diff --git a/.archgate/adrs/ARCH-005-testing-standards.md b/.archgate/adrs/ARCH-005-testing-standards.md
index c237ba16..e116ce18 100644
--- a/.archgate/adrs/ARCH-005-testing-standards.md
+++ b/.archgate/adrs/ARCH-005-testing-standards.md
@@ -184,8 +184,8 @@ globalThis.fetch = (() =>
 
 ### Risks
 
-- **Bun test runner API changes** — Although Bun is past 1.0 (currently 1.3.8), some newer APIs may still evolve between minor versions. Test runner behavior or API may change.
-  - **Mitigation:** The project pins a specific Bun version via `.prototools` (currently 1.3.8). Test runner API changes are caught during controlled Bun upgrades with full test suite validation.
+- **Bun test runner API changes** — Although Bun is past 1.0, some newer APIs may still evolve between minor versions. Test runner behavior or API may change.
+  - **Mitigation:** The project pins a specific Bun version via `.prototools`. Test runner API changes are caught during controlled Bun upgrades with full test suite validation.
 - **Coverage reporting gaps** — `bun test --coverage` may not report accurate coverage for all code paths, especially for dynamically imported modules.
   - **Mitigation:** Coverage is a guideline (80% target), not a hard gate. Critical modules (engine, formats) are tested thoroughly regardless of coverage numbers.
 - **Third-party SDK event loop retention** — External SDK instances that hold internal resource references may keep Bun's event loop alive on Linux after all tests complete, causing `bun test` to hang indefinitely. This does not surface on macOS (event loop drains normally there), making it a Linux-CI-only failure that is hard to reproduce locally.
diff --git a/.archgate/adrs/ARCH-006-dependency-policy.md b/.archgate/adrs/ARCH-006-dependency-policy.md
index eaa28d9b..664a4ede 100644
--- a/.archgate/adrs/ARCH-006-dependency-policy.md
+++ b/.archgate/adrs/ARCH-006-dependency-policy.md
@@ -120,7 +120,7 @@ const subset = pick(obj, ["a", "b"]);
 ### Risks
 
 - **Bun API instability** — Bun built-in APIs (especially newer ones like `Bun.Glob`, `Bun.spawn`) may introduce breaking changes or behavioral differences between versions. The `Bun.$` shell API is explicitly avoided due to Windows pipe deadlocks discovered in production.
-  - **Mitigation:** The project pins Bun version via `.prototools` (currently 1.3.8). API changes are caught during controlled upgrades with full test suite validation.
+  - **Mitigation:** The project pins Bun version via `.prototools`. API changes are caught during controlled upgrades with full test suite validation.
 - **Bun built-in feature gaps** — Some functionality may be missing from Bun built-ins (e.g., advanced glob options, streaming HTTP edge cases). If a Bun built-in lacks a critical feature, the fallback is to add an approved dependency with full justification.
   - **Mitigation:** The approved dependency list exists precisely for this case. The threshold is "Bun cannot do this," not "Bun can do this but an npm package is slightly more convenient."
 - **New dependency pressure from contributors** — Contributors may add packages out of habit without checking Bun alternatives.
diff --git a/.prototools b/.prototools
index 8c7d7a5e..34b733e0 100644
--- a/.prototools
+++ b/.prototools
@@ -1,4 +1,4 @@
-bun = "1.3.9"
+bun = "1.3.11"
 node = "24"
 npm = "11.11.0"
 gh = "2.88.1"