diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 414a9a4..730731b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -377,11 +377,13 @@ jobs:
           # Use osc's installed service executor to validate this standalone,
           # repository-owned _service file with the exact same local services.
           python3 - "$service_dir" <<'PY'
+          import os
           import sys
           from xml.etree import ElementTree
           from osc.obs_scm.serviceinfo import Serviceinfo
 
           service_dir = sys.argv[1]
+          os.chdir(service_dir)
           service_info = Serviceinfo()
           service_info.read(ElementTree.parse(f"{service_dir}/_service").getroot())
           raise SystemExit(service_info.execute(service_dir, "all", verbose=True))
diff --git a/.github/workflows/promote-release.yml b/.github/workflows/promote-release.yml
index cd5ee38..9104b14 100644
--- a/.github/workflows/promote-release.yml
+++ b/.github/workflows/promote-release.yml
@@ -11,7 +11,7 @@ on:
         required: true
         type: number
       tag:
-        description: Existing annotated release tag, for example v5.2.4
+        description: Existing annotated release tag, for example v5.2.5
         required: true
         type: string
 
diff --git a/AUDIT.md b/AUDIT.md
index a59383a..8ddb599 100644
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,12 +1,12 @@
 <!-- SPDX-License-Identifier: AGPL-3.0-or-later -->
-# ZUPT 5.2.4 audit guide and finding history
+# ZUPT 5.2.5 audit guide and finding history
 
 This document describes review surfaces and reproducible checks. It is an
 upstream self-review, not an independent audit, certification, or guarantee.
 `SECURITY.md` defines reporting policy and `THREAT_MODEL.md` defines the
 security boundary.
 
-## 5.2.4 scope
+## 5.2.5 scope
 
 The baseline scope is the source-only CLI and its bundled source codec:
 
@@ -28,7 +28,7 @@ output.
 
 ## Source-only review
 
-The 5.2.4 baseline retains the source-only boundary introduced in 5.2.2, which
+The 5.2.5 baseline retains the source-only boundary introduced in 5.2.2, which
 removed incomplete SDK/PQBOX header snapshots and local precompiled-library
 expectations. Git and new upstream source
 archives are intended to contain no compiled executable, object, shared/static
@@ -42,10 +42,10 @@ scripts/check-source-only.sh
 
 # committed Git tree or immutable tag
 scripts/check-source-only.sh --tag HEAD
-scripts/check-source-only.sh --tag v5.2.4
+scripts/check-source-only.sh --tag v5.2.5
 
 # generated source archive
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
 ```
 
 The scanner checks extensions and magic bytes, nested archives, symlink targets,
@@ -109,7 +109,7 @@ without evidence.
 The following upstream self-audit results apply only to the 5.2.2 candidate at
 commit `ff99770` on the recorded local Linux environments. The immutable 5.2.2
 tag was not promoted after post-tag CI integration failures. These results are
-not independent certification, a 5.2.4 result, or evidence that release assets
+not independent certification, a 5.2.5 result, or evidence that release assets
 were published.
 
 | Gate | Result | Recorded evidence |
@@ -125,11 +125,28 @@ were published.
 An earlier off-screen GUI smoke run remains supporting evidence, but is not
 represented as an exact-`ff99770` GUI-package result. The immutable 5.2.3
 candidate was not promoted because its source-policy test assumed LF for a
-Windows `.bat` checkout that correctly used CRLF. The exact 5.2.4 candidate must
-repeat the required suite. Native Windows and macOS gates, hosted GitHub CI
-and release promotion, authenticated OBS validation, and resolution of the
-openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending
-until recorded otherwise.
+Windows `.bat` checkout that correctly used CRLF.
+
+## Prior 5.2.4 exact-tag integration evidence
+
+GitHub Actions exact-tag run `33431386002` completed 12 jobs successfully. Its
+sole failed job was the openSUSE gate: the standalone `Serviceinfo` harness did
+not change into the directory containing `_service` before executing the
+service chain. Dependent native Windows and macOS jobs were therefore skipped,
+and v5.2.4 was not promoted. The tag and its record remain immutable.
+
+A separate local openSUSE Tumbleweed reproduction resolved the explicit
+`refs/tags/v5.2.4` revision to the tagged commit and, after
+`os.chdir(service_dir)`, completed `obs_scm`, `tar`, and `recompress`. It
+produced exactly one `zupt-5.2.4.tar.gz`, which passed the source-only scanner.
+This isolates a release/test harness defect; it is not evidence of a product,
+archive-format, cryptographic, codec, or SDK ABI change. It also does not turn
+the skipped native jobs into passes or transfer any result to 5.2.5.
+
+The exact 5.2.5 candidate must repeat the required suite. Native Windows and
+macOS gates, hosted GitHub CI and release promotion, authenticated OBS
+validation, and resolution of the openSUSE automatic `debugsource` rpmlint
+`no-binary` finding remain pending until recorded otherwise.
 
 ## Cryptographic review boundary
 
@@ -148,7 +165,7 @@ AES implementation has documented cache-timing risk on hostile shared hardware.
 
 The following entries are retained as release history. Their regression tests
 should be rerun, but the historical resolution does not itself constitute a
-5.2.4 test result.
+5.2.5 test result.
 
 | First corrected | Severity | Finding | Resolution recorded at the time |
 |---|---|---|---|
@@ -189,12 +206,12 @@ include SHA-256 checksums. The gated GUI set adds the architecture-independent
 DEB, noarch/source RPM, and source-only portable GUI ZIP. Package gates include
 exact payload/dependency and installed off-screen integration checks; the
 portable ZIP additionally receives source scans, an exact safe-member allowlist,
-and an extracted launcher test. An AppImage is not promoted by the 5.2.4
+and an extracted launcher test. An AppImage is not promoted by the 5.2.5
 policy; AppDir and Flatpak bundles, GUI platform installers, and bare
 Linux/Windows executables are also excluded. Windows ZIP and macOS DMG outputs
 remain CLI-only.
 
-No Wine result is retained as release evidence for 5.2.4. Cross-compilation
+No Wine result is retained as release evidence for 5.2.5. Cross-compilation
 does not establish native-Windows behavior. Extended-length/device namespace
 paths, raw UNC output roots, and mapped/network-drive output are unsupported;
 the native Windows workflow remains a publication gate for the ZIP containing
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a775f53..a842cb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # ZUPT Changelog
 
+## [5.2.5] — 2026-08-31 — OBS service working-directory correction
+
+Corrective successor to the immutable `v5.2.4` candidate. GitHub Actions run
+`33431386002` did not promote that tag: 12 jobs passed, the openSUSE Tumbleweed
+RPM gate failed because its standalone `Serviceinfo` executor inherited the
+repository working directory instead of the isolated service directory, and
+the dependent Windows/macOS gate was skipped. The tag and its recorded
+checksums remain unchanged.
+
+- Run the standalone OBS `obs_scm` → `tar` → `recompress` chain from its
+  isolated service directory so downstream services can find `.obsinfo`.
+- Add a packaging-policy regression for the OBS executor working directory
+  while retaining the immutable `refs/tags/v5.2.5` service revision assertion.
+- Record the successful local Tumbleweed reproduction of the corrected service
+  chain; it produced one source archive that passed the source-only scanner.
+- Carry the 5.2.4 security and source-only baseline forward without changing
+  the archive format, cryptography, bundled codec release, or SDK ABI.
+- Realign current package, workflow, artifact, and tag references to 5.2.5;
+  leave AUR, Homebrew, and Guix hashes pending the final source archive.
+- Require fresh exact-`v5.2.5` source, checksum, hosted CI, native-platform,
+  package, and promotion evidence; no v5.2.4 result transfers automatically.
+
 ## [5.2.4] — 2026-08-31 — Source-policy line-ending correction
 
 Corrective successor to the immutable `v5.2.3` candidate. That candidate was
diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md
index fff5d43..7aa4178 100644
--- a/DISTRIBUTION.md
+++ b/DISTRIBUTION.md
@@ -1,4 +1,4 @@
-# Distributing ZUPT 5.2.4
+# Distributing ZUPT 5.2.5
 
 This document describes the packaging material maintained in the ZUPT
 source repository. A recipe in `packaging/` is not evidence that a package has
@@ -14,10 +14,17 @@ https://github.com/cristiancmoises/zupt
 GitHub is the canonical source and release host. Packaging must never fetch
 `zupt-web` or substitute an asset from another project.
 
-The `v5.2.2` and `v5.2.3` tags are immutable non-promoted candidates. The latter
-was not promoted because its source-policy test assumed LF for a Windows `.bat`
-file that Git correctly checks out as CRLF. Corrective packages and release
-assets must use `v5.2.4`; never move or overwrite an earlier tag or checksum.
+The `v5.2.2`, `v5.2.3`, and `v5.2.4` tags are immutable non-promoted candidates.
+The v5.2.3 source-policy test assumed LF for a Windows `.bat` file that Git
+correctly checks out as CRLF. Exact-tag GitHub Actions run `33431386002` then
+recorded 12 successful v5.2.4 jobs, one openSUSE service-harness failure caused
+by its working directory, and skipped dependent Windows/macOS jobs. A local
+Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
+entering the service directory completes the source-service chain. Corrective
+packages and release assets must use `v5.2.5`; never move or overwrite an
+earlier tag or checksum, and never transfer prior evidence automatically.
+This corrective version changes release/test integration only; the product,
+archive format, cryptography, codec, and SDK ABI remain unchanged.
 
 ## Source-only boundary
 
@@ -47,7 +54,7 @@ Audit the current tree or a generated archive with:
 
 ```sh
 scripts/check-source-only.sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
 ```
 
 The scanner reports paths, not file contents, and exits nonzero on a violation.
@@ -61,8 +68,8 @@ the commit omits Git's commit-ID PAX header:
 
 ```sh
 SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
-  make DIST_TARBALL=/tmp/zupt-5.2.4.tar.gz dist
-sha256sum /tmp/zupt-5.2.4.tar.gz
+  make DIST_TARBALL=/tmp/zupt-5.2.5.tar.gz dist
+sha256sum /tmp/zupt-5.2.5.tar.gz
 ```
 
 With identical committed input and `SOURCE_DATE_EPOCH`, repeated exports must
@@ -108,12 +115,12 @@ private-library RPATH.
 | openSUSE / OBS | `packaging/opensuse/` | source and binary RPM through OBS |
 | Debian / Ubuntu | `packaging/debian/`, `packaging/build-deb.sh` | Debian metadata and binary DEB after the target gate |
 | RPM release artifact | `packaging/opensuse/zupt.spec`, `packaging/build-rpm.sh` | source and binary RPM after the target gate |
-| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.4_all.deb` after payload/dependency and installed integration gates |
-| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.4-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
-| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.4-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
-| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.4-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
+| GUI DEB | `packaging/build-gui-deb.sh` | `zupt-gui_5.2.5_all.deb` after payload/dependency and installed integration gates |
+| GUI RPM | `packaging/build-gui-rpm.sh` | `zupt-gui-5.2.5-1.noarch.rpm` and matching `.src.rpm` after package and installed integration gates |
+| Linux CLI archive | `.github/workflows/ci.yml` | `zupt-5.2.5-linux-x86_64.tar.xz` with notices after dependency, member, and extracted functional gates |
+| Portable GUI source | `packaging/portable/`, `.github/workflows/ci.yml` | `zupt-gui-5.2.5-portable.zip` after source scan, member allowlist, and extracted off-screen integration gate |
 | Fedora / RPM-based systems | `packaging/rpm/zupt.spec` | downstream RPM starting point |
-| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.4 AppImage is promoted |
+| AppImage helper | `packaging/build-appimage.sh` | downstream-only helper; no 5.2.5 AppImage is promoted |
 | Windows | `.github/workflows/cross-platform.yml` | native ZIP (executable plus notices) after the required native gate |
 | macOS | `packaging/build-dmg.sh` | native-architecture DMG after the native gate |
 | Arch Linux | `packaging/aur/PKGBUILD` | AUR package recipe |
@@ -189,17 +196,17 @@ expectations, then test the installed launcher off-screen against the matching
 ### Portable and native release artifacts
 
 The Linux x86_64 gate packages the tested `zupt` executable as
-`zupt-5.2.4-linux-x86_64.tar.xz` beside README, changelog, security guidance,
+`zupt-5.2.5-linux-x86_64.tar.xz` beside README, changelog, security guidance,
 and every applicable public license and notice. Its dynamic-library allowlist,
 archive member allowlist, and extracted CLI functional suite must pass.
 
-The `zupt-gui-5.2.4-portable.zip` artifact is source-only: it contains the GUI
+The `zupt-gui-5.2.5-portable.zip` artifact is source-only: it contains the GUI
 Python source, shell/macOS/Windows launchers, icons, provenance, changelog, and
 licenses, but no Python, Qt, CLI, or compiled runtime. The gate scans both the
 assembled and extracted trees, verifies an exact safe member allowlist, and
 runs the extracted launcher off-screen against the tested CLI.
 
-AppImage creation is deliberately offline and is not a 5.2.4 release gate.
+AppImage creation is deliberately offline and is not a 5.2.5 release gate.
 Supply a locally verified `appimagetool`, type-2 runtime, and the complete
 license/source-relink compliance notice for those exact runtime bytes; the
 helper never downloads any input:
@@ -215,7 +222,7 @@ APPIMAGE_RUNTIME_COMPLIANCE_FILE=/verified/path/runtime-compliance.txt \
 The runtime inspected while preparing 5.2.2 omitted a linked component from
 its notice and did not provide the complete LGPL source/relink handoff required
 by this release policy. No AppImage produced by this helper is promoted by the
-upstream 5.2.4 workflow. AppDir and Flatpak bundles and GUI platform installers
+upstream 5.2.5 workflow. AppDir and Flatpak bundles and GUI platform installers
 are also excluded. Bare Linux and Windows executables are not promoted; their
 CLI programs appear only inside notice-bearing archives. The Windows ZIP and
 macOS DMG remain CLI-only.
@@ -230,8 +237,8 @@ DIST_DIR="$release_dir" RUN_CHECKS=1 packaging/build-dmg.sh
 The Windows ZIP (including its executable and notices) must be built and tested
 by the Windows job in `.github/workflows/cross-platform.yml`; it is not a
 cross-compiled release claim from a Linux build. No Wine result is retained as
-5.2.4 release evidence. Extended-length/device namespace paths, raw UNC output
-roots, and mapped/network-drive output are not supported in 5.2.4. Publish the
+5.2.5 release evidence. Extended-length/device namespace paths, raw UNC output
+roots, and mapped/network-drive output are not supported in 5.2.5. Publish the
 exact architecture recorded by the native job.
 These helpers create binary distribution artifacts for the release page, not
 content to be committed to Git or included in the source archive.
@@ -239,7 +246,7 @@ content to be committed to Git or included in the source archive.
 ### AUR, Homebrew, Guix, and Nix
 
 After calculating the final reproducible source archive, but before creating or
-publishing the immutable tag, update each recipe to version 5.2.4 and to the
+publishing the immutable tag, update each recipe to version 5.2.5 and to the
 exact digest or content hash expected by its package manager. These recipe
 directories are excluded from the source archive, so this does not create a
 checksum cycle. Commit the pinned recipes in the tagged tree, then build and
@@ -258,7 +265,7 @@ build.
 
 For every published artifact:
 
-1. start from the immutable `v5.2.4` tag;
+1. start from the immutable `v5.2.5` tag;
 2. keep `WITH_SDK=0 WITH_PQBOX=0` unless system dependencies are declared;
 3. record the exact OS, distribution release, architecture, and toolchain;
 4. run format validation plus installed `--version`, `--help`, and archive
@@ -276,7 +283,7 @@ than redirecting consumers to an unverified file.
 
 ## Downstream checklist
 
-- [ ] The source URL resolves to the immutable `v5.2.4` tag.
+- [ ] The source URL resolves to the immutable `v5.2.5` tag.
 - [ ] The source archive passes `scripts/check-source-only.sh --archive`.
 - [ ] The recipe checksum matches the downloaded source exactly.
 - [ ] `WITH_SDK=0 WITH_PQBOX=0` is explicit, or system dependencies are complete.
diff --git a/INSTALL.md b/INSTALL.md
index 109a39a..2199dcf 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -1,4 +1,4 @@
-# Installing ZUPT 5.2.4
+# Installing ZUPT 5.2.5
 
 This guide covers the ZUPT command-line program and the optional Python GUI.
 The canonical source repository is
@@ -18,14 +18,21 @@ The canonical source repository is
 The immutable `v5.2.2` candidate was not promoted after CI integration
 failures. The immutable `v5.2.3` candidate was not promoted because its
 source-policy test assumed LF for a Windows `.bat` file checked out as the
-required CRLF. Do not treat either candidate's artifacts as 5.2.4 packages.
+required CRLF. The immutable `v5.2.4` candidate was not promoted after exact-tag
+GitHub Actions run `33431386002`: 12 jobs succeeded, the sole openSUSE
+service-harness job failed because its executor did not enter the service
+directory, and dependent Windows/macOS jobs were skipped. A local Tumbleweed
+reproduction confirmed both the explicit tag ref and the corrected
+working-directory contract. This is release/test integration only; the product,
+archive format, cryptography, codec, and SDK ABI are unchanged. Do not treat any
+prior candidate's artifacts or evidence as 5.2.5 packages or validation.
 
-The 5.2.4 package set eligible for promotion after each target gate succeeds is:
+The 5.2.5 package set eligible for promotion after each target gate succeeds is:
 
 | Component | Gated artifacts |
 |---|---|
-| CLI | `zupt-5.2.4.tar.gz`, `zupt_5.2.4_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.4-linux-x86_64.tar.xz`, `zupt-5.2.4-windows-x86_64.zip`, and `ZUPT-5.2.4-macOS-*.dmg` |
-| GUI | `zupt-gui_5.2.4_all.deb`, `zupt-gui-5.2.4-1.noarch.rpm`, `zupt-gui-5.2.4-1.src.rpm`, and `zupt-gui-5.2.4-portable.zip` |
+| CLI | `zupt-5.2.5.tar.gz`, `zupt_5.2.5_amd64.deb`, openSUSE x86_64 binary/source RPMs, `zupt-5.2.5-linux-x86_64.tar.xz`, `zupt-5.2.5-windows-x86_64.zip`, and `ZUPT-5.2.5-macOS-*.dmg` |
+| GUI | `zupt-gui_5.2.5_all.deb`, `zupt-gui-5.2.5-1.noarch.rpm`, `zupt-gui-5.2.5-1.src.rpm`, and `zupt-gui-5.2.5-portable.zip` |
 
 The GUI packages require the matching `zupt` CLI package and must pass exact
 payload/dependency checks plus an installed off-screen GUI/CLI integration
@@ -33,7 +40,7 @@ test. The source-only portable GUI ZIP bundles launchers, notices, and GUI
 source, but not Python, Qt, or the CLI. The Linux tar.xz carries the tested CLI
 beside the complete public license/notice payload. AppImage, AppDir, Flatpak
 bundles, GUI platform installers, and bare Linux/Windows executables are not
-promoted for 5.2.4. The Windows ZIP and macOS DMG contain the CLI only. Exact
+promoted for 5.2.5. The Windows ZIP and macOS DMG contain the CLI only. Exact
 target boundaries are listed in `README.md`.
 The release's `SHA256SUMS` and validation notes, not the mere presence of a
 download link, identify an artifact that completed its gate.
@@ -70,7 +77,7 @@ sudo pacman -S base-devel gzip
 ```
 
 Package names can differ by distribution release. These commands are examples,
-not a statement that 5.2.4 has been accepted into each distribution repository.
+not a statement that 5.2.5 has been accepted into each distribution repository.
 
 ## Build and test from source
 
@@ -90,7 +97,7 @@ From a release archive, run the scanner as follows before extraction or from a
 trusted checkout after download:
 
 ```sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
 ```
 
 The default build provides the native password, ML-KEM-768 + X25519 hybrid
diff --git a/README.md b/README.md
index 4557651..5662fa2 100644
--- a/README.md
+++ b/README.md
@@ -1,26 +1,40 @@
-# ZUPT 5.2.4
+# ZUPT 5.2.5
 
 ZUPT is a command-line backup archiver written in C11. It combines the
 bundled VaptVupt compression codec with authenticated AES-256-CTR +
 HMAC-SHA256 encryption, native ML-KEM-768/X25519 hybrid encryption, archive
 integrity checks, multithreaded operation, and a Python/Qt graphical frontend.
 
-Version 5.2.4 corrects release/source-policy integration. The immutable
-`v5.2.3` candidate was not promoted because its source-policy test assumed LF
-for a Windows `.bat` file that Git correctly checks out as CRLF. This correction
-does not change the archive format, cryptography, codec, or SDK ABI.
+Version 5.2.5 corrects the working-directory contract in the exact-tag
+openSUSE source-service harness. The immutable `v5.2.4` candidate was not
+promoted after GitHub Actions run `33431386002`: 12 jobs succeeded, the sole
+openSUSE job failed in the standalone service executor, and its dependent
+Windows and macOS jobs were skipped. A local Tumbleweed reproduction confirmed
+that `refs/tags/v5.2.4` resolves correctly and that running the executor after
+`os.chdir(service_dir)` completes `obs_scm`, `tar`, and `recompress`. This is a
+release/test integration correction; it does not change the archive format,
+cryptography, codec, or SDK ABI. No v5.2.4 evidence transfers automatically to
+v5.2.5.
 
 Version 5.2.2 restored the original ZUPT product name and the `zupt` command.
 The `.zupt` archive extension, format v1.6, magic bytes, codec identifiers, and
 SDK ABI remain unchanged. An optional `vaptvupt` command alias may be provided
 for scripts written against versions 3.0.0 through 5.2.1.
 
-## Corrective changes in 5.2.4
+## Corrective changes in 5.2.5
+
+The exact-tag openSUSE gate now executes its standalone service chain from the
+directory containing `_service`. All current release paths move to 5.2.5 and
+require fresh exact-tag hosted CI, package, native-platform, source-only, and
+checksum evidence before promotion. The `v5.2.4` tag remains immutable and
+unpromoted.
+
+## Corrective changes introduced in 5.2.4
 
 The release gate now validates the required CRLF checkout form without treating
-it as source drift. All current release paths move to 5.2.4 and require fresh
-exact-tag CI, package, native-platform, source-only, and checksum evidence before
-promotion. The `v5.2.3` tag remains immutable and unpromoted.
+it as source drift. That candidate required fresh exact-tag CI, package,
+native-platform, source-only, and checksum evidence before promotion. The
+`v5.2.3` tag remains immutable and unpromoted.
 
 ## Corrective changes introduced in 5.2.3
 
@@ -120,9 +134,9 @@ users. Those assets must be built from the tagged source, tested on their target
 environment, and kept outside Git and the source archive. A format that was not
 built and tested is not presented as supported.
 
-## 5.2.4 release artifacts
+## 5.2.5 release artifacts
 
-The 5.2.4 release workflow is defined to produce the following files only after
+The 5.2.5 release workflow is defined to produce the following files only after
 the corresponding target gate succeeds. `SHA256SUMS` records the exact promoted
 filenames and digests. The release notes identify the tested commit and the
 manually dispatched CI run; that run's job definitions and logs are the runtime
@@ -131,23 +145,23 @@ skips. This table is not a substitute for that evidence.
 
 | Format | Intended target and validation boundary |
 | --- | --- |
-| `zupt-5.2.4.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
-| `zupt_5.2.4_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
-| `zupt-5.2.4-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
-| `zupt-5.2.4-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
-| `zupt-gui_5.2.4_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
-| `zupt-gui-5.2.4-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
-| `zupt-gui-5.2.4-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
-| `zupt-gui-5.2.4-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
-| `zupt-5.2.4-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
-| `ZUPT-5.2.4-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
+| `zupt-5.2.5.tar.gz` | Reproducible, source-only archive; scanned twice-built input plus SHA-256. |
+| `zupt_5.2.5_amd64.deb` | Ubuntu 24.04 amd64 package; install, functional round trip, and uninstall gate. |
+| `zupt-5.2.5-*.x86_64.rpm` and `.src.rpm` | openSUSE Tumbleweed x86_64 source/binary RPM gate; package inspection, install, round trip, and uninstall. |
+| `zupt-5.2.5-linux-x86_64.tar.xz` | Linux x86_64 CLI plus the complete public license/notice payload; dependency allowlist and extracted-package functional gate. |
+| `zupt-gui_5.2.5_all.deb` | Architecture-independent Python/Qt GUI package; exact dependency/payload checks plus installed off-screen GUI/CLI integration gate. |
+| `zupt-gui-5.2.5-1.noarch.rpm` | Architecture-independent Python/Qt GUI RPM; package inspection plus installed off-screen GUI/CLI integration gate. |
+| `zupt-gui-5.2.5-1.src.rpm` | Source RPM corresponding exactly to the gated noarch GUI RPM. |
+| `zupt-gui-5.2.5-portable.zip` | Source-only GUI and launchers with licenses/provenance; source scan, exact member allowlist, and extracted off-screen GUI/CLI gate. |
+| `zupt-5.2.5-windows-x86_64.zip` | Native Windows x86_64 executable with notices; extracted-ZIP round-trip gate. |
+| `ZUPT-5.2.5-macOS-*.dmg` | Native macOS image; mounted packaged executable round-trip gate, with the actual architecture in the filename. |
 
 An asset absent from the release was not promoted through its mandatory gate.
 Do not infer support for another distribution release, OS version, CPU
 architecture, raw UNC/SMB destination, or package manager from a similarly
 named file. Binary assets are release outputs, never source-build inputs.
 
-No AppImage is promised for 5.2.4. The inspected upstream type-2 runtime lacked
+No AppImage is promised for 5.2.5. The inspected upstream type-2 runtime lacked
 a complete notice/source-relink handoff for every statically linked component,
 so redistributing it would not meet this release's provenance gate. AppDir and
 Flatpak bundles and GUI platform installers are likewise outside the promoted
@@ -177,8 +191,8 @@ bash tests/test_source_only.sh
 For a tag or an existing source archive:
 
 ~~~sh
-bash scripts/check-source-only.sh --tag v5.2.4
-bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
+bash scripts/check-source-only.sh --tag v5.2.5
+bash scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
 ~~~
 
 Unknown `.bin` files fail the scan. A necessary binary data fixture may be
@@ -314,16 +328,22 @@ sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
 evidence rather than an exact-candidate package result.
 
 Those results are historical upstream self-audit evidence, not independent
-certification and not 5.2.4 results. Post-tag CI integration failures prevented
+certification and not 5.2.5 results. Post-tag CI integration failures prevented
 5.2.2 promotion. The immutable 5.2.3 candidate was also not promoted because its
 source-policy test assumed LF for a `.bat` checkout that correctly used CRLF.
-The exact 5.2.4 candidate must repeat all required gates;
+The immutable v5.2.4 candidate then recorded 12 successful jobs in exact-tag CI
+run `33431386002`; the sole openSUSE service-harness job failed because the
+standalone executor did not enter its service directory, so dependent Windows
+and macOS jobs were skipped. A local Tumbleweed reproduction proved the explicit
+tag ref and corrected working-directory contract, but neither that reproduction
+nor the successful v5.2.4 jobs are v5.2.5 evidence. The exact 5.2.5 candidate
+must repeat all required gates;
 native Windows and macOS, hosted GitHub CI/release promotion, authenticated OBS,
 and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary`
 finding remain pending until recorded otherwise. Unexecuted gates are `SKIP`,
 never `PASS`.
 
-On Windows, 5.2.4 scopes output handling to normal local Win32 paths. A MinGW
+On Windows, 5.2.5 scopes output handling to normal local Win32 paths. A MinGW
 cross-build or Wine run is not native-Windows evidence; the `windows-latest`
 package job, including its Unicode round trip, remains a mandatory publication
 gate. Win32 extended-length and device-namespace paths, raw UNC output roots
@@ -345,7 +365,7 @@ downgrading authentication of header and footer metadata.
 `disk restore`, and exists only to recover a known, trusted archive created
 before AIT was introduced. Do not use that override for an archive from
 untrusted or attacker-writable storage; verify and migrate the recovered data to
-a newly created 5.2.4 archive. Compression and disk backup never create a
+a newly created 5.2.5 archive. Compression and disk backup never create a
 no-AIT archive.
 
 `info` is deliberately different: it reports unauthenticated framing metadata,
@@ -363,7 +383,7 @@ lists, tests, extracts, and restores it byte-exact. The full local Linux gate
 passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
 flag-gated 5.2.2 encoding or that every historical combination was tested.
 
-The candidate commands and outcome fields for 5.2.4 are maintained in the
+The candidate commands and outcome fields for 5.2.5 are maintained in the
 release handoff and
 [packaging/opensuse/README.md](packaging/opensuse/README.md). They must be
 updated from the final release candidate before tagging. No architecture or
@@ -375,9 +395,9 @@ Generate the reproducible source archive outside the repository:
 
 ~~~sh
 make dist
-sha256sum /tmp/zupt-5.2.4.tar.gz
+sha256sum /tmp/zupt-5.2.5.tar.gz
 bash scripts/check-source-only.sh \
-    --archive /tmp/zupt-5.2.4.tar.gz
+    --archive /tmp/zupt-5.2.5.tar.gz
 ~~~
 
 Archive ordering, ownership and timestamps are normalized. The default epoch is
@@ -393,7 +413,7 @@ final digest before the tag is published.
 ## openSUSE and OBS
 
 The maintained upstream recipe is in packaging/opensuse. It is prepared for an
-immutable v5.2.4 tag, disables submodules and Git LFS, builds with
+immutable v5.2.5 tag, disables submodules and Git LFS, builds with
 WITH_SDK=0 WITH_PQBOX=0, runs real checks, and installs without the renamed-era
 `vaptvupt` alias.
 
@@ -436,7 +456,7 @@ The optional GUI is under `gui/`. It invokes the `zupt` CLI and needs Python 3
 plus PySide6 or PyQt6. GUI image assets are data files whose purpose,
 provenance and license are recorded in [gui/assets/README.md](gui/assets/README.md).
 The integrated source and lightweight consistency checks do not constitute a
-target-native audit of every historical GUI format. The 5.2.4 artifact promise
+target-native audit of every historical GUI format. The 5.2.5 artifact promise
 is limited to the gated GUI DEB, noarch/source RPM, and source-only portable ZIP
 listed above; AppImage, AppDir, Flatpak bundles, and platform GUI installers
 remain excluded.
@@ -445,13 +465,14 @@ remain excluded.
 
 Cristian Cezar Moisés is the creator and current upstream maintainer of ZUPT and
 the author of the current upstream source, build, test, documentation, and
-packaging changes, including the 5.2.2 baseline and corrective 5.2.3/5.2.4 work.
+packaging changes, including the 5.2.2 baseline and corrective
+5.2.3/5.2.4/5.2.5 work.
 
 Alessandro de Oliveira Faria (Cabelo) is credited as the openSUSE collaborator
 and downstream package maintainer. He reviews the handoff, commits it in the
 OBS project he maintains, and may make the additional openSUSE-side adjustments
 he considers necessary. That downstream role is not attribution of ZUPT source
-authorship or of the upstream 5.2.2, 5.2.3, or 5.2.4 changes.
+authorship or of the upstream 5.2.2, 5.2.3, 5.2.4, or 5.2.5 changes.
 
 ## License
 
diff --git a/SECURITY.md b/SECURITY.md
index 28ec81c..3c7cc16 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,4 +1,4 @@
-# Security Policy — ZUPT 5.2.4
+# Security Policy — ZUPT 5.2.5
 
 ## Reporting vulnerabilities
 
@@ -66,7 +66,7 @@ partially accepted.
 
 ### Optional integrations
 
-The 5.2.4 default is `WITH_SDK=0 WITH_PQBOX=0`:
+The 5.2.5 default is `WITH_SDK=0 WITH_PQBOX=0`:
 
 - `WITH_SDK=1` enables libvuptsdk-backed features, including the SDK PQ mode
   and Argon2id support, using a separately installed system development package.
@@ -133,7 +133,7 @@ can compromise archives encrypted to it.
 
 ## Constant-time and side-channel scope
 
-Portable C is the 5.2.4 default. Sensitive comparisons and selections use
+Portable C is the 5.2.5 default. Sensitive comparisons and selections use
 branchless helpers, but generated machine-code behavior remains dependent on
 the compiler and platform. This is not a formal whole-program constant-time
 claim. The C AES implementation uses table lookups and is unsuitable for a
@@ -197,7 +197,7 @@ media before proceeding.
 
 The Windows handle-relative implementation is scoped to normal local Win32
 paths. Win32 extended-length and device-namespace paths, raw UNC output roots,
-and mapped/network-drive output are not supported in 5.2.4. Cross-build and
+and mapped/network-drive output are not supported in 5.2.5. Cross-build and
 Wine results are not native-Windows evidence; the `windows-latest` package gate
 must pass its Unicode round trip before Windows assets are published. Restore
 to a normal local directory first and move verified output to network storage
@@ -240,7 +240,7 @@ shared/static library, or distribution package. Audit them with:
 
 ```sh
 scripts/check-source-only.sh
-scripts/check-source-only.sh --archive /path/to/zupt-5.2.4.tar.gz
+scripts/check-source-only.sh --archive /path/to/zupt-5.2.5.tar.gz
 ```
 
 Nested archive inspection is required to enforce bounded recursion, member
@@ -250,13 +250,13 @@ limit violations. On commit `ff99770`, the source-only scanner suite passed
 
 DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
 ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
-AppImage is not promoted for 5.2.4. A bare Linux or Windows executable is also
+AppImage is not promoted for 5.2.5. A bare Linux or Windows executable is also
 excluded; executables are distributed only inside their notice-bearing
 archives. Trust an artifact only when its exact format has a recorded build,
 content/metadata inspection, extracted or installed smoke test, and applicable
 archive round trip. Never treat an unexecuted platform as passing.
 
-The gated 5.2.4 set is the CLI package/archive set plus the exact GUI DEB,
+The gated 5.2.5 set is the CLI package/archive set plus the exact GUI DEB,
 noarch/source RPM, and source-only portable ZIP documented in the README. The
 portable GUI ZIP contains no compiled runtime and is scanned as source before
 and after extraction. Other GUI packages, AppImage, AppDir and Flatpak bundles,
@@ -296,13 +296,21 @@ result.
 
 Post-tag CI integration failures prevented 5.2.2 promotion. Those upstream
 self-audit results are not independent certification and do not transfer to
-5.2.4. The immutable 5.2.3 candidate was not promoted because its source-policy
-test assumed LF for a Windows `.bat` file checked out as CRLF. The exact 5.2.4
-candidate must repeat the required suite. Native Windows
-and macOS, hosted GitHub CI/release promotion, authenticated OBS, and the
-openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending
-until recorded otherwise. An unavailable or unexecuted environment remains
-`SKIP`, never `PASS`.
+5.2.5. The immutable 5.2.3 candidate was not promoted because its source-policy
+test assumed LF for a Windows `.bat` file checked out as CRLF. The immutable
+v5.2.4 candidate was not promoted after exact-tag GitHub Actions run
+`33431386002`: 12 jobs succeeded, the sole openSUSE job failed in its
+standalone source-service harness because it did not enter the service
+directory, and dependent Windows and macOS jobs were skipped. A local
+Tumbleweed reproduction confirmed that `refs/tags/v5.2.4` is valid and that
+`os.chdir(service_dir)` lets `obs_scm`, `tar`, and `recompress` complete with a
+source-scanned archive. This was a release/test integration defect, not a
+product, archive, cryptographic, codec, or SDK ABI change, and its evidence does
+not transfer automatically to 5.2.5. The exact 5.2.5 candidate must repeat the
+required suite. Native Windows and macOS, hosted GitHub CI/release promotion,
+authenticated OBS, and the openSUSE automatic `debugsource` rpmlint `no-binary`
+finding remain pending until recorded otherwise. An unavailable or unexecuted
+environment remains `SKIP`, never `PASS`.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or
diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
index 73b1193..97321f0 100644
--- a/THIRD-PARTY-NOTICES.md
+++ b/THIRD-PARTY-NOTICES.md
@@ -159,7 +159,7 @@ grant attached to their unchanged Git blobs, are recorded in
 
 ## AppImage type-2 runtime
 
-No AppImage is a promised or promoted 5.2.4 release asset. The upstream
+No AppImage is a promised or promoted 5.2.5 release asset. The upstream
 type-2 runtime inspected during the 5.2.2 review statically linked musl, libfuse,
 squashfuse, zstd, zlib, and mimalloc, but its own license notice did not list
 mimalloc and the available release inputs did not provide a complete
@@ -171,7 +171,7 @@ no network input and requires the operator to supply both a locally verified
 runtime and `APPIMAGE_RUNTIME_COMPLIANCE_FILE`, containing the license notices,
 source correspondence or offer, and relink information applicable to those
 exact runtime bytes. An artifact produced independently with that helper is
-not covered by the 5.2.4 upstream release gates.
+not covered by the 5.2.5 upstream release gates.
 
 ## Reporting attribution issues
 
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 05e9a45..4e7c222 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -1,4 +1,4 @@
-# ZUPT 5.2.4 threat model
+# ZUPT 5.2.5 threat model
 
 This document defines the security boundary of the ZUPT archive tool. It is
 not a certification, a guarantee against every hostile input, or a substitute
@@ -17,7 +17,7 @@ plausibly deniable.
 
 ## Baseline considered here
 
-The upstream baseline is built from the 5.2.4 source with:
+The upstream baseline is built from the 5.2.5 source with:
 
 ```sh
 make WITH_SDK=0 WITH_PQBOX=0
@@ -175,7 +175,7 @@ temporary through its descriptor or handle. These controls reduce traversal,
 link, race, and partial-output risks, but do not establish that no parser or
 filesystem bug can exist.
 
-The Windows handle-relative boundary in 5.2.4 covers normal local Win32 paths.
+The Windows handle-relative boundary in 5.2.5 covers normal local Win32 paths.
 Win32 extended-length and device-namespace paths, raw UNC output roots, and
 mapped/network-drive output are not supported. Cross-build and Wine results are
 not a substitute for the required native `windows-latest` Unicode package
@@ -250,9 +250,9 @@ tagged source. Each artifact extends the trust boundary to its builder,
 toolchain, runner image, and packaging scripts. Treat it as validated only when
 the exact target has a recorded build, content/package inspection, extracted or
 installed smoke test, and applicable archive round trip. An AppImage is not
-promoted for 5.2.4; bare Linux and Windows executables are also excluded.
+promoted for 5.2.5; bare Linux and Windows executables are also excluded.
 
-For 5.2.4, that gated artifact scope covers the CLI files plus the exact GUI
+For 5.2.5, that gated artifact scope covers the CLI files plus the exact GUI
 DEB, noarch/source RPM, and source-only portable ZIP named in the README. The
 portable ZIP contains no compiled runtime and crosses the release boundary only
 after source scans and an exact safe-member check. AppDir and Flatpak bundles
@@ -265,12 +265,20 @@ strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
 ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
 GUI smoke evidence is retained separately. Post-tag CI integration failures
 prevented 5.2.2 promotion. This upstream self-review is not an independent
-certification and is not 5.2.4 evidence. The immutable 5.2.3 candidate was not
+certification and is not 5.2.5 evidence. The immutable 5.2.3 candidate was not
 promoted because its source-policy test assumed LF for a Windows `.bat` checkout
-that correctly used CRLF. Native Windows/macOS, hosted GitHub CI
-and release promotion, authenticated OBS, and the openSUSE automatic
-`debugsource` rpmlint `no-binary` finding remain pending until recorded
-otherwise.
+that correctly used CRLF. The immutable v5.2.4 candidate was not promoted after
+exact-tag GitHub Actions run `33431386002`: 12 jobs succeeded, the sole openSUSE
+service-harness job failed because its standalone executor did not enter the
+service directory, and dependent Windows/macOS jobs were skipped. A local
+Tumbleweed reproduction established that the explicit `refs/tags/v5.2.4`
+revision works and that `os.chdir(service_dir)` completes the source-service
+chain. This narrows the failure to release/test integration; it changes no
+product, archive, cryptographic, codec, or SDK ABI boundary and supplies no
+automatic 5.2.5 evidence. Hosted GitHub CI and release promotion, native
+Windows/macOS, authenticated OBS, and the openSUSE automatic `debugsource`
+rpmlint `no-binary` finding remain pending until an exact 5.2.5 candidate
+records them.
 
 ## Historical compatibility notes
 
@@ -297,7 +305,7 @@ These are historical facts about earlier releases, retained to support recovery:
   combinations remain unclaimed.
 
 Historical test counts in the changelog describe those releases. They do not
-automatically become 5.2.4 results; current outcomes belong in the release
+automatically become 5.2.5 results; current outcomes belong in the release
 validation record, with unavailable environments marked `SKIP`. In particular,
 runs made before the final positional-AAD and mandatory-AIT changes are not
 final release gates for the resulting candidate.
@@ -308,4 +316,4 @@ Email **zupt@riseup.net** with `[security]` in the subject. Include the version,
 platform, impact, and a minimal non-sensitive reproducer. Do not disclose the
 issue publicly until a coordinated timeline has been agreed.
 
-Document version: 5.2.4, 2026-08-31.
+Document version: 5.2.5, 2026-08-31.
diff --git a/doc/zupt-gui.1 b/doc/zupt-gui.1
index d84fd39..29dcbd4 100644
--- a/doc/zupt-gui.1
+++ b/doc/zupt-gui.1
@@ -1,6 +1,6 @@
 .\" SPDX-License-Identifier: AGPL-3.0-or-later
 .\" Copyright (c) 2025-2026 Cristian Cezar Moisés
-.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.4" "User Commands"
+.TH ZUPT-GUI 1 "2026-08-31" "ZUPT 5.2.5" "User Commands"
 .SH NAME
 zupt-gui \- Qt interface for the ZUPT backup utility
 .SH SYNOPSIS
@@ -47,7 +47,7 @@ or
 only when libvuptsdk or libpqvaptvupt is independently reported enabled.
 These two optional integrations are detected separately.
 .PP
-The gated 5.2.4 GUI release set is limited to the architecture-independent DEB,
+The gated 5.2.5 GUI release set is limited to the architecture-independent DEB,
 noarch/source RPM, and source-only portable ZIP named in the project README.
 Package gates require exact checks and installed off-screen GUI/CLI integration.
 The portable ZIP receives source scans, an exact safe-member allowlist, and an
diff --git a/doc/zupt.1 b/doc/zupt.1
index d0647a5..df66131 100644
--- a/doc/zupt.1
+++ b/doc/zupt.1
@@ -1,6 +1,6 @@
 .\" SPDX-License-Identifier: AGPL-3.0-or-later
 .\" Copyright (c) 2025-2026 Cristian Cezar Moisés
-.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.4" "User Commands"
+.TH ZUPT 1 "2026-08-31" "ZUPT 5.2.5" "User Commands"
 .
 .SH NAME
 zupt \- source-built backup compression and authenticated-encryption utility
@@ -89,7 +89,7 @@ Git and the upstream source tarball are source-only. Separately built CLI DEB,
 binary RPM, SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG assets
 may be published from the immutable tag only after their target-specific gates
 pass; they never enter Git or the source tarball. An AppImage is not promoted
-for 5.2.4; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
+for 5.2.5; neither are AppDir/Flatpak bundles, GUI platform installers, or bare
 Linux/Windows executables. The Python/Qt frontend remains available as source;
 its gated architecture-independent DEB, noarch/source RPM, and source-only
 portable ZIP are included in the release claim. The portable ZIP contains no
@@ -477,7 +477,7 @@ then traverse below a pinned directory descriptor with no-follow operations.
 Windows builds use handle-relative traversal and
 no-replace publication for normal local Win32 destinations. Extended-length and
 device-namespace paths, raw UNC output roots, and mapped/network-drive output
-are not supported in 5.2.4. Cross-compilation and Wine results are not native
+are not supported in 5.2.5. Cross-compilation and Wine results are not native
 Windows evidence; the native Windows package gate, including its Unicode round
 trip, is separate and mandatory before publication.
 .
@@ -577,7 +577,7 @@ and the encrypted-dedup linear AAD sequence published through 5.2.1. The narrow
 compatibility fixture is an actual v5.2.1 password-encrypted
 DATA/DATA/REF/DATA disk archive stored as hexadecimal text with source and hash
 provenance. The candidate lists, tests, extracts, and restores that fixture
-byte-exact. The exact 5.2.4 candidate must repeat the gate. It does not imply
+byte-exact. The exact 5.2.5 candidate must repeat the gate. It does not imply
 that a 5.2.1 reader
 accepts every new 5.2.2 archive or that every historical encrypted mode was
 retested.
diff --git a/gui/README.md b/gui/README.md
index 547b110..9c7a139 100644
--- a/gui/README.md
+++ b/gui/README.md
@@ -1,6 +1,6 @@
 # ZUPT GUI
 
-The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.4 command-line
+The ZUPT GUI is a Python/Qt front end for the ZUPT 5.2.5 command-line
 program. It starts the CLI as a subprocess; compression, archive parsing, and
 cryptography remain in the C program.
 
@@ -83,10 +83,10 @@ operating systems and must be tested on the target system.
 Release pages provide only these GUI artifacts after their separate package and
 installed off-screen GUI/CLI integration gates pass:
 
-- `zupt-gui_5.2.4_all.deb`;
-- `zupt-gui-5.2.4-1.noarch.rpm`;
-- `zupt-gui-5.2.4-1.src.rpm`;
-- `zupt-gui-5.2.4-portable.zip`.
+- `zupt-gui_5.2.5_all.deb`;
+- `zupt-gui-5.2.5-1.noarch.rpm`;
+- `zupt-gui-5.2.5-1.src.rpm`;
+- `zupt-gui-5.2.5-portable.zip`.
 
 The DEB/RPM packages install the Python/Qt source and depend on the matching
 `zupt` CLI package. The portable ZIP contains source, launchers, icons, licenses,
@@ -97,7 +97,7 @@ An absent artifact did not pass its gate and must not be inferred from another
 format's result.
 
 GUI AppImage, AppDir and Flatpak bundles, and Windows/macOS GUI installers are
-not promoted by the upstream 5.2.4 release gates.
+not promoted by the upstream 5.2.5 release gates.
 `packaging/build-gui-appimage.sh` is a downstream-only helper and fails unless
 its operator supplies the exact verified runtime plus a complete
 license/source-relink notice through `APPIMAGE_RUNTIME_COMPLIANCE_FILE`; that
@@ -110,7 +110,7 @@ notices. It fails unless the directory also has non-empty
 `PYTHON-NOTICE.txt`, `PYINSTALLER-NOTICE.txt`, `QT-NOTICE.txt`, and either
 `PYSIDE6-NOTICE.txt` or `PYQT6-NOTICE.txt`. The installer includes that
 directory together with every ZUPT license and notice. This requirement does
-not make the untested GUI installer a 5.2.4 release asset. The promoted Windows
+not make the untested GUI installer a 5.2.5 release asset. The promoted Windows
 ZIP and macOS DMG are CLI-only.
 
 Packaging recipes and scripts under `gui/packaging/` and `packaging/` are build
diff --git a/gui/packaging/deb/control b/gui/packaging/deb/control
index b4cabd5..be5b85b 100644
--- a/gui/packaging/deb/control
+++ b/gui/packaging/deb/control
@@ -1,9 +1,9 @@
 Package: zupt-gui
-Version: 5.2.4
+Version: 5.2.5
 Section: utils
 Priority: optional
 Architecture: all
-Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.4)
+Depends: python3 (>= 3.9), python3-pyqt6 | python3-pyside6.qtwidgets, zupt (= 5.2.5)
 Maintainer: Cristian Cezar Moisés <sac@securityops.co>
 Homepage: https://github.com/cristiancmoises/zupt
 Description: Qt graphical interface for the ZUPT backup utility
diff --git a/gui/packaging/windows/build-windows.bat b/gui/packaging/windows/build-windows.bat
index d66b3f4..53e3f9b 100644
--- a/gui/packaging/windows/build-windows.bat
+++ b/gui/packaging/windows/build-windows.bat
@@ -13,7 +13,7 @@ rem runtime files embedded by this local build.
 setlocal EnableExtensions
 for %%I in ("%~dp0\..\..\..") do set "REPO_ROOT=%%~fI"
 set "VERSION=%~1"
-if not defined VERSION set "VERSION=5.2.4"
+if not defined VERSION set "VERSION=5.2.5"
 if not defined ZUPT_DIST_DIR set "ZUPT_DIST_DIR=%TEMP%\zupt-release"
 if not defined ZUPT_CLI_EXE set "ZUPT_CLI_EXE=%REPO_ROOT%\zupt.exe"
 set "WORK=%TEMP%\zupt-gui-build-%RANDOM%-%RANDOM%"
diff --git a/include/zupt.h b/include/zupt.h
index 5752d79..d844746 100644
--- a/include/zupt.h
+++ b/include/zupt.h
@@ -119,7 +119,8 @@ static inline int zupt_win_mkdir_utf8(const char *path) {
 
 /* v5.2.3 corrects release packaging and CI; archive format remains v1.6. */
 /* v5.2.4 makes package metadata checks CRLF-safe; format remains v1.6. */
-#define ZUPT_VERSION_STRING "5.2.4"
+/* v5.2.5 corrects the OBS service harness cwd; format remains v1.6. */
+#define ZUPT_VERSION_STRING "5.2.5"
 /* Vendored codec release (upstream tag) — single source for display strings.
  * The codec's own VV_VERSION_* is its internal API version, not the release. */
 #define ZUPT_CODEC_RELEASE "2.65.3"
diff --git a/install.sh b/install.sh
index 140c559..e56044c 100644
--- a/install.sh
+++ b/install.sh
@@ -6,7 +6,7 @@
 set -Eeuo pipefail
 umask 077
 
-VERSION=${VERSION:-5.2.4}
+VERSION=${VERSION:-5.2.5}
 PREFIX=${PREFIX:-/usr/local}
 
 echo "🔧 Installing ZUPT..."
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index ab9dbf8..887cea5 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -11,7 +11,7 @@
 # Test locally with `makepkg -s` after the release archive is published.
 
 pkgname=zupt
-pkgver=5.2.4
+pkgver=5.2.5
 pkgrel=1
 pkgdesc='Pure-C11 post-quantum backup compression utility (AES-256-CTR + HMAC-SHA256 + ML-KEM-768 + X25519)'
 arch=('x86_64')
@@ -22,8 +22,8 @@ makedepends=('gcc' 'git' 'make')
 checkdepends=('python')
 
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
-# Byte-reproducible upstream v5.2.4 source archive.
-sha256sums=('425a950960c36086bffe6e2504f7ab3d8a8c5ef1cc76b6f04c62182e108fb32b')
+# Byte-reproducible upstream v5.2.5 source archive.
+sha256sums=('REPLACE_AFTER_FINAL_ARCHIVE_SHA256')
 
 build() {
     cd "${pkgname}-${pkgver}"
diff --git a/packaging/debian/changelog b/packaging/debian/changelog
index f266d70..21c900a 100644
--- a/packaging/debian/changelog
+++ b/packaging/debian/changelog
@@ -1,3 +1,12 @@
+zupt (5.2.5-1) UNRELEASED; urgency=medium
+
+  * Run the standalone OBS source-service chain from its isolated working
+    directory and add a packaging-policy regression for that contract.
+  * Preserve the immutable, unpromoted 5.2.4 history and require fresh 5.2.5
+    package, checksum, native-platform, and promotion gates.
+
+ -- Cristian Cezar Moisés <sac@securityops.co>  Mon, 31 Aug 2026 19:55:00 +0000
+
 zupt (5.2.4-1) UNRELEASED; urgency=medium
 
   * Make the static Windows GUI package-version check robust to canonical
diff --git a/packaging/guix/zupt.scm b/packaging/guix/zupt.scm
index 0c55115..6e99bbf 100644
--- a/packaging/guix/zupt.scm
+++ b/packaging/guix/zupt.scm
@@ -62,7 +62,7 @@
         xcb-util-renderutil xcb-util-wm xcb-util-cursor
         libinput-minimal mtdev libevdev eudev))
 
-(define %zupt-version "5.2.4")
+(define %zupt-version "5.2.5")
 
 (define %zupt-source
   (origin
@@ -72,7 +72,7 @@
           "/releases/download/v" %zupt-version
           "/zupt-" %zupt-version ".tar.gz"))
     (sha256
-     (base32 "0axkiw82w6329kqbcxncy5g8r2ixmgvh89bfzszqcq63c04ranj2"))))
+     (base32 "REPLACE_AFTER_FINAL_ARCHIVE_GUIX_BASE32"))))
 
 (define-public zupt
   (package
diff --git a/packaging/homebrew/zupt.rb b/packaging/homebrew/zupt.rb
index d1b8ffd..af89fe4 100644
--- a/packaging/homebrew/zupt.rb
+++ b/packaging/homebrew/zupt.rb
@@ -22,9 +22,9 @@
 class Zupt < Formula
   desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
   homepage "https://github.com/cristiancmoises/zupt"
-  url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.4/zupt-5.2.4.tar.gz"
-  version "5.2.4"
-  sha256 "425a950960c36086bffe6e2504f7ab3d8a8c5ef1cc76b6f04c62182e108fb32b"
+  url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.5/zupt-5.2.5.tar.gz"
+  version "5.2.5"
+  sha256 "REPLACE_AFTER_FINAL_ARCHIVE_SHA256"
   license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
 
   depends_on "python@3.12" => :test  # only for test-suite tamper harness
diff --git a/packaging/nix/flake.nix b/packaging/nix/flake.nix
index e6721cf..8b283ad 100644
--- a/packaging/nix/flake.nix
+++ b/packaging/nix/flake.nix
@@ -9,7 +9,7 @@
 #   nix flake check                     # lint the flake
 #
 # To consume from another flake:
-#   inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.4";
+#   inputs.zupt.url = "github:cristiancmoises/zupt/v5.2.5";
 #   ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
 #
 # `make dist` has its own reproducibility gate. This development flake has no
@@ -30,7 +30,7 @@
 
         zupt = pkgs.stdenv.mkDerivation {
           pname = "zupt";
-          version = "5.2.4";
+          version = "5.2.5";
 
           # When publishing, replace this with `fetchurl` against the
           # release tarball. For local development the flake assumes it
diff --git a/packaging/opensuse/README.md b/packaging/opensuse/README.md
index f9a9635..8123840 100644
--- a/packaging/opensuse/README.md
+++ b/packaging/opensuse/README.md
@@ -1,4 +1,4 @@
-# ZUPT 5.2.4 for openSUSE Build Service
+# ZUPT 5.2.5 for openSUSE Build Service
 
 This directory is the upstream, source-only OBS recipe for ZUPT. It is a
 handoff for the downstream maintainer; its presence does not mean that the
@@ -10,13 +10,14 @@ changes in this handoff. Alessandro de Oliveira Faria (Cabelo) is credited only
 as the openSUSE collaborator and downstream OBS package maintainer: he reviews
 the handoff, commits it through the portal/project he maintains, and may make
 the openSUSE-side adjustments he considers necessary. This role does not
-attribute upstream code or the 5.2.2/5.2.3/5.2.4 upstream changes to Cabelo.
+attribute upstream code or the 5.2.2/5.2.3/5.2.4/5.2.5 upstream changes to
+Cabelo.
 
 ## Files and source policy
 
 | File | Purpose |
 |---|---|
-| `_service` | Fetch the immutable `v5.2.4` tag and create `Source0` at build time. |
+| `_service` | Fetch the immutable `v5.2.5` tag and create `Source0` at build time. |
 | `zupt.spec` | Build and test the CLI with optional external system integrations disabled. |
 | `zupt.changes` | openSUSE-format package history. |
 | `source-audit.sh` | Handoff wrapper for the repository scanner; run it from the complete handoff tree. |
@@ -29,11 +30,11 @@ https://github.com/cristiancmoises/zupt.git
 ```
 
 `obs_scm` stores an `.obscpio` plus `.obsinfo`. The `tar` and `recompress`
-services reconstruct `zupt-5.2.4.tar.gz` inside the build environment, which
+services reconstruct `zupt-5.2.5.tar.gz` inside the build environment, which
 matches `Source0` in the spec.
 
 This source policy does not prohibit separately built release-page packages.
-The upstream 5.2.4 gates may publish the CLI source tarball, DEB, binary RPM,
+The upstream 5.2.5 gates may publish the CLI source tarball, DEB, binary RPM,
 SRPM, notice-bearing Linux tar.xz, Windows ZIP, and macOS DMG, together with a
 GUI DEB, noarch RPM, GUI SRPM, and source-only portable GUI ZIP after each
 format-specific test succeeds. None of those files is an OBS `Source0` input
@@ -138,7 +139,7 @@ reconstructed by the build-time services. Neither `%build` nor `%check` may
 access the network.
 
 For a source RPM check outside OBS, place the service-produced
-`zupt-5.2.4.tar.gz` next to the spec and use a disposable RPM build tree:
+`zupt-5.2.5.tar.gz` next to the spec and use a disposable RPM build tree:
 
 ```sh
 rpm_top=$(mktemp -d)
@@ -166,12 +167,36 @@ unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
 supporting evidence, not an exact-commit package result.
 
 Post-tag CI integration failures prevented 5.2.2 promotion. These historical
-local results do not establish 5.2.4, native Windows or macOS success, hosted
+local results do not establish 5.2.5, native Windows or macOS success, hosted
 GitHub CI/release promotion, authenticated OBS acceptance, or resolution of the
 automatic openSUSE `debugsource` rpmlint `no-binary` finding. The immutable
 5.2.3 candidate was not promoted because its source-policy test assumed LF for
-a Windows `.bat` file checked out as CRLF. The exact 5.2.4 candidate must repeat
-every applicable gate; those gates remain pending until recorded otherwise.
+a Windows `.bat` file checked out as CRLF.
+
+## Prior 5.2.4 exact-tag source-service evidence
+
+The immutable v5.2.4 candidate was not promoted. Exact-tag GitHub Actions run
+`33431386002` recorded 12 successful jobs and one failed openSUSE job. That job's
+standalone `Serviceinfo` harness passed the service directory to the executor
+but did not make it the process working directory; dependent native Windows and
+macOS jobs were skipped.
+
+A disposable local openSUSE Tumbleweed reproduction independently resolved
+`refs/tags/v5.2.4` to the tagged commit. With `osc` 1.27.3,
+`obs-service-obs_scm` 0.12.4, `obs-service-tar` 0.12.4, and
+`obs-service-recompress` 0.5.2 installed, the same executor completed
+`obs_scm`, `tar`, and `recompress` after `os.chdir(service_dir)`. It produced
+exactly one `zupt-5.2.4.tar.gz`; its SHA-256 was
+`aa68a58fc2e88ee92296542de1f189e2b8a803154d832fb04d5296b25acaef8f`, and the
+source scanner reported `PASS source-only: 204 files, 1 archives`.
+
+This result establishes that the explicit tag revision works and isolates a
+release/test harness defect. It does not change the product, archive format,
+cryptography, codec, or SDK ABI; it does not make skipped native jobs pass or
+establish authenticated OBS/Factory acceptance. No v5.2.4 evidence transfers
+automatically to v5.2.5. The exact v5.2.5 candidate must repeat every applicable
+gate, and the automatic openSUSE `debugsource` rpmlint `no-binary` finding
+remains unresolved and unsuppressed.
 
 ## Prior openSUSE packaging validation
 
@@ -210,11 +235,11 @@ gate.
 ## Handoff procedure for Alessandro/Cabelo
 
 1. Upstream completes every applicable pre-tag source and local audit gate,
-   then creates and verifies the annotated `v5.2.4` tag. Exact-tag hosted,
+   then creates and verifies the annotated `v5.2.5` tag. Exact-tag hosted,
    native-platform, package, and promotion gates must pass before release or
    downstream handoff; the tag itself is never moved to repair a failure.
 2. With Git, `file`, bsdtar, tar, zip, unzip and SHA-256 tools installed, run
-   `scripts/export-opensuse-package.sh v5.2.4`. Verify the reported ZIP and
+   `scripts/export-opensuse-package.sh v5.2.5`. Verify the reported ZIP and
    SHA-256 outside the Git index. The handoff includes both
    `packaging/opensuse/source-audit.sh` and its required
    `scripts/check-source-only.sh`; keep that relative layout while auditing.
@@ -226,7 +251,7 @@ gate.
    ```
 
 4. From the extracted handoff root, run
-   `packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.4.tar.gz`.
+   `packaging/opensuse/source-audit.sh --archive /path/to/zupt-5.2.5.tar.gz`.
    Then copy `_service`, `zupt.spec`, `zupt.changes` and `README.md`
    into the flat OBS package checkout. The audit wrapper is not an OBS build
    source and must not be copied without its companion `scripts/` directory.
diff --git a/packaging/opensuse/_service b/packaging/opensuse/_service
index b137896..8f1be66 100644
--- a/packaging/opensuse/_service
+++ b/packaging/opensuse/_service
@@ -4,7 +4,7 @@
   <service name="obs_scm" mode="manual">
     <param name="url">https://github.com/cristiancmoises/zupt.git</param>
     <param name="scm">git</param>
-    <param name="revision">refs/tags/v5.2.4</param>
+    <param name="revision">refs/tags/v5.2.5</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">^v(.*)$</param>
     <param name="versionrewrite-replacement">\1</param>
diff --git a/packaging/opensuse/zupt.changes b/packaging/opensuse/zupt.changes
index 645d534..33acb3b 100644
--- a/packaging/opensuse/zupt.changes
+++ b/packaging/opensuse/zupt.changes
@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Mon Aug 31 19:55:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
+
+- Update to 5.2.5:
+  * Run the standalone OBS source-service chain from its isolated working
+    directory so downstream services can find .obsinfo.
+  * Add a packaging-policy regression for the executor working directory.
+  * Preserve immutable, unpromoted 5.2.4 history and require fresh 5.2.5 gates.
+  * Pin the OBS source service to the immutable v5.2.5 tag.
+
 -------------------------------------------------------------------
 Mon Aug 31 18:55:00 UTC 2026 - Cristian Cezar Moisés <sac@securityops.co>
 
diff --git a/packaging/opensuse/zupt.spec b/packaging/opensuse/zupt.spec
index e739b14..770eeaa 100644
--- a/packaging/opensuse/zupt.spec
+++ b/packaging/opensuse/zupt.spec
@@ -18,7 +18,7 @@
 #
 
 Name:           zupt
-Version:        5.2.4
+Version:        5.2.5
 Release:        0
 Summary:        Backup compression with authenticated and post-quantum encryption
 License:        AGPL-3.0-or-later AND GPL-3.0-or-later AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0
diff --git a/packaging/portable/README.txt b/packaging/portable/README.txt
index 425b515..925622f 100644
--- a/packaging/portable/README.txt
+++ b/packaging/portable/README.txt
@@ -27,7 +27,7 @@ Requirements
 ------------
   1. Python 3.9 or newer.
   2. PySide6 6.5 or newer, or a compatible PyQt6 package.
-  3. ZUPT 5.2.4, installed as `zupt` on PATH or placed beside the launcher
+  3. ZUPT 5.2.5, installed as `zupt` on PATH or placed beside the launcher
      (`zupt.exe` on Windows). A local command must have been built
      and tested independently; this bundle never downloads one.
 
@@ -46,7 +46,7 @@ Troubleshooting
 ---------------
   * "requires PySide6 or PyQt6": install one Qt binding through your operating
     system package manager or another trusted, preconfigured Python source.
-  * "zupt not found": install ZUPT 5.2.4 or place its command beside
+  * "zupt not found": install ZUPT 5.2.5 or place its command beside
     the launcher.
   * Set ZUPT_DEBUG=1 to print command-discovery diagnostics to stderr.
 
diff --git a/packaging/rpm/zupt.spec b/packaging/rpm/zupt.spec
index 2e2e59f..394abb5 100644
--- a/packaging/rpm/zupt.spec
+++ b/packaging/rpm/zupt.spec
@@ -20,7 +20,7 @@
 # installed smoke test.
 
 Name:           zupt
-Version:        5.2.4
+Version:        5.2.5
 Release:        1%{?dist}
 Summary:        Backup compression with authenticated and post-quantum encryption
 
@@ -101,6 +101,11 @@ comments. Plain archives use non-cryptographic checksums.
 %endif
 
 %changelog
+* Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.5-1
+- Run the standalone OBS source-service chain from its isolated working
+  directory and add a packaging-policy regression for that contract.
+- Preserve immutable, unpromoted 5.2.4 history and require fresh 5.2.5 gates.
+
 * Mon Aug 31 2026 Cristian Cezar Moisés <sac@securityops.co> - 5.2.4-1
 - Make the static Windows GUI package-version check robust to canonical CRLF
   checkouts, advance source-only package metadata, and prepare final hashes.
diff --git a/tests/test_packaging_syntax.sh b/tests/test_packaging_syntax.sh
index 2ce3815..b811a3a 100755
--- a/tests/test_packaging_syntax.sh
+++ b/tests/test_packaging_syntax.sh
@@ -195,6 +195,12 @@ tumbleweed_job=$(sed -n '/^  tumbleweed-rpm:/,/^  gui-rpm-package:/p' \
     .github/workflows/ci.yml)
 fedora_gui_job=$(sed -n '/^  gui-rpm-package:/,/^  linux-portable:/p' \
     .github/workflows/ci.yml)
+if grep -Fq 'os.chdir(service_dir)' <<<"$tumbleweed_job"; then
+    pass 'OBS service executor enters its isolated working directory'
+else
+    fail 'OBS service executor does not enter its isolated working directory'
+fi
+
 # These matches intentionally assert the literal Actions variable in YAML.
 # shellcheck disable=SC2016
 if grep -Fq 'git config --global --add safe.directory "$GITHUB_WORKSPACE"' \