diff --git a/AGENTS.md b/AGENTS.md
index 4368342..51eb64d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,3 +35,5 @@
 - When materializing an external specification, standard, or project-maintained convention, use the upstream source instead of reconstructing it from memory.
   Preserve local policy separately from copied upstream text.
 - After an explicit squash or rewrite request on a pull request, subsequent pull-request updates still use follow-up commits unless the user explicitly asks for another rewrite.
+- Starlark top-level rule and extension declarations cannot reference implementation functions before those functions are assigned.
+  Keep executable public interface declarations after their implementation symbols, or validate before committing a top-down rewrite.
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index a104599..d9e5f7c 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -93,7 +93,7 @@
   "moduleExtensions": {
     "//bazel:rust_toolchain.bzl%rust": {
       "general": {
-        "bzlTransitiveDigest": "vgMjUIu7ufoJarRJsbT3Iq2bjHkW6AGipl9O+R6+0SI=",
+        "bzlTransitiveDigest": "fQj9CTS2ItcWLOd4VcpBs75mepI/nRwLQOA3c7X5QG4=",
         "usagesDigest": "SQP3kWaLgKBHOdfxAvAWSUMuSfW8zC/274pBGhq2FlQ=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
diff --git a/bazel/rust_toolchain.bzl b/bazel/rust_toolchain.bzl
index 97c7314..7077fbe 100644
--- a/bazel/rust_toolchain.bzl
+++ b/bazel/rust_toolchain.bzl
@@ -1,17 +1,3 @@
-def _require(repository_ctx, executable):
-    path = repository_ctx.which(executable)
-    if path == None:
-        fail("{} must be available in PATH.".format(executable))
-    return path
-
-
-def _execute(repository_ctx, arguments):
-    result = repository_ctx.execute(arguments)
-    if result.return_code != 0:
-        fail("command failed: {}\n{}".format(" ".join(arguments), result.stderr))
-    return result.stdout.strip()
-
-
 def _rust_repository_impl(repository_ctx):
     rustc = _require(repository_ctx, "rustc")
     rustdoc = _require(repository_ctx, "rustdoc")
@@ -50,6 +36,20 @@ def _rust_repository_impl(repository_ctx):
     repository_ctx.file("BUILD.bazel", _build_file(host_triple, release))
 
 
+def _require(repository_ctx, executable):
+    path = repository_ctx.which(executable)
+    if path == None:
+        fail("{} must be available in PATH.".format(executable))
+    return path
+
+
+def _execute(repository_ctx, arguments):
+    result = repository_ctx.execute(arguments)
+    if result.return_code != 0:
+        fail("command failed: {}\n{}".format(" ".join(arguments), result.stderr))
+    return result.stdout.strip()
+
+
 def _build_file(host_triple, release):
     return """
 filegroup(