 30m: the per-test Makefile rule recompiles
-        # every TEST_LINK_SRCS for each test binary (~30 files × ~40
-        # tests = ~1200 compiles), so each new pure-test adds ~1m to
-        # the FreeBSD VM build. Run 159 (0.7.9) was the first to
-        # timeout. A proper Makefile refactor (compile TEST_LINK_SRCS
-        # to .o once, link tests against them) is tracked separately.
-        timeout-minutes: 30
+        timeout-minutes: 10
         with:
           operating_system: freebsd
           version: '14.2'
           shell: sh
-          run: |
-            set -ex
-
-            echo "::group::Install dependencies"
-            # cpp-httplib is header-only and only needed to LINK crated
-            # (daemon/*.cpp #include <httplib.h>); ssl/crypto ship in
-            # FreeBSD base. Added 1.1.21 so the daemon link is covered
-            # in PR CI — see the "Link daemon binaries" step below.
-            #
-            # Hard build deps — these MUST install or the job is dead.
-            sudo pkg install -y pkgconf yaml-cpp rang gmake cpp-httplib
 
-            # ATF link libraries. The Makefile links every unit test with
-            # `-L/usr/local/lib -latf-c++ -latf-c`. FreeBSD 14.x base ships
-            # the HEADER (/usr/include/atf-c++.hpp) and kyua, but its ATF
-            # libraries are PRIVATE (/usr/lib/private/libprivateatf-*) and
-            # cannot be resolved as -latf-c++ — run 34233361523 compiled
-            # everything and then died at exactly that link step. So
-            # devel/atf (alive: 0.23 on quarterly) is a HARD dep, on its
-            # OWN line: bundling it with the dead kyua package made pkg
-            # abort the whole transaction and atf silently never installed.
-            sudo pkg install -y atf
+      - name: Install dependencies
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          # cpp-httplib is header-only and only needed to LINK crated
+          # (daemon/*.cpp #include <httplib.h>); ssl/crypto ship in
+          # FreeBSD base. Added 1.1.21 so the daemon link is covered
+          # in PR CI — see the "Link daemon binaries" step below.
+          #
+          # Hard build deps — these MUST install or the job is dead.
+          sudo pkg install -y pkgconf yaml-cpp rang gmake cpp-httplib
 
-            # kyua: the devel/kyua port was DELETED 2026-05-07 ("part of
-            # the base in all supported versions — Kyua's evolution
-            # happens in the base", D47473), which is what first broke
-            # this job (PR #228: "No packages available to install
-            # matching 'kyua'"). FreeBSD 14.x ships /usr/bin/kyua — verified
-            # present in this image. pkg is tried only for older images.
-            sudo pkg install -y kyua 2>/dev/null \
-              || echo "kyua pkg gone (deleted 2026-05, lives in base) — using /usr/bin/kyua"
-            echo "--- kyua/ATF preflight ---"
-            command -v kyua || true
-            ls -la /usr/bin/kyua /usr/local/bin/kyua 2>/dev/null || true
-            ls -la /usr/include/atf-c++.hpp /usr/local/include/atf-c++.hpp 2>/dev/null || true
-            ls -la /usr/lib/libatf-c++* /usr/local/lib/libatf-c++* 2>/dev/null || true
-            # If neither base nor pkg has them, show what pkg DOES offer
-            # (a rename shows up here) and fail with a clear error.
-            if ! command -v kyua >/dev/null 2>&1; then
-              echo "pkg search for kyua/atf (to catch a package rename):"
-              pkg search -q kyua 2>/dev/null || true
-              pkg search -q atf 2>/dev/null || true
-              echo "::error::kyua not found in base or pkg — see search output above"
-              exit 1
-            fi
-            if [ ! -f /usr/include/atf-c++.hpp ] && [ ! -f /usr/local/include/atf-c++.hpp ]; then
-              echo "::error::atf-c++.hpp not found in base or pkg"
-              exit 1
-            fi
-            # The check that would have caught run 34233361523 up front:
-            # a header alone is not enough, the LINKABLE lib must exist.
-            ls -la /usr/local/lib/libatf-c++.so /usr/lib/libatf-c++.so 2>/dev/null || true
-            if [ ! -e /usr/local/lib/libatf-c++.so ] && [ ! -e /usr/lib/libatf-c++.so ]; then
-              echo "::error::linkable libatf-c++.so not found — devel/atf must be installed (base only has private copies)"
-              exit 1
-            fi
-            echo "::endgroup::"
+          # ATF link libraries. The Makefile links every unit test with
+          # `-L/usr/local/lib -latf-c++ -latf-c`. FreeBSD 14.x base ships
+          # the HEADER (/usr/include/atf-c++.hpp) and kyua, but its ATF
+          # libraries are PRIVATE (/usr/lib/private/libprivateatf-*) and
+          # cannot be resolved as -latf-c++ — run 34233361523 compiled
+          # everything and then died at exactly that link step. So
+          # devel/atf (alive: 0.23 on quarterly) is a HARD dep, on its
+          # OWN line: bundling it with the dead kyua package made pkg
+          # abort the whole transaction and atf silently never installed.
+          sudo pkg install -y atf
 
-            echo "::group::System info"
-            uname -a
-            c++ --version
-            NCPU=$(sysctl -n hw.ncpu)
-            echo "ncpu=$NCPU"
-            echo "::endgroup::"
+          # kyua: the devel/kyua port was DELETED 2026-05-07 ("part of
+          # the base in all supported versions — Kyua's evolution
+          # happens in the base", D47473), which is what first broke
+          # this job (PR #228: "No packages available to install
+          # matching 'kyua'"). FreeBSD 14.x ships /usr/bin/kyua — verified
+          # present in this image. pkg is tried only for older images.
+          sudo pkg install -y kyua 2>/dev/null \
+            || echo "kyua pkg gone (deleted 2026-05, lives in base) — using /usr/bin/kyua"
+          echo "--- kyua/ATF preflight ---"
+          command -v kyua || true
+          ls -la /usr/bin/kyua /usr/local/bin/kyua 2>/dev/null || true
+          ls -la /usr/include/atf-c++.hpp /usr/local/include/atf-c++.hpp 2>/dev/null || true
+          ls -la /usr/lib/libatf-c++* /usr/local/lib/libatf-c++* 2>/dev/null || true
+          # If neither base nor pkg has them, show what pkg DOES offer
+          # (a rename shows up here) and fail with a clear error.
+          if ! command -v kyua >/dev/null 2>&1; then
+            echo "pkg search for kyua/atf (to catch a package rename):"
+            pkg search -q kyua 2>/dev/null || true
+            pkg search -q atf 2>/dev/null || true
+            echo "::error::kyua not found in base or pkg — see search output above"
+            exit 1
+          fi
+          if [ ! -f /usr/include/atf-c++.hpp ] && [ ! -f /usr/local/include/atf-c++.hpp ]; then
+            echo "::error::atf-c++.hpp not found in base or pkg"
+            exit 1
+          fi
+          # The check that would have caught run 34233361523 up front:
+          # a header alone is not enough, the LINKABLE lib must exist.
+          ls -la /usr/local/lib/libatf-c++.so /usr/lib/libatf-c++.so 2>/dev/null || true
+          if [ ! -e /usr/local/lib/libatf-c++.so ] && [ ! -e /usr/lib/libatf-c++.so ]; then
+            echo "::error::linkable libatf-c++.so not found — devel/atf must be installed (base only has private copies)"
+            exit 1
+          fi
 
-            echo "::group::Compile changed components (smoke)"
-            CXXFLAGS="-Wall -std=c++17 -Ilib $(pkg-config --cflags yaml-cpp)"
-            for f in lib/run.cpp lib/util.cpp lib/create.cpp lib/locs.cpp lib/mount.cpp; do
-              echo "  Compiling $f ..."
-              c++ $CXXFLAGS -c "$f" -o "${f%.cpp}.o"
-            done
-            echo "::endgroup::"
+      - name: System info
+        shell: cpa.sh {0}
+        run: |
+          uname -a
+          c++ --version
+          echo "ncpu=$(sysctl -n hw.ncpu)"
 
-            echo "::group::Link crate(1) binary (catches missing -lxxx in PR CI)"
-            # 1.1.15-followup: the lite workflow previously skipped the
-            # final crate binary link, so missing-library bugs (e.g. the
-            # 2026-06 -lnv miss for the FreeBSD nvpair API) slipped past
-            # PR review and only fired in the full freebsd-build.yml — a
-            # path that has been blocked on a broken SSH runner for the
-            # past several weeks. Building the binary here closes that
-            # gap with one extra link step; the .o for libcrate.a is
-            # already produced as a side effect of build-unit-tests, so
-            # the actual extra cost is the ar + link, ~1-2s.
-            gmake -j"$NCPU" crate
-            ls -la crate
-            echo "::endgroup::"
+      # 1.1.28: the old "compile changed components (smoke)" step is gone —
+      # it compiled five files that `gmake crate` compiles anyway, with a
+      # narrower include set, and bought nothing.
+      - name: Link crate(1) binary
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          # 1.1.15-followup: the lite workflow previously skipped the
+          # final crate binary link, so missing-library bugs (e.g. the
+          # 2026-06 -lnv miss for the FreeBSD nvpair API) slipped past
+          # PR review and only fired in the full freebsd-build.yml.
+          # Building the binary here closes that gap.
+          gmake -j"$(sysctl -n hw.ncpu)" crate
+          ls -la crate
 
-            echo "::group::Link daemon binaries crated + crate-snmpd"
-            # 1.1.21: lite previously linked only crate(1), so a
-            # daemon-only change (e.g. the 1.1.19 getpeereid fail-closed
-            # fix in daemon/privops_listener.cpp) shipped with NO compile
-            # coverage — the full FreeBSD workflow that builds crated is
-            # manual (workflow_dispatch). Build both daemon binaries here
-            # so every PR gets a crated/crate-snmpd compile+link gate.
-            # crated needs cpp-httplib (installed above) + ssl/crypto
-            # (base); crate-snmpd needs only base libs.
-            gmake -j"$NCPU" crated crate-snmpd
-            ls -la crated crate-snmpd
-            echo "::endgroup::"
+      - name: Link daemon binaries crated + crate-snmpd
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          # 1.1.21: lite previously linked only crate(1), so a
+          # daemon-only change (e.g. the 1.1.19 getpeereid fail-closed
+          # fix in daemon/privops_listener.cpp) shipped with NO compile
+          # coverage — the full FreeBSD workflow that builds crated is
+          # manual (workflow_dispatch). Build both daemon binaries here
+          # so every PR gets a crated/crate-snmpd compile+link gate.
+          # crated needs cpp-httplib (installed above) + ssl/crypto
+          # (base); crate-snmpd needs only base libs.
+          gmake -j"$(sysctl -n hw.ncpu)" crated crate-snmpd
+          ls -la crated crate-snmpd
 
-            echo "::group::Build unit tests"
-            # Drive via gmake so the test list lives in one place
-            # (Makefile's UNIT_TESTS variable). Adding a new test requires
-            # only one edit (UNIT_TESTS in the Makefile).
-            gmake -j"$NCPU" build-unit-tests
-            echo "::endgroup::"
+      - name: Build unit tests
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          # Drive via gmake so the test list lives in one place
+          # (Makefile's UNIT_TESTS variable). Adding a new test requires
+          # only one edit (UNIT_TESTS in the Makefile).
+          # TEST_LINK_SRCS are compiled ONCE into tests/unit/.test-objs/
+          # (Makefile, since 0.7.12) — the old "~1200 compiles, +1 min
+          # per new test" note here was stale.
+          gmake -j"$(sysctl -n hw.ncpu)" build-unit-tests
 
-            echo "::group::Run kyua unit tests"
-            # Без `|| true` — провал юніт-тесту має валити CI.
-            cd tests && sudo kyua test unit
-            sudo kyua report --verbose
-            echo "::endgroup::"
+      - name: Run kyua unit tests
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          # Без `|| true` — провал юніт-тесту має валити CI.
+          # 1.1.28: `-v parallelism=N` — 1400+ кейсів раніше бігли серійно.
+          cd tests && sudo kyua -v parallelism="$(sysctl -n hw.ncpu)" test unit
+          sudo kyua report --verbose
diff --git a/.github/workflows/freebsd-build.yml b/.github/workflows/freebsd-build.yml
index c4fdfdb..416e91d 100644
--- a/.github/workflows/freebsd-build.yml
+++ b/.github/workflows/freebsd-build.yml
@@ -157,6 +157,16 @@ jobs:
             file crate || true
             echo "::endgroup::"
 
+            echo "::group::Install crate(1) so the functional tests can run"
+            # 1.1.28: tests/functional/crate_info_test does
+            # `atf_skip "crate binary not installed"` unless
+            # /usr/local/bin/crate exists — and nothing here ever installed
+            # it, so even a healthy manual full run silently SKIPPED every
+            # functional test. Install (binary + man page) before kyua.
+            sudo gmake install
+            ls -la /usr/local/bin/crate
+            echo "::endgroup::"
+
             echo "::group::Build unit tests"
             # Drive via gmake so the test list lives in one place
             # (Makefile UNIT_TESTS). Adding a new test requires only
@@ -172,7 +182,9 @@ jobs:
             # Без `|| true`. Провал тесту = провал CI.
             # `set +e` локально — щоб встигнути зібрати report навіть при провалі.
             set +e
-            ( cd tests && sudo kyua test )
+            # 1.1.28: unit cases in parallel; functional cases touch real
+            # jails and stay serial by kyua's own per-test isolation.
+            ( cd tests && sudo kyua -v parallelism="$NCPU" test )
             KYUA_RC=$?
             ( cd tests && sudo kyua report --verbose )
             ( cd tests && sudo kyua report-html --output=../kyua-html ) || true
diff --git a/.github/workflows/linux-unit.yml b/.github/workflows/linux-unit.yml
index b718671..ccbff89 100644
--- a/.github/workflows/linux-unit.yml
+++ b/.github/workflows/linux-unit.yml
@@ -6,9 +6,10 @@ name: Linux Unit Tests
 # kyua + libatf from Ubuntu universe.
 #
 # This is a *complement* to the FreeBSD workflows, not a replacement:
-#   * Linux unit tests: ~30 seconds, every push.
-#   * FreeBSD lite: ~10 minutes, feature branches.
-#   * FreeBSD full: ~25 minutes, master / PRs / weekly cron.
+#   * Linux unit tests: ~30 seconds, every push and every PR.
+#   * Linux ASan+UBSan: ~2 minutes, same triggers (1.1.28).
+#   * FreeBSD lite: ~4 minutes, every push (compile + link + unit suite).
+#   * FreeBSD full: manual-only (workflow_dispatch) — see freebsd-build.yml.
 #
 # Functional tests (tests/functional/*) require a FreeBSD jail and are
 # scoped out here via `kyua test unit`.
@@ -28,7 +29,10 @@ on:
       - '.github/workflows/freebsd-build.yml'
       - '.github/workflows/freebsd-build-lite.yml'
   pull_request:
-    branches: [master]
+    # 1.1.28: was `[master]` — the repository's default branch is `main`,
+    # so this trigger NEVER fired and the fastest gate in the repo ran on
+    # push only, never as a PR check (fork PRs got nothing at all).
+    branches: [main]
   workflow_dispatch:
 
 concurrency:
@@ -63,7 +67,18 @@ jobs:
           # only one edit (UNIT_TESTS in the Makefile).
           # -L/usr/local/lib is harmless on Linux; libatf-c++ resolves
           # via the default loader search path.
-          make -j"$(nproc)" test-unit
+          #
+          # 1.1.28: -Werror on Linux only (gcc and FreeBSD clang differ
+          # enough that a global -Werror would be brittle); the Makefile
+          # default is -Wall -Wextra without -Werror. KYUA_FLAGS runs the
+          # 1400+ test cases in parallel instead of serially.
+          # -Wno-missing-field-initializers: the tests aggregate-initialise
+          # config structs with only the fields under test (e.g.
+          # AuthToken{hash, role}); -Wextra's complaint about the rest is
+          # noise, not a defect.
+          make -j"$(nproc)" test-unit \
+            TEST_CXXWARN="-Wall -Wextra -Wno-missing-field-initializers -Werror" \
+            KYUA_FLAGS="-v parallelism=$(nproc)"
 
       - name: Kyua report on failure
         if: failure()
@@ -79,3 +94,58 @@ jobs:
           path: kyua-html
           if-no-files-found: ignore
           retention-days: 7
+
+  # 1.1.28: the pure modules are platform-independent, so AddressSanitizer
+  # + UndefinedBehaviorSanitizer on Linux are cheap and catch exactly the
+  # class the 1.1.22 ctx.cpp `erase(end())` UB belonged to. The Makefile
+  # already threads COVERAGE_CXXFLAGS/COVERAGE_LDFLAGS into both test
+  # rules, so no Makefile change is needed to instrument the build.
+  sanitizers:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    name: Linux unit tests under ASan + UBSan
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install libatf + compiler
+        run: |
+          set -ex
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends \
+            g++ make libatf-dev kyua
+          g++ --version | head -1
+
+      - name: Build unit tests with -fsanitize=address,undefined
+        run: |
+          set -ex
+          make -j"$(nproc)" build-unit-tests \
+            COVERAGE_CXXFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer -g -O1" \
+            COVERAGE_LDFLAGS="-fsanitize=address,undefined"
+
+      - name: Run every ATF test case directly
+        run: |
+          set -e
+          # kyua scrubs the environment of the test process, so the
+          # ASAN_OPTIONS / UBSAN_OPTIONS below would never reach it. Run
+          # the ATF programs directly instead: `prog -l` lists the cases,
+          # `prog <case>` runs one (exit 0 = passed/skipped, 1 = failed).
+          # -fno-sanitize-recover=all above makes UBSan abort on the
+          # first report regardless of the environment — belt and braces.
+          export ASAN_OPTIONS=detect_leaks=0:abort_on_error=1
+          export UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1
+          cd tests/unit
+          failed=0
+          total=0
+          for prog in *_test; do
+            [ -x "$prog" ] || continue
+            for tc in $(./"$prog" -l | sed -n 's/^ident: //p'); do
+              total=$((total + 1))
+              if ! out=$(./"$prog" "$tc" 2>&1); then
+                echo "::error::$prog:$tc"
+                echo "$out"
+                failed=$((failed + 1))
+              fi
+            done
+          done
+          echo "ran $total test cases under ASan+UBSan, $failed failed"
+          test "$failed" -eq 0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9bd358..7f8d6e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,56 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
+## [1.1.28] — 2026-09-14
+
+**CI & build hygiene: a dead PR trigger, functional tests that never
+ran, sanitizers, warnings-as-errors, parallel kyua, and a workflow
+migration.**
+
+- **Linux unit tests never ran on pull requests — `linux-unit.yml`.**
+  The trigger said `pull_request: branches: [master]` while the default
+  branch is `main`, so the fastest gate in the repo ran on `push` only
+  and PR checks from forks got nothing. Now `[main]`.
+
+- **The full FreeBSD workflow silently skipped every functional test —
+  `freebsd-build.yml`.** `tests/functional/crate_info_test` does
+  `atf_skip "crate binary not installed"` unless `/usr/local/bin/crate`
+  exists, and nothing ever installed it. `sudo gmake install` now runs
+  before kyua.
+
+- **New Linux ASan + UBSan job — `linux-unit.yml`.** The pure modules
+  are platform-independent, so `-fsanitize=address,undefined` on Linux
+  is cheap and catches exactly the class the 1.1.22 `ctx.cpp`
+  `erase(end())` UB belonged to. Built through the Makefile's existing
+  `COVERAGE_CXXFLAGS`/`COVERAGE_LDFLAGS` hooks; the 1400+ ATF cases are
+  run directly (`prog -l` / `prog <case>`) because kyua scrubs the test
+  environment and `ASAN_OPTIONS`/`UBSAN_OPTIONS` would never reach it.
+
+- **Warnings on the test build, `-Werror` on Linux — `Makefile`.** The
+  two test rules had no warning flags at all (the production build has
+  `-Wall`). New `TEST_CXXWARN ?= -Wall -Wextra`; Linux CI passes
+  `-Werror` (gcc and FreeBSD clang disagree on enough diagnostics that a
+  global `-Werror` would be brittle). The four real warnings that
+  surfaced are fixed: an unused lambda parameter in `util.h`
+  (`ckSyscallError` default), the dead `skipWs` (`privops_wire_pure.cpp`)
+  and `isZero` (`ip6_alloc_pure.cpp`) helpers, and a `//` comment ending
+  in `\` in `retune_pure.h` (`-Wcomment`).
+
+- **Parallel kyua — `Makefile`, all three workflows.** New `KYUA_FLAGS`
+  variable; CI runs `kyua -v parallelism=<ncpu>` instead of the previous
+  fully serial run of ~1400 cases.
+
+- **`freebsd-build-lite.yml` migrated off the action's deprecated `run:`
+  input** to the `shell: cpa.sh {0}` custom shell (upstream: "The run
+  parameter is deprecated. Use the custom shell on subsequent steps").
+  Each phase is now a real step with its own timing; the redundant
+  "compile changed components (smoke)" step (five files `gmake crate`
+  compiles anyway) is gone; the stale "~1200 compiles / +1 min per test"
+  comment (fixed in the Makefile since 0.7.12) is corrected. The full
+  workflow keeps `run:` until the migrated lite has proven the syntax on
+  a few pushes — it is manual-only, so a breakage there would go
+  unnoticed.
+
 ## [1.1.27] — 2026-09-14
 
 **Regressions introduced by the 1.1.21–1.1.25 hardening, found by an
diff --git a/Makefile b/Makefile
index 730f453..3bf9995 100644
--- a/Makefile
+++ b/Makefile
@@ -249,14 +249,18 @@ UNIT_TESTS = util_test spec_test spec_netopt_test lifecycle_test \
              zfs_dataset_pure_test hub_scheduling_pure_test
 UNIT_TEST_BINS = $(addprefix tests/unit/,$(UNIT_TESTS))
 
+# 1.1.28: extra kyua flags, e.g. `make test-unit KYUA_FLAGS="-v parallelism=8"`
+# to run the 1400+ unit cases in parallel (CI does). Empty by default.
+KYUA_FLAGS ?=
+
 test: $(UNIT_TEST_BINS)
-	cd tests && kyua test
+	cd tests && kyua $(KYUA_FLAGS) test
 
 # test-unit: run only the unit test suite (no functional tests).
 # Handy for local development on Linux where functional/crate_info_test
 # requires a FreeBSD jail and will otherwise be reported as broken.
 test-unit: $(UNIT_TEST_BINS)
-	cd tests && kyua test unit
+	cd tests && kyua $(KYUA_FLAGS) test unit
 
 # build-unit-tests: build every unit test binary without running anything.
 # Useful in CI where the build runs as a regular user but kyua must run
@@ -271,6 +275,12 @@ build-unit-tests: $(UNIT_TEST_BINS)
 # their own dir so they don't collide with the main lib/*.o build
 # (which uses different CXXFLAGS for the production crate binary).
 TEST_OBJ_DIR = tests/unit/.test-objs
+# 1.1.28: warning flags for the test build. The two test rules below had
+# NO warning flags at all (the production build has -Wall). Default is
+# warn-only; Linux CI overrides with `TEST_CXXWARN="-Wall -Wextra -Werror"`.
+# Not -Werror by default: gcc and FreeBSD clang disagree on enough
+# diagnostics that a global -Werror would be brittle.
+TEST_CXXWARN ?= -Wall -Wextra -Wno-missing-field-initializers
 TEST_LINK_SRCS = lib/util_pure.cpp lib/err.cpp \
                  lib/spec_pure.cpp lib/stack_pure.cpp \
                  lib/lifecycle_pure.cpp lib/import_pure.cpp \
@@ -341,7 +351,7 @@ TEST_INCLUDES = -Ilib -Icli -Idaemon -Isnmpd -Ihub
 
 $(TEST_OBJ_DIR)/%.o: %.cpp lib/lst-all-script-sections.h
 	@mkdir -p $(@D)
-	$(CXX) -std=c++17 $(TEST_INCLUDES) $(COVERAGE_CXXFLAGS) -MMD -MP -c $< -o $@
+	$(CXX) -std=c++17 $(TEST_CXXWARN) $(TEST_INCLUDES) $(COVERAGE_CXXFLAGS) -MMD -MP -c $< -o $@
 
 # Test binary: compile its own .cpp inline (one source -> one
 # binary), link against the cached TEST_LINK_OBJS + stub. The .cpp
@@ -349,7 +359,7 @@ $(TEST_OBJ_DIR)/%.o: %.cpp lib/lst-all-script-sections.h
 # dependencies for that compile are NOT tracked by .d (no separate
 # .o), but tests/unit/*.cpp is small per file and fast to recompile.
 tests/unit/%: tests/unit/%.cpp $(TEST_LINK_OBJS) $(TEST_STUB_OBJ) lib/lst-all-script-sections.h
-	$(CXX) -std=c++17 $(TEST_INCLUDES) $(COVERAGE_CXXFLAGS) -o $@ $< $(TEST_LINK_OBJS) $(TEST_STUB_OBJ) $(COVERAGE_LDFLAGS) -L/usr/local/lib -latf-c++ -latf-c
+	$(CXX) -std=c++17 $(TEST_CXXWARN) $(TEST_INCLUDES) $(COVERAGE_CXXFLAGS) -o $@ $< $(TEST_LINK_OBJS) $(TEST_STUB_OBJ) $(COVERAGE_LDFLAGS) -L/usr/local/lib -latf-c++ -latf-c
 
 # Auto-generated header dependency files. The leading `-` makes make
 # tolerate them not yet existing (first build); after the first
diff --git a/cli/args.cpp b/cli/args.cpp
index 5f313a6..66ec27d 100644
--- a/cli/args.cpp
+++ b/cli/args.cpp
@@ -753,7 +753,7 @@ Args parseArguments(int argc, char** argv, unsigned &processed) {
         args.noColor = true;
         break;
       } else if (strEq(argv[a], "--version")) {
-        std::cout << "crate 1.1.27" << std::endl;
+        std::cout << "crate 1.1.28" << std::endl;
         exit(0);
       } else if (auto argShort = isShort(argv[a])) {
         switch (argShort) {
@@ -764,7 +764,7 @@ Args parseArguments(int argc, char** argv, unsigned &processed) {
           args.logProgress = true;
           break;
         case 'V':
-          std::cout << "crate 1.1.27" << std::endl;
+          std::cout << "crate 1.1.28" << std::endl;
           exit(0);
         default:
           err("unsupported short option '%s'", argv[a]);
diff --git a/docs/trust-model.md b/docs/trust-model.md
index 5777bd6..7883d1c 100644
--- a/docs/trust-model.md
+++ b/docs/trust-model.md
@@ -4,7 +4,7 @@
 operators on one machine) and contributors extending the privileged
 surface.
 
-**Applies to:** 1.1.27 (rootless model + per-tenant authz series 1.1.12 →
+**Applies to:** 1.1.28 (rootless model + per-tenant authz series 1.1.12 →
 1.1.17 covering every privops verb that carries an operator-controlled
 ownership signal). For the ≤ 0.9.x setuid model and the migration, see
 [`rootless-migration.md`](rootless-migration.md).
@@ -62,7 +62,7 @@ surface; 1.0.0 removed the setuid bit (`Makefile`, comment at the
 operator and delegates privileged operations to crated(8)"*).
 
 The single-trust-domain property did **not** disappear — it relocated.
-Reasoning about isolation on 1.1.27 means reasoning about who can reach
+Reasoning about isolation on 1.1.28 means reasoning about who can reach
 **privops**, not who can run `crate(1)`.
 
 ---
diff --git a/docs/trust-model.uk.md b/docs/trust-model.uk.md
index 81b4845..89bf8b9 100644
--- a/docs/trust-model.uk.md
+++ b/docs/trust-model.uk.md
@@ -4,7 +4,7 @@
 (кілька операторів на одній машині), і контрибʼютори, які розширюють
 привілейовану поверхню.
 
-**Стосується:** 1.1.27 (rootless-модель + серія per-tenant authz 1.1.12 →
+**Стосується:** 1.1.28 (rootless-модель + серія per-tenant authz 1.1.12 →
 1.1.17 покриває кожен privops-верб з operator-controlled ownership-
 сигналом). Про ≤ 0.9.x setuid-модель і міграцію див.
 [`rootless-migration.md`](rootless-migration.md).
@@ -62,7 +62,7 @@ privops-сокета, ніколи admin-токен і ніколи Unix-сок
 privileged operations to crated(8)»*).
 
 Властивість «єдиний домен довіри» **не зникла** — вона переїхала.
-Міркувати про ізоляцію на 1.1.27 — це міркувати про те, хто має доступ
+Міркувати про ізоляцію на 1.1.28 — це міркувати про те, хто має доступ
 до **privops**, а не хто може запустити `crate(1)`.
 
 ---
diff --git a/lib/ip6_alloc_pure.cpp b/lib/ip6_alloc_pure.cpp
index 7517d0c..6432cdd 100644
--- a/lib/ip6_alloc_pure.cpp
+++ b/lib/ip6_alloc_pure.cpp
@@ -68,11 +68,8 @@ void maskPrefix(Addr6 &a, unsigned prefixLen) {
   }
 }
 
-// Returns true if a == zero address.
-bool isZero(const Addr6 &a) {
-  for (auto b : a) if (b != 0) return false;
-  return true;
-}
+// (1.1.28: an `isZero(Addr6)` helper used to live here — no callers,
+// removed when the test build gained -Wall -Wextra.)
 
 // In-place increment of a 128-bit big-endian byte array. Returns
 // true on success; false if it overflows (hits all-ones and wraps).
diff --git a/lib/privops_wire_pure.cpp b/lib/privops_wire_pure.cpp
index 94ad1e2..6450728 100644
--- a/lib/privops_wire_pure.cpp
+++ b/lib/privops_wire_pure.cpp
@@ -12,15 +12,8 @@ const char *const kPresent = "PRESENT";
 
 namespace {
 
-// Skip whitespace at `i`, advancing `i` past it. Returns true if
-// at least one character was consumed.
-bool skipWs(const std::string &s, size_t &i) {
-  size_t start = i;
-  while (i < s.size()
-         && (s[i] == ' ' || s[i] == '\t' || s[i] == '\n' || s[i] == '\r'))
-    i++;
-  return i > start;
-}
+// (1.1.28: a `skipWs` helper used to live here — it had no callers and
+// tripped -Wunused-function once the test build got warning flags.)
 
 // Position `i` at the value following `"fieldName":`. Returns:
 //   "absent"        if the field is not in the body
diff --git a/lib/retune_pure.h b/lib/retune_pure.h
index 3f0db37..5af9aeb 100644
--- a/lib/retune_pure.h
+++ b/lib/retune_pure.h
@@ -8,12 +8,12 @@
 // container (a torrent client suddenly sucking all the disk
 // throughput) without losing its in-memory state.
 //
-// Usage on the runtime side:
+// Usage on the runtime side (one line; shown wrapped for width — no
+// trailing backslashes, which in a `//` comment splice the next line
+// into the comment and trip -Wcomment):
 //
-//   crate retune myjail \
-//       --rctl pcpu=20 \
-//       --rctl writebps=1M \
-//       --rctl readiops=500
+//   crate retune myjail --rctl pcpu=20 --rctl writebps=1M
+//                       --rctl readiops=500
 //
 // Each --rctl flag becomes one `rctl -a jail:<jid>:<key>:deny=<val>`
 // invocation. The pure module owns:
diff --git a/lib/util.h b/lib/util.h
index e23c2aa..cb278f7 100644
--- a/lib/util.h
+++ b/lib/util.h
@@ -120,7 +120,7 @@ void execPipeline(const std::vector<std::vector<std::string>> &cmds, const std::
                   const std::string &stdinFile = "", const std::string &stdoutFile = "");
 std::string execPipelineGetOutput(const std::vector<std::vector<std::string>> &cmds, const std::string &what,
                                   const std::string &stdinFile = "");
-void ckSyscallError(int res, const char *syscall, const char *arg, const std::function<bool(int)> whiteWash = [](int err) {return false;});
+void ckSyscallError(int res, const char *syscall, const char *arg, const std::function<bool(int)> whiteWash = [](int /*err*/) {return false;});
 std::string tmSecMs();
 std::string filePathToBareName(const std::string &path);
 std::string filePathToFileName(const std::string &path);
diff --git a/tests/unit/err_test.cpp b/tests/unit/err_test.cpp
index d6d55f0..21327e7 100644
--- a/tests/unit/err_test.cpp
+++ b/tests/unit/err_test.cpp
@@ -2,9 +2,10 @@
 //
 // Uses the real Exception type linked from lib/err.cpp + lib/util_pure.cpp.
 //
-// Build:
-//   c++ -std=c++17 -Ilib -o tests/unit/err_test \
-//       tests/unit/err_test.cpp lib/util_pure.cpp lib/err.cpp \
+// Build (one command, wrapped — no trailing backslashes: in a `//`
+// comment they splice the next line into the comment, -Wcomment):
+//   c++ -std=c++17 -Ilib -o tests/unit/err_test
+//       tests/unit/err_test.cpp lib/util_pure.cpp lib/err.cpp
 //       -L/usr/local/lib -latf-c++ -latf-c
 //
 // Run:
diff --git a/tests/unit/util_security_test.cpp b/tests/unit/util_security_test.cpp
index 02a8497..558feb7 100644
--- a/tests/unit/util_security_test.cpp
+++ b/tests/unit/util_security_test.cpp
@@ -7,9 +7,9 @@
 // suite (versus the previous "duplicate the function into the test"
 // pattern, which only checked a frozen copy).
 //
-// Build:
-//   c++ -std=c++17 -Ilib -o tests/unit/util_security_test \
-//       tests/unit/util_security_test.cpp lib/util_pure.cpp lib/err.cpp \
+// Build (one command, wrapped — no trailing backslashes, -Wcomment):
+//   c++ -std=c++17 -Ilib -o tests/unit/util_security_test
+//       tests/unit/util_security_test.cpp lib/util_pure.cpp lib/err.cpp
 //       -L/usr/local/lib -latf-c++ -latf-c
 //
 // Run:
diff --git a/tests/unit/util_test.cpp b/tests/unit/util_test.cpp
index 17aa987..29d757d 100644
--- a/tests/unit/util_test.cpp
+++ b/tests/unit/util_test.cpp
@@ -2,9 +2,9 @@
 //
 // Uses real Util:: symbols from lib/util_pure.cpp.
 //
-// Build:
-//   c++ -std=c++17 -Ilib -o tests/unit/util_test \
-//       tests/unit/util_test.cpp lib/util_pure.cpp lib/err.cpp \
+// Build (one command, wrapped — no trailing backslashes, -Wcomment):
+//   c++ -std=c++17 -Ilib -o tests/unit/util_test
+//       tests/unit/util_test.cpp lib/util_pure.cpp lib/err.cpp
 //       -L/usr/local/lib -latf-c++ -latf-c
 //
 // Run: