MGS3006: tool too new

The binary exists, reports a version, and is usable, and that version is at or above the ceiling declared for it.

[MGS3006] node v25.9.0 is newer than the supported range for this
project (below 25)

Its other side is MGS3005, for a version below the minimum. See that page for how a window is declared and how the spell's and the project's bounds are intersected.

Why it is its own code

The remediation is the opposite one. MGS3005 says upgrade; this says the release you are on has not been qualified here, so either pin back or widen the window deliberately.

It is also the defect this pair replaced. The single-constraint form that came before had exactly one consumer, and that consumer reported every failure as MGS3005, so a too-new binary was told it was "older than this spell supports." Folding both directions into one code is what made that possible; two bounds are two comparisons, and which one failed is structural rather than something the caller reconstructs.

The ceiling is exclusive

below names the first version rejected, not the last one accepted:

supported = VersionBounds{below = "25"},

24.19.0 passes. 25.0.0 does not.

This is deliberate. An inclusive max invites the off-by-one everyone writes: max = "24" reads as <= 24.0.0 and rejects 24.19.0, when the author meant "not the 25 line."

Resolution

• Pin back to a version under the ceiling, through whatever installs the tool for this repo. below = "25" accepts the 24 line and nothing above it.
• Widen the window, once you have qualified the newer release, by raising below in the spell's Tool.supported or in tools in the project's own magus\project call.

The message does not say which of the two set the ceiling, because they are intersected before the comparison. magus describe tools prints both declarations and the effective window.

What it deliberately does not do

An unprobeable tool is not "too new." If the probe fails, the window passes, and the missing binary is reported as MGS3003 when a target forks it.

Output magus cannot parse is not "too new" either. A version line carrying no semver is left alone.

It never suggests a version to move to. magus reports where the installed version sits against a window someone declared; choosing what to run is not a build tool's decision.