diff --git a/.github/pr-assets/364-prompt-layer-unmapped.png b/.github/pr-assets/364-prompt-layer-unmapped.png
new file mode 100644
index 00000000000..ff1b5ee15b5
Binary files /dev/null and b/.github/pr-assets/364-prompt-layer-unmapped.png differ
diff --git a/.github/pr-assets/508-grok-coupon-unknown.png b/.github/pr-assets/508-grok-coupon-unknown.png
new file mode 100644
index 00000000000..7f56c37fdcc
Binary files /dev/null and b/.github/pr-assets/508-grok-coupon-unknown.png differ
diff --git a/.github/pr-assets/5088-integrations-failed-cold.png b/.github/pr-assets/5088-integrations-failed-cold.png
new file mode 100644
index 00000000000..f450e897a58
Binary files /dev/null and b/.github/pr-assets/5088-integrations-failed-cold.png differ
diff --git a/.github/pr-assets/5089-claude-desktop-malformed-status.png b/.github/pr-assets/5089-claude-desktop-malformed-status.png
new file mode 100644
index 00000000000..324bf077f7d
Binary files /dev/null and b/.github/pr-assets/5089-claude-desktop-malformed-status.png differ
diff --git a/.github/pr-assets/5197-apply-desktop.png b/.github/pr-assets/5197-apply-desktop.png
new file mode 100644
index 00000000000..1a498c0d3e0
Binary files /dev/null and b/.github/pr-assets/5197-apply-desktop.png differ
diff --git a/.github/pr-assets/5197-apply-narrow.png b/.github/pr-assets/5197-apply-narrow.png
new file mode 100644
index 00000000000..4538af09a0d
Binary files /dev/null and b/.github/pr-assets/5197-apply-narrow.png differ
diff --git a/.github/pr-assets/5197-capture-receipt.json b/.github/pr-assets/5197-capture-receipt.json
new file mode 100644
index 00000000000..89b06a80b15
--- /dev/null
+++ b/.github/pr-assets/5197-capture-receipt.json
@@ -0,0 +1,180 @@
+{
+  "status": "HISTORICAL/CORRECTED-GUI-TREE",
+  "proofType": "fixture-rendered GUI proof from a hosted PR merge-ref build associated with the source head and GUI-tree-equivalent to the reviewed GUI; not a live backend or a literal PR-head build",
+  "sourceArtifact": {
+    "name": "PR #5197 hosted merge-ref GUI build associated with source head 07bf0a4dbe",
+    "artifactId": 10595174777,
+    "artifactName": "dashboard-preview-6c9576edb372200efec9d6ad4fea7b1e0dc35fb4",
+    "workflowRun": 35481230775,
+    "workflowAttempt": 1,
+    "workflowConclusion": "success",
+    "entrypoint": "index.html",
+    "javascript": "assets/index-CKL6ayU1.js",
+    "stylesheet": "assets/index-BTuCbqQd.css",
+    "buildCommit": "6c9576edb372200efec9d6ad4fea7b1e0dc35fb4",
+    "prHead": "07bf0a4dbe369f204c2216f5e8c07c87f52d649c",
+    "guiTree": "06c1f0c620cbfca2a557813f7ec54b7c11cbb540"
+  },
+  "commands": {
+    "fixtureServer": "cd <extracted-artifact-root> && python3 fixture_server.py",
+    "asideReplTemplate": "/usr/bin/perl -e 'alarm shift; exec @ARGV' 120 aside repl \"<single-session inspect-act-verify script>\"",
+    "desktopWindow": "Aside window {1446,762} -> CSS viewport 1280x720",
+    "narrowWindow": "Aside window {646,842} -> CSS viewport 480x800",
+    "ko390Window": "Aside native page zoom 125 percent plus window {654,900} -> observed CSS viewport 390x686"
+  },
+  "reproduction": {
+    "baseUrl": "http://127.0.0.1:18799/",
+    "harnessScript": "fixture_server.py (scratch-only capture harness; not tracked)",
+    "driver": "Aside CLI repl opened the base URL in the real browser, selected fixture modes through POST /__fixture/mode, drove the dashboard controls, read back assertions, and captured each frame at the recorded CSS viewport and DPR."
+  },
+  "fixtureRoutes": [
+    "GET / and static assets",
+    "GET /healthz",
+    "GET /api/startup-health",
+    "GET /api/client-integrations",
+    "GET /api/client-integrations/opencode",
+    "GET /api/client-integrations/journal?client=opencode",
+    "POST /api/client-integrations/preview",
+    "PUT /api/client-integrations/opencode",
+    "POST /api/client-integrations/restore/preview",
+    "POST /api/client-integrations/restore",
+    "GET /api/client-integrations/aside/profiles",
+    "GET /api/client-integrations/aside/profiles/7",
+    "GET /api/client-integrations/aside/profiles/7/journal",
+    "POST /api/client-integrations/aside/profiles/7/preview",
+    "PUT /api/client-integrations/aside/profiles/7",
+    "POST /__fixture/mode",
+    "GET /__fixture/state"
+  ],
+  "requestSequences": {
+    "apply": [
+      "POST /__fixture/mode {mode:apply}",
+      "GET /api/client-integrations/opencode",
+      "GET /api/client-integrations/journal?client=opencode",
+      "POST /api/client-integrations/preview {clientId:opencode,operation:apply}"
+    ],
+    "foreignOverwrite": [
+      "POST /__fixture/mode {mode:overwrite}",
+      "GET /api/client-integrations/opencode -> conflict, reason foreign-edit",
+      "GET /api/client-integrations/journal?client=opencode",
+      "POST /api/client-integrations/preview {clientId:opencode,operation:overwrite}"
+    ],
+    "restoreDrift": [
+      "POST /__fixture/mode {mode:restore}",
+      "GET /api/client-integrations/opencode",
+      "GET /api/client-integrations/journal?client=opencode -> op-restore-001",
+      "POST /api/client-integrations/restore/preview {opId:op-restore-001,confirmDrift:false}"
+    ],
+    "stale409Reconfirmation": [
+      "POST /__fixture/mode {mode:stale}",
+      "GET state and journal",
+      "POST /api/client-integrations/preview -> initial p1:dddd... plan",
+      "PUT /api/client-integrations/opencode with initial binding -> 409 integration_preview_stale plus p1:eeee... fresh plan",
+      "GET state and journal reconciliation",
+      "capture before reconfirming"
+    ],
+    "koRestoreDrift390": ["select Korean in dashboard", "run restoreDrift", "capture at observed innerWidth 390"],
+    "koStaleReconfirm390": ["keep Korean selected", "run stale409Reconfirmation", "capture before reconfirming at innerWidth 390"],
+    "koProfileDisableNoop390": [
+      "POST /__fixture/mode {mode:profile-noop}",
+      "GET /api/client-integrations/aside/profiles -> profile 7 enabled=true,state=absent",
+      "POST /api/client-integrations/aside/profiles/7/preview {operation:disable} -> willChange=false,changes=[],profileId=7",
+      "assert document no-op copy and sync-preference disclosure",
+      "assert primary Disable button enabled",
+      "assert consequence body contains neither Korean backup nor rollback text",
+      "capture",
+      "PUT /api/client-integrations/aside/profiles/7 {enabled:false,operation:disable,planFingerprint:p1:ffffffffffffffffffffffffffffffff}",
+      "GET /__fixture/state verifies recorded binding"
+    ],
+    "keyboardFocus": [
+      "open apply dialog",
+      "press Tab twice to focus primary Apply",
+      "capture visible focus ring",
+      "assert dialog count 1 before Escape",
+      "press Escape and assert dialog count 0"
+    ]
+  },
+  "captureBinding": {
+    "prHead": "07bf0a4dbe369f204c2216f5e8c07c87f52d649c",
+    "hostedBuildCommit": "6c9576edb372200efec9d6ad4fea7b1e0dc35fb4",
+    "sourceGuiTree": "06c1f0c620cbfca2a557813f7ec54b7c11cbb540",
+    "hostedBuildGuiTree": "06c1f0c620cbfca2a557813f7ec54b7c11cbb540",
+    "guiTreeEqual": true
+  },
+  "interactionObservations": {
+    "keyboardFocusVisible": true,
+    "dialogCountBeforeEscape": 1,
+    "dialogCountAfterEscape": 0
+  },
+  "profileNoopVerification": {
+    "previewDto": {
+      "version": 1,
+      "clientId": "aside",
+      "operation": "disable",
+      "state": "absent",
+      "foreignEdit": "none",
+      "changes": [],
+      "fingerprint": "p1:ffffffffffffffffffffffffffffffff",
+      "canApply": true,
+      "willChange": false,
+      "profileId": 7
+    },
+    "assertions": {
+      "documentScopedNoopCopyVisible": true,
+      "syncPreferenceDisclosureVisible": true,
+      "primaryButtonEnabled": true,
+      "backupPromiseAbsent": true,
+      "rollbackPromiseAbsent": true
+    },
+    "recordedBinding": {
+      "enabled": false,
+      "operation": "disable",
+      "planFingerprint": "p1:ffffffffffffffffffffffffffffffff"
+    }
+  },
+  "viewports": [
+    {
+      "name": "desktop",
+      "cssWidth": 1280,
+      "cssHeight": 720,
+      "devicePixelRatio": 2,
+      "pngWidth": 2560,
+      "pngHeight": 1440,
+      "files": ["apply-desktop.png","overwrite-foreign-desktop.png","restore-drift-desktop.png","stale-reconfirm-desktop.png","keyboard-focus.png"]
+    },
+    {
+      "name": "narrow",
+      "cssWidth": 480,
+      "cssHeight": 800,
+      "devicePixelRatio": 2,
+      "pngWidth": 960,
+      "pngHeight": 1600,
+      "files": ["apply-narrow.png","overwrite-foreign-narrow.png","restore-drift-narrow.png","stale-reconfirm-narrow.png"]
+    },
+    {
+      "name": "ko-390",
+      "cssWidth": 390,
+      "cssHeight": 686,
+      "devicePixelRatio": 2.5,
+      "browserZoomPercent": 125,
+      "pngWidth": 976,
+      "pngHeight": 1716,
+      "dimensionNote": "Observed CSS viewport and DPR imply a nominal 975x1715 raster; the actual PNG is 976x1716, one physical pixel per axis larger. The capture did not independently isolate the cause of that rounding difference.",
+      "files": ["ko-restore-drift-390.png","ko-stale-reconfirm-390.png","ko-profile-disable-noop-390.png"]
+    }
+  ],
+  "pngSha256": {
+    "apply-desktop.png": "4427b60e8885c68e2478c319e4ef428d959b4cc13ee5141a64a92777550ab420",
+    "apply-narrow.png": "0e2dfd18e76c26755c7b347e149de29dab2b4a40d2074e2ad293d93ced2e34e3",
+    "keyboard-focus.png": "29714ff85f13b35cc72fffc1a36b6d07ee820be1f9824c9f56a317f15c38feb1",
+    "ko-profile-disable-noop-390.png": "09baf33f610dccff7d26b77717682f046da821cb2ff8276325be829882f20648",
+    "ko-restore-drift-390.png": "7c51f352c24defd7cc0c669e53fd254ae314f79faf6cc48a65b9dd2589fe46de",
+    "ko-stale-reconfirm-390.png": "9dc051b7e97a19fd3dff66958fde432d35f94473ddc403424af13fcdc5ec5254",
+    "overwrite-foreign-desktop.png": "0e6d14543dfe4ff5847aa3d66d26c499f32235c02a6d741f32a528b1af12f986",
+    "overwrite-foreign-narrow.png": "8c9af82bc4cfe79e6400c10fb553378524c3f49074145a0cf845db52c3691b63",
+    "restore-drift-desktop.png": "42127e71f1f13a4902b31e59861de518dc339028a3b3cdbe130f259f0a78f5fb",
+    "restore-drift-narrow.png": "e7482dfe56b92350641b8a3b13ab3da79e7c8130db74a5cb5208a79e0ee9b2f9",
+    "stale-reconfirm-desktop.png": "307444c11e8369593b1a023fbeb2ee1ad63bf8deaa7c8bc6dfb9aa7728e6c6c1",
+    "stale-reconfirm-narrow.png": "8938274b183b888eaf8159bd6083ced670ac2070ef1a5cbdd6424475f4cc1b77"
+  }
+}
diff --git a/.github/pr-assets/5197-keyboard-focus.png b/.github/pr-assets/5197-keyboard-focus.png
new file mode 100644
index 00000000000..98c77eba848
Binary files /dev/null and b/.github/pr-assets/5197-keyboard-focus.png differ
diff --git a/.github/pr-assets/5197-ko-profile-disable-noop-390.png b/.github/pr-assets/5197-ko-profile-disable-noop-390.png
new file mode 100644
index 00000000000..fa5d1bfcb02
Binary files /dev/null and b/.github/pr-assets/5197-ko-profile-disable-noop-390.png differ
diff --git a/.github/pr-assets/5197-ko-restore-drift-390.png b/.github/pr-assets/5197-ko-restore-drift-390.png
new file mode 100644
index 00000000000..3fcc416ae36
Binary files /dev/null and b/.github/pr-assets/5197-ko-restore-drift-390.png differ
diff --git a/.github/pr-assets/5197-ko-stale-reconfirm-390.png b/.github/pr-assets/5197-ko-stale-reconfirm-390.png
new file mode 100644
index 00000000000..4960694a7ac
Binary files /dev/null and b/.github/pr-assets/5197-ko-stale-reconfirm-390.png differ
diff --git a/.github/pr-assets/5197-overwrite-foreign-desktop.png b/.github/pr-assets/5197-overwrite-foreign-desktop.png
new file mode 100644
index 00000000000..98ac20eaa87
Binary files /dev/null and b/.github/pr-assets/5197-overwrite-foreign-desktop.png differ
diff --git a/.github/pr-assets/5197-overwrite-foreign-narrow.png b/.github/pr-assets/5197-overwrite-foreign-narrow.png
new file mode 100644
index 00000000000..84fd9015915
Binary files /dev/null and b/.github/pr-assets/5197-overwrite-foreign-narrow.png differ
diff --git a/.github/pr-assets/5197-restore-drift-desktop.png b/.github/pr-assets/5197-restore-drift-desktop.png
new file mode 100644
index 00000000000..a348c662cdb
Binary files /dev/null and b/.github/pr-assets/5197-restore-drift-desktop.png differ
diff --git a/.github/pr-assets/5197-restore-drift-narrow.png b/.github/pr-assets/5197-restore-drift-narrow.png
new file mode 100644
index 00000000000..aaa8fb53d33
Binary files /dev/null and b/.github/pr-assets/5197-restore-drift-narrow.png differ
diff --git a/.github/pr-assets/5197-stale-reconfirm-desktop.png b/.github/pr-assets/5197-stale-reconfirm-desktop.png
new file mode 100644
index 00000000000..7f830bda54e
Binary files /dev/null and b/.github/pr-assets/5197-stale-reconfirm-desktop.png differ
diff --git a/.github/pr-assets/5197-stale-reconfirm-narrow.png b/.github/pr-assets/5197-stale-reconfirm-narrow.png
new file mode 100644
index 00000000000..1c17ec44dfd
Binary files /dev/null and b/.github/pr-assets/5197-stale-reconfirm-narrow.png differ
diff --git a/.github/scripts/issue-translation.cjs b/.github/scripts/issue-translation.cjs
index c7d546bc237..41638a9d993 100644
--- a/.github/scripts/issue-translation.cjs
+++ b/.github/scripts/issue-translation.cjs
@@ -805,11 +805,22 @@ function sanitizeTranslationBody(raw, maxChars = 60000) {
     .split(MARKER).join("")
     .split(END_MARKER).join("")
     .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
-    // Defuse pings only: @login / @org/team — not emails, scopes, or decorators.
+    // Mask the @ inside email addresses first: punctuation-bearing local
+    // parts (x!@example.com, a=b@example.com, a/b@example.com) must not be
+    // read as mention boundaries. Requiring a dotted domain keeps
+    // "end!@octocat"-style mentions defused. \u0001 cannot appear in the
+    // input (control chars were stripped above), so it is a safe sentinel.
     .replace(
-      /(^|[\s(])@([A-Za-z0-9](?:[A-Za-z0-9-]{0,38})(?:\/[A-Za-z0-9._-]+)?)/g,
+      /[A-Za-z0-9.!#$%&'*+\/=?^_`{|}~-]+@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+/g,
+      (email) => email.replace("@", "\u0001"),
+    )
+    // Defuse pings at Markdown/punctuation boundaries — a colon is a boundary
+    // too — but not emails, npm: scopes, or other mid-token at-signs.
+    .replace(
+      /(^|[^A-Za-z0-9._%+-])(?<!npm:)@([A-Za-z0-9](?:[A-Za-z0-9-]{0,38})(?:\/[A-Za-z0-9._-]+)?)/g,
       "$1@\u200b$2",
     )
+    .replace(/\u0001/g, "@")
     .trim()
     .slice(0, maxChars);
 }
diff --git a/.github/scripts/issue-translation.test.cjs b/.github/scripts/issue-translation.test.cjs
index f6c754fb9e0..92aea9d16ad 100644
--- a/.github/scripts/issue-translation.test.cjs
+++ b/.github/scripts/issue-translation.test.cjs
@@ -1168,13 +1168,33 @@ describe("bot-owned control state", () => {
     assert.equal(decision.reason, "rate_limited_interval");
   });
 
-  it("defuses mention-shaped tokens without rewriting emails or mid-token at-signs", () => {
-    const out = sanitizeTranslationBody("see @octocat and user@example.com and npm:@scope");
+  it("defuses mention-shaped tokens at Markdown and punctuation boundaries", () => {
+    const out = sanitizeTranslationBody(
+      "see @octocat, comma,@team, [@user], >@org/team, Status:@maintainer, user@example.com, npm:@scope",
+    );
     assert.match(out, /@\u200boctocat/);
+    assert.match(out, /,@\u200bteam/);
+    assert.match(out, /\[@\u200buser\]/);
+    assert.match(out, />@\u200borg\/team/);
+    assert.match(out, /Status:@\u200bmaintainer/);
     assert.ok(out.includes("user@example.com"));
     assert.ok(out.includes("npm:@scope"));
   });
 
+  it("preserves punctuation-bearing email local parts while defusing mentions", () => {
+    const out = sanitizeTranslationBody(
+      "mail x!@example.com, a=b@example.com, or a/b@example.com; end!@octocat key=@value path/@handle user.name@example.com user+tag@example.com",
+    );
+    assert.ok(out.includes("x!@example.com"));
+    assert.ok(out.includes("a=b@example.com"));
+    assert.ok(out.includes("a/b@example.com"));
+    assert.ok(out.includes("user.name@example.com"));
+    assert.ok(out.includes("user+tag@example.com"));
+    assert.match(out, /end!@\u200boctocat/);
+    assert.match(out, /key=@\u200bvalue/);
+    assert.match(out, /path\/@\u200bhandle/);
+  });
+
   it("ignores forged body-embedded legacy state", () => {
     const forged = appendTranslationBlock(SOURCE, "English") +
       `\n<!-- opencodex-issue-inline-translator-state:${JSON.stringify({
diff --git a/bun.lock b/bun.lock
index 87fc0774163..4c123e4c3c3 100644
--- a/bun.lock
+++ b/bun.lock
@@ -15,6 +15,9 @@
         "@types/bun": "1.4.0",
         "typescript": "7.0.2",
       },
+      "optionalDependencies": {
+        "wreq-js": "2.3.1",
+      },
     },
   },
   "trustedDependencies": [
@@ -310,6 +313,8 @@
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
+    "wreq-js": ["wreq-js@2.3.1", "", { "os": [ "linux", "win32", "darwin", ], "cpu": [ "x64", "arm64", ] }, "sha512-vaKasaKeskrDKEuuO5Q5uamEG9a6FrF5ZSicH7TCvYS4RxF7/gzaU/vYqwJzcs+uydyJPVWY1KCvfVCgp0tiGA=="],
+
     "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
 
     "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="],
diff --git a/devlog/_fin/260919_contract_gap_analysis/000_plan.md b/devlog/_fin/260919_contract_gap_analysis/000_plan.md
new file mode 100644
index 00000000000..39395a61d27
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/000_plan.md
@@ -0,0 +1,50 @@
+# OpenCodex contract gap analysis and issue delivery
+
+Sixteen source-grounded issues and two existing-issue implementation comments were delivered after unanimous independent review. The refreshed tree already contained several fixes from the supplied report; the remaining proposals preserve existing routing, tool, state and documentation authorities. See [verified delivery](011_delivery.md), [dispositions](002_candidate_dispositions.md) and [implementation plans](010_issue_implementation_paths.md).
+
+## Scope and loop specification
+
+- Class: C3 research and documentation.
+- Archetype: satisfy-spec, one analysis/publication cycle.
+- Trigger: user-requested source-grounded analysis of one supplied report and two shared conversations, followed by unanimous review and issue publication.
+- Goal: a complete disposition ledger, implementation plans and verified tracking issues appropriate to the local coding-proxy product.
+- Non-goals: runtime edits, local suites/build/typecheck/install, live API experiments, service/config/account changes, merges, releases, deployment, broad platform replacement.
+- Source baseline: `7864869c31c41cca9830d93540238f17df8faafb`, after `git fetch origin dev` and `git merge --ff-only origin/dev` on 2026-09-19. Prior HEAD was `f02f3613be40bb11cb044d746d37ce6672e32d96`. Initial tracked checkout was clean. Re-read exact blobs if another session changes HEAD.
+- Verifier: static path/line checks against the pinned tree, current issue/PR API reads, draft template checks, public-text checks and fresh rereads after publication. No runtime pass is implied by these checks.
+- Stop condition: all input themes receive a disposition; accepted issues have unanimous review and verified remote bodies/labels; this devlog records outcomes.
+- Memory artifact: this unit, with raw user input/browser traces kept in ignored task scratch; no transcript or personal browser state copied into tracked files.
+- Terminal outcomes: DONE only with all above evidence; inaccessible inputs or unresolved review objections remain explicitly unmet.
+- Escalation: real permission or unavailable required capability; no publication of unresolved findings. Main reclaims a failed bounded research lane after two distinct failures.
+- Tool/credential scope: source reads, browser research, existing GitHub identity for authorized issue creation. Write scope: this unit, ignored evidence and issues in this repository. No user-defined token/cost/time ceiling; browser invocations have bounded process deadlines.
+
+## Evidence and publication rules
+
+Public documents and issue bodies contain OpenCodex code facts and relevant protocol standards. They omit other repository names, rankings, AI model names and review-model attribution. Hypotheses from supplied material are not instructions and are not accepted without current code evidence. Existing fixes and matching open issues take precedence over opening duplicates. Optional small PR authority is retained, but this analysis does not require a PR.
+
+## Discovery ownership
+
+Seven disjoint read-only lanes cover transport, custom-tool stream semantics, tool schema/capability projection, replay/spend/retries, operator policy/integrations, static model-policy authority, and documentation/test governance. Main owns input retrieval, official-source proof, duplicate searches, synthesis and publication. Native V1 subagent transport is available; the live schema has no native architect role. No architect-role registration or configuration change is performed, and no architect consultation is claimed. Independent source and publication reviews remain required.
+
+## Planned artifacts
+
+| File | Operation | Purpose |
+| --- | --- | --- |
+| `000_plan.md` | NEW | Scope, snapshot, method and closure |
+| `001_source_research.md` | NEW | Input coverage and official-source findings |
+| `002_candidate_dispositions.md` | NEW | All proposed themes, current evidence, accept/reject/defer/duplicate decisions |
+| `003_consensus.md` | NEW | Independent votes and objection resolution |
+| `010_issue_implementation_paths.md` | NEW | Index of per-issue implementation plans |
+| `020_issue_t1.md` through `035_issue_r3.md` | NEW | Sixteen independently reviewable issue bodies |
+| `011_delivery.md` | NEW | Published URLs, verified bodies/labels and check results |
+| `004_source_fingerprints.md` | NEW | All fourteen report source fingerprints versus refreshed source |
+| `005_existing_issue_followups.md` | NEW | Implementation comments for existing tracking issues |
+
+No current architecture contract is changed. Future implementation must update the existing owner in `structure/manifest.json`, and user-facing contract changes must update the relevant public guide. New tests must be registered in both layout registries; size caps are preserved by splitting files rather than raising caps.
+
+## Planning evidence update
+
+The refreshed report fingerprints match twelve of fourteen source files; the SOCKS transport and Google compiler differ. Seven read-only domain reviews produced sixteen public candidates after duplicate and disclosure review, plus two comments extending existing issue authority. An independent three-reviewer publication council is checking every candidate; no majority-only publication is allowed. A pure document/form checker ran successfully over sixteen drafts, two comments and ninety exact-SHA anchors. No runtime result is inferred.
+
+## Closure
+
+Analysis and publication are complete. All sixteen issue bodies and two comments were reread from GitHub and match approved content. The next action belongs to each open implementation issue; this unit claims no runtime fix. The useful change in direction was rejecting broad missing-feature claims in favor of concrete residuals. A future patch or counterexample at the cited owner can supersede a candidate; the exact source snapshot makes that reassessment possible.
diff --git a/devlog/_fin/260919_contract_gap_analysis/001_source_research.md b/devlog/_fin/260919_contract_gap_analysis/001_source_research.md
new file mode 100644
index 00000000000..a963ceae87f
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/001_source_research.md
@@ -0,0 +1,45 @@
+# Source coverage and evidence limits
+
+## Inputs
+
+The supplied 23-page report was extracted in full. Its findings are treated as hypotheses because its source acquisition did not establish a repository commit and its small mechanism examples did not execute the complete proxy. The two supplied shared conversations were opened with the authenticated browser on 2026-09-19. A welcome dialog was dismissed; no sign-in or account change was required. Browser traces and original text stay in ignored scratch because they contain material outside the requested publication scope.
+
+The report contributes twelve themes: content decoding, custom-input stream consistency, isolated conformance fixtures, schema-loss policy, detailed capability projection, physical-send admission, terminal diagnostics, replay ownership, spend writer topology, key policy, observability export, and client configuration reconciliation.
+
+The first conversation adds: static model-policy authority versus dynamic evidence; registry-derived metadata; explicit precedence; source-of-truth document ownership; behavioral versus structural verification; centralized hardened utilities; canonical history versus projections; executor/translator boundaries; and embedding. The second conversation summarizes the supplied report and its limitations; it adds no independent source execution evidence.
+
+## Fixed source snapshot
+
+`git fetch --no-recurse-submodules origin dev` followed by `git merge --ff-only origin/dev` advanced the initially clean `dev` checkout from `f02f3613be40bb11cb044d746d37ce6672e32d96` to `7864869c31c41cca9830d93540238f17df8faafb`. All line anchors in this unit refer to that final SHA unless explicitly stated otherwise. No live service restart or source test invocation was performed.
+
+## Existing work discovered before publication
+
+- #5070 is merged. Its source and regressions cover SOCKS gzip/deflate decoding, unsupported-coding refusal and bodyless responses, plus multiple freeform preview/completion mismatches. The report's broad decoding and fence claims require narrowing or rejection.
+- #5047 is closed and already covers fallback-wrapper streaming disagreement.
+- #5056 is merged and adds withheld-recovery attribution; a generic claim that budget refusals have no diagnostics is stale.
+- #5032 is merged and makes the durable token ceiling configurable and refusal visible.
+- #2358 remains an open umbrella for compatibility evidence and isolated core work. New proposals must be bounded follow-ups with specific missing behavior, not another umbrella.
+- #3377 remains open for model capability declarations. Its exact axes must be distinguished from any new resolved-policy consumer consistency proposal.
+
+Issue/PR state was read from GitHub, not inferred from old notes. A second targeted search will precede final publication.
+
+## Research method
+
+A read-only research pass was also dispatched for a read-only official-standard ledger covering Fetch/HTTP content codings, custom-tool grammar and argument streaming, function declaration schema subsets, and telemetry conventions. Standards establish contract vocabulary and constraints; only the pinned OpenCodex source establishes present behavior. No performance ranking, competitor behavior, model-quality claim, live API success rate or runtime test result is inferred.
+
+## Official-source findings verified with the authenticated browser
+
+Sources below were opened on 2026-09-19. These are contract constraints and design inferences, not proof of a proxy runtime test.
+
+| Source | Supported finding | Limitation for this unit |
+| --- | --- | --- |
+| [Fetch Standard](https://fetch.spec.whatwg.org/), HTTP-network fetch and Response constructor | Network fetch processes content codings before exposing body bytes; constructing a Response around raw bytes is not network decoding. Null-body statuses constrain the constructor. | Does not prescribe a provider retry or tool replay owner. |
+| [HTTP Semantics](https://www.rfc-editor.org/rfc/rfc9110.html), sections 6.4, 8.4, 9.3.2 and 15.3.6 | Content coding is a representation transformation; no-content methods/statuses need separate treatment. A 205 response must not generate content. | HTTP rules do not prove a particular local transport is correct. |
+| [Function calling guide](https://developers.openai.com/api/docs/guides/function-calling), strict mode, streaming and custom tools | Schema-constrained functions and grammar-constrained freeform calls are distinct contracts. Stream fragments need aggregation. | It does not mandate a new proxy-side universal validator or make lowering grammar to a string lossless. |
+| [Telemetry metric conventions](https://opentelemetry.io/docs/specs/semconv/general/metrics/) | Consistent metric naming, meaningful aggregation and balanced attribute sets are documented. | Does not define OpenCodex-specific fields or justify collecting raw content. |
+
+The supplied GenAI telemetry URL now displays a relocation notice; no current GenAI privacy contract is claimed from that page. This analysis uses the repository's explicit no-body/no-credential logging contract for any proposed metadata-only diagnostics. Original-schema validation before downstream delivery is a design option, not a requirement established by the provider docs; tool execution remains client-owned.
+
+## Publication-time freshness check
+
+During publication, remote `dev` advanced one commit to `04761a188281da4a2936fc4d8d9be5e02b33bb41` via #5100. The complete comparison from the pinned analysis SHA was read. Its runtime changes are confined to `src/responses/tool-name-aliases.ts` and `src/server/responses-undeclared-tool-guard.ts`, aligning emitted tool names with authorization. It does not change the custom-input progressive decoder/completion normalization, raw transports, static-policy merges, spend/replay paths or other candidate owners. The issue evidence therefore remains anchored to the reviewed SHA, with no candidate invalidated by this intervening commit. The associated test-layout and Responses documentation changes should be retained when implementing future fixes.
diff --git a/devlog/_fin/260919_contract_gap_analysis/002_candidate_dispositions.md b/devlog/_fin/260919_contract_gap_analysis/002_candidate_dispositions.md
new file mode 100644
index 00000000000..119f2b24989
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/002_candidate_dispositions.md
@@ -0,0 +1,52 @@
+# Keep bounded contract fixes and reuse existing authorities
+
+The refreshed tree disproves several broad gaps from the supplied material. The candidates retained below address concrete residual behavior or narrowly defined maintainer/operator workflows. They do not justify a new universal runtime, a model-policy language, or a replacement test framework.
+
+## Report themes
+
+| Theme | Current evidence | Disposition |
+| --- | --- | --- |
+| A1 content decoding | `src/lib/socks5-fetch.ts:530` decodes gzip/deflate after #5070; pinned direct still returns raw bytes at `src/lib/pinned-http.ts:194` | T3 residual; reject original broad SOCKS defect |
+| A1 no-body/cancellation parity | `src/lib/socks5-fetch.ts:512` omits 205; `pinned-http.ts:144` streams all 2xx; upload waits on body reader at `socks5-fetch.ts:577` | T1/T2 concrete residuals |
+| A2 custom delta/done | Bridge fence/escape handling exists after #5070; routed restore at `responses-custom-tool-repair.ts:338` differs from completion at :363 | S1 residual; patch-envelope claim already covered |
+| A3 isolated conformance skeleton | Existing fixture manifests and assertion-bound tests in `src/compatibility/manifest.ts:3` and `tests/codex-integration/compatibility-manifest.test.ts` | Extend focused fixtures in each issue; no duplicate framework |
+| B1 schema loss | `google-tool-schema.ts:88,120` and `google-wire-compiler.ts:97` widen constraints without a report | G1 endpoint-profile/report-first proposal |
+| B2 detailed tool capability | `src/compatibility/manifest.ts:3` already models passthrough/translated/degraded/unsupported; custom format is lowered at `custom-tool-compat.ts:187` | Existing #2358 follow-up: exact-route grammar fixture claims; no second ToolContract |
+| B3 physical sends | Shared send budget and telemetry exist in `request-send-budget.ts:49`, `usage/log.ts:205` | Reject broad absence claim. R1 follows explicitly disclosed integration work in #5041 |
+| B4 terminal diagnostics | `src/usage/log.ts:274`, analytics and #1217/#5056 already provide terminal/recovery facts | O1 export-only proposal; schema repair attribution included in G1 report path |
+| B5 replay ownership | `continuation-ownership.ts:3` and `request-prepare.ts:916` enforce missing/expired-state refusal | Existing contract retained; R3 explicitly changes historical fresh-start behavior; compatibility review required |
+| C1 writer topology | Public ledger contract explicitly scopes supported topology | R2 aligns already-public sibling and ledger topology contracts; no distributed-store roadmap |
+| C2 key policy | Existing key identity and scoped hub usage; #5049 open | Reuse #5049, broader tenancy remains #95 |
+| C3 standard observability | Durable facts and management JSON analytics exist | O1 bounded exporter; no new raw-content collection |
+| C4 takeover/restore | Transactional snapshot/reconcile/recovery exists in `structure/clients/integrations.md:5` | O2 pure preview enhancement; reject missing rollback claim |
+
+## Shared-conversation themes
+
+| Theme | Current evidence | Disposition |
+| --- | --- | --- |
+| One static policy result | Repeated merges in `derive.ts:221,473`, `router.ts:300`, `model-hints.ts:105` | P1 parity-first resolver, live evidence kept separate |
+| Registry-derived identity | `knownModelIdsForProvider` at `router.ts:107` enumerates only some identity maps | P2 classified decode-hint proposal; no current incident claimed |
+| New provider/adapter registries | Existing authorities in `providers/derive.ts:290`, `adapters/registry.ts:71` | Already implemented; no new registry |
+| Numeric universal precedence | Existing typed wire authority in `server/adapter-resolve.ts:7` | Reject; retain field-specific pins/opt-outs |
+| Document authority | `scripts/structure-ssot.ts:31`, `structure/AGENTS.md:45` conflate review fan-out and normative ownership | V1 additive authority map |
+| Contract tests versus source inspection | Lab guard is transitive and mutation-tested; structure checker validates real topology | Reject blanket replacement; D3 binds existing guarantee in index |
+| Central hardened utilities | Must start from one proven shared contract, not general deduplication | Narrow stream/transport helpers in T3/S1 |
+| Canonical history/projection | Replay storage and ownership already exist | No new session-event subsystem without a concrete client need |
+| Executor/translator split | `src/adapters/base.ts:36` already supports build/transport/parse and stateful runTurn | Preserve interface; no forced universal executor rewrite |
+| Embeddable core/package split | `src/index.ts:1` already exports runtime functions | Defer until a concrete embedding consumer/lifecycle contract exists; #2358 covers broader core work |
+
+## Additional source-confirmed documentation gaps
+
+- D1: HTTP/SSE SOCKS guidance contradicts `src/lib/proxy-env.ts:89` in two public reference pages.
+- D2: `reference/configuration/server.md:27` incorrectly says data keys authorize management. Runtime and `server-management-auth.test.ts:780` prove separation.
+- D3: `structure/overview.md:90` lacks the existing core/Lab guarantee in its stable invariant map.
+
+## Duplicate and scope decisions
+
+The current bodies of #2358, #3377, #5049, #95 and #4579 were read. #4579 is about receiver-owned execution authorization, not static catalog/routing metadata; it does not duplicate P1. #3377 owns modality/context declarations, not P2's decode-hint completeness. #2894 is the existing SOCKS support umbrella; T1/T2/D1 are bounded residuals after shipped transport support.
+
+No competitor rankings, repository comparisons, review-model identity, personal browser state or raw user transcript are published.
+
+## Public provenance review for residual state work
+
+The exact body of public #5041 states that physical inner replays still need shared send-budget, pacing/fetch and physical-attempt integration. R1 tracks only that disclosed residual. Public #3188 explicitly allows a separately ported sibling; `src/lib/spend-reservation-ledger.ts:27` expressly excludes two live processes sharing a journal. R2 makes that already-published topology boundary actionable without a new bypass reproduction. R3 preserves task isolation and requests explicit full replay rather than continuing with insufficient history.
diff --git a/devlog/_fin/260919_contract_gap_analysis/003_consensus.md b/devlog/_fin/260919_contract_gap_analysis/003_consensus.md
new file mode 100644
index 00000000000..6bef84e3b80
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/003_consensus.md
@@ -0,0 +1,46 @@
+# Unanimous publication review
+
+Seven independent source-analysis lanes informed the candidate set. Three fresh-context reviewers then audited every proposed issue and both existing-issue comments. The coordinating reviewer also inspected the critical source spans and duplicate records. Publication requires all four judgments to agree; majority approval is insufficient.
+
+## Review lenses
+
+- Code correctness: source reachability, exact owners, conditional behavior and focused verification paths.
+- Product and scope: usefulness for a local coding proxy, overlap with existing issues/PRs and authority preservation.
+- Adversarial publication: evidence strength, misleading claims, public-content constraints and fresh-reader comprehension.
+- Coordinator: accept/rebut decisions, exact source snapshot, synchronization of approved drafts and published bodies.
+
+## Amendments before approval
+
+- T3 preserves explicit Accept-Encoding preferences and checks the actual response coding; it does not reject a preference list just because one alternative is unsupported.
+- S1 preserves safe progressive input and explicitly acknowledges duplicate-key/late-invalid-wrapper limits instead of claiming a universal equality guarantee.
+- D1 identifies all four contradictory English reference pages, requires the locale scan, narrows SOCKS selection wording, and coordinates with open #3901.
+- R1 lists the complete source paths and five exact existing test files; first-send accounting must not be duplicated.
+- R2 requires every process that initializes/appends/compacts the shared journal to participate, including observe-only writers and enforcement transitions.
+- R3 explicitly rejects all scope mismatches, including apparently full input, and requires retry-without-ID coverage. Its fixture description now matches continuation storage rather than transport configuration.
+- Candidate bodies were split into individual files and staged for review. The plan artifact map and all links were corrected.
+- Public prose was narrowed to relevant source facts and implementation decisions, with no review-model attribution or unrelated project comparisons.
+
+## Decision matrix
+
+| Candidate | Code | Product | Adversarial | Coordinator |
+| --- | --- | --- | --- | --- |
+| T1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| T2 | APPROVE | APPROVE | APPROVE | APPROVE |
+| T3 | APPROVE | APPROVE | APPROVE | APPROVE |
+| S1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| G1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| P1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| P2 | APPROVE | APPROVE | APPROVE | APPROVE |
+| V1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| O1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| O2 | APPROVE | APPROVE | APPROVE | APPROVE |
+| D1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| D2 | APPROVE | APPROVE | APPROVE | APPROVE |
+| D3 | APPROVE | APPROVE | APPROVE | APPROVE |
+| R1 | APPROVE | APPROVE | APPROVE | APPROVE |
+| R2 | APPROVE | APPROVE | APPROVE | APPROVE |
+| R3 | APPROVE | APPROVE | APPROVE | APPROVE |
+| Existing #2358 comment | APPROVE | APPROVE | APPROVE | APPROVE |
+| Existing #5049 comment | APPROVE | APPROVE | APPROVE | APPROVE |
+
+The reviewers checked the fixed source `7864869c31c41cca9830d93540238f17df8faafb`, staged candidate bodies, exact template sections, source anchors and relevant current issue/PR bodies. Every candidate remains labeled as source analysis with proposed runtime reproduction, not an executed test. The fresh-reader check found the product gap, authority, implementation boundary and negative cases understandable after the amendments above.
diff --git a/devlog/_fin/260919_contract_gap_analysis/004_source_fingerprints.md b/devlog/_fin/260919_contract_gap_analysis/004_source_fingerprints.md
new file mode 100644
index 00000000000..5a976c6b1e3
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/004_source_fingerprints.md
@@ -0,0 +1,20 @@
+# Report source fingerprints versus refreshed source
+
+Pinned source: `7864869c31c41cca9830d93540238f17df8faafb`. A matching fingerprint confirms the file contents only, not the report interpretation.
+
+| Source | Supplied SHA-256 | Refreshed SHA-256 | Result |
+| --- | --- | --- | --- |
+| `src/lib/socks5-fetch.ts` | `e62a9909c9ffc5db85604a3f8431576d46fcdd771a657b2bf769c8577172f0d1` | `fc1c5b7780f36f61fce0c6104cd46700ffca9a5c05e32174c9ccf437fc188974` | changed |
+| `src/lib/proxy-env.ts` | `646e25f58a37082f4c5cfba9e668aae338e16d6c9746ab9f873b3bb4bed41fa7` | `646e25f58a37082f4c5cfba9e668aae338e16d6c9746ab9f873b3bb4bed41fa7` | same |
+| `src/responses/custom-tool-compat.ts` | `010f07666c0b18abd2889bf51cb2f084affd966d956358d16c919caeb511b356` | `010f07666c0b18abd2889bf51cb2f084affd966d956358d16c919caeb511b356` | same |
+| `src/responses/parser-tools.ts` | `2fe62848231819b9f4b19491d608729198a353d051e22662993d71c36fa56673` | `2fe62848231819b9f4b19491d608729198a353d051e22662993d71c36fa56673` | same |
+| `src/server/responses-custom-tool-repair.ts` | `b0ad4a9ddfe34582250aa867c0229ea47f1f3c4082b841d1d61a8ec4ae2088ec` | `b0ad4a9ddfe34582250aa867c0229ea47f1f3c4082b841d1d61a8ec4ae2088ec` | same |
+| `src/responses/apply-patch-envelope.ts` | `2fc968e8640c0805ad119234adac653f6ea7bfd78496d425924ddb8f77267f5d` | `2fc968e8640c0805ad119234adac653f6ea7bfd78496d425924ddb8f77267f5d` | same |
+| `src/adapters/google-tool-schema.ts` | `d5bcf65418bfade8a3d98a26c7ffc1b657f943eca0e44528e8817a9ef4f5e4ac` | `d5bcf65418bfade8a3d98a26c7ffc1b657f943eca0e44528e8817a9ef4f5e4ac` | same |
+| `src/adapters/google-wire-compiler.ts` | `3b6c3360ee5e81ffd8cf784954e131ad2a53e8d8ba1492345cbe7c8cd882904f` | `691dac9507c47d931b5000208779fd4e0181118f7027e795d0a5dd3731116bd1` | changed |
+| `src/lib/spend-reservation-ledger.ts` | `acfd1b79fcb4760cb9facc0558c6e1819d2fb72845e922900dc4e51cdffae5f8` | `acfd1b79fcb4760cb9facc0558c6e1819d2fb72845e922900dc4e51cdffae5f8` | same |
+| `src/types/config.ts` | `1f83bb55b02e16a2ef5fcf9741172d98eccd95a7d58f8ad50db182b67b0a61ed` | `1f83bb55b02e16a2ef5fcf9741172d98eccd95a7d58f8ad50db182b67b0a61ed` | same |
+| `src/lib/provider-outbound.ts` | `dd823e0b5b00ebe4285149a83a13aa9bb30abe914b7765f0b416ec85620f3d9e` | `dd823e0b5b00ebe4285149a83a13aa9bb30abe914b7765f0b416ec85620f3d9e` | same |
+| `src/server/models-capabilities.ts` | `8e0135baf9f6660ec9409f71cae73c1f0d868e9c4e7b5a2b78b71019ea840262` | `8e0135baf9f6660ec9409f71cae73c1f0d868e9c4e7b5a2b78b71019ea840262` | same |
+| `src/responses/continuation-ownership.ts` | `5a173b7a767fc915569a6213ad621148b9b9f7345aa0e13547bf19e0854ddc9b` | `5a173b7a767fc915569a6213ad621148b9b9f7345aa0e13547bf19e0854ddc9b` | same |
+| `src/server/management/api-access.ts` | `68cd2e74097bda829a44e605c9acf9957b95d0a4e5d0925cdd9e05d42d075e9a` | `68cd2e74097bda829a44e605c9acf9957b95d0a4e5d0925cdd9e05d42d075e9a` | same |
diff --git a/devlog/_fin/260919_contract_gap_analysis/005_existing_issue_followups.md b/devlog/_fin/260919_contract_gap_analysis/005_existing_issue_followups.md
new file mode 100644
index 00000000000..e0324a4bfe9
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/005_existing_issue_followups.md
@@ -0,0 +1,31 @@
+# Reuse existing issue authority
+
+These are proposed comments, subject to the same unanimous publication review as new issues.
+
+## #2358
+
+Source-grounded follow-up at `7864869c31c41cca9830d93540238f17df8faafb`: custom-tool representation and grammar can extend the existing passive compatibility manifest rather than introducing another contract registry.
+
+Current path: `src/responses/custom-tool-compat.ts:187` lowers custom format into a string-input function; `src/responses/parser-tools.ts:67` also represents freeform calls without grammar provenance. The existing `src/compatibility/manifest.ts` already has passthrough/translated/degraded/unsupported dispositions and exact-subject assertion evidence.
+
+Implementation path:
+
+1. Add secret-free fixtures under `tests/fixtures/compatibility/` for the exact destination/auth/inbound/upstream subject, with separate custom representation and grammar assertions.
+2. Classify native preservation as passthrough, useful string-wrapper representation as translated, removed grammar as degraded with a concrete limitation, and refusal as unsupported.
+3. Extend the matching manifest and `tests/codex-integration/compatibility-manifest.test.ts` so every claim names live assertion IDs, not only test filenames.
+4. Update `structure/adapters/compatibility-contracts.md`. Keep manifests passive and optional Lab code outside core runtime imports.
+5. Add richer CLI/catalog output only after its consumer contract exists; leave current binary tool-availability fields unchanged.
+
+Acceptance: native and lowered fixtures are distinguishable, grammar loss cannot be labeled lossless, missing assertion evidence fails manifest validation, and no runtime behavior changes from adding evidence. This is static analysis and an implementation proposal; no local runtime suite was run. The broader universal IR/package rewrite is not needed for this bounded slice.
+
+## #5049
+
+Implementation-path refinement from source review at `7864869c31c41cca9830d93540238f17df8faafb`. This issue already owns the narrow per-admission-key authorization gap; no duplicate proposal is needed.
+
+- Extend `OcxApiKeyEntry` in `src/types/config.ts:245` with optional policy fields and wire their full chain: config/management input validation, persistence, reload/default handling, key rename/rotation preservation, management/CLI projection, catalog projection and request consumers.
+- Reuse the authenticated key identity from `src/server/auth-cors.ts:395`; caller-supplied informational identity headers are not policy authority. Keep management credentials independent.
+- Evaluate policy against canonical resolved provider/model identity, then re-evaluate after fallback/combo route changes. `src/server/responses/request-prepare.ts:404` is one repeated resolution point; inventory HTTP, WebSocket, translated inbound, combo and retry entrypoints before implementation.
+- Define aliases explicitly: an allowed combo alias must not implicitly authorize an otherwise forbidden resolved destination. Catalog filtering and actual admission must consume the same policy evaluator.
+- Refuse before upstream I/O, preserve key-scoped hub usage (`src/server/hub-usage.ts:8`), and expose bounded denial metadata without secret material.
+
+Acceptance fixtures: unset policy preserves current behavior; allowed/denied direct models; aliases; fallback and combo re-resolution; key rotation/rename; invalid policy input; data-vs-management auth separation; and zero physical sends on denial. Register new tests in both layout manifests, update config/catalog/management/Responses structure owners, and document operator behavior. Broader tenant roles and administration remain in #95. No runtime tests or live account calls were performed for this analysis.
diff --git a/devlog/_fin/260919_contract_gap_analysis/010_issue_implementation_paths.md b/devlog/_fin/260919_contract_gap_analysis/010_issue_implementation_paths.md
new file mode 100644
index 00000000000..e1e40450531
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/010_issue_implementation_paths.md
@@ -0,0 +1,22 @@
+# Proposed issue implementation paths
+
+Reader: an OpenCodex maintainer selecting a bounded implementation PR. These are proposals, not completed fixes. Bodies include exact source evidence, proposed file changes, negative cases and verification limits. Publication awaits consensus.
+
+## Candidate implementation files
+
+- [T1: [Bug]: Return null bodies for 204 and 205 in raw outbound transports](020_issue_t1.md)
+- [T2: [Bug]: Settle SOCKS5 streaming uploads on cancellation and early final responses](021_issue_t2.md)
+- [T3: [Bug]: Decode content-coded responses on the pinned direct provider transport](022_issue_t3.md)
+- [G1: [Feature]: Report endpoint-scoped tool-schema loss before applying stricter policy](023_issue_g1.md)
+- [S1: [Bug]: Keep routed custom-tool preview consistent with fence-normalized completion](024_issue_s1.md)
+- [P1: [Feature]: Resolve static model policy once for catalog and routing consumers](025_issue_p1.md)
+- [P2: [Feature]: Derive model selector decode hints from all classified registry identity maps](026_issue_p2.md)
+- [V1: [Feature]: Separate contract authority from source review fan-out in the structure manifest](027_issue_v1.md)
+- [O1: [Feature]: Export existing request telemetry through an opt-in metadata-only scrape endpoint](028_issue_o1.md)
+- [O2: [Feature]: Preview integration mutations using the server ownership plan](029_issue_o2.md)
+- [D1: [Docs]: Align SOCKS5 HTTP/SSE routing documentation with configured outbound fetch](030_issue_d1.md)
+- [D2: [Docs]: Correct apiKeys documentation to preserve management/data-plane separation](031_issue_d2.md)
+- [D3: [Docs]: Bind core/Lab isolation and synchronous activation in the invariant index](032_issue_d3.md)
+- [R1: [Feature]: Complete cross-layer send accounting for pre-output rate-limit replay](033_issue_r1.md)
+- [R2: [Feature]: Make explicit sibling instances honor the spend-ledger topology contract](034_issue_r2.md)
+- [R3: [Bug]: Request full replay when a task-scoped continuation cannot be used](035_issue_r3.md)
diff --git a/devlog/_fin/260919_contract_gap_analysis/011_delivery.md b/devlog/_fin/260919_contract_gap_analysis/011_delivery.md
new file mode 100644
index 00000000000..a903fadb985
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/011_delivery.md
@@ -0,0 +1,45 @@
+# Delivered: sixteen issues and two existing-issue implementation comments
+
+The approved source analysis is now tracked in sixteen new issues: five defects, eight feature proposals and three documentation corrections. Each published body includes the implementation path and acceptance cases. Two existing issues received bounded implementation comments instead of duplicate issues. No runtime code was changed and no implementation is claimed.
+
+## Verified issue delivery
+
+| Candidate | Issue | Type | Verified state |
+| --- | --- | --- | --- |
+| T1 | [#5109: [Bug]: Return null bodies for 204 and 205 in raw outbound transports](https://github.com/lidge-jun/opencodex/issues/5109) | bug | OPEN |
+| T2 | [#5110: [Bug]: Settle SOCKS5 streaming uploads on cancellation and early final responses](https://github.com/lidge-jun/opencodex/issues/5110) | bug | OPEN |
+| T3 | [#5111: [Bug]: Decode content-coded responses on the pinned direct provider transport](https://github.com/lidge-jun/opencodex/issues/5111) | bug | OPEN |
+| G1 | [#5112: [Feature]: Report endpoint-scoped tool-schema loss before applying stricter policy](https://github.com/lidge-jun/opencodex/issues/5112) | enhancement | OPEN |
+| S1 | [#5113: [Bug]: Keep routed custom-tool preview consistent with fence-normalized completion](https://github.com/lidge-jun/opencodex/issues/5113) | bug | OPEN |
+| P1 | [#5114: [Feature]: Resolve static model policy once for catalog and routing consumers](https://github.com/lidge-jun/opencodex/issues/5114) | enhancement | OPEN |
+| P2 | [#5115: [Feature]: Derive model selector decode hints from all classified registry identity maps](https://github.com/lidge-jun/opencodex/issues/5115) | enhancement | OPEN |
+| V1 | [#5116: [Feature]: Separate contract authority from source review fan-out in the structure manifest](https://github.com/lidge-jun/opencodex/issues/5116) | enhancement | OPEN |
+| O1 | [#5117: [Feature]: Export existing request telemetry through an opt-in metadata-only scrape endpoint](https://github.com/lidge-jun/opencodex/issues/5117) | enhancement | OPEN |
+| O2 | [#5118: [Feature]: Preview integration mutations using the server ownership plan](https://github.com/lidge-jun/opencodex/issues/5118) | enhancement | OPEN |
+| D1 | [#5119: [Docs]: Align SOCKS5 HTTP/SSE routing documentation with configured outbound fetch](https://github.com/lidge-jun/opencodex/issues/5119) | documentation | OPEN |
+| D2 | [#5120: [Docs]: Correct apiKeys documentation to preserve management/data-plane separation](https://github.com/lidge-jun/opencodex/issues/5120) | documentation | OPEN |
+| D3 | [#5121: [Docs]: Bind core/Lab isolation and synchronous activation in the invariant index](https://github.com/lidge-jun/opencodex/issues/5121) | documentation | OPEN |
+| R1 | [#5122: [Feature]: Complete cross-layer send accounting for pre-output rate-limit replay](https://github.com/lidge-jun/opencodex/issues/5122) | enhancement | OPEN |
+| R2 | [#5123: [Feature]: Make explicit sibling instances honor the spend-ledger topology contract](https://github.com/lidge-jun/opencodex/issues/5123) | enhancement | OPEN |
+| R3 | [#5124: [Bug]: Request full replay when a task-scoped continuation cannot be used](https://github.com/lidge-jun/opencodex/issues/5124) | bug | OPEN |
+
+## Existing authority extended
+
+- [Implementation comment on #2358](https://github.com/lidge-jun/opencodex/issues/2358#issuecomment-5740122588)
+- [Implementation comment on #5049](https://github.com/lidge-jun/opencodex/issues/5049#issuecomment-5740122723)
+
+## Fresh verification
+
+- All sixteen issues were reread using `gh issue view --json number,title,body,state,labels,url`. Titles and full bodies match the approved drafts; each issue is open with its matching template label. Result: `REMOTE_ISSUE_VERIFICATION_PASS`.
+- Both comments were reread through their exact issue-comment API IDs. Their bodies match the approved drafts.
+- The pure documentation checker validates all sixteen issue forms, the two comments, publication text constraints and ninety source permalinks. Result: `DOCUMENT_CONTRACT_CHECK_PASS`.
+- `git diff --cached --check` passed after the final document cleanup.
+- Source analysis remains pinned to `7864869c31c41cca9830d93540238f17df8faafb`. The one intervening `dev` commit was checked as recorded in 001 and invalidates none of these candidates.
+- Publication used the repository template chooser and the matching form. Generated field ordering and code fences were normalized to the exact approved body through the issue API. One post-submit browser read and one search-index delay were reconciled by reading the actual existing issue; neither was resubmitted.
+- Runtime suites, typecheck, builds, installs, live provider experiments and service changes were not run. Future implementation owns its focused regression and exact-head CI proof.
+
+## Implementation ordering and boundaries
+
+Transport/body lifecycle fixes and the routed input-stream consistency fix can be independent focused changes. Schema diagnostics precede opt-in stricter policy. Static-policy consolidation starts with parity fixtures; decode-hint completeness remains separate from catalog availability. Shared-journal ownership must cover every writer before any enforcement claim. Document corrections and invariant binding reuse existing runtime guards. Standard metrics export and integration preview are optional operator features; neither expands the proxy into a tool executor or tenant platform.
+
+The task ends at verified analysis and issue delivery. No PR, push, merge, release, deployment or source patch was performed. The local devlog is retained as the complete decision and delivery record. Implementation issues remain open for future work.
diff --git a/devlog/_fin/260919_contract_gap_analysis/020_issue_t1.md b/devlog/_fin/260919_contract_gap_analysis/020_issue_t1.md
new file mode 100644
index 00000000000..0ffb06ab5a6
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/020_issue_t1.md
@@ -0,0 +1,66 @@
+# T1: [Bug]: Return null bodies for 204 and 205 in raw outbound transports
+
+### Client or integration
+
+Direct HTTP/API client
+
+### Area
+
+Proxy and routing
+
+### Summary
+
+The pinned direct helper constructs a streaming Response for every 2xx response, including 204 and 205. The SOCKS helper excludes 204 but misses 205. These statuses require a null body at the Fetch Response boundary, so a valid no-content upstream response can fail during response construction instead of resolving normally.
+
+### Reproduction
+
+Static source trace at `7864869c31c41cca9830d93540238f17df8faafb`; the following fake-upstream regression is the proposed executable reproduction, not a claimed local test result.
+
+1. Have a fake HTTP upstream return 204 or 205 with no content and keep its connection alive.
+2. Invoke `pinnedHttpGet` against its pinned loopback address. Separately return 205 through a fake SOCKS tunnel.
+3. Assert the call resolves promptly with the original status and `body === null`, even when representation headers describe an unsupported coding. Current source attaches a stream in those cases.
+
+### Version
+
+7864869c31c41cca9830d93540238f17df8faafb
+
+### Operating system
+
+Source review on macOS 27.0; the transport logic is cross-platform. Runtime reproduction has not been executed in this analysis.
+
+### Provider and model
+
+Not provider- or model-specific. Use a local fake upstream and no real credentials.
+
+### Logs or error output
+
+No live traffic or runtime logs collected. Evidence is the exact source path below.
+
+### Screenshots and supporting files
+
+[src/lib/pinned-http.ts:144](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/pinned-http.ts#L144); [src/lib/pinned-http.ts:194](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/pinned-http.ts#L194); [src/lib/socks5-fetch.ts:512](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/socks5-fetch.ts#L512). Related #2894 and merged #5070; neither covers this residual status set. [Fetch null-body status](https://fetch.spec.whatwg.org/#null-body-status) and [HTTP 205](https://www.rfc-editor.org/rfc/rfc9110.html#name-205-reset-content).
+
+### Redacted configuration
+
+Use a test-owned loopback upstream and SOCKS tunnel or the pinned direct helper as specified above. No user home, provider credentials or running proxy is needed.
+
+### Implementation path
+
+1. MODIFY `src/lib/socks5-fetch.ts`: include 205 in `bodylessResponse`; keep HEAD/204/304 behavior.
+2. MODIFY `src/lib/pinned-http.ts`: branch on null-body status before creating the success stream and safely terminate the underlying response/request. Preserve response headers.
+3. Share a small eligibility predicate only if it simplifies these two owners; do not introduce a broad transport framework. Keep unsupported upgrade behavior outside this issue.
+4. ADD a focused sibling `tests/lib/transport-null-body.test.ts` or extend uncapped existing tests.
+
+### Acceptance criteria and verification
+
+- 204/205 settle with null body without waiting for connection close.
+- HEAD/304 existing behavior remains covered where the transport supports those request/status paths.
+- 205 carrying `Content-Encoding: br` is not decoded or rejected for nonexistent body bytes.
+- Ordinary 200 JSON and cleanup/cancellation still work.
+
+New test files must be registered in `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`; split tests rather than raise file-size caps. Update `structure/transports/inventory.md` and any other owner declared by the manifest. Run focused regressions and exact-head hosted CI in the implementation PR; no passing runtime result is claimed here.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] I removed secrets, tokens, account details, request credentials, and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/021_issue_t2.md b/devlog/_fin/260919_contract_gap_analysis/021_issue_t2.md
new file mode 100644
index 00000000000..b900715363a
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/021_issue_t2.md
@@ -0,0 +1,66 @@
+# T2: [Bug]: Settle SOCKS5 streaming uploads on cancellation and early final responses
+
+### Client or integration
+
+Direct HTTP/API client
+
+### Area
+
+Proxy and routing
+
+### Summary
+
+The upload loop awaits the caller body reader before parsing any response head. Aborting destroys the socket but does not settle a pending `bodyReader.read()`. A stalled upload can therefore keep the fetch promise pending, including when the peer has already returned a final response.
+
+### Reproduction
+
+Static source trace at `7864869c31c41cca9830d93540238f17df8faafb`; the following fake-upstream regression is the proposed executable reproduction, not a claimed local test result.
+
+1. Use a fake SOCKS peer and a Request body stream that produces one chunk and then leaves its next read pending.
+2. Abort after the headers/chunk arrive, or have the upstream send a final response without waiting for the upload to finish.
+3. Assert bounded settlement, request-body cancellation, no further upload writes and no orphaned socket/listeners. Do not use a production endpoint.
+
+### Version
+
+7864869c31c41cca9830d93540238f17df8faafb
+
+### Operating system
+
+Source review on macOS 27.0; the transport logic is cross-platform. Runtime reproduction has not been executed in this analysis.
+
+### Provider and model
+
+Not provider- or model-specific. Use a local fake upstream and no real credentials.
+
+### Logs or error output
+
+No live traffic or runtime logs collected. Evidence is the exact source path below.
+
+### Screenshots and supporting files
+
+[src/lib/socks5-fetch.ts:559](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/socks5-fetch.ts#L559); [src/lib/socks5-fetch.ts:573](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/socks5-fetch.ts#L573); [src/lib/socks5-fetch.ts:589](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/socks5-fetch.ts#L589). Existing handshake/response abort support is retained; this is a request-body lifecycle gap, not a claim that cancellation is absent. Related #2894.
+
+### Redacted configuration
+
+Use a test-owned loopback upstream and SOCKS tunnel or the pinned direct helper as specified above. No user home, provider credentials or running proxy is needed.
+
+### Implementation path
+
+1. MODIFY `src/lib/socks5-fetch.ts`: observe the final response head concurrently with upload, skipping informational responses.
+2. Race body reads/drain waits with caller abort and early final response. On termination, cancel/release the body reader without allowing a hanging cancel callback to block settlement.
+3. Preserve the first terminal cause and caller abort reason; do not send a terminating chunk after an early final response. Avoid concurrent consumers of the same socket reader.
+4. ADD focused `tests/lib/socks5-upload-lifecycle.test.ts` regressions.
+
+### Acceptance criteria and verification
+
+- Pending body read + caller abort rejects with the original reason and releases resources.
+- Early final response resolves and stops upload.
+- Socket error/timeout during a stalled body read settles rather than hanging.
+- Backpressure, normal POST completion and informational response handling remain correct.
+
+New test files must be registered in `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`; split tests rather than raise file-size caps. Update `structure/transports/inventory.md` and any other owner declared by the manifest. Run focused regressions and exact-head hosted CI in the implementation PR; no passing runtime result is claimed here.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] I removed secrets, tokens, account details, request credentials, and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/022_issue_t3.md b/devlog/_fin/260919_contract_gap_analysis/022_issue_t3.md
new file mode 100644
index 00000000000..f7bf699a1fa
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/022_issue_t3.md
@@ -0,0 +1,67 @@
+# T3: [Bug]: Decode content-coded responses on the pinned direct provider transport
+
+### Client or integration
+
+Direct HTTP/API client
+
+### Area
+
+Proxy and routing
+
+### Summary
+
+SOCKS responses now decode gzip/deflate, but `pinnedHttpRequest` returns raw encoded success bytes. Provider outbound chooses between these transports, so the same gzip JSON response is readable on one route and still compressed on the pinned direct route.
+
+### Reproduction
+
+Static source trace at `7864869c31c41cca9830d93540238f17df8faafb`; the following fake-upstream regression is the proposed executable reproduction, not a claimed local test result.
+
+1. Fake upstream returns gzip or deflate JSON with matching Content-Encoding and coded Content-Length.
+2. Read the response through pinned direct and SOCKS routes.
+3. Compare logical JSON, coding/length headers, decoder errors and cleanup. Current pinned direct code forwards raw bytes into a Response.
+
+### Version
+
+7864869c31c41cca9830d93540238f17df8faafb
+
+### Operating system
+
+Source review on macOS 27.0; the transport logic is cross-platform. Runtime reproduction has not been executed in this analysis.
+
+### Provider and model
+
+Not provider- or model-specific. Use a local fake upstream and no real credentials.
+
+### Logs or error output
+
+No live traffic or runtime logs collected. Evidence is the exact source path below.
+
+### Screenshots and supporting files
+
+[src/lib/pinned-http.ts:153](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/pinned-http.ts#L153); [src/lib/pinned-http.ts:194](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/pinned-http.ts#L194); [src/lib/provider-outbound.ts:209](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/provider-outbound.ts#L209); [src/lib/socks5-fetch.ts:530](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/socks5-fetch.ts#L530). This is the pinned direct residual after #5070, not a duplicate request to decode SOCKS gzip.
+
+### Redacted configuration
+
+Use a test-owned loopback upstream and SOCKS tunnel or the pinned direct helper as specified above. No user home, provider credentials or running proxy is needed.
+
+### Implementation path
+
+1. MODIFY `src/lib/pinned-http.ts`: apply an explicit content-coding policy to success bodies; default identity requests can reduce unnecessary coding but are not the complete fix.
+2. EXTRACT only the narrow shared gzip/deflate decoding policy from `src/lib/socks5-fetch.ts` if useful; leave injected executors under their existing contract.
+3. Remove stale coded length/encoding after decoding and preserve byte ceilings, cancellation, deadlines and connection cleanup. Define encoded/decoded accounting explicitly for the bounded pinned consumer.
+4. Do not reject an entire Accept-Encoding preference list merely because it mentions an unsupported alternative; validate the actual response coding. Brotli and multiple-coding support are separate policy decisions.
+5. ADD `tests/lib/pinned-http-content-coding.test.ts` and route-parity fixtures.
+
+### Acceptance criteria and verification
+
+- Identity/gzip/deflate produce identical logical JSON across owned raw transports.
+- Corrupt/unsupported coding returns a named error and closes the socket.
+- Decoded body size remains bounded when `maxBytes` is configured; existing encoded-byte behavior is explicitly preserved or versioned.
+- Abort/bodyless behavior remains intact; no direct-network fallback around operator egress policy.
+
+New test files must be registered in `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`; split tests rather than raise file-size caps. Update `structure/transports/inventory.md` and any other owner declared by the manifest. Run focused regressions and exact-head hosted CI in the implementation PR; no passing runtime result is claimed here.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] I removed secrets, tokens, account details, request credentials, and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/023_issue_g1.md b/devlog/_fin/260919_contract_gap_analysis/023_issue_g1.md
new file mode 100644
index 00000000000..ef61b66c77f
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/023_issue_g1.md
@@ -0,0 +1,56 @@
+# G1: [Feature]: Report endpoint-scoped tool-schema loss before applying stricter policy
+
+### Area
+
+Provider adapters
+
+### What are you trying to accomplish?
+
+Let an operator distinguish lossless normalization from compatibility widening for a tool declaration, while keeping current working requests compatible by default.
+
+### What prevents this today?
+
+All Google endpoint modes currently use the same sanitizer. [src/adapters/google-tool-schema.ts:88](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/google-tool-schema.ts#L88) drops non-string enums; [src/adapters/google-tool-schema.ts:120](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/google-tool-schema.ts#L120) widens mixed unions; [src/adapters/google-wire-compiler.ts:97](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/google-wire-compiler.ts#L97) has no endpoint profile or loss report. Existing tests intentionally expect several constraints to be removed. A request passing upstream does not establish original-schema fidelity.
+
+### What should OpenCodex do?
+
+Compile against an explicit endpoint profile and return bounded, content-free loss categories. Preserve the conservative current behavior initially. Add opt-in reject-lossy behavior only after the report is wired through initial compilation and compatibility repair. Do not claim a broader accepted dialect until that endpoint has evidence.
+
+### Example usage or interface
+
+Given an integer enum or a mixed union, diagnostics identify a bounded category such as `enum-value-filtered` or `union-widened`, plus counts and endpoint class. Default mode sends the existing compatible shape. Opt-in reject-lossy refuses before the changed physical send. Names are illustrative, not an existing API.
+
+### Alternatives or workarounds
+
+Forwarding arbitrary keywords would remove current request-containment guarantees. Globally turning off tool support confuses availability with fidelity. A mandatory universal argument validator is outside this proposal because client tool execution and inbound-protocol contracts differ.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+Bounded follow-up to #2358; distinct from the input-modality/context axes in #3377. [src/adapters/google-http.ts:73](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/google-http.ts#L73) and [src/adapters/google-http.ts:149](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/google-http.ts#L149) establish repair scope. Official endpoint docs do not prove one universal schema dialect.
+
+### Implementation path
+
+1. MODIFY `src/adapters/google-tool-schema.ts`: return parameters plus loss report; retain traversal limits.
+2. MODIFY `src/adapters/google-wire-compiler.ts`: consume endpoint profile and aggregate reports without names/property paths/schema text.
+3. MODIFY `src/adapters/google.ts`: derive profile from the existing `googleMode`; update all three call sites.
+4. Carry the selected policy to `src/adapters/google-http.ts` so a 400 repair cannot silently bypass it; direct mode already disables that repair.
+5. If policy becomes persisted, wire type in `src/types/provider.ts`, provider config validation/persistence, management and CLI creation, hydration/default handling and every compiler/retry consumer in one change. Start report-only if that full chain is not in scope.
+6. Update `structure/providers/google.md` and all adapter owners; add focused `tests/adapters/google/google-tool-schema-contract.test.ts`.
+
+### Acceptance criteria and verification
+
+- Profile matrix: numeric enum, bounds, mixed union, recursion, depth/node budget loss.
+- Unset policy stays byte-compatible; explicit reject-lossy sends zero initial requests for initial loss and zero repaired sends when a repair would erase constraints.
+- Indexed and unindexed 400 repair are reported; direct mode still does not repair.
+- Output `responseMimeType`/`responseJsonSchema` stay untouched.
+- Privacy fixtures use canary tool/property/value strings and assert none appear in report output.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/024_issue_s1.md b/devlog/_fin/260919_contract_gap_analysis/024_issue_s1.md
new file mode 100644
index 00000000000..1e12d981ce4
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/024_issue_s1.md
@@ -0,0 +1,68 @@
+# S1: [Bug]: Keep routed custom-tool preview consistent with fence-normalized completion
+
+### Client or integration
+
+Direct HTTP/API client
+
+### Area
+
+Proxy and routing
+
+### Summary
+
+On routed Responses custom-tool restoration, the progressive decoder emits the string inside the input wrapper immediately. Completion strips a complete outer Markdown fence for exec/apply_patch. A delta consumer can therefore receive fence bytes that do not belong to the authoritative final input. The bridge fix in #5070 does not cover this restoration module.
+
+### Reproduction
+
+Static source trace at `7864869c31c41cca9830d93540238f17df8faafb`; the following fake-upstream regression is the proposed executable reproduction, not a claimed local test result.
+
+1. Declare a custom exec tool and route it through function lowering.
+2. Feed output_item.added and function argument deltas whose full argument object is `{"input":"```js\ntext(1)\n```"}`.
+3. Complete the argument/item/response events.
+4. Compare every emitted prefix with the canonical `text(1)` input. Current restoration can emit fence bytes before completion removes them.
+
+### Version
+
+7864869c31c41cca9830d93540238f17df8faafb
+
+### Operating system
+
+Source review on macOS 27.0; the transport logic is cross-platform. Runtime reproduction has not been executed in this analysis.
+
+### Provider and model
+
+Not provider- or model-specific. Use a local fake upstream and no real credentials.
+
+### Logs or error output
+
+No live traffic or runtime logs collected. Evidence is the exact source path below.
+
+### Screenshots and supporting files
+
+[src/server/responses-custom-tool-repair.ts:32](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses-custom-tool-repair.ts#L32); [src/server/responses-custom-tool-repair.ts:338](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses-custom-tool-repair.ts#L338); [src/server/responses-custom-tool-repair.ts:363](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses-custom-tool-repair.ts#L363); [src/responses/apply-patch-envelope.ts:31](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/responses/apply-patch-envelope.ts#L31); [src/bridge/sse.ts:198](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/bridge/sse.ts#L198). Related #5047/#5070; this is a remaining routed path.
+
+### Redacted configuration
+
+Use a fake Responses upstream with a caller-owned custom exec declaration lowered to a function. Feed the event fixture through the routed restoration helper; no live provider credentials, SOCKS tunnel or user home are needed.
+
+### Implementation path
+
+1. Add a small shared progressive freeform-input helper under `src/responses/`, used by `src/bridge/sse.ts` and `src/server/responses-custom-tool-repair.ts`. Preserve current completion normalization.
+2. Hold only prefixes that can still become a fence, patch envelope or fallback wrapper; do not strip arbitrary backticks from executable input.
+3. Keep ordinary safe input progressive, retain stable call/item identity and common TranslatorBudget charging/release.
+4. Add sibling `tests/responses/responses-custom-tool-stream-consistency.test.ts`; the existing large repair test is at its cap. Update `structure/transports/responses.md` and adapter/byte-accounting owners.
+
+### Acceptance criteria and verification
+
+- Wrapped fenced exec across every split emits no prefix inconsistent with final input.
+- Done/item/terminal input and identity agree; when preview is suppressed, the final input remains authoritative. Do not incorrectly require empty preview to equal a nonempty done payload.
+- Plain input stays progressive; fallback keys, JSON whitespace/escapes and split surrogate pairs are covered.
+- Existing patch normalization and buffer release on done/failure/incomplete/disposal remain intact.
+- Define and document duplicate-key or late-invalid-wrapper preview limits rather than claiming an impossible general invariant without a buffering policy.
+
+New test files must be registered in `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`; split tests rather than raise file-size caps. Update `structure/transports/inventory.md` and any other owner declared by the manifest. Run focused regressions and exact-head hosted CI in the implementation PR; no passing runtime result is claimed here.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] I removed secrets, tokens, account details, request credentials, and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/025_issue_p1.md b/devlog/_fin/260919_contract_gap_analysis/025_issue_p1.md
new file mode 100644
index 00000000000..1b2640975ed
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/025_issue_p1.md
@@ -0,0 +1,54 @@
+# P1: [Feature]: Resolve static model policy once for catalog and routing consumers
+
+### Area
+
+Multiple areas
+
+### What are you trying to accomplish?
+
+Keep client-advertised capabilities and runtime static policy consistent when provider registry defaults or operator overrides change.
+
+### What prevents this today?
+
+Policy fields are merged independently during preset materialization, enrichment, routing and catalog correction: [src/providers/derive.ts:221](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/providers/derive.ts#L221), [src/providers/derive.ts:473](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/providers/derive.ts#L473), [src/router.ts:300](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/router.ts#L300), [src/codex/catalog/model-hints.ts:105](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/codex/catalog/model-hints.ts#L105). The catalog correction documents prior drift. This is repeated authority, not proof of a currently failing model.
+
+### What should OpenCodex do?
+
+Introduce one immutable resolved static-policy result with explicit field-level precedence. Catalog and routing consume it; late account, credential, quota, health and observed transport evidence remain separate. Preserve existing wire pins and explicit operator opt-outs.
+
+### Example usage or interface
+
+A registry default and explicit per-model override produce the same supported effort/window/semantic policy in catalog and route projections. Later credential changes may rebind transport but must not silently replace unrelated static policy. Unknown capabilities remain unknown.
+
+### Alternatives or workarounds
+
+A universal numeric priority or a static copy of account health would erase distinct authority rules. A descriptor-driven shared merge is a valid smaller alternative to a rich request-wide object.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+#3377 owns additional user-declared capability axes; this issue owns consistent consumption of existing static policy. #4579 was read and concerns execution authorization, not this metadata merge. #2358 remains the wider compatibility roadmap.
+
+### Implementation path
+
+1. Inventory each duplicated static field and its current precedence; add parity fixtures before changing consumers.
+2. Add `src/providers/resolved-model-policy.ts` or a shared field-descriptor resolver; do not introduce a new policy language.
+3. Migrate `src/providers/derive.ts`, `src/router.ts`, `src/codex/catalog/model-hints.ts` and `gather-capture.ts` incrementally. Preserve gather-flight authority capture.
+4. Route adapter static selection through the result in `src/server/adapter-resolve.ts`, preserving late binding in `src/server/responses/request-transport.ts`. If adding a RouteResult field, enumerate builder, every consumer and snapshots; no persistence serializer is needed unless persistence is explicitly added.
+5. Add `tests/providers/resolved-model-policy.test.ts` and parity/cold-catalog cases. Update `structure/providers-and-adapters.md`, `structure/catalog.md`, `structure/config.md` and routing owners.
+
+### Acceptance criteria and verification
+
+- Existing precedence is byte/behavior-equivalent for current fixtures before cleanup.
+- Registry default, explicit override, custom row, unknown and discovered hints are compared across catalog and route consumers.
+- Live evidence cannot widen a static hard limit; credentials/health do not become frozen request policy.
+- Hard pins, aliases and explicit false values retain their meaning.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/026_issue_p2.md b/devlog/_fin/260919_contract_gap_analysis/026_issue_p2.md
new file mode 100644
index 00000000000..68b7985a5ec
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/026_issue_p2.md
@@ -0,0 +1,53 @@
+# P2: [Feature]: Derive model selector decode hints from all classified registry identity maps
+
+### Area
+
+Catalog / models
+
+### What are you trying to accomplish?
+
+Allow an encoded provider/model selector to round-trip when its native model ID is declared only in an authoritative policy map, without falsely publishing that model as available.
+
+### What prevents this today?
+
+[src/router.ts:107](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/router.ts#L107) gathers known native IDs from a hand-written subset of model-keyed registry maps. [src/providers/registry/types.ts:169](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/providers/registry/types.ts#L169) declares additional identity-bearing maps. The type system permits an ID to exist only in an omitted map. No specific current production failure is claimed.
+
+### What should OpenCodex do?
+
+Classify every registry field whose keys are native model IDs and derive selector decode hints from that classification. Keep decode hints separate from catalog availability and retain ambiguous-selector rejection.
+
+### Example usage or interface
+
+A synthetic registry entry contains `vendor/model-a` only in its wire-default map. Its client-safe encoded selector decodes to that native ID. The hint alone creates no new visible catalog row.
+
+### Alternatives or workarounds
+
+Requiring every policy key in the static models list would interfere with live discovery. Retaining a partial hand-maintained list leaves future fields easy to omit.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+Adjacent closed #4730 concerns catalog slug collisions, not completeness of registry decode hints. Treat this as a bounded robustness proposal, not a live incident.
+
+### Implementation path
+
+1. Add `src/providers/registry/model-ids.ts` with a typed classification/helper.
+2. Replace the manual map list in `knownModelIdsForProvider` while retaining config IDs, transport identity checks and stale discovered hints.
+3. Classify maps carefully: not every object key is a model ID. Make new model-keyed fields require an explicit classification decision.
+4. Extend `tests/codex-integration/slug-codec.test.ts` and registry parity coverage using a model present only in each formerly omitted map. Update `structure/catalog.md` and `structure/providers-and-adapters.md`.
+
+### Acceptance criteria and verification
+
+- Each classified map independently supplies decode hints.
+- Unknown/ambiguous encoded IDs retain current fail-closed or pass-through behavior as applicable.
+- Transport-mismatched custom providers do not inherit unrelated registry IDs.
+- Decode hints never create catalog rows or availability claims.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/027_issue_v1.md b/devlog/_fin/260919_contract_gap_analysis/027_issue_v1.md
new file mode 100644
index 00000000000..f0546dcb67c
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/027_issue_v1.md
@@ -0,0 +1,54 @@
+# V1: [Feature]: Separate contract authority from source review fan-out in the structure manifest
+
+### Area
+
+Documentation
+
+### What are you trying to accomplish?
+
+Let maintainers find one authoritative statement for each cross-cutting contract while still reviewing all documents affected by a source-area change.
+
+### What prevents this today?
+
+[scripts/structure-ssot.ts:31](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/scripts/structure-ssot.ts#L31) represents related source paths but no contract owner/dependent distinction. [structure/AGENTS.md:45](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/structure/AGENTS.md#L45) makes every mapped document an update obligation; [structure/INDEX.md:126](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/structure/INDEX.md#L126) maps the broad server area to many documents. Repeated cross-cutting preambles already appear in runtime/config/transport documents.
+
+### What should OpenCodex do?
+
+Keep many-to-many source review coverage, add stable contract authority links and distinguish review obligations from actual content changes. Consumer docs link to the owner instead of repeating the same normative prose.
+
+### Example usage or interface
+
+A change under `src/server/` still lists every relevant document for review. A named streaming contract points to one owner anchor; only changed dependent explanations need edits. No automatic claim of semantic proof is made from link validation.
+
+### Alternatives or workarounds
+
+A prose-only cleanup is smaller but leaves authority navigation manual. One owner per source directory is explicitly wrong for this repository and is not proposed.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+This preserves the existing checker and mutation-tested structural guards. It does not replace structural invariants with runtime-only tests.
+
+### Implementation path
+
+1. Add a versioned optional `contracts` section in `structure/manifest.json`: stable ID, owner document+anchor, dependent documents.
+2. Update `scripts/structure-ssot.ts` parsing, validation and index generation; reject duplicate IDs, missing files/anchors and invalid dependents.
+3. Regenerate `structure/INDEX.md`; never hand-edit generated output.
+4. Amend `structure/AGENTS.md` to require review of all mapped documents and updates to the owner plus affected dependents.
+5. Migrate a few existing duplicated contracts with preserved links before expanding coverage. Extend `tests/ci-workflows/structure-ssot.test.ts` with malformed-manifest and generated-output cases.
+
+### Acceptance criteria and verification
+
+- Existing many-to-many source ownership remains accepted.
+- Duplicate/missing authority entries fail the checker; valid consumer links appear in generated navigation.
+- Unrelated source changes do not require copied unchanged-behavior prose.
+- The checker continues to claim topology and declared binding only, not behavioral correctness.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/028_issue_o1.md b/devlog/_fin/260919_contract_gap_analysis/028_issue_o1.md
new file mode 100644
index 00000000000..bde55537fc9
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/028_issue_o1.md
@@ -0,0 +1,55 @@
+# O1: [Feature]: Export existing request telemetry through an opt-in metadata-only scrape endpoint
+
+### Area
+
+Multiple areas
+
+### What are you trying to accomplish?
+
+Integrate existing logical-request, physical-send, terminal and latency facts with operator monitoring without reading raw request history or exporting private identifiers.
+
+### What prevents this today?
+
+[src/usage/log.ts:274](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/usage/log.ts#L274) already stores bounded operational facts, and [src/server/management/routing-analytics-routes.ts:24](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/management/routing-analytics-routes.ts#L24) serves JSON analytics. The pinned tree has no standard scrape exporter. The gap is export format and bounded aggregation, not absent observability.
+
+### What should OpenCodex do?
+
+Add an opt-in management-plane text exposition endpoint with documented counter/histogram lifecycle. Reuse existing completion/attempt facts, keep labels closed and bounded, and preserve independent management authentication.
+
+### Example usage or interface
+
+An operator scrapes aggregate logical requests, physical sends, terminal outcome counts, duration and TTFT. Protocol/result/recovery class may be labels; request/key/account/model IDs, raw errors, prompts and tool bodies never are. Metric names and route are design proposals.
+
+### Alternatives or workarounds
+
+Existing JSON analytics remains valid for interactive use. Raw request labels or scraping historical logs on every poll would make cardinality and cost unbounded. New timing instrumentation is outside this issue.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+Closed #1217 owns durable stream-stage attribution and is not reopened. This proposal exports existing facts only; standard GenAI field mapping is deferred until verified.
+
+### Implementation path
+
+1. Add `src/server/metrics-registry.ts` with bounded in-memory counters/histograms and explicit restart semantics.
+2. Feed it from existing lifecycle/completion/attempt seams in `src/server/request-log.ts`; avoid rescanning logs on scrape. Define incomplete/aborted and missing-TTFT denominators.
+3. Add management route in `src/server/management/metrics-routes.ts` and register it in `route-registry.ts`.
+4. Wire opt-in config type, validation/defaults, persistence/hydration and startup consumers; default remains off.
+5. Add `tests/server/management-metrics-export.test.ts`; update management/config structure owners and `docs-site/src/content/docs/reference/management-api.md`.
+
+### Acceptance criteria and verification
+
+- One logical request with retries increments logical count once and physical sends by actual sends.
+- HTTP 200 with failed terminal event is not counted as successful completion.
+- Management credential required; data credentials do not grant access.
+- Canary private strings and arbitrary IDs never appear in output; label series stay bounded.
+- Disabled mode adds no exporter timer/network activity; restart/reset semantics and units are documented.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/029_issue_o2.md b/devlog/_fin/260919_contract_gap_analysis/029_issue_o2.md
new file mode 100644
index 00000000000..310240ef0f2
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/029_issue_o2.md
@@ -0,0 +1,54 @@
+# O2: [Feature]: Preview integration mutations using the server ownership plan
+
+### Area
+
+Dashboard
+
+### What are you trying to accomplish?
+
+Review which managed configuration fields will change before applying, overwriting, disabling or restoring a client integration.
+
+### What prevents this today?
+
+Existing writers already snapshot, classify foreign edits, publish atomically and journal recovery. [src/server/management/integration-routes.ts:108](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/management/integration-routes.ts#L108) exposes mutation controls, while [gui/src/pages/integrations/RestoreDialog.tsx:137](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/gui/src/pages/integrations/RestoreDialog.tsx#L137) shows generic consequences rather than the exact bounded planned paths.
+
+### What should OpenCodex do?
+
+Offer a read-only plan from the same server-owned classifier/writer used by mutation. Show change kinds and safe managed paths, never raw before/after values. Bind confirmation to a fingerprint and re-read at commit.
+
+### Example usage or interface
+
+Preview reports that a managed provider URL field will be changed and a snapshot will be created, with a foreign-edit status. If a user edits the file before confirmation, mutation rejects or requires a fresh preview instead of applying the stale plan.
+
+### Alternatives or workarounds
+
+Raw unified diffs can expose credentials/private settings. Client-side inference duplicates server authority. Existing status remains useful but cannot show operation-specific consequences.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+This is a reviewability enhancement, not a claim that takeover/restore or transactional recovery is missing.
+
+### Implementation path
+
+1. Extract a pure planning seam in `src/integrations/plan.ts` around existing ownership classification.
+2. Add authenticated preview routes and bounded response types in `src/server/management/integration-routes.ts`/`route-registry.ts`.
+3. Carry operation+fingerprint from preview response through `gui/src/pages/integrations/integration-api.ts` into existing confirmation dialogs, then validate on mutation.
+4. Reuse existing snapshot/rollback/foreign-edit code; do not create a second client-side planner.
+5. Add read-only, privacy and stale-preview regressions; update `structure/clients/integrations.md`, management owners and the existing integration guide.
+
+### Acceptance criteria and verification
+
+- Preview performs no config writes, snapshot creation, secret rotation or journal mutation.
+- Returned paths are from an allowlisted managed schema, bounded and value-free.
+- Unchanged state: confirmed plan matches applied mutation. Changed state: safe refusal/recompute.
+- Existing rollback, restore, overwrite and foreign-edit semantics stay intact; dialogs explain the state.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/030_issue_d1.md b/devlog/_fin/260919_contract_gap_analysis/030_issue_d1.md
new file mode 100644
index 00000000000..fb02c2460cf
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/030_issue_d1.md
@@ -0,0 +1,34 @@
+# D1: [Docs]: Align SOCKS5 HTTP/SSE routing documentation with configured outbound fetch
+
+### Documentation problem type
+
+Incorrect documentation
+
+### Documentation location
+
+`docs-site/src/content/docs/reference/proxy-formats.md:257` and `docs-site/src/content/docs/reference/configuration/providers.md:514`
+
+### What is wrong or missing?
+
+The proxy-format guide says HTTP/SSE does not use ALL_PROXY, and provider configuration says applicable ALL_PROXY retains native fetch. [src/lib/proxy-env.ts:89](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/proxy-env.ts#L89) selects the built-in SOCKS tunnel for SOCKS5 ALL_PROXY. The server configuration guide already describes that behavior.
+
+### What should the documentation explain instead?
+
+Distinguish HTTP(S) proxy handling from the SOCKS5 selection branch. Describe NO_PROXY exclusions, existing precedence and supported coding/protocol limits accurately.
+
+### Suggested wording or example
+
+“When configured outbound fetch selects an explicit SOCKS5 proxy or SOCKS5 ALL_PROXY and NO_PROXY does not exempt the target, HTTP/SSE uses OpenCodex’s built-in tunnel. Scheme-specific HTTP(S) proxy settings retain their separate documented behavior.” Verify surrounding precedence text against the actual resolver.
+
+### Additional context or attachments
+
+Pinned source: `7864869c31c41cca9830d93540238f17df8faafb`. Static documentation/source comparison only; no runtime test result is claimed.
+
+Update all four English source pages: `docs-site/src/content/docs/reference/proxy-formats.md`, `docs-site/src/content/docs/reference/configuration/providers.md`, `docs-site/src/content/docs/reference/adapters.md:135`, and `docs-site/src/content/docs/guides/providers.md:975`, plus every translated copy of the contradicted statements; cross-link the correct server configuration section. No runtime change or new behavioral test is needed. Use a text consistency scan plus docs build/hosted checks during implementation. Related #2894 and merged #4986/#5070.
+
+### Checks
+
+- [x] I searched existing documentation issues.
+- [x] No secrets or personal information are included.
+
+Coordination: inspect open #3901 before implementation because it touches provider documentation and transport. Preserve its applicable changes and avoid a conflicting duplicate patch.
diff --git a/devlog/_fin/260919_contract_gap_analysis/031_issue_d2.md b/devlog/_fin/260919_contract_gap_analysis/031_issue_d2.md
new file mode 100644
index 00000000000..a3413e80f74
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/031_issue_d2.md
@@ -0,0 +1,32 @@
+# D2: [Docs]: Correct apiKeys documentation to preserve management/data-plane separation
+
+### Documentation problem type
+
+Incorrect documentation
+
+### Documentation location
+
+`docs-site/src/content/docs/reference/configuration/server.md:27` and translated copies
+
+### What is wrong or missing?
+
+The apiKeys row says generated credentials authorize management and data-plane auth. Runtime rejects data credentials as management tokens: [src/server/management-auth.ts:207](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/management-auth.ts#L207). The canonical management reference and [tests/server/server-management-auth.test.ts:780](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/tests/server/server-management-auth.test.ts#L780) already establish independent planes.
+
+### What should the documentation explain instead?
+
+Describe generated apiKeys as data-plane admission credentials only and link the separate management credential instructions. This corrects prose; no authentication behavior changes.
+
+### Suggested wording or example
+
+“Generated data-plane admission credentials. They do not authorize management APIs; management access uses its separate credential.” Preserve documented local listener exceptions rather than broadening either plane.
+
+### Additional context or attachments
+
+Pinned source: `7864869c31c41cca9830d93540238f17df8faafb`. Static documentation/source comparison only; no runtime test result is claimed.
+
+Correct the English row and all seven translated copies carrying the same statement; link `reference/management-api.md`. Confirm by text scan and documentation checks. Existing runtime integration coverage is sufficient; do not alter auth code or add implementation-mirroring tests.
+
+### Checks
+
+- [x] I searched existing documentation issues.
+- [x] No secrets or personal information are included.
diff --git a/devlog/_fin/260919_contract_gap_analysis/032_issue_d3.md b/devlog/_fin/260919_contract_gap_analysis/032_issue_d3.md
new file mode 100644
index 00000000000..86da7f3211a
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/032_issue_d3.md
@@ -0,0 +1,32 @@
+# D3: [Docs]: Bind core/Lab isolation and synchronous activation in the invariant index
+
+### Documentation problem type
+
+Incorrect documentation
+
+### Documentation location
+
+`structure/overview.md:90`, `structure/adapters/compatibility-lab.md`, `tests/lab/core-lab-boundary.test.ts`
+
+### What is wrong or missing?
+
+The root agent guidance declares core/Lab import isolation and synchronous activation non-negotiable, and a transitive mutation-tested guard exists, but the overview invariant index has no corresponding stable binding. [tests/lab/core-lab-boundary.test.ts:20](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/tests/lab/core-lab-boundary.test.ts#L20) and [tests/lab/core-lab-boundary.test.ts:991](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/tests/lab/core-lab-boundary.test.ts#L991) already own enforcement.
+
+### What should the documentation explain instead?
+
+Add a stable invariant ID tying both guarantees to the existing guard, with a backlink in the test and a link from the Lab contract document. Preserve the guard and its current negative coverage.
+
+### Suggested wording or example
+
+“INV-LAB-01: the protected core entrypoints cannot reach optional Lab runtime imports; gated Lab activation remains synchronous before startServer returns.” Check that this ID is unused before implementation.
+
+### Additional context or attachments
+
+Pinned source: `7864869c31c41cca9830d93540238f17df8faafb`. Static documentation/source comparison only; no runtime test result is claimed.
+
+Update `structure/overview.md`, `structure/adapters/compatibility-lab.md` and an existing test comment/describe label. Use the existing invariant binding checker and focused guard in implementation; no new runtime mechanism is needed. Closed #4704 hardened the guard, not this documentation binding.
+
+### Checks
+
+- [x] I searched existing documentation issues.
+- [x] No secrets or personal information are included.
diff --git a/devlog/_fin/260919_contract_gap_analysis/033_issue_r1.md b/devlog/_fin/260919_contract_gap_analysis/033_issue_r1.md
new file mode 100644
index 00000000000..4e9ce64a8d6
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/033_issue_r1.md
@@ -0,0 +1,55 @@
+# R1: [Feature]: Complete cross-layer send accounting for pre-output rate-limit replay
+
+### Area
+
+Proxy and routing
+
+### What are you trying to accomplish?
+
+Finish the explicitly deferred integration between adapter-local pre-output replay and OpenCodex request-wide send accounting, provider pacing and recovery telemetry.
+
+### What prevents this today?
+
+Public PR #5041 explicitly lists physical inner replay integration with the shared send budget, provider fetch wrapper and physical-attempt accounting as remaining work. At the pinned source, [src/server/responses/run-turn-execution.ts:162](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses/run-turn-execution.ts#L162) passes the budget/fetch seam, while [src/adapters/devin.ts:570](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/adapters/devin.ts#L570) does not thread it into the reset-retry wrapper.
+
+### What should OpenCodex do?
+
+Admit every actual inference send through the existing shared permit/observer path and count it once. Keep the zero-yielded-output replay boundary, cancellation and server-stated wait semantics unchanged. Reuse current spend reservation/refund and usage settlement semantics rather than adding another local counter.
+
+### Example usage or interface
+
+With a fake reset response followed by another attempt, the request-level used-send count and recorded physical attempts match actual fake-upstream sends. A refused next permit emits the existing withheld-recovery reason and makes no further inference request.
+
+### Alternatives or workarounds
+
+Removing safe replay discards the shipped recovery behavior. Incrementing budget.used directly misses reservation/observer/refund semantics. An adapter-only cap would preserve separate authorities.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+This tracks a remaining item already disclosed in [#5041](https://github.com/lidge-jun/opencodex/pull/5041), not a new broad retry system. #5044/#5056 handle attribution when recovery is withheld and do not complete this adapter integration. Long-wait keep-alives and a cross-transition scheduled-wait allowance remain separate work.
+
+### Implementation path
+
+1. Thread `IncomingMeta.sendBudget` and `providerFetch` through `src/adapters/devin.ts`, `src/adapters/devin/cloud-direct/stated-reset-retry.ts` and the inference send in `src/adapters/devin/cloud-direct/chat.ts`. Inventory each actual inference send before choosing permit placement.
+2. Acquire/commit/refund through existing `reserveDispatch` semantics exactly once per physical send; do not double-charge the initial outer slot.
+3. Extend `src/adapters/base.ts` IncomingMeta callbacks only if needed to share the existing physical-send/recovery contract; wire caller, adapter, callback consumer and usage aggregation together.
+4. Preserve auth, selected-account, pacing and no-replay-after-output boundaries.
+5. Extend `tests/providers/devin-stated-reset-retry.test.ts`, `tests/providers/devin-stated-reset-hardening.test.ts`, `tests/adapters/adapter-inner-send-budget.test.ts`, `tests/adapters/adapter-inner-send-budget-wiring.test.ts`, and `tests/responses/responses-send-budget-counts.test.ts`; update `structure/adapters/registry.md`, `structure/transports/responses.md` and the adapter reference.
+
+### Acceptance criteria and verification
+
+- Shared cap, actual fake sends, per-attempt telemetry and spend settlement agree.
+- Refused send performs no inference I/O and records why recovery was withheld.
+- Aborted waits and post-output failures never replay.
+- Initial send is neither omitted nor counted twice.
+- Tests use fake send seams and isolated state; no live account calls.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/034_issue_r2.md b/devlog/_fin/260919_contract_gap_analysis/034_issue_r2.md
new file mode 100644
index 00000000000..e795d186847
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/034_issue_r2.md
@@ -0,0 +1,56 @@
+# R2: [Feature]: Make explicit sibling instances honor the spend-ledger topology contract
+
+### Area
+
+Service lifecycle
+
+### What are you trying to accomplish?
+
+Align the supported local sibling-process workflow with the documented single-writer spend-ledger guarantee when a token ceiling is enabled.
+
+### What prevents this today?
+
+Public sibling-start work in #3188 allows an explicitly different port, while [src/lib/spend-reservation-ledger.ts:27](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/lib/spend-reservation-ledger.ts#L27) explicitly limits journal guarantees to one live proxy process. [src/cli/index.ts:413](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/cli/index.ts#L413) retains sibling support. These public topology contracts need an explicit product boundary.
+
+### What should OpenCodex do?
+
+Require every process that may initialize, append or compact the shared journal to participate in a state-directory writer lease, or provide a proven cross-process transaction boundary. Prefer a local single-writer lease first. Give a clear second-writer refusal and scalar ownership/health diagnostics. Do not suggest a shared database is necessary for ordinary local use.
+
+### Example usage or interface
+
+An operator starts a second explicitly ported instance under the same state directory. With an active enforced ledger owner it is refused clearly; an isolated state directory remains independent. An observe-only process must not write into an enforced owner’s journal merely because its own local config has no ceiling.
+
+### Alternatives or workarounds
+
+An append-only lock does not serialize in-memory reservation state and compaction. Silent per-process ceilings weaken the shared-directory meaning. Distributed state is deferred until a real multi-host requirement exists.
+
+### Additional context
+
+Source snapshot: `7864869c31c41cca9830d93540238f17df8faafb` after fast-forwarding `dev` on 2026-09-19. This is source-grounded analysis, not a runtime test result.
+
+This is a supported-topology follow-up to [#3188](https://github.com/lidge-jun/opencodex/pull/3188) and the public single-process limitation in the ledger. #5032 made ceilings configurable but did not change topology. No new bypass reproduction is included.
+
+### Implementation path
+
+1. Add `src/lib/spend-ledger-owner.ts` or reuse a compatible process-identity lease primitive after source review.
+2. Enforce ownership at the ledger construction/use boundary, covering CLI and exported startServer paths; CLI preflight supplies readable diagnostics but is not the only check.
+3. Cover every shared-journal writer, including observe-only mode: permit only one writer unless cross-process serialization is proven. Siblings can retain independent journals/state directories, or explicitly non-writing observation. Enabling a ceiling after observe-only operation must retain or acquire valid ownership before any enforced dispatch.
+4. Validate stale process identity beyond PID; refuse uncertain ownership; release on shutdown and every partial-start failure.
+5. Expose only initialized/configured/degraded and bounded error counters, never scope/account/request IDs or journal paths. A diagnostic read must not initialize or prune the ledger.
+6. Add isolated multiprocess ownership/rollback tests; update runtime/config/Responses structure owners and server configuration docs.
+
+### Acceptance criteria and verification
+
+- Two processes cannot simultaneously own an enforced journal.
+- Two observe-only siblings and mixed observe-only/enforced siblings obey the same journal ownership rule; enabling a ceiling after observation cannot skip ownership.
+- Independent state directories, stale-owner recovery and ambiguous-owner refusal behave explicitly.
+- Shutdown and partial startup release ownership; config changes cannot enable enforcement without acquiring it.
+- Public guidance distinguishes process restart durability from host power-loss guarantees.
+
+Register new tests in both layout inventories, preserve size caps, and update the existing structure owners. User-facing policy changes need corresponding public documentation and non-contradictory translations. Run focused tests and exact-head hosted CI during implementation; no local suite was run for this analysis.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
+- [x] I removed secrets and personal data.
diff --git a/devlog/_fin/260919_contract_gap_analysis/035_issue_r3.md b/devlog/_fin/260919_contract_gap_analysis/035_issue_r3.md
new file mode 100644
index 00000000000..6be879f11f7
--- /dev/null
+++ b/devlog/_fin/260919_contract_gap_analysis/035_issue_r3.md
@@ -0,0 +1,69 @@
+# R3: [Bug]: Request full replay when a task-scoped continuation cannot be used
+
+### Client or integration
+
+Direct HTTP/API client
+
+### Area
+
+Proxy and routing
+
+### Summary
+
+A task-scope mismatch correctly avoids replaying another task’s state, but removes previous_response_id and continues with the current input. If that input is only a delta, the proxy silently turns it into a fresh conversation. Missing or corrupt state instead asks the client to replay the full conversation. The proposed policy rejects every scope mismatch, including requests that appear to contain full input, because the proxy cannot prove the supplied input is complete. This deliberately changes the historical fresh-start behavior; a caller can retry explicitly without previous_response_id.
+
+### Reproduction
+
+Static source trace at `7864869c31c41cca9830d93540238f17df8faafb`; the following fake-upstream regression is the proposed executable reproduction, not a claimed local test result.
+
+1. In an isolated state fixture, store a response under task scope A.
+2. Submit its previous_response_id with task scope B and a delta-only input.
+3. Trace expandPreviousResponseInput into the ordinary/combo request paths. Current code strips the ID and continues fresh. Expected: the generic continuation-unavailable response before upstream I/O, allowing explicit full client replay.
+
+### Version
+
+7864869c31c41cca9830d93540238f17df8faafb
+
+### Operating system
+
+Source review on macOS 27.0; the transport logic is cross-platform. Runtime reproduction has not been executed in this analysis.
+
+### Provider and model
+
+Not provider- or model-specific. Use a local fake upstream and no real credentials.
+
+### Logs or error output
+
+No live traffic or runtime logs collected. Evidence is the exact source path below.
+
+### Screenshots and supporting files
+
+[src/responses/state.ts:1066](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/responses/state.ts#L1066); [src/server/responses/request-prepare.ts:245](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses/request-prepare.ts#L245); [src/server/responses/core-combo.ts:203](https://github.com/lidge-jun/opencodex/blob/7864869c31c41cca9830d93540238f17df8faafb/src/server/responses/core-combo.ts#L203). Related closed #702 covers expired-state context loss. The mismatch fresh-start behavior was intentional historically; this residual applies the current fail-closed replay principle without replaying foreign state.
+
+### Redacted configuration
+
+Use a test-owned continuation store and fake upstream. Set different client-task scopes in the stored entry and request. Do not use a live user home, credentials, SOCKS tunnel or running proxy.
+
+### Implementation path
+
+1. MODIFY `src/responses/state.ts`: represent scope mismatch as unavailable replay provenance rather than silently turning the body into a fresh request. Keep foreign state inaccessible.
+2. MODIFY ordinary `request-prepare.ts` and `core-combo.ts` consumers to reuse the generic 400 previous_response_not_found shape, preserving the internal reason only for bounded diagnostics.
+3. Update current tests that intentionally expect fresh-start behavior; preserve same-scope and valid unscoped compatibility.
+4. Cover HTTP/WS/combo entrypoints through the existing replay tests or new sibling files. Update Responses transport and client replay guidance.
+5. Record this as an intentional change to the historical fresh-start policy; validate affected client behavior before merge.
+
+### Acceptance criteria and verification
+
+- Mismatched continuation + delta returns generic previous_response_not_found with zero upstream sends.
+- Response reveals neither stored scope nor foreign-state existence/details.
+- A mismatched request carrying apparently full input also gets the same generic refusal; retrying that full input without previous_response_id succeeds. Update the deliberate fresh-start cases in `tests/responses/responses-state.test.ts` and `tests/server/server-combo-failover-e2e.test.ts`.
+- Explicit full replay without previous_response_id succeeds normally.
+- Same-scope continuation and documented legacy unscoped behavior remain valid.
+- HTTP, WS and combo paths produce consistent semantics.
+
+New test files must be registered in `scripts/test-layout/layout.json` and `tests/fixtures/test-layout-expected.json`; split tests rather than raise file-size caps. Update `structure/transports/inventory.md` and any other owner declared by the manifest. Run focused regressions and exact-head hosted CI in the implementation PR; no passing runtime result is claimed here.
+
+### Checks
+
+- [x] I searched existing issues and documentation.
+- [x] I removed secrets, tokens, account details, request credentials, and personal data.
diff --git a/devlog/_fin/260919_contract_resolution/000_plan.md b/devlog/_fin/260919_contract_resolution/000_plan.md
new file mode 100644
index 00000000000..36618520d0b
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/000_plan.md
@@ -0,0 +1,57 @@
+# Resolve the reviewed contract gaps through isolated implementation lanes
+
+The analysis unit delivered sixteen source-grounded issues and implementation paths. The user now authorizes implementation, scoped no-verify pushes, ordinary dependent PRs, coordinator-owned integration, closure after merge, and heartbeat follow-through. This campaign preserves the accepted boundaries and revalidates each issue against current source before changing it.
+
+## Loop specification
+
+Class C3 campaign, with C4 review for affected authentication, spend ownership and enforcement changes. Satisfy-spec loop; no numeric optimization target. First cycle locks this roadmap, audits the two-owner split, creates isolated implementation tasks and registers a real heartbeat. Second host cycle coordinates execution and integration until every scoped issue has a verified outcome. Each implementation owner performs its own docs-first PABCD cycles.
+
+No local suite, focused test, typecheck, build, installation, or live proxy/service invocation is permitted. Write regressions but execute them through hosted CI. Static text/source inspection, git diff checks, GitHub reads, browser research and no-verify commit/push are allowed. No releases, deployment, branch-protection changes, native-stack registration, unrelated issue expansion or live credential/config changes.
+
+Tool scope: repository/GitHub operations needed for these issues, isolated worktree tasks and read-only browser convention research. No user-defined resource ceiling; useful parallel review/implementation rounds remain bounded by actual tool capacity and non-overlapping file ownership. No persistent model-routing settings are changed.
+
+Verifier: task creation receipts and observed startup for handoff; saved current-task automation; later exact-head check-runs, per-layer ancestry, inspected diffs and actual dev landing for integration. A skipped/cancelled/missing check is not a pass. Stop only after all sixteen acceptance contracts are met or a documented issue-specific decision is genuinely needed; never shrink scope to make completion easier.
+
+Evidence lives in this unit; previous implementation specifications remain in `devlog/_fin/260919_contract_gap_analysis/020_issue_t1.md` through `035_issue_r3.md`. Those documents are a reviewed starting point, not permission to skip fresh source reads. Initial refreshed origin/dev: `4e45e1770f11576cf81bd9b7307d0cbdf628be65`. No matching open PR referenced #5109-#5124 in the refreshed inventory.
+
+## Ownership and dependencies
+
+| Lane | Issue and layer ownership | File domains and sequence |
+| --- | --- | --- |
+| Runtime | #5109 #5110 #5111 #5113 #5115 #5118 (server) #5122 #5123 #5124 | Raw transport contract, custom input consistency, send accounting, journal ownership and continuation policy. Stack null-body/coding only if a real shared helper dependency exists; upload can stay independent. Keep stream and state changes separate. |
+| Policy and operator | #5112 #5114 #5116 #5117 #5118 (dashboard) #5119 #5120 #5121 | Schema reports before reject-lossy policy, static merge parity before consolidation, identity hints separate from availability, authority-map/tooling, optional metrics and pure preview, documentation alignment. Stack by these dependencies; independent docs can land separately. |
+| Coordinator | Review, CI, base/merge judgment and issue closure | Workers never merge or close issues. Cross-lane shared test-layout/structure changes are serialized at integration, with no cap increases or dropped regressions. |
+
+Workers may use unlimited useful subagent rounds; concurrent workers have disjoint writes and never perform branch-level git operations in parallel on one checkout.
+
+## Integration policy
+
+Ordinary PRs/manual chains only. Per-PR CI remains required; the referenced task does not grant a new tip-only skip exception. No blanket skip-ci commits. A simple standalone PR normally squashes; dependent children must be retargeted/restacked after parent landing, retain parent refs while needed, and get fresh head/base evidence. Avoid rebase when the current base is already sufficient. Any required rewrite uses an exact lease on the owned branch, never bare force.
+
+Follow MAINTAINERS.md. Validate actor/base/head, technical review, required CI and any security review; preserve objections and attribution. The coordinator integrates one lane at a time and checks dev after each landing before landing the next conflicting change. Close an issue only when the accepted behavior is fully on dev, not when a child merged into its parent or a PR merely opened.
+
+## Files and work phases
+
+- `010_dispatch.md`: exact handoff scope, acceptance and scheduler behavior for wp1.
+- `020_integration.md`: event-driven execution/review/merge/closure procedure for wp2.
+- `001_status.md`: actual task IDs, PRs and issue states; updated from live evidence.
+
+Runtime architecture is unchanged by the coordinator roadmap. Each implementation PR must update all applicable current structure owners and public documentation. Public prose remains English, source-grounded, and free of other repository or review-model attribution.
+
+## Dispatch audit and current convention proof
+
+Independent roadmap audit passed after preserving the existing staged analysis, binding exact lane routing in private task configuration, and requiring a reviewed-SHA precondition on every merge write. Public documents intentionally omit routing model attribution. The official [merge command reference](https://cli.github.com/manual/gh_pr_merge) was retrieved with the requested browser research surface on 2026-09-19 (HTTP 200); its `--match-head-commit` description confirms the head precondition. The same reference documents merge/squash and administrator behavior. The flag does not replace required CI, security review, current-base validation or user scope.
+
+## First-cycle conclusion and next direction
+
+The roadmap is locked, the two isolated implementation owners are active, and the coordinator heartbeat is registered and verified. First-cycle completion certifies dispatch and continued coordination only; no implementation issue is claimed resolved. The next host cycle consumes this roadmap and the per-issue specifications to review, integrate and close proven fixes. The overall goal remains active, with the user-requested heartbeat providing subsequent wakes between meaningful events.
+
+Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged.
+
+Independent preparation audit accepted the #5115 ownership amendment: `knownModelIdsForProvider` is byte-identical across #5174, the registry entry type is unchanged by that layer, and the new helper has no static-policy dependency. Expected later overlap is import ordering and line movement; integration must retain both independent changes and obtain new-head hosted proof.
+
+Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created.
+
+Ownership refinement for #5118: the runtime owner retains server/writer/routes/backend tests and documentation; the existing policy owner takes the dashboard and its tests after explicit release of the untouched layer. Delivery remains server parent #5185 followed by a manually chained dashboard child, with independent reviews, each required hosted gate and actual screenshot evidence. No acceptance criterion or execution restriction changes.
+
+Final documentation ownership clarification: the original #5118 implementation path requires the existing integration guide. The dashboard owner now owns that user-flow guide and its translated counterparts in the final child layer; the server owner retains API references and backend/structure contracts. This closes an original artifact requirement without adding product scope or overlapping writers.
diff --git a/devlog/_fin/260919_contract_resolution/001_status.md b/devlog/_fin/260919_contract_resolution/001_status.md
new file mode 100644
index 00000000000..454a1b4be0f
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/001_status.md
@@ -0,0 +1,154 @@
+# Campaign status
+
+Status: IMPLEMENTATION COMPLETE. The active regression and release follow-up is tracked in [its separate open unit](../../_plan/260920_regression_release/000_scope.md). All sixteen original implementation issues are now closed. Final dashboard #5197 landed as `ed44e04a933f6d4d62d2e049bf7606f08d347b06`; #5118 was closed after ancestry/tree checks and current source/fixture evidence. The owner explicitly requested immediate integration while macOS verification remained unfinished, and that timing exception is recorded on the PR. No full-platform pass is claimed for that incomplete run. Complete hosted regression, main/preview promotion, release publication and post-publication verification remain outstanding. Two non-blocking review observations are retained for follow-up. The heartbeat remains active.
+
+## Owners
+
+| Lane | State | Issues |
+| --- | --- | --- |
+| Runtime | Delivered | All assigned implementation work landed |
+| Policy and operator | Delivered | Final dashboard landed; release remains coordinator-owned |
+
+Private orchestration records retain the actual task handles and wake cursors. The current coordinator heartbeat is ACTIVE at a 20-minute interval. It follows the two existing implementation owners; it must not duplicate them. The coordinator owns integration and issue closure.
+
+## Current evidence
+
+- The original 24 staged analysis documents remain intact.
+- Local suites, focused tests, typecheck, build, install and runtime/service execution remain prohibited.
+- The original issue states and every closed issue's landing ancestry were rechecked; see [the acceptance ledger](037_acceptance_ledger.md).
+- Remaining work is current-head verification, issue-specific implementation, integration and closure. Dispatch alone is not completion.
+
+## Issue outcomes
+
+Closed: #5109, #5110, #5111, #5112, #5113, #5114, #5115, #5116, #5117, #5118, #5119, #5120, #5121, #5122, #5123, #5124.
+Open implementation issues: none. Regression, promotion and release remain open.
+
+The entries below are chronological historical checkpoints. Their earlier open/closed states do not override the current summary or acceptance ledger.
+
+## Integration-cycle opening
+
+Runtime owner has completed its transport source orientation and is reading existing test conventions while independent audits cover larger issues. Policy owner registered a thirteen-phase roadmap, including report-before-enforcement and server-preview-before-client wiring dependencies, and entered its own plan phase. Its one shell quoting failure was corrected by the owner; it is not a blocker. No runtime test was run or claimed. No PR had been reported at that opening observation.
+
+Independent integration-procedure audit: PASS, no concrete blockers. This authorizes collecting/reviewing delivered PRs under the recorded gates, not merging a future PR without its own proof. Latest scoped PR lookup returned no linked open PR. Both owners remain active; the coordinator awaits their deliverables under the registered heartbeat rather than repeatedly polling GitHub.
+
+## First delivered PR
+
+#5125 addresses #5109 at `303e731d04eb00950922ba7d9749875e0a643551`, base dev. It is an ordinary standalone PR. Main diff review and independent regression audit are underway; exact-head hosted CI is running. See `021_pr_5125.md`. Issue remains open.
+
+#5125 coordinator feedback: fix the new 101 reachability comment/PR prose without expanding upgrade scope; dependent #5111 branch must include the parent correction. Independent regression review remains pending; no repeat CI poll until a new head/actionable result.
+
+## Current transport stack
+
+- #5125 / #5109: latest observed head `6557add72b48e91f8fdb5805a82192777b7d3286`, dev base. Parent prose correction is in; test now observes target connection close before fixture teardown. Current-head CI still needs a later result read. Old-head cancellations are supersession, not current failure.
+- #5126 / #5111: observed head `161f724361753fb2ad80863ceadb41990b0f024c`, parent base at `4c7fe1e...`; coding review underway. Owner notified to propagate latest parent before merge readiness. Ordinary/manual membership confirmed empty native-stack lookup.
+- Both PRs attached to coordinator. No merge/close. Full regression execution remains hosted only.
+
+#5126 is now REVIEW-BLOCKED at the reviewed head: source/socket errors are relabeled as decoder failures, and two downstream error-category consumers need updates. The owner received exact source locations, distinctions from pre-existing abort debt, and regression requirements. The same independent reviewer is retained for interdiff review after a corrected head. #5125 remains separately eligible for exact-head verification; neither issue is closed.
+
+Policy lane acknowledged its complete dependency-aware twelve-PR roadmap across the nine owned issues and is drafting detailed per-PR designs with six parallel workers. Runtime lane has source specifications for the remaining state issues and awaits the custom-input implementation. These are observed progress statements, not delivered/verified fixes.
+
+A targeted pre-publication scan of the policy lane's new convention document found review-routing attribution inconsistent with the user's public-prose constraint. The owner was asked to replace it with neutral role wording and scan incoming worker plans before committing; exact routing remains private task configuration. No main-side edit was made in the owner's checkout.
+
+Verified wait checkpoint: both native task handles remain active, not stopped. Runtime owner reports custom-input work returned for review and is now correcting both error-category consumers for #5126. Policy owner reports its static-policy designs complete with remaining operator designs under review. These reports do not satisfy merge/issue-close criteria; exact updated heads and hosted results remain required.
+
+## Verified completed issue
+
+#5109 CLOSED: #5125 MERGED into dev as `4e7d7132d8f8a7d46e460b48c5104a6d5ced4567`, after all applicable exact-head CI passed and regression execution was confirmed in hosted logs. Closure reread succeeded. Progress: 1 of 16 issues resolved; 15 remain open. Dev post-merge CI is queued in the initial snapshot, so no next overlapping merge is allowed yet. #5126 requires parent alignment plus remaining review fixes. #5127 is independently open for #5110 and has review fixes pending at a newer head.
+
+## Review and hosted verification checkpoint
+
+- #5126 at76b226: static corrections passed independent review, but exact-head hosted test2/4 failed one new successful-completion peer-destruction assertion. Owner is investigating lifecycle-versus-oracle semantics with primary evidence; no blind rerun or timeout change accepted.
+- #5127 atf18c: type/oracle fixes reviewed; exact null abort reason still needs correction.
+- #5129 at641f407: High introduced raw apply_patch prefix mismatch found; owner asked to preserve grammar-specific hold and add the missing routed patch regression.
+- #5130 at2e4681: acceptance corrections and explicit WS mismatch/recovery coverage requested; no merge approval.
+- CI producers for several campaign PRs and dev remain queued. Runtime owner acknowledged holding additional pushes while continuing static implementation. Policy owner continues audited roadmap work; both task handles are active.
+
+No further issue has closed. Overall goal remains active in integration/build; no C/D completion claim is justified for the full campaign yet.
+
+Both owners remain active. Runtime owner is batching received review corrections without adding new CI launches; policy owner completed its audit amendments and is correcting orchestration argument serialization. Coordinator supplied safe argv/attest-file guidance for that tooling friction without altering the child's FSM or verdicts. No stopped-task claim or duplicate task creation was made.
+
+Policy owner completed its audited roadmap cycle and started the #5120 documentation correction cycle. Coordinator clarified that a genuine docs-only PR may use its normal event-applicable documentation/lightweight checks while full runtime launches are throttled; no CI skip override is involved. Runtime owner is completing coherent review-fix batches, including the missing WebSocket regression, before updated pushes.
+
+#5134 MERGED to dev as `1b54f2940b038e5aba0665fed2a606e30773dd35` after all applicable docs/structure/aggregate and separate control gates passed at44f8fa1. #5120 closure completed and state reread. Progress: 2 of 16 resolved (#5109, #5120), 14 still open. Prepared #5122 commit90b646c passed independent static fourteen-file review; hosted execution proof and publication remain pending scheduling. #5123 prepared commit remains under independent core/lifecycle review.
+
+Prepared send-accounting commit90b646c independently passed all fourteen-file static review; publication awaits capacity. Prepared writer-ownership commitbf5feb02 received changes-requested from both private core and lifecycle reviews; owner is amending it before publication. No new claim of enforcement readiness is made. PR #5138 for #5121 is now attached; its three-file diff adds the invariant declaration, Lab contract link and existing test backlink without changing runtime code.
+
+Current prepared-change review checkpoint: send-accounting commit90b646c is statically approved; writer-ownership commitbf5feb02 remains private and changes-requested pending corrections. PR #5138's invariant binding is source-reviewed and running its applicable checks. Coordinator has explicitly prohibited further partial-job reruns; the existing #5129 attempt2 is observed live/queued and is not restarted merely because observation times out. Runtime owner follow-up instructions are queued through task messaging; a queued message is not claimed as acknowledged until reflected in task progress.
+
+Runtime dev run35432310593 at52c427 is live and has only macOS2/2 remaining in the current job snapshot. #5130 received a further corrected head a863c4b; same reviewer is checking acceptance and negative cases. #5127 remains exact-head green and statically merge-compatible, pending the prior dev guard. #5138 remains on hosted verification.
+
+Integration collision observation: dev52c427 run35432310593 was cancelled when another authorized integration advanced dev toe668aa (#5131); new run35434188285 is live/queued. This supersession is not a test failure, but repeated dev movement prevents the recorded post-merge guard from completing. Coordinator read the reference task's idle state and sent one question-only merge-slot coordination message, preserving its work/automation ownership. Requested the current dev run finish before the next overlapping runtime landing. No stale run rerun or other task cancellation was performed.
+
+#5127 MERGED to dev9824aa55bb0ed5fb27ca92ed0851a2fd5529123c; #5110 CLOSED after proof reread. Progress is now 3/16 (#5109, #5110, #5120), thirteen open. Next merge slot was coordinated with the reference integrator and returned after landing. Only actual acceptance/merge/closure is counted, never prepared commits or queued CI.
+
+## Monitor recovery
+
+A peer task reported accidentally deleting this campaign's previous heartbeat. Read-only host inspection confirmed only the reference task monitor remained. The coordinator restored the saved campaign prompt, actual owner IDs and 20-minute schedule using the automation tool. New ID `opencodex-01a0b850`, target this coordinator, ACTIVE status and saved fields were reread successfully. Existing implementation tasks were not restarted. Monitor mutation now explicitly requires checking name, kind and target identity; another task's monitor is never treated as a duplicate by directory order.
+
+Current reviewer disposition: #5126 c109586 and #5129 b1b604 passed exact interdiff review; both require their own new-head hosted proof and resolved GitHub findings. #5130 hosted old-message expectations were identified exactly and owner is updating only those contract assertions, retaining behavior checks. #5138 6986fc documentation amendments accepted by coordinator; hosted proof and GitHub thread resolution pending. No additional issue closure is claimed.
+
+Scheduling exception reported by runtime owner: two previously held branches were pushed without a PR, and the writer branch triggered Service lifecycle run35435244324 because that workflow has path-scoped push triggers without a branch restriction. Coordinator did not authorize that hold exception and corrected the assumption that a public branch push is unpublished or required for reviewing local commits. No remote deletion/cancellation was authorized; existing run may finish as evidence, while further writer-branch publication remains held pending exact-commit review. All matching workflows must be inspected before future push scheduling. Reviewers can read unpushed commits from the shared Git object database.
+
+## Current integration checkpoint
+
+Independent review accepted #5130 head4209818 as a test-only correction preserving the shared public error contract. #5126 c109586, #5129 b1b604, #5130 4209818 and #5138 6986fc still need current-head applicable macOS/aggregate results; current GitHub review threads are resolved except one documented pre-existing direct-stream grammar limitation on #5129, under coordinator scope disposition. No additional merge or closure is claimed.
+
+Writer ownership commit1661a920 remains changes-requested after private core and lifecycle review. Concrete corrective requirements were sent to the owner; details remain in ignored scratch. The policy owner was instructed to advance the next audited independent documentation slice while hosted work waits, preserving the current invariant PR head.
+
+New follow-up #5151 tracks the verified pre-existing direct-SSE reordered/escaped wrapper-key limitation. It is separate from the original sixteen implementation commitments. #5129 review disposition is accepted for its routed scope; exact-head hosted proof still pending. The bug-form chooser was inspected in the browser; submission used the matching form headings and bug label through CLI after the browser radio interaction failed. No duplicate issue was created.
+
+CI scheduling update: with existing Linux producers drained, one new send-accounting PR for statically reviewed90b646c is authorized for its normal hosted checks. The writer-ownership branch remains review-blocked. Both implementation tasks retain the original no-local-execution restriction and no merge/closure authority. Coordinator verified the current heartbeat remains ACTIVE at a20-minute interval with the correct task target.
+
+#5126 MERGED as af4f744c75 and #5111 CLOSED after exact-head CI, review and landing checks. Progress:4/16 resolved (#5109,#5110,#5111,#5120). New owned PRs #5152 (send accounting, head90b646c) and #5153 (SOCKS5 documentation, head4a576ba0) are attached and under hosted verification; documentation review dispatched. Corrected writer ownership head5328a723 is under two independent private interdiff reviews. #5129 final independent review is being refreshed before integration despite green hostedCI.
+
+#5129 MERGED asbb2fa5ab25; #5113 CLOSED after landing verification. Progress5/16. #5130 runtime CI passed; its only current control execution was cancelled, so coordinator verified no live duplicate and reran only run35435033238; attempt2 succeeded. #5138 runtime CI now success. #5153 has two source-confirmed documentation blockers (configured NO_PROXY semantics and adjacent SOCKS fake-IP wording), returned to the owner.
+
+#5130 MERGED asacd43bf442; #5124 CLOSED after verification. Progress6/16; current cumulative dev tipacd43bf442 is being tracked. #5138 has completed green proof and is undergoing final integration.
+
+#5138 MERGED as5ce51cb554; #5121 CLOSED after verification. Progress7/16 (#5109,#5110,#5111,#5113,#5120,#5121,#5124). The policy owner may proceed with the next audited authority/policy slice while fixing #5153; one new full-CI lane launch is authorized. #5152 has an actual hosted test3 failure under investigation; no merge approved.
+
+The reference integrator requested the next slot for #5128 and #5107. Coordinator confirmed no immediate merge candidate remains in this campaign and will revalidate the resulting dev before the next integration. Our current #5152 failure is independently traced to a zero-dispatch fixture and is not attributed to the referenced server-auth fixture issue.
+
+#5153 MERGED asf117c20d12; #5119 CLOSED after verification. Progress8/16 (#5109,#5110,#5111,#5113,#5119,#5120,#5121,#5124). Remaining #5112/#5114/#5115/#5116/#5117/#5118/#5122/#5123 remain open. Policy owner is moving into contract-authority implementation; runtime owner is investigating fresh #5152 CI and the private ownership API corrections.
+
+Writer-ownership head86eb1d06 passed the final private identity-boundary review; the owner may publish it for hosted verification. Runtime integration remains held pending the separately assigned sideband failure. #5152 fullCI at225e885 and #5155 fullCI at7d17f497 passed, but each has a valid newer review blocker requiring a corrected head and fresh proof; green old-head CI is not treated as merge readiness.
+
+Verifiedstate now10/16 CLOSED: #5109,#5110,#5111,#5113,#5116,#5119,#5120,#5121,#5122,#5124. #5116 closed by coordinator after5155 merge6d427233; #5122 closed by otherintegrator after5152 merge26d3a862, thenindependentlyreverifiedandretained. Sixoriginalissues remainopen:#5112,#5114,#5115,#5117,#5118,#5123. Cumulative sidebandruntimefailure and small5152 testfollowup remainseparaterequiredwork. Leasefixtureinventory deliveredforbatchmigration; runtimeowner authorized to rebaseleasebranch onlatestdev beforecoherentverification.
+
+Verifiedwait: runtimeowner reports fourdisjoint fixturegroups active and firstgroup placementreviewed; policyowner applies the remaining schema-categorysemanticrename aftercorefixreview. CurrentnewPR5161/5162 jobs are live/queued, notcomplete. No additionalissueclosure claimed.
+
+Sidebanddiagnostic/cleanup PR5161 merged d1745ee7 afterexacthead fullapplicableCI andfinalreview; originalissuecountstill10/16. Campaignsidebandrecoverydeliverablecomplete, broader4997 rootcause remainsseparatelyopen. Currentleasecf496 asyncfinalization/responsecleanup underindependentreview; strictschema parent/child awaitfreshhostedproof.
+
+2026-09-19T13:40Z: #5170 merged after all applicable hosted checks passed and current dev/head/actor were revalidated; its required follow-up task is complete. #5171 corrected the failing substring assertion at `2fdd21004eb256890ae9d7a54baab6c00653c65d`; this proves whole-policy non-mutation and preserves the legitimate registry-only value. Child #5174 at `7b25d449d9828019de8a9799f51539863d2eec68` migrates actual consumers; two disjoint independent reviews are active. #5157 at `271139883a552f1aac9ce3f847eb94e3327e5efc` cleanup re-review has no blocking finding; one conditional teardown improvement was sent to its owner. Hosted checks are still pending. Heartbeat ownership and ACTIVE state rechecked; no original issue closure claimed.
+
+Report parent #5162 merged at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1` after current-head CI and reviews passed. Child #5167 still requires retarget/restack and fresh verification. Original resolved count remains 10/16; #5112 remains open.
+
+Runtime owner pushed `9e789c1613b22109dd0398e9619be8902bff9662` for #5157: management ACL failure injection is restricted to the token file, the stream retry fixture uses its narrow relay-platform seam, and the direct combo fixture holds a writer lease and drains its response. Assertions and production ownership rules are unchanged in this delta. Independent review and fresh hosted CI are required. Policy owner is implementing #5117 in its isolated checkout while repairing #5174; #5115 and #5118 remain required scope.
+
+Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged.
+
+#5157 integrated and #5123 closed after final acceptance verification. Current progress is11/16, with five remaining original issues. See031_pr_5157.md for exact-head CI and merge evidence.
+
+Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created.
+
+#5177 is integrated and #5115 closed after complete acceptance verification. Current progress is12/16; remaining issues are #5112/#5114/#5117/#5118. The independent decode-hint change landed before policy migration after a recorded source-based sequencing amendment.
+
+The current-task heartbeat was updated and read back ACTIVE with the existing twenty-minute cadence. It now reflects twelve closed issues, runtime ownership of #5118, policy ownership of #5112/#5114/#5117, and the remaining publication/visual verification duties. Other task monitors were not modified.
+
+Current verified ledger remains thirteen closed issues and three open (#5114/#5117/#5118). The policy owner now owns only the dashboard child layer of #5118 in addition to #5114/#5117; the runtime owner retains its server, writer, routes, backend tests and documentation. The runtime handoff confirmed no dashboard writer, branch or commit existed. The two-owner limit, manual parent-child delivery and actual screenshot requirement remain unchanged.
+
+Fourth public checkpoint #5218 was opened at449d1144 after independent six-file publication review and the requested wording corrections. It records fourteen verified closures and remaining work; hosted controls/public review remain pending. All fourteen recorded merge ancestors and closed issue states were freshly rechecked against devfec3add6ce.
+
+Fourth checkpoint revision: public review identified detailed unshipped working notes in the preview record. The full notes were retained in ignored scratch; neutral progress/evidence wording replaced them and passed re-review. PR5218 now uses b6c0cd02224de03b62e25034f2c7d32bf02a1b64; the finding was answered and resolved. New-head hosted/public review remains pending, and no claim is made that prior remote objects were erased.
+
+Latest execution update: #5174 e5d is held after macOS shard1 reported actual fixture assertions and subprocess timeouts before its job deadline; diagnosis is active. #5185 ea8 exact-head run35467605982 completed successfully and public review is active. The dashboard final source cascade is prepared locally; its final-parent publication and fresh hosted-artifact captures follow verified server integration.
+
+Fourth public checkpoint #5218 merged as1883f2fff9b395dea5d849730997dac683e59939 at2026-09-19T20:55:23Z. Final headfb978cc2eb passed applicable hosted run35468644496 and controls; both public findings were resolved. Actual dev ancestry and merged tree11341f4cf66d2963847c05d1c3fe1e74e705e87f were verified. The fourteen-closure checkpoint is now public; later source/CI updates remain active working records.
+
+Final server run35471595302 succeeded at3a8e73d417, and the tested merge tree was verified equal to the accepted union. A subsequent public canonical-route consistency finding is being corrected before server integration. The earlier pass is not reused for a future changed head.
+
+Final-audit correction: the earlier fifteen-closure checkpoint was an accurate GitHub state, but original transport verification rows remained weak. #5109/#5110 are now explicitly open until a focused regression follow-up executes and lands. Existing implementation and successful receipts remain valid for the scenarios they cover. No acceptance criterion was removed or weakened.
+
+The dashboard delivery owner encountered a terminal execution-capacity failure after source and capture completion. The same existing task was resumed with available capacity, preserving its worktree and scoped ownership. No duplicate delivery lane or third main task was created. Remaining work is final capture-asset publication, independent visual evidence, applicable hosted checks and coordinator integration.
+
+Later verification: run35483995896 attempt1 completed SUCCESS at source278513a79e, including all event-applicable jobs and both macOS shards. The earlier integration timing exception remains a historical fact; the formerly pending source-PR platform checks are now complete. Full main-through-candidate regression, promotion and release remain separate follow-up work.
diff --git a/devlog/_fin/260919_contract_resolution/010_dispatch.md b/devlog/_fin/260919_contract_resolution/010_dispatch.md
new file mode 100644
index 00000000000..0a2b6ca3553
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/010_dispatch.md
@@ -0,0 +1,14 @@
+# Dispatch two isolated implementation owners and register continued coordination
+
+Depends on: the completed analysis and current GitHub duplicate scan. No production code changes in this host cycle.
+
+1. Create two saved-project tasks with environment=worktree, starting at refreshed origin/dev. The existing staged analysis remains untouched in the source checkout. Tasks may read that analysis by absolute path but copy only their relevant sanitized plan into their own worktree before implementation.
+2. Pass the exact lane issue roster, ownership, no-local-run restriction, no-verify commit/push authorization, template and attribution rules, cxc-loop requirement, mandatory source/convention research and shared-checkout subagent constraints. Require independent regression review and report exact task worktree/branch and first planned PR boundaries.
+3. Name one runtime owner and one policy/operator owner. Each owns its own goal/FSM. The coordinator cannot advance a child FSM. Workers do not merge/close issues or create their own competing coordinator monitors.
+4. Register a current-task heartbeat at 20-minute intervals. Preserve the separate reference task's existing monitor. The prompt reads this status record, inspects both tasks through compact snapshots and then current PR heads once per actionable wake.
+5. Verify each creation request against the exact private dispatch-routing manifest and record the tool-accepted model plus initial task identity. The runtime/policy assignments and medium-effort worker setting are explicit in that manifest; do not put routing model names in public documents, per user constraint.
+6. Confirm actual initial progress with wait_threads, not only creation responses. Record returned IDs/host IDs and observed worktree paths in 001_status.md. If a requested model cannot start, report the exact failure; never silently substitute.
+
+Acceptance: both requested main-task model selections accepted, separate worktrees exist, initial bounded plans/progress observed, current-task heartbeat created and saved, and source checkout staged analysis preserved. Verification is tool receipts and read-only state inspection; no runtime tests/build are justified for this coordination cycle.
+
+Final acceptance follow-up: the runtime owner retains a separate test-only delivery for original #5109/#5110 HEAD, informational-response and stalled-upload-timeout criteria. Freeze/preserve server PR5185 before switching the single owned checkout; use a separate branch/PR from current dev and no concurrent writers. No production change is planned unless the new execution exposes a concrete defect.
diff --git a/devlog/_fin/260919_contract_resolution/020_integration.md b/devlog/_fin/260919_contract_resolution/020_integration.md
new file mode 100644
index 00000000000..2aacd85d448
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/020_integration.md
@@ -0,0 +1,110 @@
+# Integrate reviewed issue fixes with hosted proof and close only completed contracts
+
+Depends on: verified dispatch/heartbeat wp1. Consume the sixteen exact implementation proposals from the completed analysis. Implementers re-read each owned source and nested instructions before modification; they record concrete diff-level plans in their own unit before B.
+
+On each wake:
+
+1. Read 001_status and the bound goalplan. Fetch compact task snapshots once and current PR metadata once. An idle owner with actionable assigned work receives a specific follow-up; a running owner is not repeatedly interrupted.
+2. Associate every PR with issue, lane, source worktree, base, exact head and scope. Check existing remote work before a new issue implementation. Avoid overlap with the reference task or unrelated authors; coordinate only when a concrete collision appears.
+3. Require independent source review and meaningful regression tests for runtime or contract behavior changes. Documentation-only changes use applicable documentation and structure checks. Compare test deletions/names before commits. Check file-size caps, test-layout registrations, exhaustive unions, structure ownership, public docs and attribution. Record forbidden local checks as NOT RUN, never as green.
+4. Read direct check-runs on the exact head and applicable workflow graph. Record all required tests/platforms/aggregate jobs and event/ref. Do not treat UI rollup, missing tests, skip or cancellation as success. Diagnose real assertion failures from logs; no arbitrary timeout widening, platform skipping or regression deletion. If cancelled legs poison the aggregate, inspect the workflow and rerun the complete relevant run only when justified; do not repeatedly rerun partial jobs or stale heads.
+5. Limit hosted-CI launch pressure. At most one new full run per lane at a time; do not cancel another task's CI. Poll once per PR/head per heartbeat, not every 30 seconds. On rate limit, honor reset/backoff and continue independent static work.
+6. Coordinator validates merge policy and exact head immediately before integration. Every merge write MUST use `--match-head-commit <reviewed-sha>` (or the equivalent API sha precondition), and revalidate that the current base is dev immediately before the write. A changed head/base invalidates the previous decision. Inspect native membership read-only; ordinary/manual chain is the intended topology. Unknown or unexpected membership is a real blocker, not license to dissolve it. Integrate a standalone PR with squash when appropriate; preserve dependent ancestry, retarget/restack children and require new evidence after parent landing. Never delete a parent branch still needed by a child.
+7. After each dev landing, verify merged state/SHA and dev CI before the next overlapping landing. Close only issues whose full acceptance list is satisfied on dev, with the PR/commit and verification evidence. Partial fixes stay open. No issue closes on a worker's report alone.
+8. Update status/devlog and notify only on meaningful completion, real failure, blocking collision or necessary user decision. If nothing changed, remain silent and wait for the next scheduled wake. When all sixteen issues have verified final dispositions, close the host cycle/goal and pause the heartbeat through its tool.
+
+Research: existing source and structure owners determine local conventions; missing/current protocol or workflow conventions must be searched and source-opened using the requested browser research skill. Public documentation is evidence only after the relevant page is read. Keep private source material out of public artifacts.
+
+## Current integration-cycle plan
+
+Previous cycle concluded that the two owners and heartbeat are active, with no implementation completion claimed. This cycle retains that direction. The runtime owner is examining transport tests while independent audits cover its larger state issues; the policy owner is comparing the nine assigned proposals with current source. No mergeable PR has been delivered yet.
+
+The coordinator's concrete write set is this unit's status/evidence files plus scoped GitHub PR review/merge and issue-close operations. Source changes remain confined to each owner's worktree and exact issue plan. For each delivered PR, add a record with issue IDs, changed source/test/doc paths, base/head, native membership observation, independent findings/dispositions, applicable CI jobs/run IDs, integration SHA and post-merge state. Refuse the write if any prerequisite is absent. No planned merge is pre-approved by this procedural audit.
+
+Transport body eligibility precedes shared coding normalization only if the owner actually extracts a shared primitive; upload cancellation is separately reviewable. Source-policy parity precedes static merge consolidation. Schema reports precede stricter admission. Metadata-only export and preview consume existing operational seams and remain separate changes. Document fixes can proceed independently with their source-truth checks. Review every returned layer against the corresponding archived exact-path proposal rather than accepting a batch success summary.
+
+Current failure signal review: the coordinator friction log contains historical entries from unrelated sessions, not a new repeated failure in this campaign. Do not run any recovery command from those old records. A single failed marker in a running child is not yet a blocker; inspect the actual error only if progress stops or the child reports it.
+
+## Applicable hosted jobs, observed workflow
+
+Current `ci.yml:1150-1237` aggregate derives requested jobs from event and path outputs, then requires success for requested jobs and skipped only for jobs the event did not request. For a runtime PR, inspect four general shards, two macOS shards, storage/api/gates/keyring/docker and applicable packaging/structure jobs. The full Windows shard matrix and macOS control are workflow-dispatch lanes in this snapshot, not ordinary-PR jobs; their skipped PR placeholders are not evidence they passed. A docs-only PR may correctly omit runtime jobs while requiring docs/structure and a successful aggregate. Follow the live workflow at the reviewed head and record requested-versus-not-requested explicitly, rather than using a universal name checklist or accepting every skip.
+
+CI-pressure interpretation: defer additional independent full-run PR launches while capacity is saturated. A statically reviewed batch correcting an already failed or review-blocked PR may still be pushed as one coherent new head, allowing the existing workflow's normal same-ref supersession to retire stale evidence. Do not wait for known-bad old-head jobs merely to free capacity, manually cancel unrelated work, skip checks, or push each small finding separately. This changes scheduling only; exact-head verification requirements are unchanged.
+
+Current-source correction: never infer rerun requirements solely from the reference task. Exact-head workflow code now explicitly supports latest-job evidence across partial retries. A full rerun is required only if current aggregate/provenance rules demand it or the existing attempt cannot produce valid evidence. In all cases require successful applicable jobs and aggregate at the actual head; cancelled/pending is never success.
+
+Pre-merge scheduling correction after coordinator agreement and live workflow inspection: push-event dev runs deliberately supersede on later dev commits; cancelled superseded runs are neither passing nor failing regression evidence. Do not make every intermediate dev SHA's full completion an indefinite global merge barrier when reviewed exact-head PR checks are all green and intervening integration changes are inspected. Track each new dev run, stop on genuine regression failures, and require final cumulative tip proof. If a specific integration SHA needs immutable full coverage, use the existing workflow_dispatch isolation after verifying the dispatch ref resolves to that SHA; no CI guarantee is waived. This policy is recorded before the next merge, with no failing regression excused.
+
+## Cumulative dev proof
+
+The exact dev9824aa55bb0ed5fb27ca92ed0851a2fd5529123c check-runs endpoint now confirms run35434532056 completed with all applicable producer jobs and aggregate ci successful. The skipped docs/macOS-control/full-Windows entries are event applicability, not execution passes. This closes the previously pending cumulative integration observation after #5127. A branch-filtered runs query returned historical commits, so the coordinator used the exact-commit endpoint rather than treating its branch list as current proof.
+
+## Latest cumulative integration observation
+
+Reference integration #5128 advanced dev from5ce51cb554 tof39ba5aad94fe019f2ee9c57398c9f9a436b8116. Its two-file diff changes only the server-auth reset fixture and helper. Prior cohort run35436552876 was superseded: its aggregate log explicitly rejects cancelled requested test/macOS jobs, not a newly observed assertion failure. It is neither passing evidence nor a runtime-regression diagnosis. Current cumulative run35436695398 atf39ba5aad9 is live; no historical rerun was launched.
+
+## Actual cumulative runtime failure
+
+Run35436695398 atdevf39ba5aa failed macOS2 job105880533745 on the exact50MiB sideband frame case, server-live.test.ts:662,15.308s (13251pass/23skip/1fail). This is an assertion timeout, not supersession. Docs-only #5153 landed asf117c20d12 before the runtime result completed and changes no runtime code. Further runtime integration is held while ownership of the narrow repair is coordinated. No timeout increase, test deletion, or blind rerun substitutes for a diagnosis.
+
+Sideband ownership resolved: no duplicate repair exists in the reference campaign. Runtime owner receives this scoped integration blocker with existing phase-timing helper, retained50MiB assertion and unchanged timeout/production limits. Existing issue4997 comments5727773831/5732577461 corroborate prior occurrences in both control and sharded lanes; introductionPR1398 is a distinct history fact. New implementation will be reviewed and verified through hosted diagnostics only.
+
+## Integration ownership deviation
+
+Another integrator merged campaign PR5152 at00666fea as26d3a862d6ebfa406701c76a6fbe25570a58ac76 at2026-09-19T11:06:07Z and closed5122 before the coordinator stopmessage arrived. This bypassed this campaigns sole-integration ownership and recordedruntimehold. Coordinator reverifiedactualmerge/issue and independentlyreviewedhead. Retainedthechange because it had scopedreview/exactheadCI and revertingunrelatedsendaccounting would notfix the pre-existing sidebandcase. No rollback or extraissue manipulation requested. Integrator acknowledged futurecampaignPR/issueownership; cumulativeCI and sidebandrecovery remainopen.
+
+## Fresh cumulative runtime gate recovery
+
+Exactdev26d3a862d6 completed run35439183186 with allapplicableLinux/macOS/packaging/structure/producers andaggregateCI success. Coordinator re-read exactcommitchecks and macOS2log ratherthan relyingonpeerreport. Latestdev46195ac09b changesonlyissue-translation automation anditstest, so runtimecontentmatches theverified26d3cohort. The earlierf39 sidebandfailure remainsvalidhistorical evidence; currentgreen is not a rootcausefixclaim.
+
+Decision updatedfromnewexecutionproof: the cumulative red gate has cleared, so eligiblefuture runtimePRs canagain beconsidered ontheir exactheadreview/CI andinspectedunion. DiagnosticPR5161 and issue4997 remainopen forobservability/recoverywork; no failedcheck skipped or oldrun blindlyrerun. Freshfailureswillstopintegrationagain.
+
+Latestdev118c66a8f4 includesindependentlyowned5141canonical-onlyWSselection and5139imagebounds. LeasebranchsharesWSfixturefile; staticmerge-tree isclean but finalunionneedssemanticreview/hostedproof. No silentoverwrite oroldheadgreen-as-unionclaim.
+
+Branchprovenanceclarification: referenceintegrator deniescampaignrebase/push; sharedlinkedworktrees sharebranch/stashrefs andGitHubactorisaccount-wide, nottaskidentity. Reflog551a->45bcrebaseconfirmed; exactscopedblobs/ancestryalreadyverified. No rollback/stashoperationperformed; sourcestageddevlogintact. Identityofwriter remainsunprovenfromactoralone, no attributionclaim.
+
+Background notification reconciliation: four rebase receipts (#4942/#5068/#5069/#5098) report clean replay. The #3025 receipt reports an unresolved Logs.tsx conflict despite command exit 0; the live result file has progressed further than the old completion receipt and still records a conflict. These are separate integration-lane artifacts, outside the sixteen-issue campaign. No branch/ref/worktree mutation was made by this coordinator. Current campaign blocker is instead the new exact-head #5157 Linux failure documented in031_pr_5157.md.
+
+Further background receipts: #4989 and #4597 report clean replay. #5009 and #2366 report remaining conflicts despite exit 0; these are not completion proofs. The separate publish pass reports remote-SHA verification for #3709/#4663/#4942/#5068/#5069/#5098, and #5107 closed during replay. These notices do not authorize or establish campaign integration; no unrelated branch mutation was performed.
+
+Next background receipts: #2366 now reports clean replay at `eec3a8a4663020c4a732ed6a6b6ed04bef32eceb`. #3901 and #4872 remain in documentation conflicts; #3025 progressed to another Logs.tsx conflict. #3983 replay has no content conflict but its diff check reports an extra EOF blank line in src/bridge/diagnostic.ts. These receipts are recorded without conflating replay, push, CI, or integration. No unrelated edits or branch mutations were made.
+
+Background receipt update: #5009 advanced from a relocated-test conflict to clean replay at `4f338311c4b3bcdb69b490f6dac4500358833978`. #2366 and #4597 publish receipts verify matching remote heads. #4872 advanced to a remaining provider documentation conflict. The remote-state snapshot is timestamped 2026-09-19T12:55:13Z and is historical, not current campaign proof; its old #5157 head must not replace the current reviewed head. No unrelated writes were performed.
+
+Background receipts now record clean replay for #3901 at `d0da0264e8092f65575b6eb69aa9bc2ee067e9d8` and #3983 at `c25e79ea0d076859aa43f09fd97802e3e7cd79ee` after the whitespace correction. #4989 publication matched remote head `7a8cb1ad286355c5aaefcdd84b16752daad8e849`. The separate consolidation command reports #3389 closed as superseded by #4989, not merged. #3025 still reports a Logs.tsx conflict at a later replay step. These are external lane receipts rather than campaign completion evidence.
+
+Final background batch in this notification: #4056 reports clean replay at `5eb0d1e311a1c2d5986bcd701711cd007f2090b8`; #4225 still has a compatibility-facade conflict. An older pinned-base check detected concurrent remote changes for #5157 and #5136, and verified an externally updated #5016. The historical pinned-base mismatch is not current mergeability evidence and triggers no automatic overwrite/rebase by this coordinator. Both campaign implementation owners remain active, repairing the separately observed exact-head CI failures.
+
+Cumulative integration verification: push run [35446842226](https://github.com/lidge-jun/opencodex/actions/runs/35446842226) completed successfully at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`, including aggregate ci and all applicable jobs. This independently verifies the earlier runtime union through #5170/#5162. The later docs-only #5175 is separate; future runtime integrations still require fresh cumulative proof. Superseded earlier runs are not retried merely because their canceled legs made an aggregate red.
+
+External integration advanced dev to0c45969a846e38bbd89f892af5118712da4f65d8 with seven separately owned contributor changes. Their owner explicitly retained this campaign's5174/5183/5185/dashboard/5192 scope outside its five lanes. Current-head union review is renewed where runtime surfaces intersect; no external PR or branch ownership is assumed. Documentation5192 retains only its six-file documentation delta on this dev tree.
+
+Confirmed cross-campaign integration failure: #5165 introduced a synthetic credential-bearing URL in tests/providers/rate-limit-retry.test.ts that the privacy email detector rejects. Hosted gates job105937216310 reported the exact fixture line on the merged dev tree. Its integration owner was asked to repair only fixture construction while preserving the userinfo-refusal input and unchanged privacy checks. The preview branch's separate test failure remains independently assigned; no gate is waived.
+
+The external integration owner repaired the synthetic URL fixture in #5195, landed at dbaad90ab1e0812d08fd1106454d37eafd51d0d8. Main fetched and inspected the diff: URL setters retain the same rejection input; the scanner, allowlist and assertions are unchanged. Hosted recovery remains to be observed before declaring the shared gate clear.
+
+Completed job105938951943 identified two further current-dev size violations before preview tests ran: src/codex/history-provider.ts2009 lines exceeds the2000 threshold; tests/server/server-combo-failover-e2e.test.ts4192 exceeds its4166 ratchet. The preview branch does not modify either file. The external integration owner received the exact source provenance (#5137/#5142) and a request for scoped extraction/test separation with unchanged caps and assertions. This replaces the unproven assumption that the failure came from the preview prune regression.
+
+The external owner published [#5201](https://github.com/lidge-jun/opencodex/pull/5201) to repair both size violations through source/test extraction. It remains an integration dependency, not a campaign-owned PR or a verified fix. The owner is awaiting hosted checks before landing; campaign branches keep their current diagnostic runs and will verify the eventual integrated base without changing caps.
+
+Dependency #5201 now includes the Reserve cache-content fixture correction at68e5265685. Its run35461030173 did not complete the requested macOS shard1(job105945232171); cancellation caused aggregate failure105948774256. This is missing completion evidence, not a newly observed assertion failure. The dependency owner received the exact distinction and retains rerun/merge ownership.
+
+Dependency #5201 landed atc81d43053ba1d1cdd4d3fdeb4c7f90d66c057291. Main fetched dev and verified ancestry. The policy owner was asked to carry #5174/#5183 onto that repaired base once quiescent and obtain new exact-head verification; the runtime owner retains its unfinished admission work. No original issue closure follows from the dependency alone.
+
+External relay classification change #5200 moved dev to3fd293d841dfe098ee9d7e6864290669101e373c. Main fetched the actual commit; static merge trees for consumerf38ce45b and metrics4d9bcead are conflict-free. A scoped semantic review is checking its interaction with terminal metrics before integration; no automatic rebase or ownership transfer is implied.
+
+The last external waves moved dev to98b9b344e1. Static union found concrete conflicts in the policy consumer branch at src/router.ts and src/server/responses/compact.ts; its owner was assigned a coherent resolution preserving both captured policy and newly configured compaction routing, followed by new-head CI. Metrics merged textually without conflict and has an incremental semantic review pending. No original issue was closed on an older conflicting candidate.
+
+Shared-base integration block: the later #5090 landing6b742ec947 grew src/oauth/index.ts to2009lines, producing NEW_OVERSIZED in server PR5185 run35469583032/job105968068362. Current devbd55ab7a3a retains that length. The existing integration owner received the exact failure and owns a minimal extraction preserving the landed behavior, without a cap increase or guard suppression. This campaign does not take over that PR. Policy5174 has complete retry proof but awaits a clean shared base and source-union review before integration.
+
+The external integration owner acknowledged the size regression and published repair #5220 at reported head30859d7d30. The owner reports extracting the in-flight login state module, retaining public exports and existing behavior without cap changes or removed tests. This remains a dependency awaiting actual CI and dev landing; this campaign will verify the resulting dev SHA and preserve its separate PR ownership.
+
+Repair5220 first hosted feedback: OAuth length is no longer the reported offender, but current shared openai-chat.ts has823lines and a GREW ratchet result in job105968931691. The repair also fails the missing_regression_test publication rule. Both concrete failures were returned to the existing integration owner, retaining separate ownership and unchanged caps/guards. No repaired-base success is claimed.
+
+A read-only Git-blob audit of the prospective policy/dev union checked all51 recorded caps plus changed JavaScript/TypeScript files since known-green fec3 (97paths total). It found only the two already assigned offenders: openai-chat.ts823 versus cap822, and oauth/index.ts2009 with no pre-existing cap. This is a bounded static count check, not a local suite or complete hosted verification.
+
+The repair owner reports final candidate bbc825290c in #5220, covering the OAuth extraction, openai-chat option refactor and explicit registration of client-runtime.test.ts in both inventories. The owner used the repository maintainer-approved pure-move test exception and documented the rationale; no dummy test or guard suppression was introduced. Actual latest checks and dev landing remain required before treating the dependency as resolved. A static inspection of all newly added tests since fec3 confirms client-runtime.test.ts was the only missing new-file registration.
+
+Shared-base repair #5220 landed as936e3524ebab7fea34aa9d937eb2b838803c8f51 at2026-09-19T21:47:02Z, from reviewedbbc825290c after run35470622277 success. Main fetched dev, verified ancestry and identical repair content, then integrated policy #5174 into the corrected base. No unrelated branch was taken over.
+
+#5185 server parent integrated at e64d6994eb179dbc6f9e5c073bb1f110503a6247 after exact e7 CI35478692205attempt2 success and current union/security/public review. Merged treeeb011 matches hosted checkout34423ad; ancestry verified. #5197 final dashboard delivery is now unblocked. #5118 remainsOPEN; closed count stays15.
diff --git a/devlog/_fin/260919_contract_resolution/021_pr_5125.md b/devlog/_fin/260919_contract_resolution/021_pr_5125.md
new file mode 100644
index 00000000000..5b959850882
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/021_pr_5125.md
@@ -0,0 +1,39 @@
+# PR 5125: raw outbound null-body responses
+
+Status: review in progress, hosted CI running; no merge authorization yet.
+
+- Issue: #5109.
+- PR: https://github.com/lidge-jun/opencodex/pull/5125
+- Head: `303e731d04eb00950922ba7d9749875e0a643551`.
+- Base: `dev` at `4e45e1770f11576cf81bd9b7307d0cbdf628be65`.
+- Native membership lookup succeeded with an empty array: ordinary standalone PR.
+- Seven changed files inspected: new shared response status helper, two raw transports, a focused new fake-peer regression file, both layout inventories and transport owner documentation.
+- Main runtime read confirms the new branch runs before the pinned success stream, adds 205 to SOCKS bodyless handling, preserves representation headers and leaves ordinary 200 behavior unchanged.
+- Independent regression-oracle review pending. Verify comments about informational/upgrade reachability separately from the scoped 204/205 fix.
+- Current direct exact-head check-run read: all four test shards, both macOS shards, gates, storage policy, packaging smoke and docker smoke still in progress. Several lightweight/structure/keyring/api-usage checks passed. Event-specific skipped jobs are not represented as test passes; applicability follows the actual workflow. Aggregate completion is not yet available.
+- Repository permission read confirms maintain/admin capability; current dev ruleset is PR-only with protected deletion/non-fast-forward rules and merge/squash methods. This is not permission to skip technical/CI/security duties.
+- Local runtime tests/typecheck/build/install: NOT RUN under user restriction.
+
+Next: collect independent review, send any concrete corrections to the runtime owner, and reread hosted results on a later actionable wake. Do not repeatedly poll unchanged checks or merge while proof is incomplete.
+
+## Coordinator finding
+
+At the reviewed head, new `http-response-semantics.ts:19-21` claims a 101 upgrade is refused before the final decision. `socks5-fetch.ts:592-624` actually stops the informational loop on 101 and reaches the Response construction path. The scoped helper need only define supported final statuses; upgrade support is not requested. Sent the runtime owner a correction to the new comment and repeated PR-body claim, preserving runtime scope and requiring propagation into the dependent coding branch. This is a documentation correctness correction, not a demonstrated new runtime regression. Any updated parent head needs fresh interdiff/CI evidence before merge.
+
+Independent exact-head regression review returned GO-WITH-FIXES with zero runtime blockers. It confirmed all seven changed files, meaningful real-transport keep-alive fixtures, preserved existing regressions and no runtime execution. The new SOCKS 205 test's title claims tunnel release while assertions only establish status/null body and teardown force-closes peers; requested an accurate title or a real pre-teardown observed-close assertion without fixed sleeps. Existing 204 coverage observes close separately. Both prose corrections were sent to the owner; no CI green claim or merge follows from this static review.
+
+Parent head advanced to `4c7fe1e7e3491a858d5308aa30cfa7a47dcbce7d`. Exact interdiff from the reviewed head changes only the informational/upgrade explanatory comment; the earlier false early-refusal claim is removed. Runtime and regression logic are unchanged. Fresh CI at this head is required. Child #5126 at `161f724361753fb2ad80863ceadb41990b0f024c` contains this parent (comparison is ahead=1, behind=0) and correctly names the parent branch as its base.
+
+The direct check-run read for `4c7fe1e...` showed a failed aggregate and cancelled required legs. Before any rerun, PR metadata was refreshed: head had already advanced to `6557add72b48e91f8fdb5805a82192777b7d3286`. The run at the old head is superseded, not evidence of a failing regression on the current head. No stale run was restarted. All prior passing/failed results remain tied to their own SHA; current-head evidence must be collected separately.
+
+Current-head `6557add...` check-run snapshot: all four general test shards, gates, storage policy, api usage, structure gate, docker smoke, three packaging smokes, keyring legs and lightweight gates succeeded. Both macOS shards remain in progress; aggregate ci has not completed. The event did not request macOS control/full Windows shards/docs build, so their skips are applicability facts rather than passes. Merge remains pending until required macOS and aggregate evidence is complete. No further same-head polling is scheduled before the next actionable heartbeat.
+
+Read-only review-state snapshot at current head `6557add...`: base dev, not draft, mergeable, reviewDecision REVIEW_REQUIRED, no submitted reviews and no unresolved review threads (pagination complete). Maintainer integration remains an explicit coordinator decision under MAINTAINERS.md, not self-approval. Applicable hosted CI is still a separate unmet prerequisite in the last snapshot; no merge was issued.
+
+## Landed and closed
+
+Final preflight confirmed actor maintain/admin permission, current dev base, reviewed head `6557add...`, mergeable/non-draft state and no unresolved review or maintainer objection. All applicable exact-head checks including both macOS shards and aggregate ci succeeded in run `35430059298`. Logs explicitly show transport-null-body regressions passing in Linux test 4/4 and macOS 2/2.
+
+Coordinator recorded maintainer integration in PR comment `https://github.com/lidge-jun/opencodex/pull/5125#issuecomment-5740379633`, then used squash with the reviewed SHA precondition. Actual merged state and dev tip confirmed merge commit `4e7d7132d8f8a7d46e460b48c5104a6d5ced4567` at 2026-09-19T08:07:26Z. Parent branch retained for #5126.
+
+Issue #5109 was closed as completed at 2026-09-19T08:08:28Z after landing verification, with proof comment `https://github.com/lidge-jun/opencodex/issues/5109#issuecomment-5740385524`. Initial dev check-runs are queued; hold the next overlapping integration until dev CI outcome is known. Local runtime suites remained NOT RUN.
diff --git a/devlog/_fin/260919_contract_resolution/022_pr_5126.md b/devlog/_fin/260919_contract_resolution/022_pr_5126.md
new file mode 100644
index 00000000000..25f84d921ce
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/022_pr_5126.md
@@ -0,0 +1,52 @@
+# PR 5126: pinned direct content-coding parity
+
+Status: exact-head source/test review in progress; not approved for integration.
+
+- Issue #5111; PR https://github.com/lidge-jun/opencodex/pull/5126.
+- Head `161f724361753fb2ad80863ceadb41990b0f024c`.
+- Base `codex/raw-transport-null-body` at `4c7fe1e7e3491a858d5308aa30cfa7a47dcbce7d`, parent #5125.
+- Exact comparison proves child includes the updated parent, ahead 1/behind 0. This is a real null-body-before-coding dependency; native membership is checked separately.
+- Seven files: shared coding classifier, pinned decoder/dual byte ceilings, SOCKS classification reuse, focused fake-upstream tests, both layout maps and transport owner documentation.
+- Main source review confirms explicit Accept-Encoding preferences survive; actual response coding determines behavior; null-body branch precedes coding; encoded-byte accounting remains and decoded-byte accounting is added.
+- Focused tests cover gzip/deflate, logical route parity, stale headers, unsupported/corrupt coding, expansion over the ceiling and explicit preference preservation. No runtime suite was executed locally.
+- Independent review is examining source-error/abort classification and cancellation/cleanup. In particular, generic source failures pass through a decoder catch that assigns content_decode_failed; caller behavior must be checked before accepting the new error taxonomy.
+
+Next: consume independent review; require exact-head hosted proof. Parent landing will change this PR's base, so retarget/restack and fresh evidence are required before dev integration. Do not close #5111 on a merge into the parent branch alone.
+
+Native membership lookup returned an empty array, confirming an ordinary manual chain. Initial exact-head CI for `161f724...` was running with no failed non-skipped producer observed. Parent subsequently advanced again; old ancestry evidence must not be reused for a merge until the child is rechecked against that latest parent.
+
+## Blocking review at 161f724
+
+Independent review FAIL; coordinator accepts the new source-error regression. `src/lib/pinned-http.ts:78-81` converts any non-PinnedHttpError passing through the decoder pipeline into content_decode_failed, including ordinary socket/source errors that previously surfaced unchanged. The separate post-header abort-identity weakness is pre-existing and is not wholly attributed to this change.
+
+The extended error union also requires consumer updates: `src/providers/quota/antigravity.ts:199` currently labels every non-output-limit PinnedHttpError as timeout, and `src/lib/lab-live-pinned-sender.ts:35` only maps the old four categories. Sent owner exact findings and asked for complete consumer analysis, preservation of source-error identity, coded reset/cancellation/encoded-cap tests and observed cleanup before teardown. No separate resource leak was proven statically. All seven changed files were covered; tests were not run locally. No merge while this blocker is unresolved, regardless of aggregate CI color.
+
+## Revised head under re-review
+
+Head `d7b5c83a018827dcbd86417300ea2e3f55e71c6f` now includes current parent `6557add...` (ahead 2/behind 0). It adds a source-failure attribution stream before decompression and compile-exhaustive quota/Lab mappings. The original-versus-new branch comparison is diverged after parent propagation, so review uses exact old/new blob differences and the full current parent-to-head layer, not a merge-base-relative patch mislabeled as an interdiff.
+
+Main identified two remaining oracle weaknesses and sent them to the owner for batching: the encoded-cap case has both encoded and decoded sizes above its limit and thus does not isolate the encoded counter; the cancellation case sends the entire coded body and can conflate normal completion with cancellation. Requested deterministic encoded>limit>=decoded fixture and an intentionally unfinished coded response for cancellation. Both are static test-adequacy findings, not executed failures.
+
+Latest reported head `76b226f40b7baa8d0862c3013b301dcb96733c93` is retargeted to dev at the parent squash merge. It expands the deterministic Lab error taxonomy and adds direct quota/Lab mapping fixtures, plus stronger coded-limit/cancellation cases. Same reviewer is rechecking the full changed value chain and previous findings at this head. No integration verdict yet.
+
+Independent review of exact dev-to-`76b226...` layer: PASS, all thirteen changed files covered, no remaining findings. Deterministic unreadable_response now maps to existing protocol_failure results; type/serialization/classification consumers were traced. Direct quota/Lab tests cover both new coding cases, encoded-only cap fixture distinguishes its guard, and cancellation holds an incomplete coded response open before observing peer release. Local execution remains NOT RUN. Hosted current-head and post-merge dev proof remain separate gates.
+
+## Hosted failure after static approval
+
+Current-head run `35431301737`, test 2/4 job `105866388278`, failed one new case: `tests/lib/pinned-http-content-coding.test.ts:303`, decoded-response successful completion followed by `awaitDestroyed(connection())`, expected true/received false after its bounded wait. The batch reports 94 pass/1 fail. This is genuine hosted evidence, not an old-head cancellation, and prevents integration.
+
+Owner received the exact assertion/log and must determine whether the source failed its required cleanup or the test incorrectly equates successful HTTP-agent release with peer destruction. Successful keep-alive reuse and mandatory failure/cancellation teardown are distinct contracts. No timeout increase, blind rerun or assertion deletion is accepted without source/primary-contract evidence and a replacement meaningful oracle. Local runtime probes remain prohibited.
+
+Primary-contract research: the official [HTTP Agent reference](https://nodejs.org/api/http.html#class-httpagent) was searched and retrieved using the requested browser research surface (HTTP 200, 2026-09-19). Its success lifecycle permits either socket destruction or pooling depending on keep-alive policy; `agent: false` changes reuse behavior. This supports separating successful body settlement from mandatory failure/cancellation teardown. It does not prove the exact runtime-specific failure mechanism, and is not authority to alter pooling merely to turn a test green. Owner received the source and that limitation.
+
+Re-review at `89a8b9b5de8ffa3dbafa0b8fdca683fbf5947e38`: PASS. The invalid gzip and encoded-limit fixtures now keep HTTP responses incomplete before asserting peer destruction. Documentation distinguishes premature termination from normal agent-owned completion. Interdiff is two files, no production changes and no timeout widening. Hosted checks at this corrected head remain required.
+
+Latest89a8 head now has successful full applicable runtime CI (run35433104226), and clean static merge-tree onto dev9824 preserves the merged upload/null-body behavior. Final review-thread inspection found one unresolved valid test-oracle comment at tests/lab/lab-live-pinned-timeouts:137-141: actual send rejection is matched by shape, but classification uses a separately constructed error. Coordinator requested classifying the captured actual TransportError for unsupported and corrupt cases, then resolving the thread with evidence. No merge while that review item remains open; corrected head needs fresh hosted evidence. A cancelled duplicate enforce-target execution is retained separately from the successful same-head control run, not counted as a pass.
+
+Review-thread correction head `c10958672e51c50b0966b93f7917d2981553913b` independently passed exact interdiff review: unsupported and corrupt cases now capture the actual sender rejection, verify TransportError identity and classify that same instance. Only the test changed; previous production fixes remain intact. Current-head hosted CI/review-thread closure still required before integration.
+
+At c109586, hosted Linux test2 job105875367464 and macOS2 job105875367428 logs explicitly show content-coding regressions passing. Full current-head aggregation still waits for macOS1. Static merge-tree onto dev9824aa succeeds with tree6d87698e81077ba4bc600792da6ff77e8082de67; native membership is empty and all review threads resolved. This is preflight evidence, not merge authorization without final green.
+
+## Verified integration
+
+#5126 MERGED into dev as af4f744c75e4dd0348b4e497e67db4ac80208e07 at2026-09-19T10:00:37Z, pinned to reviewed c109586. Exact-head run35434708658 and current control checks succeeded; all review threads resolved; maintainer-integration validation passed. Actual dev ancestry and issue5111 CLOSED were reread. All issue acceptance conditions map to the reviewed implementation and observed hosted regressions. No local suite ran. Post-merge cumulative dev execution remains monitored.
diff --git a/devlog/_fin/260919_contract_resolution/023_pr_5127.md b/devlog/_fin/260919_contract_resolution/023_pr_5127.md
new file mode 100644
index 00000000000..dfe3f147a8b
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/023_pr_5127.md
@@ -0,0 +1,25 @@
+# PR 5127: SOCKS upload lifecycle
+
+Issue #5110, head `4b85ecde0ff3c03c38a66ba523edc4560369d2ce`, base dev `4e45e1770f11576cf81bd9b7307d0cbdf628be65`. Five changed files: SOCKS helper, focused lifecycle regressions, two layout maps and transport owner docs. PR attached to coordinator; no merge approval.
+
+Main source inspection confirms the response-head read is moved before upload, keeping one socket reader, and stalled body reads/drain waits race the head/abort. The cancel algorithm is invoked without awaiting a potentially non-settling caller hook. Independent lifecycle/oracle review is underway.
+
+Main identified a likely type-narrowing defect without running typecheck: UploadStep includes drained; read/answered promises are annotated with the full union, so after excluding answered/end, step.value still has a drained alternative. Sent owner exact lines and advised precise race result unions. Also requested upstream-observed first uploaded chunk before triggering the abort fixture, since a source's delivered promise can resolve during initial stream pre-pull rather than actual upload. Await independent source falsification and hosted CI; no local runtime execution.
+
+Independent review confirmed non-Error abort reasons are replaced by the new helper and the abort fixture does not establish pending-upload state. Coordinator requires both medium findings fixed before integration, alongside the type-narrowing correction. Old-head CI has a failed gates job and superseded/cancelled producers; PR head has already advanced to `606f76bdf9c3af4d02acb1ede627da19fcb7b0e7`, so old results are not applied to the new head and no stale rerun was issued.
+
+Interdiff to `606f76bd...` fixes the broad UploadStep type by separating body/read and drain race results. It also adds an upstream-observed upload latch before the Error-reason abort case. The valid non-Error reason preservation finding is not addressed by this interdiff and remains pending. This is static re-review, not a claim that current hosted checks passed.
+
+Independent re-review at `f18c488...` confirms correct type narrowing and upstream-observed abort activation. Strings/objects now pass through, but `signal.reason ?? fallback` still replaces a deliberate null reason, contradicting the new comment. Coordinator requested exact reason preservation and a null regression, including competing socket-reader race semantics. No merge while the declared preservation contract is incomplete.
+
+Final static interdiff review at `cc8eeab585a7ce175cecf73268a325497c26eaf4`: PASS. Defined abort reasons including null are preserved across competing upload/reader/drain paths; upstream-observed abort activation and string/null/object identity cases are present. Type narrowing remains correct. No local runtime result claimed; applicable exact-head hosted CI and integration with current dev remain prerequisites.
+
+Exact-head hosted CI for `cc8eeab...` completed with aggregate success (run35432240251); no failed/pending check remained in the final read. Current PR review threads are resolved, no maintainer changes requested, head unchanged and base dev. A static merge-tree against current dev `1b54f294...` resolves cleanly to tree `83070a0c0047a26d8bf155b6a27becef5e049158`, preserving the already-landed shared 204/205 bodyless rule together with the new upload helpers; its dev delta remains only the five scoped files.
+
+Coordinator still holds runtime integration because the preceding current runtime dev run at52c427 remains live/queued. This is the recorded post-merge guard, not a defect in this now-green PR. No unnecessary rebase, merge or issue closure has occurred while that evidence is pending.
+
+## Landed and closed
+
+After explicit merge-slot coordination with the reference integrator, current dev e668aa and its supersession behavior were rechecked. Static integration tree31112244 preserves both existing null-body and new upload behavior, with only five scoped files changed. Final exact-head CI, actor/base/head, no unresolved objections and ordinary membership checks passed; GitHub's temporary UNKNOWN mergeability was re-read as MERGEABLE before any merge command.
+
+Coordinator recorded decision at `https://github.com/lidge-jun/opencodex/pull/5127#issuecomment-5740735857`, squash-merged with exact SHA precondition, and reread actual dev landing `9824aa55bb0ed5fb27ca92ed0851a2fd5529123c` at2026-09-19T09:22:46Z. Issue #5110 was closed only after that verification, with proof comment `https://github.com/lidge-jun/opencodex/issues/5110#issuecomment-5740742948`. Cumulative dev CI is monitored, not claimed complete. No local runtime checks.
diff --git a/devlog/_fin/260919_contract_resolution/024_pr_5129.md b/devlog/_fin/260919_contract_resolution/024_pr_5129.md
new file mode 100644
index 00000000000..dd49b8bcbfa
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/024_pr_5129.md
@@ -0,0 +1,23 @@
+# PR 5129: shared progressive tool input
+
+Issue #5113; head `641f407cfb3d13d2a0518d194ea859ea3338059b`; base dev at `4e7d7132d8f8a7d46e460b48c5104a6d5ced4567`. Nine files. Adds a shared freeform-input module, replaces bridge-local implementation and routed decoder, adds focused consistency tests, updates both layout maps and three structure owners. Independent exact-head review assigned. Main is checking whether fallback/raw streaming newly enabled on routed restoration preserves completion semantics, without treating the already documented canonical duplicate-key/late-invalid debt as newly introduced. Hosted proof and review required; no local runtime execution.
+
+Independent review FAIL at `641f407...`: the shared decoder newly returns raw arguments on routed apply_patch, while the restore hold only covers code-mode exec. Decorated patch delimiter bytes therefore stream before completion normalizes them, violating the prefix contract. Existing new test helper constructs exec only and misses this introduced path. Coordinator accepted the finding and requested a grammar-scoped apply_patch hold plus split-input done/item/terminal regressions. The fallback valid-JSON concern was falsified: another field cannot be appended inside an already parsed complete valid object, so the remaining case is the explicitly documented late-invalid class.
+
+Base metadata and head are siblings after #5125 landed; the actual nine-file PR layer is measured from merge-base `4e45e177...`. Do not interpret sibling-base null-body changes as deleted by this PR. Integration later must preserve them explicitly.
+
+CI attempt integrity: run `35432239071` atbb430bf is now attempt2 after the owner reran only cancelled macOS 2/2. Job inventory shows attempt1 macOS cancellation and aggregate failure, with only macOS queued in attempt2. Coordinator instructed no further partial retries and is diagnosing the cancelled job. A partial retry is not accepted as complete current-attempt coverage; any final full rerun decision remains bound to this unchanged head and actual workflow rules.
+
+Cancelled-job log inspection: the first macOS 2/2 attempt ran about twenty minutes and stopped emitting output in an unrelated client-connect test after 08:38:40Z, then reported operation cancelled at08:56:07Z. No assertion failure appeared. This is a running-test/subprocess stall observation, not a mere runner-queue delay. Owner was told not to alter unrelated tests or widen timeouts; partial-attempt results remain insufficient for final aggregate proof.
+
+Correction after exact-head workflow inspection: the historical reference-task claim that every partial retry requires a full workflow rerun is stale. `ci.yml` atbb430bf explicitly uses latest-job results to support partial reruns. Attempt2 is not intrinsically invalid; accept only fresh successful applicable latest jobs plus successful aggregate on the same head. No extra full rerun will be launched merely to satisfy the earlier incorrect coordinator assumption. The original cancellation/stall still needs diagnosis if it recurs.
+
+Latest control-character correction head `b1b604e14cfacf7f1efe5f5b6566b89f165a08bc` independently passed exact interdiff review. Literal JSON U+0000-U+001F controls cause the shared preview decoder to hold; escaped controls and external whitespace remain unchanged. The one-chunk malformed wrapper fixture proves this case only, not a universal partition-independent no-preview guarantee. Previously documented late-invalid-prefix limits remain explicit; the earlier apply_patch hold remains fixed.
+
+## Pre-existing direct-bridge limitation disposition
+
+Independent exact-base review confirmed reordered/escaped wrapper property names already behaved this way at4e7d713: the bridge literal matcher/raw return differs from completion JSON parsing. The routed restoration suppresses these unchanged object prefixes, so this does not invalidate #5113 acceptance. Follow-up #5151 records bounded object-scanning implementation and split/ambiguous-object/budget acceptance; the review thread is resolved as separately tracked, not falsely fixed. Official RFC8259 was retrieved with HTTP200 through the requested browser research surface on2026-09-19.
+
+## Verified integration
+
+Final independent nine-file review PASS atb1b604; hosted run35434780189 applicable producers and aggregate success with all10 new cases observed in macOS logs. All threads resolved, maintainer preflight passed, merge-tree on devaf4f744c was clean, native membership absent. PR5129 MERGED asbb2fa5ab25d65a4e5fbab9253f5cc750cbbf2dcf at2026-09-19T10:03:30Z. Dev ancestry and issue5113 CLOSED reread. PR description corrected to acknowledge the intentional literal-control rejection rather than claiming byte-identical extraction.
diff --git a/devlog/_fin/260919_contract_resolution/025_pr_5130.md b/devlog/_fin/260919_contract_resolution/025_pr_5130.md
new file mode 100644
index 00000000000..7bef1704004
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/025_pr_5130.md
@@ -0,0 +1,15 @@
+# PR 5130: explicit full replay for scope mismatch
+
+Issue #5124; head `2e4681f0d15e3683f367b7773ce6a87abe4c7d59`; base dev at `4e7d7132d8f8a7d46e460b48c5104a6d5ced4567`. Nine files. Records internal scope_mismatch failure rather than removing the continuation ID, ordinary/combo consumers return the generic replay error, and EN/KO/structure documents describe the intentional all-mismatch policy change. HTTP delta refusal and combo full-input retry/same-scope/legacy cases are added. Independent review assigned; main asks whether WS activates the same mismatch in actual regression coverage and whether shortened existing assertions preserve all prior isolation/projection guarantees. No foreign scope enters response text in the inspected diff. No merge or test pass claimed.
+
+Independent review requires additional acceptance corrections before integration. The owner received the required changes and will return a revised exact head. Explicit WebSocket scope-mismatch activation and no-ID recovery coverage are still required; existing expired/missing WS cases do not activate this new path. The removed shorter assertions were traced to equivalent remaining behavior checks and were not treated as lost regression coverage. No merge approval or issue closure.
+
+Final static review at `110ea92ea1f828c124196a18ef8d346959c2127b`: PASS. Real missing spill, corrupt spill and mismatched live-state cases traverse the same public route with exact envelope/body equality and zero upstream requests. Known mismatch refusal, legitimate unknown native continuation, explicit WS mismatch/recovery, combo and legacy behavior remain covered. No runtime test result is claimed until exact-head hosted CI is read.
+
+Hosted run35434598909 at110ea failed two existing message assertions: issue-702-expired-replay-state:687 expected an expired-specific regex, and plaintext-v2-agent-messages-server:541 expected the previous expired wording. Both received the intentionally unified generic local-replay response. Owner was told to update all exact old-message consumers while preserving status/code/send-count/retention checks; no deletion or vague assertion weakening. New hosted proof is required after the contract-aligned fixture update. No local runtime execution.
+
+Head4209818e998d716273fe44382278a0f5f002a739 independently passed interdiff review: old-message fixtures now use one literal expected public envelope, preserving original status/code/send/retention/WS behavior assertions. Static merge-tree against dev9824aa is clean (tree46fb12e52fcb08fc81ba0023075539e639c11f92). All GitHub review threads are resolved. Exact-head macOS1 remains pending, so no merge/closure yet.
+
+## Verified integration
+
+Head4209818 completed run35435034056 successfully. Only current-head control run35435033238 had been cancelled; no live duplicate existed, and its targeted rerun attempt2 passed. All review threads resolved and explicit technical/security review accepted. Static merge onto devbb2fa5ab was clean; native membership absent; maintainer preflight passed. PR5130 MERGED asacd43bf442c62b115cb2d1f24da9a3f6239d7826 at2026-09-19T10:06:09Z. Actual dev ancestry and issue5124 CLOSED were reread; HTTP/WS/combo and explicit full-replay acceptance mapped to the reviewed regressions.
diff --git a/devlog/_fin/260919_contract_resolution/026_pr_5134.md b/devlog/_fin/260919_contract_resolution/026_pr_5134.md
new file mode 100644
index 00000000000..07c32813ac4
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/026_pr_5134.md
@@ -0,0 +1,15 @@
+# PR 5134: data/management credential documentation
+
+Issue #5120. Head `44f8fa1fdc2e0b0a1047feac21acba6dd691fa77`, dev base `52c427a3d3ec41d813f28a6e394ca39584077a5c`.
+
+Nine files inspected: exactly the apiKeys table row in English and seven locale copies, plus the docs/release owner sentence. All eight edited rows state data-plane-only admission, preserve the existing non-loopback context and link to separate management credentials. Every linked locale management page exists at this exact tree. Main static review found no actionable defect; no runtime behavior changed. Local docs build/tests were NOT RUN. Initial hosted snapshot has lightweight/changes producers queued; docs build and aggregate must complete before integration.
+
+The dev base advanced through two separately owned integrations after #5125: coupon reset UI and same-target key retry. Source paths do not overlap this docs-only patch. No reference task's PR or monitor was modified by this campaign.
+
+Later exact-head snapshot: changes succeeded and normal runtime matrices/storage/gates/docker/keyring/packaging were event-inapplicable and skipped. Required docs site build, structure gate and producer/aggregate work remain queued. Those skips are not runtime pass evidence. The documentation correction remains merge-pending until requested checks finish.
+
+Run `35432368404` completed successfully: docs build, structure gate, both producers and aggregate ci passed at the exact head. Final merge preflight also verified current actor admin permission, current dev base/head, non-draft mergeability and no unresolved reviews. It nevertheless stopped: the separate PR-control workflow still has resolve-pr pending and has not produced enforce-target. No pending/missing gate was treated as passing; no merge or issue closure was attempted.
+
+## Landed and closed
+
+Separate enforce-target also passed. Final actor/base/head/review/thread/native-membership preflight passed; current head remained `44f8fa1...`, ordinary PR, dev base, no unresolved objections. Coordinator recorded maintainer integration at `https://github.com/lidge-jun/opencodex/pull/5134#issuecomment-5740638509` and squash-merged with the SHA precondition. Actual merged state and dev tip confirm `1b54f2940b038e5aba0665fed2a606e30773dd35` at 2026-09-19T09:01:26Z. Issue #5120 closure was performed only after that verification. No local runtime execution.
diff --git a/devlog/_fin/260919_contract_resolution/027_pr_5138.md b/devlog/_fin/260919_contract_resolution/027_pr_5138.md
new file mode 100644
index 00000000000..a5249cac074
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/027_pr_5138.md
@@ -0,0 +1,13 @@
+# PR 5138: core/Lab invariant binding
+
+Issue #5121; head `48f615f1e3eadd15bf26a6e2aec7d99604b6a2cb`; dev base `1b54f2940b038e5aba0665fed2a606e30773dd35`.
+
+Three-file static review: `structure/overview.md` adds unused stable ID INV-LAB-01 covering transitive protected-core isolation and synchronous activation; `structure/adapters/compatibility-lab.md` points to the same guard and invariant; `tests/lab/core-lab-boundary.test.ts` adds only the reverse identifier comment. Existing runtime guard/assertions and layout registration remain intact, and no maintained file cap was raised. Hosted structure binding and applicable runtime jobs are required because the test file changed. Local runtime/structure scripts were NOT RUN. No merge decision yet.
+
+Exact-head CI completed successfully, but final review-thread inspection found two valid unresolved documentation defects. The new wording claims all transitive runtime reachability is prohibited although firstLabPath skips deferred dynamic edges and the management API intentionally loads Lab handlers by namespace; wording must match eager/static closure plus direct dynamic-import checks. The new server activation contract also lacks src/server ownership in this document's manifest entry. Owner was asked to correct wording, update ownership and regenerate the index canonically, preserving runtime scope and guard behavior. No merge despite green CI until findings and new-head verification are resolved.
+
+Revised head `6986fc6b2391f9b07dc6587e094aea95377c6ca8` addresses both findings. The invariant distinguishes static/side-effect/re-export load-time closure, separate direct dynamic imports and sanctioned deferred namespace activation. The Lab manifest now explicitly owns `src/server/index.ts` (precise source path), and generated INDEX reflects that link. Main read the exact diff and corresponding guard; no runtime guard/assertion was weakened. New exact-head hosted checks and resolved review state remain prerequisites.
+
+## Verified integration
+
+All applicable head6986fc6 checks and aggregate passed in run35434996760; both review threads resolved; source/test/manifest/index final diff reviewed with no runtime guard change. Maintainer preflight and clean merge-tree onto devacd43bf passed. #5138 MERGED as5ce51cb554b333c9b369baf1b15b5d04047c85b4 at2026-09-19T10:07:45Z. Actual dev ancestry and #5121 CLOSED reread.
diff --git a/devlog/_fin/260919_contract_resolution/028_pr_5152.md b/devlog/_fin/260919_contract_resolution/028_pr_5152.md
new file mode 100644
index 00000000000..99b34104181
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/028_pr_5152.md
@@ -0,0 +1,31 @@
+# PR 5152: physical inference-send accounting
+
+Issue #5122; ordinary dev PR, head90b646c21c694b585dfed319af705075b8e578b4. Fourteen-file independent static review passed before publication. The adapter physical-send observer reaches initial and internal replay sends, shares existing permit/refund/pacing and identity accounting, and preserves prior retry response on denied replay. No new budget owner is introduced. Tests cover refusal, permits, retry safety and accounting wiring.
+
+Current exact-head hosted test3/4 failed. The coordinator is inspecting its assertion log; runtime macOS checks remain in flight. No local execution, merge approval or issue closure is claimed.
+
+Failure located in run35435976658/job105878594551: responses-send-budget-counts.test.ts:133 expected one GetChatMessage dispatch, observed zero (295pass/1skip/1fail). The owner received exact evidence and must trace admission/route/fixture activation before the fake executor, preserving the physical-send assertion. No assertion deletion or blind rerun is accepted.
+
+macOS2 job105878594526 confirmed the same zero-dispatch failure and a second exact-frame sideband timeout (20s limit,23.884s observed). Coordinator assigned a separate static lifecycle/oracle RCA. The newly landed server-auth reset fixture fix does not address this sideband case, and no timeout widening or flaky-test label substitutes for verification.
+
+Fixture correction head1d92134160c47625cf71804fa327986e7e115b5f adds explicit authMode:key, matching the test-owned API credential instead of inheriting the registry OAuth requirement. The observed13ms zero-send failure occurred before adapter entry. Both chatCalls1 and totalSends1 are retained in one equality assertion with bounded status/body diagnostics. Only the test fixture changed; fresh hosted proof and independent interdiff review pending.
+
+Independent interdiff review at1d921341 PASS: explicit key auth overrides the registry OAuth default correctly for the fake credential, and both exact count assertions remain. New-head hosted CI remains required.
+
+Hosted run35436798014/job105880777459 at1d921341 disproved the fixture activation assumption: same exact count assertion still sees zero sends, and the new diagnostic identifies HTTP401 authentication refusal. The explicit key-auth change was insufficient to reach the adapter. Owner is tracing the real isolated OAuth fixture path before the next update. Independent static approval did not prove runtime activation; the failure remains blocking.
+
+Second correction225e88536938c8eeea71df98119a9985f86fe2f1 uses the actual stored test credential in isolated OPENCODEX_HOME. Independent review traced registry OAuth resolution into the adapter, catalog identity and fake fetch interception; cleanup and exact count assertions remain. Static PASS, hosted activation proof still pending.
+
+Fresh execution evidence: run35437138983/test1 job105881685464 at225e885 explicitly reports the initial-send exact-count case PASS(43.21ms). This confirms the corrected stored-credential fixture reaches the intended send path. Full current-head/macOS/aggregate proof and the separate cumulative sideband blocker remain open.
+
+Final GitHub review surfaced a separate production accounting blocker: run-turn-execution observes the logical first send before physical budget admission, while the inner observer ignores ordinal1. A denied initial reservation can therefore increment physical-send accounting without invoking the executor. Coordinator confirmed ordering and requested admission-bound first-send observation plus a zero-additional-send exhausted-budget regression; independent value-chain review pending. Green fixture/CI does not dismiss this finding.
+
+Interdiff225e885..c4cdd005 source deferral is statically well placed: only adapters declaring physical-send reporting suppress eager first observation. However independent review FAILs test adequacy: new directadapter zero-callback test bypasses the original outer counting path and can pass with the old bug. Owner must exercise actual request/runTurn logging and exact refusal, not a blanket-catch zero-only assertion.
+
+Outer-test revision14cdcc765 reaches handleResponses but does not actually exhaust the two-target combo allowance: one admission remains for the first inner send. It also permits an absent attempt through optional fallback and does not assert exact refusal. Independent review requests explicit exhausted realbudget injection at the request boundary, a present zero-send attempt, exact429/code and zero executor calls. Production deferral remains accepted; test activation remains blocking.
+
+00666fea independent interdiffPASS: explicit exhausted realbudget flows through public handleroptions, knownDevinattempt exists and remains0, executor0,total0; old225e eagerly logs1 and wouldfail. Correct nonstream contract is HTTP200 carrying failedresponse and request_send_budget_exhausted, not an assumed HTTP429. Auth fixture cleanup preserved. Newhead hostedproof pending.
+
+## Verified external integration
+
+Another integrator merged reviewed00666fea as26d3a862d6ebfa406701c76a6fbe25570a58ac76 andclosed5122 before the coordinator stopmessage arrived. Coordinator re-read actualmerge/devancestry/issueclosure and exactheadCI35438374391 success; hostedlogs show initialcount and exhaustedfirstsend regressions passing. Retainedimplementation after verifying its separation from sidebandfailure; see020_integration.md for ownership/holddeviation. Initialphantomcount reviewthread resolved withfixevidence. Separateminor directadapter rejectionassertion strengthening remains as a test-onlyfollowup; HTTP429 suggestion was rejected because actualbufferednonstreamcontract isHTTP200 failedbody. No unresolved productionaccounting defect is claimed.
diff --git a/devlog/_fin/260919_contract_resolution/029_pr_5153.md b/devlog/_fin/260919_contract_resolution/029_pr_5153.md
new file mode 100644
index 00000000000..53486cd7635
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/029_pr_5153.md
@@ -0,0 +1,14 @@
+# PR 5153: SOCKS5 documentation alignment
+
+Issue #5119; ordinary dev PR, head4a576ba0ac619552dd8a0f136ef4a87eb2ef118d. Twelve files: four English pages, seven localized provider-configuration pages and existing structure owner. Independent review returned two blockers, both accepted after source verification.
+
+1. Server config.proxy is projected into ALL_PROXY, so configured and inherited server SOCKS5 routes both honor NO_PROXY. The wording incorrectly applies that condition only to inherited configuration. RequestInit.proxy is a different per-request override.
+2. Adjacent Mihomo IPv6 fake-IP guidance still says ALL_PROXY never counts. Effective routing admits SOCKS5 ALL_PROXY when the host is not exempt; only non-SOCKS ALL_PROXY is excluded. Correct the adjacent paragraph in English and every locale.
+
+DNS/peer pinning limitations, HTTP/SSE support, WebSocket fallback, config types and translated links were otherwise source-correct. Owner received corrections. No local build/tests ran, and no merge approval is claimed.
+
+Correction commit7bc014a5a5d39ca81978c0ec2b90772eb03c1a81 is under same-reviewer interdiff review against4a576ba0, covering all affected locales and adjacent fake-IP text. Fresh hosted documentation proof required; no merge yet.
+
+## Verified integration
+
+Final interdiff7bc014a5 passed independent review; source spans and all11 corrected pages checked. Remaining fixed review thread was answered with commit/run evidence and resolved. Exact-head35436860842 documentation build, structure and aggregate succeeded; applicable controls succeeded; runtime skips were event-inapplicable. Native membership empty, maintainer validation and clean merge-tree onto devf39ba5aa passed. PR5153 MERGED asf117c20d1244bf20d8cf5bd35de5bb7c71003799 at2026-09-19T10:20:23Z. Actual ancestry and #5119 CLOSED reread.
diff --git a/devlog/_fin/260919_contract_resolution/030_pr_5155.md b/devlog/_fin/260919_contract_resolution/030_pr_5155.md
new file mode 100644
index 00000000000..64591a8ec2f
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/030_pr_5155.md
@@ -0,0 +1,17 @@
+# PR 5155: contract authority registry
+
+Issue #5116; ordinary dev PR, head7d17f49746c289b46835e0e14495985a4d9b7741. Thirteen files: structure manifest/index/guidance and dependent documents, checker and its existing regression file. The proposal adds optional versioned contract authority separately from source-review fan-out, consolidates repeated paginated-history text and registers byte-accounting authorities.
+
+Independent review assigned to inspect complete acceptance, authority/anchor/dependent topology validation, generated-index parity, preservation of many-to-many review ownership, regression strength and removal of duplicate normative text. Hosted CI required. Coordinator has not run local generator or suites; owner's canonical-generation claim is distinct from hosted executable verification. No merge approved.
+
+Independent full13-file review PASS after requirement-based synthesis. Initial reverse-link completeness suggestion was retracted: #5116 explicitly validates declared topology/bindings, while ordinary hyperlinks are not automatically normative dependent membership. All current migrated normative consumers are declared and linked, and source-review fan-out stays separate. Automatically deriving obligations from informational links would expand the contract. No code change was made merely to satisfy that unsupported condition. Hosted current-head proof and final external review remain separate gates.
+
+Final GitHub review surfaced a valid malformed-generation issue: CLI--fix parses/casts unchecked JSON and invokes renderIndex before loadManifest. Malformed contracts.entries can throw a raw TypeError instead of an actionable schema diagnostic. Owner was asked to validate before render/write and cover invalid--fix with unchanged INDEX plus diagnostic/nonzero assertions. This is separate from the retracted reverse-link policy proposal. No merge while unresolved.
+
+Correction982ad809 production validation/write order accepted. Independent review still requires a subprocess regression through the actual--fix CLI; helper-only tests do not protect the entrypoint where the original defect occurred. Owner received exact malformed/valid scaffold assertions. No local execution.
+
+CLI regression36be9dbe passed independent static review: production script copied into isolated scaffold, actualprocess.execPath--fix invoked, malformed contracts produce nameddiagnostic/nonzero/noTypeError withunchangedindex, validcase regeneratesexactindex andexitszero. New-head hostedproof stillrequired.
+
+## Verified integration
+
+36be9dbe completed all applicable checks in35438419328; actualCLI regressions passed in job105885044981. Atomicwrite suggestion independently dispositioned as unchanged pre-existing optionalhardening; currentdeclaredtopology contract met. Allthreads resolved, maintainerpreflight/cleanmerge/no-native-stack checked. PR5155 MERGED as6d4272338701a15b0ed2adc3f422f5a7c33fef11 at2026-09-19T11:05:57Z; ancestry and issue5116 CLOSED reread. This tooling/docsintegration did not claim the separate sidebandruntime blocker resolved.
diff --git a/devlog/_fin/260919_contract_resolution/031_pr_5157.md b/devlog/_fin/260919_contract_resolution/031_pr_5157.md
new file mode 100644
index 00000000000..660153430b7
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/031_pr_5157.md
@@ -0,0 +1,19 @@
+# PR 5157: spend-ledger writer ownership
+
+Issue #5123 is closed after verified integration. [PR #5157](https://github.com/lidge-jun/opencodex/pull/5157) targets `dev`; its current head is `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3`. It merged into dev as `40670044146adc714f06d8b2e29f9114f8393df5`; the entries below preserve pre-integration checkpoints.
+
+The proposed control requires a single writer for each state directory. Implementation and regression changes have received independent static reviews, including storage, startup/shutdown, fixture lifetime, and current integration compatibility. Detailed security review and historical repair reasoning are retained in ignored task scratch pending a final published outcome.
+
+The preceding head `271139883a552f1aac9ce3f847eb94e3327e5efc` failed Linux shard 1 in [run 35446241123](https://github.com/lidge-jun/opencodex/actions/runs/35446241123/job/105905603621). The latest two-file fixture correction received independent static PASS. This does not establish runtime success; new-head hosted CI remains required. No assertion, production ownership gate, or file-size limit was relaxed in that correction.
+
+Local suites, individual tests, typecheck, builds, installation and runtime execution were NOT RUN. Static syntax screens performed during earlier review are not compiler or runtime proof. No issue closure or completion claim is made.
+
+A subsequent three-file fixture correction addresses platform-specific hosted failures. Independent delta review and current-head hosted CI are running; previous-head successes do not establish the new head. Public status remains open and unmerged.
+
+Acceptance mapping exposed a mode-activation gap in the process tests. The new test-only delta adds all four holder/contender combinations with actual contender policy configuration, and a transition from observation to enforcement. Independent review and new-head hosted CI are pending; no production behavior change or completion is claimed.
+
+Independent review of the mode-activation correction at `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed. The real-process matrix and configuration transition now exercise the stated modes; existing failure, restart, cleanup and privacy checks remain. Hosted CI at this head is still required.
+
+Verified integration at 2026-09-19T14:35:24Z: reviewed head `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed all applicable hosted checks and aggregate [35448104919](https://github.com/lidge-jun/opencodex/actions/runs/35448104919). Logs show actual four-mode process contention, observation-to-enforcement transition, independent directories, crash recovery and startup rollback. Independent technical/security and nine-file integration-union reviews passed; no unresolved public reviews or maintainer objections remained. Merge `40670044146adc714f06d8b2e29f9114f8393df5` was verified in origin/dev before #5123 closed at 2026-09-19T14:36:03Z. The resulting cumulative dev run remains separately monitored.
+
+Cumulative dev verification completed successfully at merge head `40670044146adc714f06d8b2e29f9114f8393df5` in [push run35449204833](https://github.com/lidge-jun/opencodex/actions/runs/35449204833). All applicable jobs and aggregate passed, confirming the integrated ownership change with the current runtime union.
diff --git a/devlog/_fin/260919_contract_resolution/032_ci_sideband.md b/devlog/_fin/260919_contract_resolution/032_ci_sideband.md
new file mode 100644
index 00000000000..70083a2883c
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/032_ci_sideband.md
@@ -0,0 +1,29 @@
+# Cumulative CI blocker: exact-ceiling sideband relay
+
+The current integration cohort exposed a repeatable hosted timeout in the exact50MiB sideband frame case. Initial campaign observation: #5152 run35435976658/macOS2 job105878594526, followed by devf39ba5aa run35436695398/macOS2 job105880533745. The latter reports one failure among13251passes, at the test's internal15s bound. Historical occurrence evidence is recorded in issue4997 comments5727773831 and5732577461; introductionPR1398 is separate history.
+
+The relevant sideband test/relay/handler blobs are unchanged by physical-send accounting. That source trace separates the work scopes but does not dismiss the failed integration gate. Runtime owner owns a narrow diagnostic/repair branch; no duplicate repair exists in the reference integration task.
+
+Keep the real50MiB bidirectional assertion, production limits and cancellation semantics. Use existing tests/helpers/phase-timing.ts to observe setup, ping, allocation/send, relay/upstream reception, echo and teardown. Always clear the inner timer and client in final cleanup. A diagnostic-only change is not proof the underlying timeout is fixed. Do not increase timeouts, skip platforms or delete assertions merely to get green.
+
+Primary reference: [Bun WebSocket documentation](https://bun.com/docs/runtime/http/websockets), retrieved HTTP200 through the requested browser research surface on2026-09-19. It distinguishes server-side send backpressure, dropped messages and bytes sent. Instrument send result and drain/close state rather than equating a successful call with peer delivery. This server API distinction does not by itself explain the client-WebSocket relay delay or establish the pinned runtime's exact failure mechanism; hosted stage evidence remains required. No local runtime/probe/suite was executed.
+
+Initial diagnostic96316e14 rejected beforepublication: phaseTimer had no probe/progressupdates and alwaysreported moving=no; ceilingphase conflatedallocation/send/relay/echo; earlyclose had noguard. Cleanup direction preserved, but comments claiming23s cause were unsupported. Owner is rebuilding with a focused helper and observable progress, preserving originalassertion/limits. Independent review confirms these findings; no diagnosticCI launched on inadequate evidence.
+
+Rebuilt2a3b3a9 adds a boundedpeerprobe/helper and preserves50MiB/time/headerassertions. Beforehosteddiagnostics, review requires send-return boundary, earlyclose detection through finalACK and precise event-progress limits. Whole-eventcount cannot prove absenceofpartialtransfer. Mockserver sends a short byte-countACK ratherthan50MiBoutboundecho; documentation mustnameactualmeasurement. No runtimefailurefix claimed.
+
+8d34fc77 passes independentdiagnosticreadinessreview: separateallocation/sendreturn/ACKwait, earlyclose untilfinalsuccess, milestone-onlyinterpretation, boundedprivacy-safeprobes and unchanged50MiB/15s/20s. Onehosteddiagnosticrun authorized. This approval is not rootcauseorperformancefixproof.
+
+DiagnosticPR5161 published at8d34fc77 andattached, ordinarydevbase, explicitlyRelates4997 withoutclaimingafix. Exactheadhostedtiming evidence nowpending.
+
+Firsthosteddiagnostic at8d34fc77/run35439343947 succeeded. macOS2: upgrade4.8ms,echo0.5ms,allocation49.7ms,synchronoussend20.3ms,ACKwait6039.4ms,total6220.25ms. One tickappearedat5927ms withoutnewmilestone beforecompletionprogress8. This localizesthatpassingrun toawait/relay/eventloopwindow, notallocation/send; itdoesnotexplainallpriorfailures orproveperformancefix. Finalreviewrequiresoutercleanupboundary include startServerstartupfailure soWebSocketoverride/mockcannotleak. Ownerreceivedcorrectionbeforemerge.
+
+Startup-boundarycorrectione34aab04 fixes startServerthrowleak. Finalcleanupreviewrequests independentupstreamstop eveniflivestopthrows and movingphasecreationinsideclientcleanupscope. The latterisboundedhygiene, notanobservedruntimecause. Preserveexistingtimings/assertions; consolidatebeforefreshhostedrun.
+
+Final1f0ab934 cleanupinterdiffPASS: clientphase/timerwithincleanupscope, proxyshutdownfailurestillattemptspeerstop, actualframe/headerassertions/privacy/limitsunchanged. FreshhostedCI authorized. Combinedwithindependentlygreen cumulative26d3runtime, landingtheseproveddiagnostics/cleanup willcompletecampaignintegration-recoverywork; broader4997performancecause remainsopenandisnotclaimedfixedornewunboundedoptimizationgoal.
+
+Current1f0run35441351500 wascancelledatmacOS1job20mdeadline, after17m44sofnooutputinunchangedcodex-inject-write-lock.test.ts. Noassertionfailureprinted; sidebanddiffonlytest/helperandnotthatpath. Allotherproducerssucceeded. Afterinspectingrun/job/log/sourceequality andconfirmingnolivererun, coordinatorrequestedoneboundedjob-onlyrerun105892583094 withdependentaggregate. Recurrentstallrequiresdedicateddiagnosis,norepeatedblindrerunsorbudgetwidening. Cancelledattemptisnotapass.
+
+## Delivered diagnostic and integration recovery
+
+PR5161 MERGED asd1745ee7e8d2189e496f0d8ccdf3580a434791f0 at2026-09-19T12:40:33Z, exactreviewedhead1f0ab934. Currentattempt2 run35441351500 applicableproducers+aggregateSUCCESS, resolvedreviewthreads, maintainerpreflight/cleanunion/no-native-stack verified; actualdevancestryreread. FinalheadmacOSlog shows50MiBcasePASS6810.83ms withphaseevidence (allocation20.6ms,send106.2ms,ACKwait6509.5ms). Broader4997 remainsopen; diagnostic/cleanupdelivery+priorcumulativegreen closescampaignrecoverytaskwithoutclaiminggeneralperformancecausefixed.
diff --git a/devlog/_fin/260919_contract_resolution/033_schema_report_review.md b/devlog/_fin/260919_contract_resolution/033_schema_report_review.md
new file mode 100644
index 00000000000..462d6c5b2c5
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/033_schema_report_review.md
@@ -0,0 +1,33 @@
+# Initial tool-schema loss report review
+
+Prepared commitdaae0ee29bf3246f95c7b49f5f5bda8aaf36f90f is the report-only first layer for #5112. It does not complete strict opt-in rejection or compatibility-repair reporting. Source/compiler/tests and documentation are reviewed separately.
+
+Documentation review covered all18changed docs. Endpoint profiles, privacy boundaries, nativeoutput separation and no broaderdialect claims were accepted. Two corrections requested beforepublication: link/names for existing debug enable/read workflow and diagnosticrecord, and include version/lossy fields in the otherwise-exhaustive reportshape description across8locales. Source review pending; no localexecution or hostedpass claimed.
+
+Core audit daae0ee2 FAIL: multi-type/unsupportedtype and omitted constraint keywords can change schemas while report remainslossyfalse; numericconst reachedthroughref canbe countedtwice; actualadapter integration matrix coversonlyone endpointmode. Coordinator verifiedcited sanitizerbranches and requested comprehensive bounded semanticloss accounting, exactlyonce refcounts and allthree adapterentry tests, preserving wirecompatibility/privacy/nativeoutput. Avoid unboundednewtraversal solelyforunknownkeywordreporting. No broaderdialect or completedstrictpolicy claim.
+
+Report-only PR5162 published atdbdbc573 afterrebasingcurrentdev; corecorrectionchanges sanitizer/report tests, andfinalendpoint/docs claims underre-review. Docsfe39eb2f passed8locale discovery/payloadshapereview. Sourcepartialstage doesnotclose5112. CI/publication is not acceptanceproof.
+
+Corecorrectiondbdbc573 re-review accepts previousmissingclassification/refdoublecount/realendpointmatrix fixes, boundedfixedkeywordprobes, unchangedwirebytes/nativeoutput. Remainingsemanticcategoryissue: a multi-type union collapsing toonesubtype narrowsacceptedvalues, so type-union-widened misdescribesit. Ownerasked torenamecollapsed/narrowed beforecontractestablished andkeepproseaccurate. No need changetransform.
+
+Final6ce0819958 scopedrename/docsinterdiffPASS. Categorytype/emission/testexpectation agree; transform/compiler/adapter/registries unchanged; eightlocaleguides retainobservation-onlyprivacy/nativeoutput boundaries. CurrentheadCI pending. Owner may prepare auditedstrictpolicy manualchild onthishead, preservingparentandperPRproof; initialreport acceptance doesnotclose5112.
+
+G1b roadmap revalidation after5155: all source-mapped docs remainreviewobligations, but oldplaninstructions toadd unchanged-boundaryprose everywhere are superseded. Ownerasked toeditactualcanonicalcontracts/affecteddependents and recordreviewed-unchanged evidence, preservingneededlocaleoperatorpolicy updates. Fullstrictconfig/initial/repairchain acceptance remainsunchanged.
+
+Current6ce0819 had onlycancelledcontrolgate executions andno liveone; coordinator targetedlatest35439892314 forcontrol-onlyrerun. No runtime rerunorcancel requested. Current5161 successfulcontrolruns distinguishitsoldcancelledduplicates.
+
+FinalGHreview raised newsemanticcases: anyOf canoverwrite siblingconstraintswithoutloss; referenceidentitycomparisonmislabels structurallyequivalentsiblings; inertdefault-valuedconstraints canbespuriouslylossy. Sentownerboundedcomparison/value-awarereportrequirementsandregressions; coreindependentvalidationpending. Strictchildmustinheritcorrectparentreport, withmanualcascadeandfreshproof. No diagnosticsorCIcoloroverrides theseacceptancegaps.
+
+Independent5ea56 review confirms late-differinglargeenum counterexample: boundedcomparison returnsunknown beforedifference; schema-nodebudgetdoesnotcoverenumvalues; reporthasno uncertaintyflag andstrictchildadmitssilently. Ownerreceivedbounded explicituncertaintyreport/aggregation andstrictrefusalrequirement, withminimalnormalizedtype/enum/required equivalences. No fullJSONSchemaequivalence solver orwirebehaviorchange requested.
+
+Parent76bbc600 introducesbounded uncertainComparisons count andaggregation pluscanonicalcomparisonchanges. Re-reviewassigned forcomparisonbudget/privacy/semanticaccuracy; strictchild mustexplicitlyrejectnonzero uncertainty beforedispatch. Currentpublicationdoesnotconstituteapproval.
+
+76bbc parent implementationreview accepts explicitboundeduncertaintyandcanonicalcomparison. Requiredfinishinggaps: late-differing(notidentical) oversizedenumregression andparentdebugconsumer emittinguncertainty-onlyreports. Child11581 addsstrictlossy-or-uncertaincheck/typedindeterminateerror andisunderre-review. Parentmuststandalone exposeitsdiagnostics beforechildlands.
+
+Parentenumreviewadjudication: target/overlayenumcomparisons mustconsiderdeclaredref+siblingintersection, notmerelyrawidentityorindependentfiltering. Exactnumericexcluded-by-overlayexampleislossless, whilenumericpresentinintersectionmustreportonceandwidenedoverlaystringsmustreport. Ownerasked boundedfocusedenumaccounting withuncertainty, preservingdefaultwirebehavior; nogeneralJSONschemaequivalencesolver.
+
+cf4c59 enumintersection re-reviewPASS: requiredlossless/restrictive/numeric-exactonce matrix, boundedunknowncount andunchangedwire transformationverified. Strictchild374dada descendant/coreblobsunchanged. ActualcurrentheadhostedCI remainsrequired.
+
+Four remaining parent review threads were answered with exact implementation evidence and resolved: anyOf sibling loss, structured/ref equality, enum intersection accounting, and docs-build proof. Hosted docs job105902238280/run35444918425 succeeded atcf4c59. No localbuild/install performed; current runtime/platform proof stillpending.
+
+Parent #5162 merged as `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1` at 2026-09-19T13:48:19Z. Head `cf4c59bd5f2002d9df9f9427843701451c36fb1e` passed all applicable hosted jobs and aggregate in [35444918425](https://github.com/lidge-jun/opencodex/actions/runs/35444918425), plus target enforcement35444917556. Current maintainer identity/base/head, empty native-stack membership, no unresolved threads or maintainer objections, and clean merge-tree were checked. Refreshed origin/dev contains the merge. #5112 remains open because strict-policy child #5167 has not landed. Parent branch retained; child owner requested to retarget/restack and obtain fresh exact-head proof.
diff --git a/devlog/_fin/260919_contract_resolution/034_strict_schema_policy.md b/devlog/_fin/260919_contract_resolution/034_strict_schema_policy.md
new file mode 100644
index 00000000000..a2561f82aee
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/034_strict_schema_policy.md
@@ -0,0 +1,49 @@
+# Opt-in strict schema policy review
+
+Preparedmanualchildc150640b376fe700be49f7fbff4fb69cec03d055 builds onreportparent6ce0819958. Implements persistedgoogleToolSchemaPolicy, CLI/config/editorfieldchain, initialcompilerrejection and changedrepairwithholding, pluspubliclocaleguidance.
+
+Threeindependentreviewsassigned: Googlecompiler/retry/testsemantics; config/CLI/managementpersistenceandregistries; all23public/structuredocs. Strictacceptance mustcoverzeroinitialsend, zerolossyrepairdispatch indexed/unindexed, original400preserved, directno-repair, omittedcompatiblebehavior andcontent-free diagnostics. No localexecution oracceptanceclaim. Parentandchild needseparateexactheadhostedproof; issue5112 staysopenuntilfulllanding.
+
+G1b c150640b config/CLI/editor/securityreviewPASS: closedoptionalunion, actualCLIrejectionwithoutconfigmutation, persistence/hydration/editorreadwrite, redactedcredentialfields preserved, registriesconsistent. Coreinitial/repair controlflowacceptedconditionallybutparentreportoraclefalsepositive/negativeblockersstillpreventapproval. Docs23filesPASS withsmallrepairrecordfieldlistcorrectionrequested. No localexecution.
+
+Child11581 strictuncertaintyinterdiff independentPASS: all3adaptercasesrejectloss-or-nonzerouncertainty beforephysicalsend; typederrorstayscontent-free; previousrepair/default/directbehavior preserved. Parentdebugconsumer visibilityandlate-difference regression remainparent-ownedfinishingwork; report-onlyparentmustnotdependonchildforcorrectdiagnostics.
+
+Finalparent551a7209/childbc68b2c9 sourcechainPASS andancestryverified. Coordinatorauthorizesordinarymanualchildpublication withitsownfullCI whileparentwaits (schedulingexceptiononly,no tip-onlyskip), andindependentnextlocalimplementation. Subsequentparentchange stillrequirescascadeandre-review.
+
+ChildPR5167 openedagainstreportparent5162 andattached. This ismanualbranchdependency, notnative-stackoptin. Currentparentchildexactheads/ancestryandperPRCI trackedseparately; no issue5112closeuntilbothfullacceptedchangeslandondev. Ownercontinuesnextauditedindependentstatic-policyphase.
+
+Parent45bc664d/childa361aa7a arebaseupdatesoverprevious551a/bc68: scopedGoogle/configtest blobs checkedbyte-identical, parentancestorverified. Diffconsistsonlyupstreamdoctor/subagentfallback/issue-translation changes. CurrentheadCIstillrequired; priorstaticreviewretainedonlyforunchangedscopedblobs.
+
+Hostedchilda361 run35443168272/job105898238238 failsoneVertexrepairtest: clientresponse retainsoriginalupstreamerrorcanary whiletestexpectsabsence. Newlossdiagnosticprivacy andexistingoriginal400normalization aredistinctcontracts; ownerandindependentreviewer tracingbeforechangingassertionorproduction. Other195casespassed; fullchildacceptance remainsopen.
+
+Independenthostedfailureadjudication: Vertexclientcanaryassertion misappliesnewdiagnosticprivacy toexistingnormalizedupstream400 surface. Withheldrepair usespreexistingclassification+sanitizeddetail; ordinaryprovidercanarytext isnotasecret. Ownerrequested exactoriginalformattedresponse assertion whilekeepingnewreportcanaryexclusion andstatus/send/refusalchecks. Productionnormalizerchangewouldcontradictexistingoriginal400retention.
+
+Secondchildhostedfailure: test2job105898238282 layoutseed resolvesgoogle-tool-schema-policy-config.test.ts toadapters/google ratherthanserver despiteexplicitinventory. Ownerrequested narrowcorrectseed/filenameconventionandbothinventories; membershiporaclepreserved. Batchwithcontract-correctclient400testfix beforefreshheadCI.
+
+Child745f6b6 test-onlycorrectionindependentPASS: originalVertex400literalexpected, newdiagnosticprivacyretained, renamedmanagement-configtestbody100%unchangedandseed/explicit/expectedagree. Parsedregistrydiffhasnoothermappingchanges. Latestchild60516397 requiresinterdiffconfirmation beforeusingearlierevidence.
+
+Latestchild60516397 onlyrestoresregistryformatting over745f6b6; parsedfullJSONsemanticsequalforbothlayoutfiles. Previousscopedtest/code reviewsremainvalid; currentheadCIrequired.
+
+Prepared post-parent cascade at `16ed5bee42eb53110983e2788f607c390bf43ac0` has clean merge-tree against current dev. Range-diff matches the first four strict-policy commits exactly; test rename/repair history is consolidated. Final inventory/union re-review was assigned before treating the cascade as equivalent. The previous head CI is not new-head proof; fresh hosted CI remains required.
+
+Independent cascade review PASS at `16ed5bee42eb53110983e2788f607c390bf43ac0`: base ancestry verified, first four stable patch IDs preserved, complete child patch equivalent excluding the two test-layout inventories, renamed test byte-identical, and inventories changed only the intended test name. Production strict-uncertainty behavior, docs and regression assertions remain intact. The new head is published and hosted CI is in progress.
+
+Current public review additionally requests consistent documentation of both strict refusal conditions (proven loss or indeterminate comparison), and exact repair-diagnostic shape. Source/documentation validation was assigned before accepting the requested edits. The request for local verification commands does not override the task restriction: applicable hosted suite, type and privacy proof must be recorded instead. The current PR remains unmerged.
+
+Independent documentation validation confirmed a bounded seventeen-file correction: all eight guide/configuration pairs must describe rejection on proven loss or indeterminate comparison; the eight guides must include the bounded uncertainty count in their report shape; the Google structure repair-shape list must include the same field already emitted by source. No runtime change was requested.
+
+Documentation correction `fc12e8f7b009cc31b6bebf7b6633c91de35d972b` is prepared; seventeen-file locale/shape interdiff review assigned. Earlier runtime reviews remain relevant only where source is unchanged; new-head hosted proof is still required.
+
+The seventeen-file uncertainty documentation correction passed independent review. New head `50af16087ca08751af7c1b1e49fd85337a1b99f2` additionally clarifies that compatibility repair replay remains enabled by default and adds exact original-400-body assertions in two existing regression cases. This narrow delta is under re-review; production source is unchanged.
+
+Final nine-file delta at `50af16087ca08751af7c1b1e49fd85337a1b99f2` passed independent review: each translated guide distinguishes strict repair withholding from unchanged default replay, and both additional response assertions retain the original 400 payload and one-send behavior while diagnostic canaries stay excluded. Production source is unchanged. No known static blocker remains; current-head hosted jobs are still running.
+
+Final integration-union review passed for candidate tree `07141dc1ab9e6dbe313208a1bf5a00f3e0979968` with dev `4067004414`: five shared structure/layout files preserve both ownership and strict-policy contracts; source/tests on each side remain intact. New public wording feedback identified one separate diagnostic-boundary clarification: strict initial compilation throws before initial loss-record emission, while strict repair has its own record. Main verified the source order and requested a precise eight-guide correction, without changing runtime behavior.
+
+The latest guide-only review accepted the strict initial diagnostic boundary but rejected a newly added statement that the policy error carries the full same facts as the report. The error and report have different bounded shapes. The owner was asked only to remove that added clause across eight translations, retaining all already-correct behavior descriptions and avoiding a runtime expansion.
+
+Commit `eb5d51b7c0` removes only the newly introduced overclaim about policy-error/report equivalence from all eight guides. Main inspected the bounded deletion; independent language consistency re-review is pending. No runtime or regression behavior changes in this delta.
+
+Independent review accepted final eight-guide clause removal at `eb5d51b7c022637ac086639a695864bcf1f7a136`. No other claim or behavior changed. Current-head hosted verification remains required before integration.
+
+Verified integration: #5167 merged as `96a6de86b71cf8a8f78959e0bf626dac642510a7` at2026-09-19T15:26:53Z. Exact headeb5d51b7 passed every applicable job and aggregate [35450471540](https://github.com/lidge-jun/opencodex/actions/runs/35450471540), including type/privacy checks. Logs explicitly show endpoint loss/uncertainty refusals, lossless/native-output acceptance, indexed/unindexed withholding, direct no-repair and CLI/management persistence. All known reviews resolved; current union retains ownership and decode hints. Both parent8a030721 and child merge ancestries were verified before #5112 was closed. No local execution.
diff --git a/devlog/_fin/260919_contract_resolution/035_static_policy_resolver.md b/devlog/_fin/260919_contract_resolution/035_static_policy_resolver.md
new file mode 100644
index 00000000000..5cf46eaf61f
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/035_static_policy_resolver.md
@@ -0,0 +1,135 @@
+# Resolved static model policy review
+
+Current checkpoint: #5114 is closed. Resolver #5171 and consumer #5174 are both on dev. Consumer head e5d54624503803972b787990d5d50de53bfef712 passed run35467320406 attempt2, including all15 prior failed cases. After shared-base repair #5220, #5174 merged asb9d430bb5b7f2ecbc0dda74879dbef2004d850d3 at2026-09-19T21:49:11Z. The actual merged tree29acad379a009307f73bbc6ae6fceaec0725de39 matches the reviewed candidate; both merge ancestries and issue closure at21:50:11Z were verified. Final cumulative campaign verification remains separate. No local execution or intermittent process-stall root-cause fix is claimed.
+
+The entries below are chronological evidence. Earlier failures and pending states do not override this checkpoint; scoped passes are not whole-feature completion.
+
+Prepared25019c8ae765b317aa732d90b6df94a8232d45f1 isfirstlayerfor5114: staticresolverandparityfixtures, notyetconsumer migration. Sevenfilesindependentreviewassigned. Verifyfieldprecedence/explicitfalse/hardpins/aliases/customunknownmetadata, pureimmutabledata, nofrozencredentials/health/quota andparityagainstexistingconsumers. Latermigrationmustretain captureauthorityandlatebinding. No localexecution; nofullissuecompletionclaim.
+
+25019 reviewrequires3paritycorrections beforeconsumer migration: explicitmodelCapabilities modalities precedence, admittedkey-auth override authority withoutfreezingcredentials, andmodelidentitynormalization/virtualalias/idempotence fixtures. Existingimmutable/detachedresult, lateobservedlimitsandhardpinparityaccepted. Ownerreceivedsourceanchorsandscopedalternatives; no newpolicy language.
+
+cbafc6 correctionreview accepts explicitcapabilities precedence, credential-freecaptured auth, realmodelalias/virtualnormalization andidempotence. One parityfixturegap remains: effectiveauthmanuallysupplied instead ofderivedfromexistingroutingauthority. Ownerrequested usablekey/unresolvedreference fixtures capturedthroughactualroutedProviderConfig beforepassingstaticresolver, preventingimplementation-mirrortest.
+
+9eecc2b finalauth-oracle testreviewPASS. Latest64b7196 rebasescurrentdev; resolverandfocusedtest blobs byte-identical toreviewedhead. P1aparentpublication authorized withperPRhostedCI; consumer migration stillrequired for5114closure.
+
+PR5171 publishedat64b7196c73039b8ed13d9ac07941d4c91a1aebf3 andattached. Resolver+parityfirstlayerreviewaccepted; actualconsumermigration remainsnextmanualchildand5114staysopen.
+
+Hosted64b test4run35445279670/job105903138954 failsglobalJSONsubstring90000absence. Sourcefixturealreadycontains registry-only:90000, soassertioncollideswithlegitimatepreservedstaticdata. Actualclampandmodelcapassertionspass. Ownerrequested exactbefore/afterwholepolicycomparison plusunchangedmodelcaps/registry-onlyentry, retainingexistingconsumeroracle; no productionchange orblindrerun.
+
+Parent fixture corrected at `2fdd21004eb256890ae9d7a54baab6c00653c65d`: whole-policy equality across repeated observed clamps, exact static caps, preserved registry-only entry and no observed projection field. Child #5174 at `7b25d449d9828019de8a9799f51539863d2eec68` now performs the consumer migration. Base is the parent branch; native-stack lookup returned empty. Independent reviews split provider/catalog authority from router/server transitions. Hosted CI is pending, so neither layer nor issue #5114 is declared complete.
+
+Independent provider/catalog subset review of `7b25d449d9828019de8a9799f51539863d2eec68` passed field precedence, explicit false, frozen gather capture, late observed limits, and virtual wire identity. The parent fixture correction also passed. Existing hosted suites remain necessary for consumers not directly exercised by the new focused file. Latest child CI failed Linux shards and the gates job; its owner has already begun diagnosis of four reported failure classes. Static subset PASS is not whole-PR approval, and no merge is permitted pending corrected source and exact-head hosted proof.
+
+Second independent review passed router/server source tracing at `7b25d449d9828019de8a9799f51539863d2eec68`: admission-before-capture ordering, inbound and virtual identity recapture, dynamic credential rebuilds, repeated body-size admission, and stream/terminal decisions. This complements the provider/catalog review but does not override the observed hosted failures. Owner was explicitly told to retain CI as a blocking gate and use concrete failures to identify review or test-coverage gaps. No local execution was performed.
+
+Final parent preflight at `2fdd21004eb256890ae9d7a54baab6c00653c65d`: applicable hosted CI and aggregate35446324533 passed, but thirteen public review threads remain unresolved. Merge is held. Findings concern legacy policy parity, limit projection and provenance/documentation; independent source adjudication is split between legacy compatibility and the other projection findings. Owner must reconcile any valid findings in the parent and cascade its child, with fresh exact-head evidence. A green run and earlier subset reviews do not override concrete unresolved findings.
+
+Independent source adjudication of thirteen parent threads accepted eleven and rejected two. Accepted work includes raw-input legacy parity, shared family-limit resolution, cross-field input bounds, selected-destination validation/provenance, captured-auth capability overlays, output-default fallback and two documentation scope corrections. Existing callers already repair three legacy cases, so these must not be misreported as observed runtime failures. The explicit captured-auth boundary and existing supported custom-header policy support rejecting two proposed changes. Owner received precise source evidence and minimum regression cases; no blanket header-name heuristic or weakened shared-policy objective was accepted. Corrections must be reviewed at the new parent head and cascaded to the child.
+
+Parent correction `b21937d152fba9b7eccb8d4c8ff454a0595fa5e6` is published. It addresses the accepted parity, limit and provenance findings with focused oracle cases and extracts pure merge helpers. Two independent re-reviews cover the same adjudicated split; rejected changes remain excluded. New-head CI and child cascade are required before integration.
+
+The repaired parent still has two concrete review blockers: the legacy reasoning-ladder repair must require a matched registry entry so intentional custom destinations are preserved; service-tier provenance must follow the captured-auth overlay and provider fallback, including unlisted models. Other accepted fixes passed their assigned reviews. Owner received minimal regressions and was asked to batch both corrections before cascading the consumer layer.
+
+Follow-up parent `df578b6719500344091fcf60a94c3879af72b908` adds the matched-entry legacy guard and corrects service-tier provenance fallback, with focused parity cases and documentation clarification. Independent re-review is limited to the two remaining findings; earlier accepted changes are unchanged. New-head hosted verification is running.
+
+Both narrow re-reviews at `df578b6719500344091fcf60a94c3879af72b908` passed. Custom unmatched destinations retain their explicit reasoning ladder/provenance; canonical legacy repair remains. Service-tier provenance now follows merged model defaults and captured-auth provider fallback, retaining operator false and covering an unlisted key-auth model. No known static parent blocker remains; current-head hosted proof and consumer cascade remain required.
+
+Consumer child `20ea64ff9475204443391ffa16980be2f914a579` incorporates the corrected parent but still fails the four observed consumer classes in hosted run35450781362: a narrowed route type omits staticPolicy, resolved URL refusal parity, virtual-model identity behavior, and clearing explicit modality back to inference. Range-diff shows the consumer production patch was unchanged; parent repairs cannot substitute for consumer-specific fixes. Completed job logs and exact anchors were delivered to its owner for a coherent repair while preserving existing assertions.
+
+Owner confirmed the earlier consumer repair had not actually been executed after its delegated attempt did not proceed. Coordinator requested verified worker acceptance and an actual immutable diff before any renewed repair claim; the parent-only cascade does not count as consumer correction. Existing implementation and regression scope remain unchanged.
+
+Independent execution-driven source diagnosis split the child failures into two consumer fixes (route type propagation and final wire-model identity selection) and two parent parity fixes exposed by consumption (absent base-URL error semantics and legacy colon-family map lookup). Exact capability lookup remains exact-only. Original test expectations were confirmed meaningful and must remain. Parent integration is held again until these cross-layer findings are corrected; prior isolated static PASS did not establish complete consumer equivalence.
+
+Prepared consumer correction `1a2ed3eb896d4ee54d7e8b0eefa3d104c28ec684` requires further review: it fixes the retry type and a missing-URL guard, but temporarily restores the old catalog modality authority and does not visibly change the reported final-wire identity selection. Coordinator explicitly retained the shared-authority objective and requested completing those contracts after the parent fallback fix, not treating a compatible bypass as the requested consolidation. Original transport identity assertions remain required.
+
+Independent consumer review confirmed the type correction, but the virtual-model identity repair was still absent at1a2ed. Owner was explicitly directed to resolve from the final routed model rather than namespaced logging identity, and to consume the shared modality result once the parent lookup parity is fixed. Parent correction6892fd25 adds absent-URL and colon-family cases and is under narrow re-review.
+
+Parent6892 narrow review found one cross-source provenance mismatch: a registry exact model key wins the merged value over an operator family key, while separate source lookups can incorrectly report operator provenance. Owner was asked to derive value and provenance from the same winning merged lookup and add a cross-source regression. Absent-URL behavior and exact-only capability precedence otherwise passed. Parent remains held until the source/value agreement is proved.
+
+Parent `844cea4e0f11b5fa78fb5b1352a6949f4ab19035` adds merged winning-key provenance; the consumer stack is published on it at `304648706a360a737cad4d6473b9d164869e4c45`. Narrow parent re-review and exact-head hosted checks are pending. Running checks are not recorded as passing execution evidence.
+
+Independent review accepted winning-key provenance at `844cea4e0f11b5fa78fb5b1352a6949f4ab19035`, including cross-source exact/family precedence and explicit false. Source and provenance now share the same key-selection order. Current parent/child hosted proof remains in progress.
+
+Refreshed consumer head3046487 reached later existing cases and exposed two further contract regressions: inbound protocol is lost during Responses replay for Chat/Anthropic, and an explicit provider-level service-tier false is not retained by the catalog. Completed hosted job logs were sent to the owner and an independent boundary review; existing expectations remain authoritative. Earlier fixes are not proof of complete migration.
+
+Independent review localized the remaining consumer regressions to final-route inbound recapture, preserving captured configured intent for Fast eligibility, and explicit-empty default-map semantics during gather enrichment. Owner received exact source boundaries and must retain the original assertions. Captured dynamic eligibility remains distinct from shared static merge authority; a generic static value must not override an explicit disabled result.
+
+Remaining parent public review points to a documentation precision fix: the observed-limit projection may fill an absent static cap; it remains unknown only when both inputs are absent. Main confirmed source behavior and requested a call-local wording correction that preserves the immutable static policy. No runtime change is needed for that comment.
+
+Parent844 hosted run35451826594 ended with one macOS timing assertion: an unchanged stalled-stdout case took256ms against its250ms bound; 13,652 cases passed and22 skipped in that shard. Its test and adapter files are byte-unchanged against current dev. This is a timing-jitter candidate, not a proven resolver defect or a pass. Owner was told not to widen/skip the assertion and to use the next already-required documentation head for fresh CI rather than repeatedly rerun the superseded head.
+
+Consumer correction124e34f778 is under narrow review for all initial/fallback route recaptures, captured Fast eligibility and explicit-empty default-map semantics. Parent documentation correction7896b715 was inspected and preserves source behavior while clarifying call-local observed-limit filling. New-head hosted evidence remains required.
+
+Independent review passed `124e34f778913f8adcc1ff1fde66f7d5379d9e7a`: all route-selection paths recapture inbound protocol before adapter consumption; captured Fast intent is authoritative for publication; an explicit empty reasoning-default map retains its established fallback. All three original regression files are unchanged. Current-head hosted proof is still required.
+
+Child67bc1488 is a descendant of corrected parent7896b715; its source/tests match the independently reviewed consumer fix. A small catalog-document merge artifact retains parent-only migration wording and a duplicate fragment. Owner was asked to make that paragraph describe the final migrated contract without changing implementation. New-head CI and final public review remain required.
+
+Child documentation cleanupf5df7cb049 removes only the obsolete parent-only migration sentence and duplicate fragment. Main verified the final catalog contract remains consistent with the migrated implementation and frozen gather behavior. Current-head hosted verification remains required.
+
+Resolver parent #5171 merged as `efb55e71e547ac83563e1d45dd60fb0b646e6cf7` at2026-09-19T16:10:55Z. Head7896b715 passed every applicable hosted check and aggregate [35453258484](https://github.com/lidge-jun/opencodex/actions/runs/35453258484); macOS logs show36 parity cases executing. Independent reviews and public threads are complete. Current merge preserves reviewed core/test blobs and current integration documentation/layout. Actual dev ancestry verified. #5114 remains OPEN until child#5174 is restacked, verified and integrated; parent branch retained.
+
+Post-parent cascade `20ac21d4a650399870c397de8c8fad608f43488c` passed independent union review: reviewed consumer changes and decoded-identity helper remain, and current schema/ownership/policy documentation and layout inventories coexist. No cap change or semantic cascade regression was found. Current-head hosted checks remain running.
+
+Current post-parent child20ac reached an unchanged source-oracle assertion expecting the former terminal-repair helper call. The implementation intentionally consumes captured static policy instead. Owner received the exact assertion anchor to update while retaining all platform/relay invariant checks; no runtime fallback or removed assertion was requested.
+
+Independent oracle-fix review passed head6878d8b24: the source assertion now names captured terminal policy while preserving every platform, bounded relay, native WebSocket and failure invariant. Hosted CI at that head remains required.
+
+Child6878d8b24 reached green applicable hosted CI. Final public review requested two bounded end-to-end precedence cases: API-key provider lower/higher configured limits through capture into catalog, and a family-specific context limit competing with a provider-wide default. These correspond to the issue's explicit consumer-parity acceptance. Owner was asked for focused coverage only; an independent lookup checks for existing equivalent tests before duplication. No current source defect was asserted by these comments. Merge remains held until disposition and fresh head evidence.
+
+Independent existing-test lookup confirmed the two requested coverage cases are not duplicates: lower/higher limits are tested separately in routing and augmentation, but not through capture-to-catalog; existing family-context tests omit the competing provider-wide fallback. Owner was asked for only the minimal three cases, retaining existing tests and file-size constraints.
+
+Coverage commit `3b731ac5d95eec4b4f430abf80c571924a1d09c3` adds the minimal capture-to-catalog lower/higher limit and family-versus-provider context cases. Independent test review checks activation and fixed expected values; production source is unchanged in this delta. Fresh exact-head hosted verification is required.
+
+Review of3b731ac5 found the API capture test incomplete: it covers only configured-lower context/output values, while the requested positive-cap contract applies to context and max input and also requires an above-registry case. Owner received the exact two-row correction; the Anthropic family-versus-provider/observed test passed review. No production change is requested.
+
+Corrected coverage head `bc9e61aed886252a4bbb33cef340ae8dc91ac557` is published with the requested lower/higher context and max-input cases. Independent review is scoped to that test correction; the previously accepted family-context case is retained. New-head hosted proof remains required.
+
+Independent test re-review passed bc9e61aed8: configured lower and higher context/max-input values are checked against fixed expected caps in both captured maps and emitted catalog rows; the family-precedence conflict remains covered. Current-head hosted verification and final public-thread disposition remain the only known gates for this test delta.
+
+Final source integration review passed at bc9e61aed886252a4bbb33cef340ae8dc91ac557 against dev efb55e71e547ac83563e1d45dd60fb0b646e6cf7. The conflict-free merge tree139eebbab0cefb4a9113a16a26e6cd4bc6eeb34e equals the reviewed head tree. Production consumers are unchanged from6878d8b24a; later edits add only the accepted precedence cases. Parent policy, schema and ownership contracts and registry identity hints remain present. No public review thread is unresolved. Hosted run35456151926 still has macOS shard1 running; no merge or issue closure is claimed.
+
+Hosted execution evidence for the four consumer regressions was read directly from run35456151926 Linux shard4 job105931863842: frozen capture with late credential replacement, virtual wire identity replacement, lower/higher API context/input caps, and family context precedence all passed. The macOS shard1 handle105931863680 was independently confirmed in progress in its Test step. No completed-job failure was observed and no rerun or cancellation was started.
+
+Run35456151926 attempt1 ended with macOS shard1 cancellation and aggregate failure. GitHub annotation confirms the20-minute job limit; the last file group was tests/clients/client-connect.test.ts, with no subsequent result. Head bc9e61 is unchanged. One targeted diagnostic rerun of job105931863680 was accepted as attempt2 and read back queued. This measures recurrence; it is not a fix or environmental attribution. Source investigation is active, with no timeout increase, skipped case or local execution. Merge remains held.
+
+Source diagnosis narrowed the missing observation to file startup, not a proven environmental cause: top-level imports, synchronous warm-up scanning and child startup remain distinct hypotheses. Earlier green-head blob identity is not causal proof. If the diagnostic run repeats without phase evidence, add bounded phase markers before changing harness behavior. Attempt2 job105935450017 was read back in progress on the same head.
+
+Renewed integration review against dev0c45969a846e38bbd89f892af5118712da4f65d8 passed: candidate merged tree d1d963b493c80d0e0806dd54225c338908396946 retains the consumer head production blobs and all seven intervening integration changes. Only structure documentation intersects textually. One repeated sentence is a nonblocking documentation artifact. The macOS startup diagnosis and required execution evidence remain separate unresolved gates.
+
+Diagnostic attempt2 also reached the20-minute job limit (job105935450017). Its checkout remained merge8ab14dcead799d5e8df1823468d825d2b594f40b of the same head and dev efb55e71; no changed-base explanation applies. The first-attempt client-connect file passed this time. The second stall followed two successful cases in codex-inject-integration.test.ts. Observation is therefore two timeouts at different points, not proof of one file's defect or an environmental cause. No third unchanged rerun was started; source diagnosis is comparing the actual boundaries.
+
+A scoped diagnostic patch was prepared and statically checked for the second observed startup stall. It adds fixed phase markers around file import, fixture preparation and the existing child call, with bounded status/signal/error-class scalars only. Assertions, child invocation, timeout and cleanup remain unchanged. The implementation owner will apply it after its current writer is quiescent; it has not yet been executed.
+
+Diagnostic head b381f677885a63776052f47c6f38498cacf932f1 passed independent rebase review on dev dbaad90ab1e0812d08fd1106454d37eafd51d0d8. All eight previously reviewed commits are patch-equivalent; the35 diagnostic lines match the reviewed artifact. No assertions, deadlines, subprocess options or cleanup changed. Candidate tree312bca13d2547b292d6699bfb842b7b652b94b99 equals the head tree. Hosted proof remains pending.
+
+The diagnostic b381f677 macOS shard1 job105939834395 completed in552 seconds without a startup hang. Fixed markers show the observed unreadable-preimages child returned in604ms with status0. The run instead exposed three Reserve catalog lifecycle assertions requiring cacheSynced=true despite committed output reporting cacheSynced=false. Source diagnosis is checking the new byte-identical cache-write behavior against actual retained-content assertions. Neither a timeout root-cause fix nor full CI success is claimed.
+
+Independent source diagnosis tied the Reserve fixture failure to the newer byte-identical cache-write contract from #5108: cacheSynced records an actual write, while the fixture incorrectly requires it on every committed refresh. The external integration owner was asked to preserve production semantics and all Reserve assertions while independently checking committed catalog and cache content, including valid no-op refreshes. A bare removal of the boolean assertion would not distinguish a swallowed write failure and is not accepted.
+
+Repaired-base head f38ce45b659f5298751cc8938213994341f29c3b is published on c81d43053b. Range comparison preserves all nine reviewed consumer/diagnostic commits exactly. Its new hosted matrix is active; no passing completion is claimed.
+
+Incremental source-union review passed f38ce45b65 against dev4853f90d9ac87f49d95a7370f9bdf7eca014af3f, prospective treedb071d051321fff15eb0193d138d0953675bb493. Captured adapter/replay policy coexists with generation-scoped account denial and readiness changes; entitlements and quota remain late decisions. All five intersections and inventory registrations are preserved, with no cap increase or required new regression identified. Hosted completion remains required before merge.
+
+Job-level state clarified the remaining check-rollup ambiguity: macOS shard2 job105950838594 and npm-global macOS job105950838649 are queued, with no active step, rather than executing or failed. Their handles remain valid. Required completion evidence is still absent; no replacement run or relaxed gate was introduced.
+
+Final98b9b344 source review narrowed both conflicts to imports: keep destination-specific registry lookup with the resolver migration, and keep final-wire policy capture with compaction-routing imports. No new manual route literal or semantic blocker was found. The resolved head must execute the existing compaction override, policy consumer and provider replay/opt-in coverage; no new test requirement is inferred without a defect.
+
+Resolved policy head3a5ce7d7930078bcb3c22080be4ea56b011aa8b7 is published on final peer dev98b9b344e1. Main range review confirms the nine accepted patches survive with only the required destination/compaction import contexts and the new compaction shadow-routing guard retained. Final-wire policy capture occurs immediately after the wire-model assignment and before Fast decisions. GitHub reports mergeable; exact-head hosted verification is still required.
+
+Pre-merge review at3a5ce7d793: native membership absent, maintainer-integration helper passed, current devfec3add6ce union tree205abdda4675a61eb385de0e4b22884c8d298e91 is clean. Only structure/config.md and both layout inventories intersect; additive metrics entries preserve policy content and parse without duplicate keys. One public documentation finding remains, so integration is held for that correction.
+
+Documentation correction e5d54624503803972b787990d5d50de53bfef712 removes exactly the duplicated sentence and preserves its authoritative statement. Main inspected the one-line-only diff against green3a5ce7d793. New-head run35467320406 is active; no earlier success is relabeled as final-head proof.
+
+Additional execution receipt: green head3a5ce7d793 run35466012694 placed the previously observed startup files in macOS shard2 job105958396043. Main read its actual log: file-import and fixture-entry markers appear, and the unreadable-preimages child returns status0 after650ms under the unchanged40000ms deadline; the case passes in652.29ms. This restores execution evidence for that sample without identifying the intermittent stall root cause.
+
+New execution failure: e5d job105961973500 checked out merge022d34a12c8dd7ddacb3820a031cb2ef9b646530. Two native-label cases fail at codex-catalog.test.ts3156 after about8seconds each; subsequent account-selector fixture cases fail at line270 on the same missing-model symptom. Later production-path lock, crash-adoption and parent-stop cases report subprocess timeouts. GitHub records both assertions and the20minute job cancellation. All other requested jobs passed. Full logs and annotations were preserved in ignored scratch and assigned to the implementation owner for source-grounded diagnosis. No environmental or causal fix claim is made.
+
+Diagnosis synthesis: the first missing-model assertions occur in executable fixture/runtime preparation before migrated catalog writer/projection calls. The repeated approximately8second waits match the version-probe bound, and independent spawnSync timeouts appear later in the same job. This supports an early child-process stall hypothesis; unchanged source blobs and elapsed time do not prove environmental origin or exclude cross-test global state. One targeted retry of macOS1job105961973500 in exact-head run35467320406 was requested after all jobs became terminal, with its dependent aggregate. The run was read back queued; this is a recurrence measurement, not passing evidence. All assertions and deadlines remain. Recurrence requires precise process/probe and contamination diagnosis, not automatic cache-seam substitution or a blind repeat.
+
+Targeted retry completed: run35467320406 attempt2 at e5d5462450 succeeded with all requested latest jobs and aggregate. Actual macOS1log105966566531 contains passing results for all15 exact names that failed in attempt1 and no failed cases. This restores current-head execution evidence; intermittent process-stall cause remains unproven. Integration is now waiting for a separately assigned shared-dev file-size repair and review of the latest intervening source union.
+
+Independent prospective union review passed e5d5462450 with devbd55ab7a3ab5080d6d2b1f4272adde19d339f946, tree9cc91c20e2be8d7cd8b6b7838d60676d43e16a12. Parsed-body fallback reuse, captured static policy, final-wire recapture, late credential refresh/rotation, image cancellation signals, both inventories and intervening auth/dependency changes survive. No blanket rebase is required by this source evidence. Shared-base repair and cumulative hosted proof remain separate gates.
+
+Integration receipt: native membership absent; four public review threads resolved; exact-head CI and current maintainer/dev-base preflight accepted. The final repair changes and both inventories survived in the actual merged tree. The bounded macOS diagnostic task is complete as diagnosis and restored required execution evidence; its outcome explicitly leaves the intermittent root cause unproven.
+
+Post-integration cumulative receipt: devb9d430bb5b7f2ecbc0dda74879dbef2004d850d3 push run35471545835 attempt1 completed successfully with all applicable requested jobs and aggregate. This verifies the landed fifteen-issue state at that tip; later preview/server and dashboard integrations still require their own cumulative proof.
diff --git a/devlog/_fin/260919_contract_resolution/036_send_assertion_followup.md b/devlog/_fin/260919_contract_resolution/036_send_assertion_followup.md
new file mode 100644
index 00000000000..38119159d28
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/036_send_assertion_followup.md
@@ -0,0 +1,11 @@
+# PR 5170: exact send-budget refusal assertions
+
+PR #5170 is a test-only follow-up to merged #5152, at head `825d4ed9c72233bc862668fec6010862bcddadea`, targeting dev. It captures the actual adapter rejection and requires `SendBudgetExhaustedError`, while preserving zero executor calls and zero spent permits. The outer request case now asserts its existing HTTP 200 buffered-failure contract explicitly, alongside the refusal code and zero send counts.
+
+Both changed files were inspected and independent review was assigned. No production behavior changes, assertions removed, or limits raised. Local tests, typecheck, build and runtime execution were NOT RUN. Exact-head hosted CI remains required; the campaign follow-up task stays open until verified landing.
+
+Independent two-file review PASS at825d4ed9: actualtypedrefusal, presentouterattempt, explicitHTTP200 failedbody andzerocount/executors areallpreserved. No productionchange or weakenedassertion. Exactheadhostedproofstillrequired.
+
+Controlcheckinspection: samehead825d4ed9 has successfulenforce-target35443894094 andcancelledduplicate35443954318. No rerunnecessaryforthisduplicate; currentruntime/macOS proofstillpending.
+
+Merged as `49c79f366c571bad47a59faca230164b9da40d88` at 2026-09-19T13:38:58Z. Exact-head hosted run [35443894116](https://github.com/lidge-jun/opencodex/actions/runs/35443894116) passed all applicable jobs and aggregate; target enforcement passed in 35443894094. Current actor, dev base, empty native-stack membership, absence of open review threads, and clean merge tree were checked before integration. The merge is an ancestor of refreshed origin/dev. The remaining review thread on merged #5152 was resolved, and the campaign follow-up task is complete. Original issue count remains 10/16; #5122 was already closed.
diff --git a/devlog/_fin/260919_contract_resolution/037_acceptance_ledger.md b/devlog/_fin/260919_contract_resolution/037_acceptance_ledger.md
new file mode 100644
index 00000000000..f8e15a63702
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/037_acceptance_ledger.md
@@ -0,0 +1,50 @@
+# Sixteen-issue acceptance ledger
+
+This checkpoint does not declare the campaign complete. Current disposition: sixteen implementation issues closed; regression and release follow-up remains open. The initial 2026-09-19 checkpoint confirmed ten closed issues and six open issues; the later verified #5123 closure is recorded below. The initial ten-issue checkpoint checked its recorded merges against `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. The three later merges for #5123, #5115 and #5112 were separately verified after landing; the prior thirteen-issue checkpoint checked those merges against `96a6de86b71cf8a8f78959e0bf626dac642510a7`. The historical 00:50 refresh verified all fifteen then-closed issue merges and acceptance follow-up #5225 as ancestors of `97aaf8c736d0d8271a095c3bbff19a58f484c0f6`, and re-read all sixteen issue states at 2026-09-20T00:50Z. Acceptance/review and exact-head hosted receipts are in the linked per-PR records; this checkpoint does not re-run or replace those checks.
+
+| Issue | Current disposition | Evidence / remaining requirement |
+| --- | --- | --- |
+| #5109 | Closed; original fix plus acceptance follow-up landed | #5125 remains on dev; #5225 adds actual HEAD coverage at3f9fe3fa29. Run35477114410 and case log105988178081 passed; reclosed2026-09-20T00:04:02Z. [Follow-up](041_transport_acceptance_followup.md). |
+| #5110 | Closed; original fix plus acceptance follow-up landed | #5127 remains on dev; #5225 adds actual informational/timeout coverage at3f9fe3fa29. Run35477114410 and case log105988178063 passed; reclosed2026-09-20T00:04:04Z. [Follow-up](041_transport_acceptance_followup.md). |
+| #5111 | Closed; landed through #5126 | [`af4f744c75`](022_pr_5126.md); closure at 2026-09-19T10:01:05Z. |
+| #5112 | Closed; parent #5162 and child #5167 landed | [`96a6de86b7`](034_strict_schema_policy.md); current closure verified after both ancestries. |
+| #5113 | Closed; landed through #5129 | [`bb2fa5ab25`](024_pr_5129.md); closure at 2026-09-19T10:04:15Z. |
+| #5114 | Closed; parent #5171 and consumer #5174 landed | Mergeb9d430bb5b, reviewed tree29acad, exact-head run35467320406 attempt2; both ancestries and closure at2026-09-19T21:50:11Z verified. [Record](035_static_policy_resolver.md). |
+| #5115 | Closed; landed through #5177 | [`838af40f1b`](039_decode_hint_review.md); closure at 2026-09-19T15:01:16Z. |
+| #5116 | Closed; landed through #5155 | [`6d42723387`](030_pr_5155.md); closure at 2026-09-19T11:07:05Z. |
+| #5117 | Closed; landed through #5183 | Merge fec3add6ceff1dcc0ab31b232d65efc12db451db; exact-head CI35464220426 passed; dev ancestry and closure at2026-09-19T20:20:59Z verified. [Record](038_metrics_review.md). |
+| #5118 | Closed after implementation landing | Server #5185 merged as `e64d6994eb` after exact-head35478692205 attempt2 success and reviewed/tested tree equality. Dashboard #5197 landed ased44e04a93 and #5118 closed2026-09-20T03:00Z. Six new hosted regressions and v3 surface/request evidence passed their scope. Owner-directed merge timing exception leaves complete platform regression to the release gate. [Record](040_preview_review.md). |
+| #5119 | Closed; landed through #5153 | [`f117c20d12`](029_pr_5153.md); closure at 2026-09-19T10:21:08Z. |
+| #5120 | Closed; landed through #5134 | [`1b54f2940b`](026_pr_5134.md); closure at 2026-09-19T09:02:10Z. |
+| #5121 | Closed; landed through #5138 | [`5ce51cb554`](027_pr_5138.md); closure at 2026-09-19T10:08:29Z. |
+| #5122 | Closed; landed through #5152 | [`26d3a862d6`](028_pr_5152.md); closure at 2026-09-19T11:06:36Z. |
+| #5123 | Closed; landed through #5157 | [`4067004414`](031_pr_5157.md); closure at 2026-09-19T14:36:03Z. |
+| #5124 | Closed; landed through #5130 | [`acd43bf442`](025_pr_5130.md); closure at 2026-09-19T10:06:43Z. |
+
+Supplementary requirements: sideband diagnostic/cleanup #5161 and send-assertion follow-up #5170 landed and their goalplan tasks are complete. The broader sideband root-cause issue is not claimed resolved. The initial public devlog checkpoint is merged; later evidence publication, final cumulative dev verification, all remaining acceptance checks, final PABCD closure and heartbeat shutdown remain outstanding. No local test, typecheck, build, installation or proxy execution has been performed.
+
+Publication review checkpoint: independent re-review accepted the corrected English owner/status summary, neutral pre-integration ownership record, and this ledger. The complete historical working records were preserved in ignored scratch; no implementation evidence was discarded. This is documentation readiness for the reviewed files, not permission to declare or publish the campaign as complete.
+
+Public checkpoint #5175 landed as `57b1df792ef7e66e17b0110727eefdd5387e164d` at 2026-09-19T14:13:30Z after reviewed head `128a47ea9db9b93ffc80fc2d42a2f4cddcc8f8c0` passed all applicable hosted checks and public review. Runtime checks were change-inapplicable, not executed. The original coordinator checkout staging was retained. Future implementation outcomes still require ledger updates and independent completion proof.
+
+At the #5123 checkpoint, the total was eleven closed and five open; this earlier checkpoint remains historical evidence.
+
+Second public checkpoint #5187 landed as `00ac9b6a6c0707b8e315b88f334c396162909b17` at2026-09-19T15:45:45Z after applicable hosted CI and all publication findings were resolved. It records thirteen completed issues and three open issues; later working updates remain pending publication.
+
+Third public checkpoint [#5192](https://github.com/lidge-jun/opencodex/pull/5192) was opened at110bb438ff6351e3231d1421254fe2ef66f8c9cb after independent publication review. Applicable hosted controls passed at the first check; public review remains pending. This PR does not resolve another original issue.
+
+Third public checkpoint #5192 merged as920d8d7b2d66e81353a0c10084793d916ec55ffa at2026-09-19T17:32:08Z. Reviewed head110bb438ff passed applicable hosted controls35458046177 and public review; native membership was absent. The six-file documentation union preserved the intervening runtime integrations. Actual dev ancestry was verified. Original issue progress remains thirteen closed and three open.
+
+Fourteenth closure: #5117 accepted and closed after #5183 integration. Original issues #5114 and #5118 remain open. This is not final campaign completion.
+
+Fifteenth closure: #5114 is resolved and closed after both resolver and consumer landed. Only #5118 remains open. The latest actual integration tree matches reviewed29acad, with shared-base repair936e3524 retained. Final dashboard/server delivery, cumulative verification, publication and heartbeat shutdown are still required.
+
+Final audit supersedes the earlier closure count: #5109 and #5110 are reopened for original explicit verification coverage. The source implementation was not disproved, but indirect evidence cannot satisfy those rows. A separate focused regression follow-up is assigned; current closed count is13 and the goal remains active.
+
+The two transport verification gaps are now closed: #5225 merged as3f9fe3fa29 with reviewed/tested tree088e56b6, direct passing scenario logs and verified dev ancestry. Both reopened issues were explicitly reclosed and reread. Current closed count is15; #5118 is the only open original issue.
+
+A bounded retention audit at dev e64d6994eb inspected the eight source/test intersections introduced since the earlier closed-issue audit. Existing metrics collection, static policy dispatch and send-budget wiring remain intact; the transport test changes are the accepted #5225 follow-up. All13 newly introduced completed-campaign domain tests remain registered with their exact basename/domain pairs in both layout inventories. This adds source-retention evidence; it does not replace original per-issue execution or the pending final cumulative CI.
+
+Final implementation closure: all 16 original issues are closed. This is not full regression or release completion. See [the implementation handoff](043_implementation_handoff.md) for the explicit integration timing exception and follow-up obligations.
+
+Final state readback at 2026-09-20T03:09:27.735783+00:00: all sixteen issues are CLOSED and every recorded implementation merge is an ancestor of dev 12cb129d424d1a67319c1e7a761ba5474fdc48a4. Source278513a79e run35483995896 subsequently completed SUCCESS for every event-applicable job. Full release regression/promotion/publication remains open.
diff --git a/devlog/_fin/260919_contract_resolution/038_metrics_review.md b/devlog/_fin/260919_contract_resolution/038_metrics_review.md
new file mode 100644
index 00000000000..d1a738c64bf
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/038_metrics_review.md
@@ -0,0 +1,101 @@
+# Metrics export acceptance review
+
+Current checkpoint: #5117 is closed. PR #5183 head4d9bcead8728a467c960910e38a7258357f7563b passed all applicable exact-head hosted jobs in run35464220426, including Linux and macOS suites. Technical, security and public reviews passed. It merged into dev as fec3add6ceff1dcc0ab31b232d65efc12db451db at2026-09-19T20:20:36Z; ancestry and issue closure at20:20:59Z were verified. Cumulative dev CI remains a separate campaign requirement. No local execution was performed.
+
+The entries below are chronological evidence. Earlier failures and pending states do not override this checkpoint; scoped passes are not whole-feature completion.
+
+Issue #5117 remains open. Prepared implementation `7578198be2289966fa637e36c996faf9368c1cec` adds an opt-in bounded exporter, configuration, management routing, documentation and focused tests. Runtime aggregation and configuration/privacy/documentation reviews were assigned independently. No local execution was performed.
+
+Runtime review found two required corrections. Buffered HTTP 200 responses with a failed or incomplete terminal body lose terminal status at the non-stream finalizer and can be classified as completed; parsed terminal metadata must reach the metrics recorder without overriding cancellation or read errors. The new focused cases call recorder/logging helpers or inspect source strings, so they do not prove real HTTP or WebSocket finalization. Add transport-level flows and authenticated scrape assertions for exact logical/physical counts, terminal outcomes and missing timing/cancellation cases.
+
+Static review accepted bounded labels, the WebSocket duplicate-finalization guard, attempt send-count inputs, terminal-stream EOF handling, disabled-mode inactivity and fresh-owner reset semantics. These accepted parts do not offset the missing acceptance evidence. The implementation owner received the source anchors and must return a corrected immutable head for review and hosted CI.
+
+The separate config/auth/privacy/docs review passed at the prepared head. It covered default-off strict validation and malformed-load behavior, restart activation, shared transport injection, management authentication before disabled404, fixed labels/finite values, English and seven translated documentation sets, and lifecycle/units documentation. Runtime aggregation and transport-level proof gaps above remain blocking; the scoped PASS is not full implementation acceptance.
+
+Correction `fbbe437614` passed independent runtime re-review: bounded terminal metadata is propagated only at clean EOF; cancellation and read-error precedence remain. New real-server HTTP and WebSocket scrape regressions cover exact logical/send counts, failed/incomplete buffered responses, retry/recovery, EOF/cancellation, missing versus zero TTFT and disabled behavior. Combined with the earlier config/auth/privacy/docs review, no known static blocker remains. Hosted verification and integration with the current writer-ownership layer still need proof.
+
+Published as [PR #5183](https://github.com/lidge-jun/opencodex/pull/5183), dev base, head `298ec5f1ce45fdd412eee3d14b6665a199e6eaeb`, after rebasing onto the landed ownership change. The terminal-metadata correction has an identical patch ID; only base-dependent union handling in the initial feature layer changed. Independent rebase/fixture compatibility review and new-head hosted CI are required. The PR is attached to the coordinator task and covers the complete #5117 endpoint scope.
+
+Initial #5183 hosted run35450374594 failed four new real-flow cases. The first buffered-read-error fixture reports an uncaught injected error; following cases encounter a state-home ownership conflict. Owner received completed-job logs for diagnosis of the first failure and cleanup consequences, without weakening ownership or removing transport assertions. This observed execution failure takes precedence over the earlier source-only PASS.
+
+A second completed hosted job (Linux shard3, job105916394852) identified one source-oracle mismatch: the WebSocket idle-timeout test expected the previous one-argument handler construction. Owner received the exact anchor to update alongside real-flow repairs while retaining explicit timeout and activation assertions. No test removal or policy relaxation was requested.
+
+Independent rebase review found no additional integration loss: source/test blobs match the reviewed feature, overlap docs/inventories preserve both metrics and ownership, and production shutdown still releases ownership in final cleanup. The observed read-error fixture and subsequent home-conflict cascade remain owner-assigned repairs; their existence is not evidence to relax production ownership. The separate source-oracle mismatch also remains tracked until corrected.
+
+Fixture/source-oracle corrections committed at `6158748a4cd2cf5ed70420e2aef56069994910e7`; independent review is scoped to error activation, real transport assertions, complete teardown and retained WebSocket idle-policy coverage. No passing execution claim until new-head hosted CI.
+
+Independent review accepted `6158748a4cd2cf5ed70420e2aef56069994910e7`: real read-error activation occurs after the first delivered chunk, error precedence remains observable, server teardown is awaited with a failure-visible cleanup safety net, and WebSocket source assertions preserve idle policy and terminal/fallback checks. Current-head hosted jobs are running without observed failures at this checkpoint; no runtime success is claimed yet.
+
+New-head hosted execution at6158748 removed the subsequent state-home conflicts but still failed two actual transport cases: the buffered error rejects the fetch before body consumption, and cancellation is scraped before the expected aborted count is visible. Owner and independent source reviewer are investigating deterministic transport/error handling and finalization observation, preserving exact counts and avoiding fixed sleeps or skipped assertions. Static fixture approval did not establish execution success.
+
+Further source tracing corrected the fixture-only assumption: a pre-response handler rejection bypasses final request logging, so the metric is absent. Owner was asked to use the existing once-only finalization guard before rethrowing, preserving client-visible transport behavior and missing timing semantics. The separate cancellation count failure is a propagation race; a bounded upstream-cancel signal can establish the actual completion boundary without sleeps or relaxed counts. Both require new source/test review and hosted proof.
+
+Production/error-boundary correction `bf462d6070977746a2c5eb377220ca0d80494aaa` is published on #5183. Independent re-review is focused on once-only pre-response failure finalization, unchanged client transport errors, timing/send facts and deterministic cancellation observation. Fresh hosted verification is required.
+
+Review of the new exception finalizer found a concrete pre-response cancellation case: a client abort during a buffered read reaches the same catch but must classify as aborted, not a non-abort read failure. Owner was asked to choose the existing cancellation status/reason from the actual request signal, preserve once-only finalization and rethrow, and add a live pending-body abort regression while retaining the non-abort failure test.
+
+Hosted run35451702720 atbf462 again falsified assumptions in the error/cancellation fixtures: the client fetch resolved rather than rejecting in the observed handler-error case, and the expected upstream cancel callback was not observed before the bounded deadline. Owner and reviewer were told to derive a deterministic real-server harness boundary from source and existing conventions, preserve the actual metrics assertions, and avoid changing assertions speculatively or raising timeouts.
+
+Head `8b589b3114b82027e164f38e08dc580803c89c43` adds cancellation-aware status/reason to the pre-response finalizer and a real pending-body abort case. That correction is under narrow review. The earlier read-error and cancellation fixture execution failures are separate and remain unresolved until a deterministic harness and new hosted proof establish them.
+
+The8b589 production cancellation branch passed static review. Its new synthetic upstream body, however, did not observe the outgoing request abort signal; a mock is not automatically coupled to real network cancellation. Reviewer supplied an existing repository signal-aware fixture precedent. Owner was asked to attach rejection handling immediately, explicitly model upstream abort propagation, synchronize actual server finalization and retain the complete metrics assertions instead of assuming one Bun transport error shape.
+
+Fixture-harness redesign `052eedb5cd10f135f8760aed76a170168cffc624` is published. Independent review now checks that the expected error/cancellation boundaries are actually activated and synchronized rather than inferred from default client transport behavior. Exact metrics counts remain required, with fresh hosted CI.
+
+Combined harness review confirmed final-log observers run after the corresponding metrics update. Two deterministic-test corrections remain: explicitly handle the expected test server error without suppressing unexpected errors, and start rejecting deadlines only at await sites so early subscriptions cannot produce unhandled timeout rejections. The signal-aware abort/cancellation activations were accepted.
+
+Primary-source research (2026-09-20) opened the [Bun HTTP error-handling contract](https://bun.com/docs/runtime/http/error-handling) in the requested browser and read the [server reload reference](https://bun.com/reference/bun/Server/reload). A handler error without an explicit error response uses Bun's default response path; a dedicated error handler can supply a deterministic response. The reload reference alone does not prove an error-only option object is accepted by the project's pinned types. Owner was given these boundaries to implement a test harness without assuming a universal client rejection or altering production error semantics. No local server or test was run.
+
+Hosted1c1c8229 confirms the pre-response client-abort regression now passes. The two already-tracked read-error/default-handler and streaming cancellation observation cases still fail; no new defect class is inferred. Owner has the completed-job evidence and the confirmed official error-handler contract.
+
+Fixture correction d4ee3baf3b installs a narrowly scoped explicit test server error handler, asserts the exact expected error and absence of unexpected errors, and makes event subscriptions non-rejecting until bounded observation. Independent review is checking the full cancellation activation rather than assuming client abort automatically controls a synthetic upstream body. Production behavior is unchanged in this test delta.
+
+The revised error-handler and observer harness passed review. The remaining SSE fixture still ignored the outgoing abort signal: production permits a bounded post-cancel drain, so an indefinitely open mock cannot establish prompt finalization. Reviewer corrected the earlier acceptance and traced the real signal path. Owner was asked to make the second SSE mock honor that signal, preserving both the production drain bound and the test deadline. No timeout increase was requested.
+
+Final targeted SSE fixture correction `794948670241886841b6ce6e89524bf2a63c5c1b` explicitly connects the second synthetic response to the outgoing request abort signal. No deadline or metrics assertion changed. Narrow independent review and fresh hosted checks are pending.
+
+Independent final narrow review passed the SSE abort linkage at79494867: it uses the actual outgoing signal, handles pre-aborted input, errors the pending mock once, and preserves deadlines and all counts. Earlier error-handler and non-rejecting observer corrections remain accepted. Only actual current-head hosted execution can establish runtime success.
+
+Head79494867 completed applicable hosted CI, but final public review exposed a remaining classification case: successful WebSocket upgrades finalize with101 and were counted failed by the fallback200–399 rule. Main verified source and requested explicit101 success while retaining cancellation and terminal-error precedence, with an upgrade regression. Green CI does not override this concrete gap.
+
+Head `28ab81c3e44b8bac548766702d3385efd8dbde8d` adds101 success classification after existing terminal/cancellation precedence, a real live-sideband upgrade scrape regression and explicit failed/incomplete101 precedence cases. Narrow independent review and fresh hosted verification are pending.
+
+Independent review passed the final101 classification correction at `28ab81c3e44b8bac548766702d3385efd8dbde8d`. The real upgrade path and metric are exercised; cancellation and failed/incomplete terminal precedence remain unchanged. No known static blocker remains at this head, but applicable hosted checks are still running.
+
+The101 correction at28ab81c3 passed independent review with real upgrade activation and retained terminal/cancellation precedence. Current-head hosted verification remains pending; the earlier79494867 green run is not substituted for this head.
+
+Hosted28ab81c3 cleared the earlier read-error and cancellation cases, but the new live101 fixture failed before the WebSocket opened. Owner and reviewer are checking the route's actual admission/configuration prerequisites against an existing successful upgrade harness. The metrics classifier is not proven through that fixture until the real upgrade is activated; helper-only substitution or relaxed admission was not requested.
+
+The live101 fixture rejection was traced to an ineligible synthetic provider: route admission refused before the injected local WebSocket factory ran. Owner received an existing canonical-key fixture precedent and a test-only setup correction, while retaining real upgrade/count assertions and unchanged production eligibility. The earlier static activation claim was corrected.
+
+Independent review passed the canonical101 fixture correction at `009317c24d46f3e03156bac3fc5b4b468ddaebec`. It meets the actual realtime selector prerequisites while redirecting only the injected upstream dial to a real local test server, asserts one factory invocation, and retains status/count/precedence/cleanup checks. Current-head hosted CI remains required.
+
+Exact-head hosted run35456050014 passed at009317c24d46f3e03156bac3fc5b4b468ddaebec. Final public and independent review nevertheless confirmed two uncovered corrections: the live-upgrade fixture creates its upstream before the cleanup scope, and six post-context live-sideband terminal exits omit request finalization (admission refusal, resolver exception, acquisition cancellation/timeout, pre-upgrade cancellation, upgrade exception and rejected upgrade). The owner is correcting those paths with preserved transport statuses and real-route regressions. Merge remains held; the green run is not full acceptance.
+
+Correction bf6a073cd23e15278d802b8f42f1eb5c54701ac2 is published with a request-local idempotent live-sideband finalizer, the six missing terminal exits and real-route cancellation/upgrade-failure regressions. The standalone upstream now has an outer cleanup scope. Independent re-review is in progress and exact-head hosted run35457502555 is active; no new passing execution claim yet.
+
+Independent bf6a073cd2 review accepted production status/metadata and once-only finalization across all six exits, plus the repaired fixture cleanup. The acquisition-cancellation/timeout branch still lacks actual-route regression activation. The owner received that focused coverage requirement and an existing deterministic timer fixture precedent. The already-added pre-upgrade cancellation and upgrade throw/refusal cases remain retained.
+
+Hosted bf6a073cd2 run35457502555 completed with a single macOS shard1 timing assertion failure in tests/providers/codebuddy-adapter.test.ts:643: expected elapsed time below250ms, observed312ms. Independent source diagnosis is comparing fixture setup and runtime cleanup boundaries; the threshold is unchanged and no environmental waiver is claimed. Acquisition-path coverage remains separately required.
+
+The completed bf6a073cd2 macOS shard2 log(job105935319960) directly confirms all four live-sideband regressions passed: successful101, pre-upgrade499 cancellation, upgrade exception502 and refused upgrade426. This is scoped execution evidence; the separate shard1 timing failure and acquisition-coverage requirement still prevent merge readiness.
+
+Independent ffb7b16c06 review confirmed real activation of acquisition cancellation, captured production deadline, capacity refusal and resolver exception with once-only status/metrics assertions. One fixture isolation correction remains: resolver/timer spies must enter cleanup scopes before server setup can throw. Timing diagnostic5899641f94 preserves the raw250ms assertion and adds bounded failure-only phase evidence; it does not claim a root-cause fix.
+
+Independent cleanup re-review passed a9f69ec0514cbdf0c4db97d64b0a05f363d7cfff: resolver and timer spies enter restoration scopes before server setup; nested cleanup covers early failures while preserving all accepted actual-route and once-only metric assertions. Production deadlines remain unchanged. Current-head hosted execution and integration remain required.
+
+Current a9f69ec051 macOS shard2 job105943379816 executed all17 real HTTP/WebSocket metrics cases successfully, including the four newly required acquisition/capacity/exception cases. The job's only failure is the already-assigned current-dev file-size ratchet pair. This directly proves the scoped metrics flows at this head; it does not waive full applicable CI or the repaired-base integration requirement.
+
+Repaired-base head4d9bcead8728a467c960910e38a7258357f7563b is published on c81d43053b. Range comparison preserves all reviewed implementation and fixture patches; the first feature commit differs only in the expected layout inventory context supplied by the integrated schema work. Its current hosted matrix is active.
+
+Scoped semantic union review passed metrics4d9bcead against dev3fd293d841, candidate treefd3fc217ef8c491218251bd9dd90dcfe79b6da7b. The relay overlap preserves EOF-only buffered metadata, cancellation/read-error precedence, final send counts and once-only finalization, alongside the integrated refusal classification. It does not change the existing separation between synthesized wire refusal and request-log classification; combined-tree hosted verification remains distinct from this source verdict.
+
+Incremental semantic review also passed against dev4853f90d9ac87f49d95a7370f9bdf7eca014af3f, candidate tree7f727ae7435b00d58738808e3b83455d46f9e92b. The new readiness and streaming changes preserve optional metrics initialization, first-output timing, terminal/cancellation finalization and send accounting; both layout inventories retain all registrations. Combined-tree hosted proof remains a separate integration obligation.
+
+Publication correction: screenshot-only commitc99d32fa7e was briefly pushed to the metrics branch, then removed with an exact-lease correction back to reviewed4d9bcead87 and placed on the dashboard branch. Main verified the intermediate diff contained only eight PNG assets and no runtime/test changes. The owner acknowledged the mistake and froze the metrics head. Earlier run35463258955 and target control35464219463 were cancelled by subsequent publication events, not failed assertions. Current run35464220426 is the execution receipt to assess.
+
+Final-wave source-union review passed metrics4d9bcead against dev98b9b344e155b527f5f9a2c12af5d4845329d3ef, tree053911ae0a17ca098dcc9ea39c4417844f0d13fa. Eight additive intersections preserve configuration and inventory fields. Compaction retains the parent logging context, signal, lease and send budget; outbound header defaults introduce no extra dispatch; terminal/finish handling remains intact. No concrete source blocker or mandatory rebase was identified. Full combined hosted verification remains required in the integration track.
+
+Integration receipt: native stacks lookup returned an empty list; maintainer-integration preflight, current actor/dev base and immutable head were checked. The actual merged tree053911ae0a17ca098dcc9ea39c4417844f0d13fa equals the independently reviewed final-dev union. Target control35463257826 succeeded; later intermediate control35464219463 was cancelled. Full Windows shards and diagnostic control were event-inapplicable, not passing executions. Dev push run35467094926 tracks the integrated tree.
+
+Cumulative integration receipt: devfec3add6ceff1dcc0ab31b232d65efc12db451db push run35467094926 attempt1 completed successfully with all applicable producers and aggregate. This verifies the metrics plus prior integration union at that dev tip; later campaign changes still need their own cumulative proof.
diff --git a/devlog/_fin/260919_contract_resolution/039_decode_hint_review.md b/devlog/_fin/260919_contract_resolution/039_decode_hint_review.md
new file mode 100644
index 00000000000..f458fd530a9
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/039_decode_hint_review.md
@@ -0,0 +1,29 @@
+# Registry decode-hint review
+
+Issue #5115 is owned by the runtime lane following the explicit ownership handoff. Prepared head `b56511bc6d21a20928d8cfe66e97fbbe8a860ba9` is based on `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. It adds a registry-owned exhaustive field classification and replaces only the router's manual identity-map list, with existing-file regression additions and structure documentation.
+
+Independent source review passed: direct and nested model-key maps contribute only their intended identity keys; non-model records and virtual wire-target values remain excluded; existing configured, cached and custom identity sources remain; the transport guard precedes registry hints; no catalog availability or entitlement is inferred. Separate test/documentation review and exact-head hosted execution remain required.
+
+The layer can be prepared independently because #5174 leaves the known-model hint function unchanged. Final integration remains after #5171 and #5174, with a current integration base, reviewed union and fresh hosted proof. No local execution and no completed-issue claim.
+
+Test review found missing public-boundary coverage: all maps are enumerated through the helper, but the actual route-decoding table covers only the seven newly omitted direct maps. Owner was asked to extend that same bounded table to all classified direct maps, add the shipped map-only provider decode case and verify the declared frozen-result contract. Existing transport, ambiguity, unknown pass-through and no-availability negatives were accepted. No implementation defect or cap violation was claimed.
+
+Correction `3918a95040` extends public routing coverage to all fifteen direct maps and checks frozen output. A new shipped-entry example used a transport-mismatched custom configuration and slash-free IDs, so its route equality could pass without activating registry hints. Main review requested a canonical configuration and an explicit map-only known-ID assertion, with accurate naming; the synthetic slash-ID matrix remains the proof of decoding. No production source change was requested.
+
+The independent test review passed the overall corrected coverage. It also corrected the preceding transport inference: this provider uses the non-key registry-owned matching path, so the custom fixture does not demonstrate transport exclusion. The actual issue is the slash-free selector assertion not proving decode activation. Existing synthetic public cases and shipped helper provenance are sufficient; the shipped example needs accurate wording, not a new production transport change or expanded acceptance contract.
+
+Final narrow test correction `8502bf99aa` removes only the newly added vacuous slash-free route example and its unused import. All fifteen synthetic public decode cases, the nested case, negatives and frozen-result checks remain; shipped-entry collection parity remains in the separate provider test. Source and test reviews are accepted for publication with exact-head hosted verification; final integration order is unchanged.
+
+Published as [PR #5177](https://github.com/lidge-jun/opencodex/pull/5177), base dev, exact head `8502bf99aaae6785eac4fe86d818fc454f79872d`. Template and reviewed test scope checked; attached to the coordinator task. Exact-head hosted CI and future integration with the earlier policy layers remain required before #5115 closure.
+
+Initial #5177 hosted run35448915385 failed the gates job on TS2352 at model-ids.ts:152 (registry entry cast to an indexed record), and a production-graph type-contract test exited nonzero. Completed job logs were retrieved directly before the overall run finished. Owner received the exact diagnostic and is correcting typed iteration/casting without changing classification semantics or removing the contract test. New-head hosted proof is required.
+
+The prepared type correction iterates keys of the exhaustive classification with the registry key type, reads direct maps through that key and reads the sole nested owner explicitly. Main source review found the current classification semantics preserved without the invalid index-signature cast. A syntax search returning no error-node matches is not a compiler pass; the corrected head still needs hosted type and suite proof.
+
+Type correction published at `a654ee8e4469f2c431b378a4ec42c68765e74a90` on #5177. Main reviewed the one-file typed-iteration delta; an independent narrow check and fresh hosted compiler/suite proof are pending. Existing public decoding and immutable-output regression coverage is unchanged.
+
+Independent one-file review of `a654ee8e4469f2c431b378a4ec42c68765e74a90` passed: role iteration order, selected-field access, sole nested owner, exclusion, deduplication and frozen output remain unchanged. Hosted compiler and suite verification is still pending; no local execution occurred.
+
+At corrected head `a654ee8e4469f2c431b378a4ec42c68765e74a90`, hosted run35449601489 gates and Linux shard4 passed. The shard log explicitly shows the previously failing production-graph translator-budget type contract passing. The original two failures are cleared; remaining applicable jobs and final integration still require completion.
+
+Verified integration: #5177 merged as `838af40f1b2fe32596b207ff85afcda40636f4d9` at 2026-09-19T15:00:41Z. Exact-head run35449601489 passed all applicable checks and aggregate; public decode cases were observed in macOS logs. Independent source/test/type correction and integration review passed, no public threads or maintainer objections remained, and all six files were preserved in the clean union with no overlapping dev changes. The former policy-first order was explicitly revised after both independent source review and the policy owner confirmed no semantic dependency. Later policy integration must preserve the helper/import and obtain fresh union proof. Issue #5115 closed at 2026-09-19T15:01:16Z after actual dev ancestry verification.
diff --git a/devlog/_fin/260919_contract_resolution/040_preview_review.md b/devlog/_fin/260919_contract_resolution/040_preview_review.md
new file mode 100644
index 00000000000..1c80280210e
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/040_preview_review.md
@@ -0,0 +1,130 @@
+# Integration preview delivery status
+
+Issue #5118 remains open. [Server PR #5185](https://github.com/lidge-jun/opencodex/pull/5185) and [dashboard child #5197](https://github.com/lidge-jun/opencodex/pull/5197) form an ordinary manual chain. The coordinator will close the issue only after both layers satisfy the original acceptance criteria and land on dev.
+
+The runtime owner retains the server, writer, routes, backend tests and API documentation. The existing policy owner owns the dashboard and its tests. Detailed unshipped review findings, hypotheses and correction plans remain in ignored scratch. They will be summarized as outcomes after integration; individual scoped reviews do not establish whole-feature acceptance.
+
+## Server checkpoint
+
+Server head36cdb569544349e174612cf9569ee01eea761afb has scoped source-review evidence and hosted run35466424534. A subsequent bounded correction and regression are in progress. Final-head review, complete applicable hosted execution and ready-for-review publication remain required. Earlier-head results must not be reused as approval for new source.
+
+English and seven translated API references have been reviewed. Their availability wording was corrected to describe conditional recovery rather than promise unconditional readiness. Existing issue scope and acceptance criteria remain unchanged.
+
+## Dashboard checkpoint
+
+The reviewed dashboard corrections preserve explicit confirmation, cancellation, retry state, localization and profile boundaries. Head580f087376409411d9c5557f9bc7b6679777affd passed hosted dashboard gates and React Doctor. Its full matrix exposed an inherited server-base assertion; it did not establish complete stack acceptance. The final child must contain the accepted server head and pass fresh applicable checks before integration.
+
+The hosted artifact from run35462441376, artifact10590256653, identifies build commitbf1bf424f3ebabe977af0dd7b54e3c285baf1769 and GUI treece7f1018aa53203767a665de94d7e6005311f2a8. The GUI tree matches the reviewed dashboard input. No local product build was used.
+
+## Rendered evidence
+
+Main directly inspected eleven real-browser screenshots of the hosted artifact served with isolated fixture responses: apply, foreign overwrite, restore drift and stale reconfirmation at desktop and narrow sizes, two narrow Korean-label captures, and keyboard focus. No visible clipping or overlap was observed in those captures. These are fixture-rendered interface observations, not live-backend execution.
+
+The receipt records desktop1280x720 CSS pixels at DPR2, narrow480x800 at DPR2, and Korean390x686 at DPR2.5. It includes all eleven PNG hashes, fixture routes and request sequences, the scratch fixture-server command, artifact provenance, and keyboard Escape closing the dialog. Main verified hashes and the final commit-pinned image links. Filenames alone were not used to establish viewport measurements.
+
+The [dashboard capture receipt](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-capture-receipt.json) is pinned to commit3d9fffd1be64ff47ca504493e14a7c293dc139e1. Artifact identity and current GUI-tree equality must remain valid after the final cascade, or affected evidence must be refreshed.
+
+
+Pinned capture files (historical artifact, before the final parent cascade):
+
+- [apply-desktop.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-apply-desktop.png)
+- [apply-narrow.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-apply-narrow.png)
+- [keyboard-focus.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-keyboard-focus.png)
+- [ko-restore-drift-390.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-ko-restore-drift-390.png)
+- [ko-stale-reconfirm-390.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-ko-stale-reconfirm-390.png)
+- [overwrite-foreign-desktop.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-overwrite-foreign-desktop.png)
+- [overwrite-foreign-narrow.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-overwrite-foreign-narrow.png)
+- [restore-drift-desktop.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-restore-drift-desktop.png)
+- [restore-drift-narrow.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-restore-drift-narrow.png)
+- [stale-reconfirm-desktop.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-stale-reconfirm-desktop.png)
+- [stale-reconfirm-narrow.png](https://github.com/lidge-jun/opencodex/blob/3d9fffd1be64ff47ca504493e14a7c293dc139e1/.github/pr-assets/5197-stale-reconfirm-narrow.png)
+
+## Remaining delivery
+
+Complete the current server correction and review, run applicable hosted verification on its final head, cascade the dashboard, inspect the combined changes and current-head checks, then integrate bottom-up and verify dev ancestry before closing #5118. Local tests, typecheck, builds, installation and proxy execution remain prohibited.
+
+Publication correction: review of the intermediate progress PR found that detailed unshipped working findings had entered the draft devlog. Those records were preserved in ignored scratch and replaced here with neutral delivery and evidence status. The PR remains subject to renewed review; this correction does not claim prior remote objects were erased.
+
+Subsequent bounded server correction completed at ea8c69c577c3bc5419ae13886283f42c07c2aef2, treee7a9476006a43a742c7541f9f2bd3bb269312c3d. Independent scoped review and main inspection passed. Run35467605982 still requires its remaining jobs to finish; an earlier broad green summary was corrected against actual job state. Final publication, dashboard cascade and full verification remain separate requirements.
+
+Later source/public review produced a subsequent server revision104b5a48ac767c11ea216fd500ea51346ce8d22b and further pending corrections. The owner is consolidating the batch before final acceptance; earlier ea8 hosted success remains historical evidence. No final server or complete-stack claim is made. Detailed working findings remain in ignored scratch.
+
+Independent review of a1eeb80bd3 identified two remaining acceptance gaps; main confirmed the cited production paths and returned one consolidated correction packet. Other scoped corrections were accepted, but this is not final server acceptance. The detailed findings and required regression witnesses remain in ignored scratch until a published outcome is appropriate.
+
+Revision80a1c4fa53 closed most of the preceding source-review findings. One scoped correction and completion of the actual restore postconditions remain before final acceptance. Earlier accepted behavior and regression assertions remain required; detailed working analysis stays in ignored scratch.
+
+Final scoped source re-review passed ea4b55f8872dbb4a57d94acbc27b33c302a09d97, tree4e8ec52f919e5cea0a8ccbca2eefd933cfb6623a; main inspected the correction diff. The remaining actual restore postconditions and early-refusal regression are now present, with prior assertions retained. Source acceptance does not replace current-head hosted proof, repaired-base integration, dashboard cascade or fresh rendered evidence.
+
+Repaired-base server head3a8e73d417cf9b42b0a77c26eca6e9563a60938a contains both accepted sourceea4b55f887 and integrated policy/devb9d430bb5b. Main verified both ancestries and exact tree equality with prospectivea93943e1e000c8dd5d0966b6eec90ab01947728d. Hosted run35471595302 is active; final union review, current-head execution and public review remain required before server landing.
+
+Independent integration-union review passed treea93943e1e000c8dd5d0966b6eec90ab01947728d, matching actual head3a8e73d417. Shared producers/consumers retain detached admission, frozen policy capture, row-revision provenance, late credentials, passive preview reads and management authentication boundaries. Route registrations, both inventories and shared documentation preserve all parents. This is source acceptance only; current-head hosted and public review gates remain.
+
+Execution receipt for head3a8e73d417: all four Linux jobs in run35471595302 passed. Main read the logs and verified158 passing cases across seven affected test files, including actual apply/disable undo, alternate-copy restoration, early missing-profile refusal, changed-roster rejection and executor handling. All four jobs checked out synthetic merge7d606f9b5e9c884b8994b63a6047c3224465bfe8; the Git API confirms its parents are devb9d430 and head3a8e73, with the accepted treea93943e1. Remaining platform/aggregate completion remains separate.
+
+Run35471595302 completed successfully at3a8e73d417. Final publication review then identified one additional canonical-route consistency correction, confirmed against the current source and assigned to the owner with focused HTTP coverage. Server integration remains held for that correction and new-head verification; the completed run is retained as prior-head evidence. Detailed working findings remain private.
+
+The final canonical-route correction fe77823a81116ef914124bc387cbc7bbbad62927, tree1664beb0e02f8cf05aa8cc576553e193b436c7be, passed main production review and independent tests/documentation review. Exact HTTP refusal assertions, no-write witnesses, a positive generic-client control and all eight API references agree with the narrowed route contract. Canonical profile paths remain unchanged. Run35472565093 still requires its remaining platform jobs and aggregate to complete; no newer-head green claim is made.
+
+Headfe77823a81 completed all applicable hosted jobs in run35472565093. The documentation-build request was resolved using actual job105976107227, whose frozen-lockfile installation and docs build both succeeded; no local build was run. One final documentation-only correction remains: the canonical profile-preview response row needs its existing unavailable-roster409 listed consistently in all eight references. Runtime code is unchanged by that requested correction; its next head still requires normal applicable hosted verification.
+
+Documentation-only head0c671271067f2c8fcaa1f17dad2fcb7c55958fc8 adds the existing unavailable-roster409 to exactly one canonical profile-preview table row in each of eight locales. Main inspected all eight rows and confirmed no source/test change from greenfe778. All five public threads are resolved. New-head run35473490998 is active; prior-head success is retained separately.
+
+Final acceptance cross-check identified the original integration-guide update as still missing from both PR diffs. The dashboard owner is assigned the user-flow guide and translations before final child publication; server API/structure documentation ownership remains unchanged. Final acceptance continues to require this original named artifact.
+
+Head0c671 run35473490998 ended with macOS2job105978618346 exceeding20minutes. No failed assertion was printed; the last result was the first launcher-runtime case, followed by18minutes without another result. The next fixture already declares30second subprocess and60second case limits. No root cause or environment attribution is established. The actual tested merge3dea649f used base3f9b9569, which is retained in the private diagnostic receipt. No blind rerun is started while a separately required explanation/test correction will produce a new head.
+
+Whole-issue acceptance audit identified one bounded explanation mismatch: client-document no-op and saved profile preference were described as one fact. Existing mutation behavior is intentional and remains unchanged. The server owner will align API wording and add a focused profile no-op witness; the dashboard owner will align dialog copy, its assertion and the guide translations. All other original requirements passed the requirement-directed source/evidence audit; final execution and rendered evidence remain pending.
+
+A further requirement-directed falsification confirmed one final state-validation correction is needed in the profile workflow. The owner received the concrete source trace and supported regression seam, with explicit constraints to retain existing preference semantics and unchanged-state success. This is within the original changed-state acceptance requirement. Details remain in ignored scratch; no public bypass/reproduction material is added here.
+
+The dashboard half of the no-op explanation correction passed independent review at6fad3cdc08512564def7187b1582b27a2fff3586, tree79a6e8a2d3a413fd338e83d87704521d19ad614e. All ten locale catalogs, enabled explicit confirmation/binding assertion and four existing integration guides agree. API wording and the backend witness remain separately pending. Final capture scope now also includes a narrow Korean profile no-op state so the changed conditional explanation is actually rendered and observed.
+
+Both no-op explanation and final profile-state-validation corrections passed independent scoped review atc270fb8ca3d2578e566030c0d9ab24791b3f387b, tree1b33a6e014cbe23afee7662f0812111d1de331ec. The actual profile no-op witness, intentional preference persistence, late refusal cases and unchanged-state control are present. Full hosted and final stack evidence remain required; later regression-strengthening changes, if any, must be inspected rather than inheriting this verdict automatically.
+
+The initial scoped review of5bd1d3149f was superseded by a falsification pass: the new early protection must coexist with the previously accepted final protection, not replace it. The owner received a minimal correction and supported regression witness, explicitly preserving existing partial-preference/history semantics without a broader transaction mechanism. Detailed analysis remains private.
+
+Revisionc67cf0bf19 restores both required state checks and passed source-wiring review. Its new post-copy witness initially used a read ordinal that activated an earlier check instead; the owner received an actual-copy marker and exact postconditions to make the regression distinguish the prior defect. Production behavior needs no further change for this correction. Details remain private until appropriate publication.
+
+A concrete test-only witness correction was prepared againstc67cf0bf19 and independently reviewed. It uses actual destination snapshot creation and byte equality to trigger the competing edit, then checks saved preference, exact stale response, preserved target and absence of a restore row. Source guards are unchanged. Application and final-head hosted execution remain pending; syntax-only inspection is not runtime proof.
+
+The reviewed one-test witness correction is now published as e7bc9e9aff6e00da13179f28611d2181d1b18c50, tree3683f630b631293c310b7cda86645a1a1de9b74a, directly above c67cf0bf19. Coordinator publication used an isolated checkout and an explicit prior-head lease; the implementation checkout and original staged documents were not changed. Only the test changed. New-head hosted proof is required before integration.
+
+Head e7 hosted run35478692205 attempt1 executed the strengthened post-copy case successfully in Linux job105992414303 (15.88ms). macOS2job105992414279 exceeded its20minute job limit before the first client-connect case result; no failed assertion was printed. Its test and warm-up helper blobs match the earlier successful head. A single diagnosed failed-job rerun with debug logging was requested; this is verification recovery, not a claimed root-cause correction. The actual tested merge34423ad19b used base97aaf8c736 and treeeb01167657; branch-head identity is retained separately. Integration remains held.
+
+Independent static union review passed for synthetic checkout `34423ad19bb0e1e1b5b7c2407ff5c3feb922d1dd`, tree `eb01167657a91124933fbd0e27fac9bbb929a8d3`, with current dev `97aaf8c736` and server head `e7bc9e9aff`. All54 compared source/test files retain their respective parent blobs; both test inventories and shared runtime documentation preserve both changesets. Config, catalog/vision and affinity interactions showed no concrete union regression. This is static acceptance only: complete hosted verification and the dashboard layer remain pending.
+
+The PR description was refreshed and read back after detecting stale prior-head verification prose. It now names exact e7 and synthetic merge34423ad, separates the pending macOS rerun from passing Linux coverage, records the accepted source/security union review, and states that the dashboard and whole-issue acceptance remain outstanding. No new source commit or CI override was introduced.
+
+Server #5185 merged into `dev` as `e64d6994eb179dbc6f9e5c073bb1f110503a6247` at 2026-09-20T01:01:14Z. Final reviewed head `e7bc9e9aff6e00da13179f28611d2181d1b18c50` passed run35478692205 attempt2, including macOS2job105995278806 and aggregate105996440493. The rerun logs confirm the same checkout34423ad and the previously stalled initial client-connect case passing; this is verification recovery, not a root-cause fix. All applicable control checks passed, public threads were resolved, native stack membership was empty and the maintainer preflight/current actor/base/head were verified. Actual merge tree `eb01167657a91124933fbd0e27fac9bbb929a8d3` equals the reviewed and hosted-tested tree, and dev ancestry was checked. The dashboard owner received the actual merge SHA for final retargeting, CI and twelve fresh rendered captures. #5118 remains open until the complete dashboard and server acceptance is delivered.
+
+Dashboard #5197 was retargeted to `dev` and published at `f6468bc8851cbce2367d3add3d6bb178d7854649`, based on the actual server mergee64d6994eb. Its GUI subtree `3d7dfd3c1334e6630b6c6c4926b1dc706d01d43a` and four integration guides match the previously reviewed local correction6fad3cdc08. The final diff contains only the dashboard, its tests, public capture assets/receipt and those four guides. Run35480409592 is active and its gates job105997111617 passed; earlier same-head concurrency cancellation is not counted as verification. The refreshed twelve-image proof remains pending.
+
+The fresh dashboard gates log105997111617 records81 passing cases across the four affected integration test files, including profile no-op confirmation, stale re-confirmation, cancellation and drift intent. Artifact10595497569 was built from synthetic checkout `df807b028819b21cff3ad817f01bc1e91bb54601` (parents e64d6994eb and f6468bc885), whose GUI subtree `3d7dfd3c1334e6630b6c6c4926b1dc706d01d43a` matches the reviewed source. The owner is refreshing the rendered proof from this artifact. Full platform and final capture evidence are still pending.
+
+Cumulative server integration CI35480291642 completed successfully at actual dev `e64d6994eb179dbc6f9e5c073bb1f110503a6247`, with every event-applicable job and aggregate accepted. This covers the landed server and preceding integrations; final dashboard integration proof remains separate. The newly authorized main-to-final full regression and release follow-up is recorded in042 and has not been executed in this work phase.
+
+Direct inspection of the fresh narrow Korean profile no-op capture found one remaining explanation mismatch: the no-op/preference disclosure is correct, but the generic consequence paragraph still promises a backup and rollback entry that this plan does not create. The dashboard owner is correcting this bounded presentation condition and adding a negative no-op assertion with a positive changing-plan control. Confirmation semantics remain unchanged. The current captures are retained as historical review evidence; corrected-source hosted execution and final renders are required before acceptance.
+
+The bounded no-op presentation correction was published as `07bf0a4dbe369f204c2216f5e8c07c87f52d649c`, changing only the consequence dialog and two focused assertions. Backup/rollback copy now follows the active server plan, including a stale replacement, while unbound legacy dialogs retain their existing explanation. New-head run35481230775 and final corrected renders remain pending. The superseded f646 run had three macOS runtime-fixture assertion failures before concurrency cancellation; it is not recorded as passing. Those unchanged-fixture observations are preserved separately from the GUI correction, and the old head is not rerun.
+
+The07bf correction passed main and independent scoped review. Corrected gates105999438089 in run35481230775 executed all81 affected integration cases, including the strengthened no-op negative assertion and changing-plan positive control. Artifact10595174777 was built at `6c9576edb372200efec9d6ad4fea7b1e0dc35fb4`; its tree `241debfd688881de2444d690e7bfe7346042e9db` and GUI subtree `06c1f0c620cbfca2a557813f7ec54b7c11cbb540` match the reviewed head. Final captures and complete platform verification remain pending.
+
+Corrected source07bf passed all applicable jobs and aggregate in run35481230775 attempt1. macOS1job105999438045 also executed the three earlier failed runtime-fixture cases successfully; this is observed recovery, not a claimed fixture-root-cause fix. Main directly viewed all12 corrected frames and verified their hashes against the capture receipt. The no-op backup/rollback promise is absent while document scope, preference persistence and enabled explicit confirmation remain visible. The receipt records the exact profile operation/fingerprint request. Desktop/narrow pixel dimensions match reported CSS size and DPR; the three125-percent-zoom Korean images have a one-pixel-per-axis difference, retained explicitly for receipt clarification. Independent visual passes and final asset publication remain pending. This is fixture-rendered proof, not a live-backend session.
+
+The first independent visual pass accepted all12 corrected frames after checking every PNG hash against the receipt. It found no actionable clipping, overlap, wrapping, readability, button visibility or visible-focus defect. Keyboard interaction is not inferred from pixels; the separate receipt/flow review remains pending. Final capture asset publication and its new-head checks still precede integration.
+
+The second independent pass accepted the corrected packet after inspecting all12 images, fixture source, request sequences, operation/fingerprint binding, build metadata and hashes. Main synthesized both passes as PASS for the fixture-rendered surface. The record does not claim live-backend or screen-reader execution; actual server behavior remains backed by hosted route/transport regressions. Final asset publication, its exact-head CI and owned-resource teardown remain required before integration.
+
+Final public-review reconciliation found seven unresolved threads, including a verified aggregate-profile routing regression outside the twelve captured states. The overview and bulk flows sent aggregate Aside actions through a profile-only preview contract. Integration is held for one coherent GUI repair: preserve existing aggregate intent, handle non-actionable bulk plans and stale partial results correctly, retain explicit confirmation, clarify two ownership-record translations and separate hosted merge-ref identity from PR-head identity in the receipt. The coordinator returned Check to Build within the same work phase. Earlier evidence remains valid only for its covered paths; new focused hosted and driven-flow evidence is required.
+
+Asset head53ead run35482234447 attempt1 ended with macOS2job106002001259 exceeding20minutes and a failed aggregate. The log printed no failed assertion; its last two results were passing catalog-restore cases before output stopped. This is incomplete platform evidence, not a root-cause diagnosis. The obsolete head is not rerun while the independently required aggregate/bulk GUI repair is pending. Its successor must obtain fresh complete hosted proof.
+
+A supplementary caller-contract audit traced shared-history and single-profile restoration through their canonical profile identifiers and found no additional reachable mismatch beyond the seven known repair items. The proposed aggregate/bulk patch is frozen for independent review. Main review found a pending-state defect in that proposal: keeping a bulk stale-plan dialog mounted after a normally resolved callback leaves its local pending flag set, preventing the required second confirmation. This is being corrected before publication, with a direct enabled-confirmation assertion required. No new source head has been published for this repair yet.
+
+Independent review of the uncommitted aggregate/bulk repair confirmed two blockers: bulk stale replacement retained the dialog-local pending state, and direct aggregate failures could escape into an unhandled promise rejection. Both were accepted and assigned back to the existing owner with focused enabled-reconfirmation and failure/retry assertions. Other reviewed repair contracts passed; the same reviewer will check the corrected delta before publication.
+
+The separate read-only CI investigation localized the earlier53ead timeout to the third catalog-restore case and its synchronous child helper, which has no helper-level timeout. A dangling-child message occurs at the case deadline, but no child phase markers identify where execution stopped. The mechanism remains unproven. No production or CI-policy change is made for this obsolete head; a recurrence at the same location on the successor would justify bounded content-free phase diagnostics with all limits and assertions unchanged.
+
+The same independent reviewer accepted the corrected six-file working diff (`8810d23e00a6cb3cc606f046e2d2c466792882e3e6a661759fd05b03cf492694`) after both blockers were fixed. The dialog now releases pending state after a settled callback, and only the direct aggregate caller consumes its already-displayed failure. Added assertions cover re-enabled confirmation/close controls, exact non-repeated requests and fresh binding, and a realistic aggregate partial failure with retry. Main approved the unchanged diff for one coherent publication. Hosted execution and the expanded affected-flow proof remain required; no local product check was run.
+
+The reviewed repair was published as `278513a79e66585c68dffcb461e8fbb63228039a`; its actual commit diff matches the approved `8810d23e` fingerprint. All seven public review threads were answered and resolved with commit-scoped evidence. Gates106006865376 in run35483995896 executed six new regression cases successfully: aggregate overview requests, aggregate partial failure/retry, Aside-only and mixed bulk, all-refused readiness, stale partial-success reconfirmation without repeated completed writes, and overview stale-card presentation. The fresh hosted artifact10596691936/build600618e45242b88931d23bae8fe0e5e3f0576be2 has GUI tree `dd425c2793a0c4e01bf20255eea1b6fa4c562e0d`. The owner retains capture execution; main owns independent acceptance. Full platform and expanded actual-flow evidence remain required in Check.
diff --git a/devlog/_fin/260919_contract_resolution/041_transport_acceptance_followup.md b/devlog/_fin/260919_contract_resolution/041_transport_acceptance_followup.md
new file mode 100644
index 00000000000..76d8966be06
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/041_transport_acceptance_followup.md
@@ -0,0 +1,29 @@
+# Original transport acceptance verification follow-up
+
+Current status: COMPLETE. The focused follow-up merged as3f9fe3fa29 after exact-head hosted proof, and both issues were reclosed. Earlier checkpoints below are retained as history; the final receipt is in Verified delivery.
+
+Final acceptance audit at devb9d430bb5b found three explicitly requested scenarios without direct execution evidence. The implementations from #5125 and #5127 remain integrated; no new production defect was asserted. Issues #5109 and #5110 were reopened until the missing regression evidence is delivered and verified.
+
+| Original issue | Required witness | Intended test location |
+| --- | --- | --- |
+| #5109 | A supported real SOCKS HEAD request settles with a null body without waiting for the upstream peer to end its response. Existing headers and cleanup remain correct. | `tests/lib/transport-null-body.test.ts` or the existing uncapped SOCKS fixture suite |
+| #5110 | Informational responses precede a final response without being treated as final, and upload handling remains correct. | `tests/lib/socks5-upload-lifecycle.test.ts` |
+| #5110 | A response timeout fires while a body read is stalled and the request settles with its intended timeout outcome, releasing reader/socket resources. | `tests/lib/socks5-upload-lifecycle.test.ts` |
+
+The runtime owner delivers a separate focused branch/PR from current dev. Preserve the published preview-server head and serialize checkout writers before switching branches. No production change is planned unless the focused execution exposes a concrete defect. Reuse current fixtures and preserve existing assertions, deadlines, size caps and test inventories. A controlled timer may activate the real timeout branch after the stalled-read condition is observed; a predicate-only check is not equivalent evidence.
+
+Verification remains static source/test review plus exact-head hosted execution. No local test, typecheck, build, installation or runtime execution is authorized. Re-close each issue only after the follow-up lands on dev and its original scenarios are observed executing successfully. The previous per-PR receipts remain historical evidence for their covered scope and are not discarded or relabeled.
+
+Historical publication checkpoint: [PR #5225](https://github.com/lidge-jun/opencodex/pull/5225) was published atf43cc0f6e95f85cb24ec7a891f26200fca4d8428. Its initial hosted checks were green, and source review accepted HEAD and timeout activation/cleanup. Informational-response coverage still needed a causal upload-continuation witness at that checkpoint.
+
+The initial informational fixture queued the whole request body before the peer sent interim responses. It therefore proved header parsing and eventual upload, but not continuation after interim processing. The correction holds the trailing chunk/EOF until client-side receipt of both complete100/103heads and a native event-loop checkpoint, then observes the rest of the upload and final response. No production hook or arbitrary delay is needed. Closure remains pending the corrected head, hosted execution and actual dev landing.
+
+Corrected head497b7df9e9376cab448297d6c5d2ef02704d09df is published on #5225, with source unchanged and a single informational-fixture interdiff. It gates the trailing body on the peer sending interim responses and adds pre-teardown closure; independent review found that client-side receipt/processing was not yet observed. Independent re-review and exact-head run35475511843 remain pending.
+
+Revision899c57ca2a adds the actual client-side receipt/native-checkpoint witness and closes the original behavior-coverage rows statically. Review then identified a fixture failure-safety gap in unbounded receipt waiting and global observer cleanup. One bounded test-only correction patch was prepared in ignored scratch, inspected by main and handed to the owner. No source behavior or timeout constant changes are needed. The899 hosted macOS1 job also reports four separate runtime-probe/settings/combo failures; these are recorded without asserting an environmental root cause or rerunning a superseded head.
+
+## Verified delivery
+
+Final head9e3ee90f930d6f7ebaf94f3a2dd2425a6f7ce332 passed independent causal-order and failure-cleanup review. Exact-head run35477114410 attempt1 succeeded with all applicable jobs/aggregate. Actual macOS logs105988178081 and105988178063 show HEAD, informational100/103 continuation and stalled-read timeout passing. Both checked outa81daf8d491f830899264a55a4f99eddbd8bc80b, whose tree088e56b6379cd5dbf6b28fd5db8f682bd362a468 equals the reviewed head and actual dev merge.
+
+PR5225 merged as3f9fe3fa2993126c95a0c64627f4a5d609e0a1a7 at2026-09-20T00:03:16Z. Dev ancestry was verified, then #5109 and #5110 were reclosed at00:04:02Z and00:04:04Z and their states reread. Native membership was absent, the public finding was resolved and maintainer integration was recorded. No production behavior, timeout or existing assertion was weakened; no local execution was performed. This closes the follow-up, not the still-open #5118 or final campaign gate.
diff --git a/devlog/_fin/260919_contract_resolution/042_release_followup_authorization.md b/devlog/_fin/260919_contract_resolution/042_release_followup_authorization.md
new file mode 100644
index 00000000000..b7f1ea71313
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/042_release_followup_authorization.md
@@ -0,0 +1,19 @@
+# Authorized regression and release follow-up
+
+Status: QUEUED after the current sixteen-issue implementation cycle. This is an authorization and scope record, not an executed release or a substitute for the next phase's detailed plan.
+
+The maintainer explicitly requested full regression coverage from `main` through the final integrated changes, followed by `main` and `preview` promotion and a completed release. The existing no-local-suite restriction remains in force: full execution evidence must come from hosted CI. Existing commit/push conventions and protected-branch/release policies remain binding.
+
+Request-time branch references:
+
+| Branch | Commit |
+| --- | --- |
+| main | `134c92a01b120162f00c7275189cc47858720379` |
+| preview | `48e1ddba0bb8da9ad39e32f8e20c1e4d7f1794da` |
+| dev | `e64d6994eb179dbc6f9e5c073bb1f110503a6247` |
+
+The immutable `main` baseline preserves the requested regression scope even if another authorized integration later advances a branch. The final target is captured after the campaign lands; no missing change may be dropped merely by choosing a newer comparison base.
+
+At authorization time, the current work phase still needed to finish #5118 and its acceptance evidence. That implementation prerequisite is now complete; the still-open release work is tracked in [the separate plan unit](../../_plan/260920_regression_release/000_scope.md). After that cycle closes, the next Plan phase must inspect the current release authority, versions, branch ancestry and workflow inputs; write the complete regression/promotion/release plan; and register its remaining criteria before execution. Do not infer a release version or dist-tag before that inspection. Use the repository's required version ordering and promotion sequence.
+
+Completion of the expanded request requires all original issue evidence plus the full regression result, verified `main`/`preview` promotions, release publication and post-publication evidence for the actual released version and commit. Keep those claims separate. The host goal must not complete at sixteen issue closures alone. Retain the heartbeat for the handoff and stop it only once all authorized follow-up work is verified.
diff --git a/devlog/_fin/260919_contract_resolution/043_implementation_handoff.md b/devlog/_fin/260919_contract_resolution/043_implementation_handoff.md
new file mode 100644
index 00000000000..bc41cf59f51
--- /dev/null
+++ b/devlog/_fin/260919_contract_resolution/043_implementation_handoff.md
@@ -0,0 +1,22 @@
+# Implementation landing and release handoff
+
+All sixteen original implementation issues are closed. The final server/dashboard pair is #5185 (`e64d6994eb179dbc6f9e5c073bb1f110503a6247`) and #5197 (`ed44e04a933f6d4d62d2e049bf7606f08d347b06`). The latter's actual merge tree is `62883f3d4de5bc8c1cb3b1fe30aa8b04b5fb1ef5`, equal to inspected hosted checkout `600618e45242b88931d23bae8fe0e5e3f0576be2`. Dev ancestry was verified; #5118 closure was reread at2026-09-20T03:00:00Z.
+
+The source repair at278513a79e matches the independently approved six-file diff. All six added aggregate/bulk regression cases passed in hosted gates106006865376. The v3 hosted GUI artifact10596691936 was driven through twelve baseline states and aggregate toggle, aggregate partial failure/retry, Aside-only/mixed bulk, all-refused and partial-success/stale/refusal flows. Fifteen PNG hashes and actual operation/fingerprint request traces were checked; main directly viewed the captures. Fixture servers and owned browser tabs were cleaned up. This is fixture-rendered GUI evidence, with separate hosted backend regression evidence; it is not a live-backend or assistive-technology claim.
+
+## Explicit timing exception
+
+The owner requested immediate merge and release after the remaining platform status was reported. The coordinator integrated the reviewed current head under that timing direction while macOS jobs in run35483995896 remained unfinished. The decision is recorded at https://github.com/lidge-jun/opencodex/pull/5197#issuecomment-5747175119. This is not a complete CI-pass claim. Full hosted regression and release verification remain required before publication, and the current goal is not complete.
+
+## Non-blocking follow-up observations
+
+- ConsequenceDialog contains nested live regions; announcement behavior should be checked and the status markup simplified in a follow-up. This head does not claim that change.
+- The retained bulk-refusal test's final substring assertion is weaker than a notice-specific assertion. The implementation and actual v3 flow retain partial failure state, but that assertion should be strengthened in a follow-up.
+
+## Next authorized work
+
+Use the request-time main baseline134c92a01b120162f00c7275189cc47858720379 through the final integrated candidate for full hosted regression. Verify the repository's release/version ordering, promote through protected main/preview pull requests, publish through the canonical release workflow and verify the resulting registry/tag artifacts. Local suites, builds, installation and product runtime remain prohibited. Keep the heartbeat active through this follow-up and do not mistake sixteen issue closures for release completion.
+
+Later verification: run35483995896 attempt1 completed SUCCESS at source278513a79e, including all event-applicable jobs and both macOS shards. The earlier integration timing exception remains a historical fact; the formerly pending source-PR platform checks are now complete. Full main-through-candidate regression, promotion and release remain separate follow-up work.
+
+The still-open follow-up lives in [the regression and release unit](../../_plan/260920_regression_release/000_scope.md); this archive contains only the completed implementation record and its handoff.
diff --git a/devlog/_plan/260919_5008_antigravity_turn_ordering/000_upstream_contract_evidence.md b/devlog/_plan/260919_5008_antigravity_turn_ordering/000_upstream_contract_evidence.md
new file mode 100644
index 00000000000..ab8d9ba4d0e
--- /dev/null
+++ b/devlog/_plan/260919_5008_antigravity_turn_ordering/000_upstream_contract_evidence.md
@@ -0,0 +1,107 @@
+# #5008 — what the upstream actually validates
+
+Evidence gathered for the intermittent first-send 400 on `google-antigravity/gemini-3.8-flash`:
+"Please ensure that function call turn comes immediately after a user turn or after a function
+response turn." Sources are public and primary where one exists. Nothing here is a fix, and one
+finding contradicts an assumption the investigation started from.
+
+## Where the error comes from
+
+It is a Google service-layer `400 INVALID_ARGUMENT`, not a client-library check. The public Go,
+Python and Node clients carry the content types and serializers but not this string or its
+validator.
+
+- Direct Gemini API, same string:
+  <https://discuss.ai.google.dev/t/about-the-gemini-api-400-please-ensure-that-function-call-turns-come-immediately-after-a-user-turn-or-after-a-function-response-turn-error/46213>
+- Vertex/gRPC, `io.grpc.StatusRuntimeException: INVALID_ARGUMENT` then the same string:
+  <https://stackoverflow.com/questions/78574345/invalid-argument-using-langchain4j-tools-with-gemini-model>
+- The converse validator captured from `generativelanguage.googleapis.com/...:generateContent`:
+  "Please ensure that function response turn comes immediately after a function call turn."
+  <https://github.com/google-gemini/deprecated-generative-ai-js/issues/267>
+- The exact string captured from `daily-cloudcode-pa.googleapis.com/v1internal:streamGenerateContent`:
+  <https://github.com/router-for-me/CLIProxyAPI/issues/4959>
+
+For ordinary `generateContent` the validated object is the submitted `contents[]`, which Google
+describes as holding "the conversation history and the latest request"
+(<https://ai.google.dev/api/generate-content>).
+
+## The ordering the upstream considers valid
+
+The canonical loop is `user` then `model` carrying `functionCall` then `user` carrying every
+matching `functionResponse`.
+
+- A `user` turn carrying `functionResponse` parts counts as a function-response turn; current
+  Google examples use `role: "user"` for it, where older ones used `role: "function"`. That churn
+  explains contradictory cookbook examples.
+  <https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tools/function-calling>
+- Parallel calls need exactly one response each, together in the immediately following turn:
+  "Return exactly one `FunctionResponse` for each `FunctionCall` received."
+  <https://ai.google.dev/gemini-api/docs/whats-new-gemini-3.5>
+- Calls and responses must not interleave. Google documents `FC1 + signature, FC2, FR1, FR2` as
+  valid and `FC1, FR1, FC2, FR2` as a 400.
+  <https://ai.google.dev/gemini-api/docs/generate-content/thought-signatures>
+- **A model text-only turn immediately followed by a separate model `functionCall` turn is
+  invalid**: the call turn then follows a model turn, which is exactly what the error rejects.
+  Same-role adjacency is not forbidden by the protobuf schema, which only constrains role values,
+  but it is unsafe around function calling.
+
+## The finding that contradicts the starting assumption
+
+The issue was narrowed on the grounds that the reporter's A-F matrix all returned 200, so the
+translator's adjacency handling was unlikely to be at fault. Case A is exactly the shape above —
+`model(text)` then `model(functionCall)` — and the upstream contract says that shape is invalid.
+A near-identical report exists against another Antigravity proxy: Gemini 3.6/3.7 Flash failed
+after several tool rounds because a converted reasoning carrier became a model turn immediately
+before another model `functionCall`, while clean tool ordering and plain chat worked
+(<https://github.com/router-for-me/CLIProxyAPI/issues/4959>).
+
+`messagesToGeminiFormat` can emit that pair today: it pushes one `model` turn per assistant
+message, so a text-only assistant message followed by an assistant message carrying tool calls
+serializes as two adjacent model turns. That is a sourced structural candidate, and it is the
+first one this investigation has. It is not proof: a 200 on the reporter's isolated case A is a
+real observation too, and the two together suggest the rule is enforced conditionally rather than
+uniformly. Nothing here establishes which condition.
+
+Related long-session corruption mechanisms, all of them client-side rather than server-state:
+
+- orphaned `functionResponse` after a model turn carrying a call plus empty text was dropped:
+  <https://github.com/google-gemini/gemini-cli/issues/26956>
+- a projected request that began with model tool turns after MCP calls and large masked outputs:
+  <https://github.com/google-gemini/gemini-cli/issues/26472>
+- checkpoint/resume during pending tool execution producing incomplete call/response batches:
+  <https://github.com/google-gemini/gemini-cli/issues/4403>
+
+Gemini 3.5 Flash has separate intermittent function-call failures with large arguments, but those
+surface as `MAX_TOKENS` or `MALFORMED_FUNCTION_CALL`, not this ordering error
+(<https://github.com/googleapis/js-genai/issues/1619>).
+
+## The session-state hypothesis is unproven
+
+Cloud Code Assist demonstrably receives both the full history and a session identifier: Gemini
+CLI sends `contents: toContents(req.contents)` alongside `session_id: sessionId` and comments
+"Use sessionId as trajectoryId"
+(<https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/converter.ts>,
+<https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/server.ts>).
+A captured Antigravity request carries `contents`, `sessionId` and `requestType: "agent"` together
+(<https://github.com/router-for-me/CLIProxyAPI/issues/1675>).
+
+What no public source establishes is that `sessionId` indexes an authoritative server-side
+conversation ledger, or that Cloud Code Assist validates `contents[]` against one. Google
+documents the opposite default for stateless operation — "you must pass the full history of the
+conversation" — and exposes server-side continuation separately through the Interactions API's
+`previous_interaction_id` (<https://ai.google.dev/gemini-api/docs/function-calling>).
+"trajectoryId" is equally compatible with telemetry, agent association or routing.
+
+## Verdict
+
+Public evidence explains the error as validation of the serialized tool-call history, and it
+supplies several long-session corruption mechanisms on the client side. It does not explain an
+intermittent first-send 400 when the exact final Cloud Code Assist payload is independently
+valid. Server/client state divergence remains a hypothesis. The issue should stay open.
+
+## What was built on this evidence
+
+`src/adapters/google-wire-shape.ts` (PR #5079) projects the structure of the compiled request
+without its contents, so the next occurrence can be described from the request that actually
+failed. Its `call-turn-after-model-turn` class is the shape named above; the projection reports
+it and does not act on it. No translator change was made.
diff --git a/devlog/_plan/260920_regression_release/000_scope.md b/devlog/_plan/260920_regression_release/000_scope.md
new file mode 100644
index 00000000000..613c4875128
--- /dev/null
+++ b/devlog/_plan/260920_regression_release/000_scope.md
@@ -0,0 +1,11 @@
+# Regression and release follow-up
+
+Status: OPEN / queued for the next PABCD cycle after the completed sixteen-issue implementation unit closes. This scope record preserves the active work; it is not a claim of regression, promotion or publication completion.
+
+The owner explicitly authorized full hosted regression from request-time main134c92a01b120162f00c7275189cc47858720379 through the final integrated candidate, main/preview promotion and release publication. The implementation record is [archived separately](../../_fin/260919_contract_resolution/043_implementation_handoff.md). The overall goal and heartbeat remain active.
+
+Current release candidate version is2.60.0; revalidate the frozen candidate, existing registry/tag state and branch ancestry before executing. The repository's release authority is scripts/release.ts and .github/workflows/release.yml. Publishing requires an immutable expected-sha, the release branch's successful push CI, applicable service-lifecycle proof, and dev already ahead of the intended release. The dev-version-bump workflow prepares that prerequisite through a pull request.
+
+Remaining obligations: register the detailed next-cycle plan and acceptance criteria; freeze the candidate; run the full hosted regression lane including event-requested platform coverage; satisfy version ordering; promote through protected main/preview pull requests; run the canonical release workflow; verify the published version/tag/provenance and hosted package smoke. Record exact source, event, attempt and artifacts.
+
+Local product tests, typecheck, builds, installs and runtime/service execution remain prohibited. Do not replace missing hosted evidence with a claimed pass. Do not stop the heartbeat or complete the host goal at the implementation handoff.
diff --git a/docs-site/astro.config.mjs b/docs-site/astro.config.mjs
index df02daf48bc..29b5abb1e79 100644
--- a/docs-site/astro.config.mjs
+++ b/docs-site/astro.config.mjs
@@ -95,6 +95,7 @@ export default defineConfig({
             { label: "Codex Integration", translations: { fr: "Intégration de Codex", ko: "Codex 통합", "zh-CN": "Codex 集成", "zh-TW": "Codex 整合", ru: "Интеграция с Codex", ja: "Codex 連携", tr: "Codex Entegrasyonu" }, slug: "guides/codex-integration" },
             { label: "Codex App Model Picker", translations: { fr: "Sélecteur de modèles de Codex App", ko: "Codex App 모델 선택기", "zh-CN": "Codex App 模型选择器", "zh-TW": "Codex App 模型選擇器", ru: "Выбор модели в Codex App", ja: "Codex App モデルピッカー", tr: "Codex App Model Seçici" }, slug: "guides/codex-app-models" },
             { label: "Codex Prompt Layers", translations: { fr: "Couches d'invite Codex", ko: "Codex 프롬프트 레이어", "zh-CN": "Codex 提示词层", "zh-TW": "Codex 提示詞層", ru: "Слои промпта Codex", ja: "Codex プロンプトレイヤー", tr: "Codex İstem Katmanları" }, slug: "guides/codex-prompt" },
+            { label: "Native Context Compatibility", translations: { ko: "네이티브 컨텍스트 호환성" }, slug: "guides/codex-native-context" },
             { label: "Model Ordering", translations: { fr: "Ordre des modèles", ko: "모델 정렬에 관하여", "zh-CN": "模型排序", "zh-TW": "模型排序", ru: "Сортировка моделей", ja: "モデルの並び順", tr: "Model Sıralaması" }, slug: "guides/model-ordering" },
             { label: "Combos", translations: { fr: "Combinaisons", ko: "콤보", "zh-CN": "组合", "zh-TW": "組合", ru: "Комбо", ja: "コンボ", tr: "Kombolar" }, slug: "guides/combos" },
             { label: "Claude Code", translations: { fr: "Claude Code", ko: "Claude Code", "zh-CN": "Claude Code", "zh-TW": "Claude Code", ru: "Claude Code", ja: "Claude Code", tr: "Claude Code" }, slug: "guides/claude-code" },
diff --git a/docs-site/src/content/docs/fr/getting-started/quickstart.md b/docs-site/src/content/docs/fr/getting-started/quickstart.md
index 7adfd06f762..7a7c3f8cec3 100644
--- a/docs-site/src/content/docs/fr/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/fr/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` vous accompagne dans les étapes suivantes :
 
-1. **Choix d’un fournisseur** — sélectionnez l’un des 94 préréglages intégrés au registre, ou `custom` pour saisir une
+1. **Choix d’un fournisseur** — sélectionnez l’un des 95 préréglages intégrés au registre, ou `custom` pour saisir une
    URL de base et un adaptateur.
 2. **Clé API** — collez une clé ou référencez une variable d’environnement telle que `${ANTHROPIC_API_KEY}`.
 3. **Modèle par défaut** — pour les fournisseurs clés, locaux et personnalisés, acceptez le préréglage ou saisissez un identifiant de modèle.
diff --git a/docs-site/src/content/docs/fr/guides/integrations.md b/docs-site/src/content/docs/fr/guides/integrations.md
index 3162e0f7559..38fb208516d 100644
--- a/docs-site/src/content/docs/fr/guides/integrations.md
+++ b/docs-site/src/content/docs/fr/guides/integrations.md
@@ -134,6 +134,24 @@ Kimi Code, gjc, MiniMax Code et Raycast — documents YAML, JSON5 et TOML rééc
 d'opencodex ont été modifiées, le commutateur se verrouille et la désactivation est refusée plutôt que de
 deviner quelles modifications vous appartiennent.
 
+## Prévisualiser et confirmer les modifications
+
+Appliquer, Remplacer, Désactiver et Restaurer commencent désormais par un aperçu. La boîte de dialogue
+indique exactement quels réglages gérés vont changer, avec les chemins concernés dans les limites prévues
+et la nature de chaque modification : ajout, mise à jour ou suppression. Examinez ce plan avant de confirmer.
+
+Lorsqu’un plan n’indique aucune modification, cela signifie que le document client géré est déjà dans l’état
+demandé. Pour un profil Aside sélectionné, la confirmation peut tout de même enregistrer sa préférence de
+synchronisation, même si le document géré ne change pas.
+
+Si le fichier change après votre examen, l'écriture est refusée car le plan est devenu obsolète. La boîte de
+dialogue remplace l'ancien plan par le nouveau et vous demande de confirmer à nouveau ; elle ne relance jamais
+l'écriture automatiquement. Si l'aperçu est temporairement indisponible, rechargez normalement la page et
+recommencez l'action.
+
+Aside utilise le même flux d'aperçu et de confirmation pour un seul profil sélectionné à la fois. **Synchroniser
+tous les profils** reste une action groupée distincte et n'est pas liée à un aperçu combiné unique.
+
 ## À quoi s'attendre, en toute transparence
 
 **Le formatage n'est généralement pas préservé.** L'application analyse une configuration avant de la
diff --git a/docs-site/src/content/docs/fr/guides/providers.md b/docs-site/src/content/docs/fr/guides/providers.md
index 1024ca801ed..f34081cfcc5 100644
--- a/docs-site/src/content/docs/fr/guides/providers.md
+++ b/docs-site/src/content/docs/fr/guides/providers.md
@@ -131,6 +131,25 @@ ocx logout <provider>
 
 Les vérifications de quota Google Antigravity utilisent des points de terminaison Google fixes, y compris le repli vers la liste des modèles. Elles prennent en charge le DNS Fake-IP transparent pour ces destinations en conservant la vérification TLS, le refus des redirections et les contrôles des adresses privées. Une URL de base personnalisée ne modifie que les requêtes de modèles ; `NO_PROXY` conserve la politique de connexion directe.
 
+### Diagnostic de perte du schéma d’outil Google
+
+Les déclarations d’outils Google sont compilées selon la classe du point de terminaison sélectionné.
+Lorsque le débogage du fournisseur est activé — avec `ocx debug provider on`, le bouton Logs du
+tableau de bord ou `OCX_DEBUG=1` — la perte de schéma lors de la conversion de compatibilité sur le
+chemin où la politique est absente ou vaut `compatible` émet un enregistrement
+`[ocx:google:google-tool-schema-loss]` (à suivre avec `ocx debug provider logs -f`) ne contenant que
+la version du rapport, la classe du point de terminaison, un indicateur `lossy`, un compteur borné de
+comparaisons indéterminées, des catégories de perte fixes avec des compteurs bornés et un indicateur de troncature. Les noms d’outils et de
+propriétés, les chemins, les valeurs et le texte du schéma ne sont jamais inclus. Avec une politique
+absente ou `compatible`, ce diagnostic observe la conversion sans la refuser. Sous `reject-lossy`,
+une compilation initialement avec perte ou dont la comparaison bornée est indéterminée est refusée
+avant l’envoi ; aucun enregistrement de perte distinct n’est émis pour la requête refusée. Sous `reject-lossy`, une
+réparation Vertex ou Cloud Code Assist qui supprimerait des contraintes émet un enregistrement
+`google-tool-schema-repair` également sans contenu et renvoie le 400 d’origine sans nouvel envoi ;
+avec une politique absente ou `compatible`, la requête réparée est rejouée comme auparavant. AI Studio direct ne tente jamais cette réparation. Les schémas
+de sortie natifs restent hors de ces deux chemins. Consultez la
+[référence des commandes de débogage](/fr/reference/cli/agents/).
+
 
 Après un échec définitif d'actualisation de Nous, exécutez `ocx login nous` pour vous réauthentifier.
 
@@ -264,7 +283,7 @@ existante n'est pas concernée.
 
 ## 3. Catalogue des clés API
 
-opencodex fournit 94 préréglages intégrés : 78 à clé, 12 OAuth, trois locaux et un préréglage par défaut de
+opencodex fournit 95 préréglages intégrés : 79 à clé, 12 OAuth, trois locaux et un préréglage par défaut de
 transfert ChatGPT. Dans le tableau de bord, le sélecteur **Ajouter un fournisseur** ouvre le tableau de bord du
 fournisseur à clé, valide la clé et l'enregistre ; la validation dépend du fournisseur. Parmi les entrées notables :
 
@@ -359,7 +378,7 @@ restriction. Conditions en amont : [opencode.ai/docs/zen](https://opencode.ai/do
 
 La plupart utilisent l'adaptateur `openai-chat` avec une clé Bearer ; quelques fournisseurs qui n'exposent
 qu'un point de terminaison compatible Anthropic, comme **Xiaomi MiMo**, emploient l'adaptateur `anthropic`
-(`x-api-key`). Volcengine Agent Plan utilise son point de terminaison Responses natif par `openai-responses`.
+(`x-api-key`). Volcengine Coding Plan et Agent Plan utilisent leur point de terminaison Responses natif par `openai-responses`. Lors des continuations d'outils validées sur Ark Coding Plan, renvoyer l'élément `reasoning` retourné par le tour précédent provoque `400 InvalidParameter` ; le préréglage Coding Plan retire donc ces éléments avant de transmettre l'entrée de continuation. Cela perd l'état de raisonnement de ce tour et se désactive avec `dropResponsesReasoningItems: false`. Une configuration Coding Plan déjà enregistrée en `openai-chat` n'est pas réécrite et reste sur Chat : pour basculer, passez `adapter` à `openai-responses` et `responsesPath` à `/responses`, ou supprimez puis rajoutez le préréglage.
 Le préréglage DeepSeek intégré route également `deepseek-v4-flash` par son point de terminaison Responses natif
 et conserve le streaming SSE en amont. Si ce modèle termine tous les éléments de sortie mais omet l'événement
 Responses final, opencodex applique une réparation après un délai de grâce de cinq secondes, limitée à ce
diff --git a/docs-site/src/content/docs/fr/reference/cli/lifecycle.md b/docs-site/src/content/docs/fr/reference/cli/lifecycle.md
index 148febbf448..c134193f422 100644
--- a/docs-site/src/content/docs/fr/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/fr/reference/cli/lifecycle.md
@@ -15,7 +15,7 @@ Assistant de configuration interactif (`setup` est un alias de `init`). Il deman
 
 ### `ocx start [--port <port>] [--socks5 [host:port] | --socks5-off]`
 
-Démarre le serveur proxy, de préférence sur le port `10100`. La commande écrit l’état du PID et du port d’exécution, et refuse de démarrer une deuxième instance active. Lorsque le port préféré est occupé, `start` interroge le processus qui l’occupe puis s’arrête dans tous les cas : elle refuse de démarrer si un processus opencodex y répond et signale sinon que le processus est inconnu. Elle ne déplace jamais l’écouteur vers un autre port d’elle-même, car cela laisserait le premier proxy en cours d’exécution et redirigerait Codex vers le second. Indiquez un autre port avec `--port`, ou définissez `port: 0` dans la configuration pour demander au système d’exploitation d’en attribuer un. Au démarrage, elle synchronise dans le catalogue Codex les modèles de chaque fournisseur. À l’arrêt, elle rétablit le fonctionnement natif de Codex, sauf si le proxy a été lancé comme service géré (`OCX_SERVICE=1`).
+Démarre le serveur proxy, de préférence sur le port `10100`. La commande écrit l’état du PID et du port d’exécution, et refuse de démarrer une deuxième instance active. Lorsque le port préféré est occupé, `start` interroge le processus qui l’occupe puis s’arrête dans tous les cas : elle refuse de démarrer si un processus opencodex y répond et signale sinon que le processus est inconnu. Elle ne déplace jamais l’écouteur vers un autre port d’elle-même, car cela laisserait le premier proxy en cours d’exécution et redirigerait Codex vers le second. Un autre `--port` explicite est également refusé avec le même `OPENCODEX_HOME`, car les modes d’observation et de plafond écrivent tous deux dans le même journal de dépenses. Utilisez un `OPENCODEX_HOME` distinct pour une instance sœur indépendante ; `port: 0` ne sépare que l’attribution du port, pas l’état. Au démarrage, elle synchronise dans le catalogue Codex les modèles de chaque fournisseur. À l’arrêt, elle rétablit le fonctionnement natif de Codex, sauf si le proxy a été lancé comme service géré (`OCX_SERVICE=1`).
 
 `--socks5` (par défaut `127.0.0.1:10808`) enregistre l’URL SOCKS5 dans `config.proxy` et achemine
 les requêtes HTTP(S) sortantes dans un véritable tunnel SOCKS5. `--socks5-off` supprime uniquement
diff --git a/docs-site/src/content/docs/fr/reference/configuration/providers.md b/docs-site/src/content/docs/fr/reference/configuration/providers.md
index cb6601775d7..a96d502b6c4 100644
--- a/docs-site/src/content/docs/fr/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/fr/reference/configuration/providers.md
@@ -148,6 +148,7 @@ sauvegarde dont le contenu diffère, puis réécrit en identifiants sans préfix
 | `escapeBuiltinToolNames?` | `boolean` | Échapper aux noms d'outils intégrés pour les passerelles compatibles Anthropic et les restaurer lors des appels renvoyés. |
 | `anthropicEofTolerance?` | `boolean` | Laissez une passerelle compatible Anthropic compléter un flux qui se termine avant `message_stop`, uniquement lorsque du texte visible ou une entrée complète d'outil d'objet JSON a été reçue. Désactivé par défaut. |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Mode Google transport/auth. Par défaut `ai-studio`. |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Google uniquement. Une valeur absente ou `compatible` conserve le schéma compatible et la réparation 400 existante hors mode direct. `reject-lossy` refuse une perte initiale ou une comparaison bornée indéterminée avant l’envoi et bloque une réparation Vertex ou Cloud Code Assist qui ouvrirait des contraintes. AI Studio direct n’effectue jamais cette réparation. |
 | `project?` | `string` | ID du projet Vertex ou Antigravity Cloud Code Assist. |
 | `location?` | `string` | Région Vertex ; la valeur de repli de l'environnement est `GOOGLE_CLOUD_LOCATION`. |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | Cursor uniquement : serveurs MCP sur entrée-sortie standard ou HTTP diffusé en continu. |
@@ -168,9 +169,7 @@ proxy sortant, opencodex résout le nom d'hôte une seule fois et se connecte ex
 HTTPS conserve l'hôte d'origine, le SNI et la vérification du certificat ; la configuration du fournisseur ne peut pas désactiver
 ces contrôles.
 
-Lorsque `HTTP_PROXY`, `HTTPS_PROXY` ou `ALL_PROXY` s'applique, ces opérations conservent la fonction de récupération native de Bun.
-Les vérifications de l'URL et de l'adresse littérale sont toujours exécutées, mais le proxy choisit la route finale, la réponse DNS et l'homologue ;
-opencodex ne peut donc ni épingler ni vérifier cet homologue. Il s'agit d'une limitation de sécurité explicite.
+Ces opérations utilisent le [fetch sortant configuré du serveur](/fr/reference/configuration/server/). Un proxy SOCKS5 du serveur — défini avec `config.proxy` ou hérité d'un `ALL_PROXY` SOCKS5 — utilise le tunnel intégré d'OpenCodex lorsque la cible ne correspond pas à `NO_PROXY`. `HTTP_PROXY` et `HTTPS_PROXY` conservent le traitement HTTP(S) natif de Bun, tandis qu'un `ALL_PROXY` non SOCKS n'est pas une route du fetch HTTP natif. Les vérifications de l'URL et de l'adresse littérale sont toujours exécutées, mais le proxy sélectionné choisit la route finale, la réponse DNS et l'homologue ; opencodex ne peut donc ni épingler ni vérifier cet homologue. Il s'agit d'une limitation de sécurité explicite.
 
 Les destinations privées ou locales nécessitent `allowPrivateNetwork: true` et, lorsqu'un proxy sortant est actif,
 une entrée `NO_PROXY` correspondante. Le bouclage est ajouté automatiquement ; indiquez explicitement chaque hôte du réseau local, car
@@ -179,7 +178,7 @@ les adresses IPv6 entre crochets et `*` ; par exemple, indiquez explicitement `
 restent bloquées. Les requêtes de diagnostic rejettent les redirections et signalent une cible dont les identifiants ont été retirés. L'examen des
 redirections des requêtes ordinaires vers les fournisseurs reste distinct de cette protection de diagnostic.
 
-Deux accommodements fake-IP DNS existent pour les utilisateurs de Clash / Surge / Mihomo, et tous deux ne s'appliquent qu'aux *réponses* DNS — une adresse littérale dans l'URL reste rejetée. La plage de benchmark IANA `198.18.0.0/15` (et ses écritures IPv6 IPv4-mapped) est acceptée dès qu'un proxy sortant s'applique à l'hôte. La plage IPv6 fake-IP par défaut de Mihomo `fdfe:dcba:9876::/48` est acceptée sous une condition plus stricte : la variable de proxy correspondant au schéma de l'URL (`HTTPS_PROXY` pour `https:`, `HTTP_PROXY` pour `http:` ; `ALL_PROXY` ne compte pas) doit être définie, l'hôte ne doit pas correspondre à `NO_PROXY`, et la requête est alors explicitement liée à ce proxy. Tout autre ULA, un préfixe adjacent ou une réponse fake-IP mélangée à une vraie réponse privée exige toujours `allowPrivateNetwork: true`. La validation à l'enregistrement du fournisseur n'applique jamais l'accommodement IPv6.
+Deux accommodements fake-IP DNS existent pour les utilisateurs de Clash / Surge / Mihomo, et tous deux ne s'appliquent qu'aux *réponses* DNS — une adresse littérale dans l'URL reste rejetée. La plage de benchmark IANA `198.18.0.0/15` (et ses écritures IPv6 IPv4-mapped) est acceptée dès qu'un proxy sortant s'applique à l'hôte. La plage IPv6 fake-IP par défaut de Mihomo `fdfe:dcba:9876::/48` est acceptée sous une condition plus stricte : la variable de proxy correspondant au schéma de l'URL (`HTTPS_PROXY` pour `https:`, `HTTP_PROXY` pour `http:`) ou un `ALL_PROXY` SOCKS5 doit être définie (un `ALL_PROXY` non SOCKS ne compte pas), l'hôte ne doit pas correspondre à `NO_PROXY`, et la requête est alors explicitement liée à ce proxy. Tout autre ULA, un préfixe adjacent ou une réponse fake-IP mélangée à une vraie réponse privée exige toujours `allowPrivateNetwork: true`. La validation à l'enregistrement du fournisseur n'applique jamais l'accommodement IPv6.
 
 ## Groupe de comptes Codex
 
diff --git a/docs-site/src/content/docs/fr/reference/configuration/server.md b/docs-site/src/content/docs/fr/reference/configuration/server.md
index f0e4b9415a8..dd12ed399da 100644
--- a/docs-site/src/content/docs/fr/reference/configuration/server.md
+++ b/docs-site/src/content/docs/fr/reference/configuration/server.md
@@ -19,9 +19,10 @@ exécute des fonctionnalités d'assistance autour des demandes du fournisseur.
 | `shutdownTimeoutMs?` | `number` | `5000` | Délai de vidange gracieux avant l’annulation des tours actifs. |
 | `websockets?` | `boolean` | `false` | Annonce et autorise la route WebSocket Responses destinée aux clients. La valeur false maintient les clients sur HTTP/SSE ; elle ne désactive pas une optimisation WebSocket canonique admissible vers ChatGPT en amont. |
 | `corsAllowOrigins?` | `string[]` | `[]` | Origines exactes supplémentaires autorisées par CORS. Les origines de bouclage sont toujours autorisées. Les origines d'extensions de navigateur basées sur l'autorité telles que `chrome-extension://<extension-id>` sont prises en charge ; `*` n'est pas un caractère générique. Firefox et Safari régénèrent l'extension UUID (par installation / par lancement de navigateur), mettez donc à jour l'entrée lorsque l'origine change. |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | Identifiants `ocx_…` générés, acceptés par l'API de gestion et l'authentification du plan de données sur les liaisons hors bouclage. Gérés depuis le tableau de bord. |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | Identifiants `ocx_…` générés pour l'admission au plan de données sur les liaisons hors bouclage. Ils n'autorisent pas les API de gestion ; l'accès à la gestion utilise l'identifiant distinct décrit dans la [référence de l'API de gestion](/fr/reference/management-api/). Gérés depuis le tableau de bord. |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | désactivé | Politique facultative de nettoyage des sessions archivées. Elle n'est jamais activée implicitement. |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | Plafond en Mio pour les journaux, caches, objets binaires et charges utiles de continuation évincables qui appartiennent à l'application. Plage : 64–4096 ; il ne s'agit pas d'un plafond RSS. |
+| `metricsExport.enabled?` | `boolean` | `false` | Active les métriques de requêtes agrégées, locales au processus, sur `GET /api/metrics` authentifié. Redémarrage requis ; lorsque désactivé, le chemin renvoie 404 et aucune activité d'export n'est démarrée. |
 | `codexAutoStart?` | `boolean` | `true` | Autorise le lanceur intermédiaire Codex à exécuter `ocx ensure` avant de démarrer Codex. Avec la valeur false, cette vérification ne fait rien. |
 | `codexShimAutoRestore?` | `boolean` | `true` | Restaure le lanceur intermédiaire installé après son remplacement par une mise à jour externe de Codex terminée. Désactivation par variable d'environnement : `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. |
 | `syncResumeHistory?` | `boolean` | `true` | Compatibilité historique Codex App réversible. Les métadonnées originales sont sauvegardées et restaurées par `ocx stop` / `ocx restore`. |
diff --git a/docs-site/src/content/docs/fr/reference/management-api.md b/docs-site/src/content/docs/fr/reference/management-api.md
index 8bd738a0c4d..0ce8ea8003b 100644
--- a/docs-site/src/content/docs/fr/reference/management-api.md
+++ b/docs-site/src/content/docs/fr/reference/management-api.md
@@ -103,6 +103,53 @@ Pour comprendre la liste de modèles et le comportement chiffré des tâches con
 | `GET /api/client-integrations/journal?client=...` | Lister les opérations de restauration, éventuellement pour un seul client. Chaque ligne contient le champ `deletable` calculé par le serveur. | 400 client invalide |
 | `DELETE /api/client-integrations/journal?opId=...` | Retirer une ancienne opération et supprimer son instantané si possible. La réponse contient `snapshotRemoved` ; `false` conserve le nettoyage pour une nouvelle tentative de maintenance. | 400 `opId` absent ; 404 opération absente ou déjà retirée ; 409 opération la plus récente du client |
 
+## Prévisualiser une modification d'intégration
+
+Une prévisualisation montre ce qu'une modification ferait sans la faire. Ces routes n'écrivent
+rien : ni instantané, ni enregistrement de propriété, ni ligne de journal, ni verrou, ni
+maintenance, ni récupération.
+
+| Méthode et chemin | Objet | Erreurs notables |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | Planifier `apply`, `overwrite` ou `disable` pour un client ; corps `{ "clientId": "...", "operation": "..." }` | 400 client ou opération invalide ; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | Planifier une annulation ; corps `{ "opId": "...", "confirmDrift": false }` | 404 opération inconnue ; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Planifier la modification d'un seul profil Aside ; `restore` exige un `opId` | 400 corps invalide ou profil non précisé ; 404 profil ou opération inconnus; 409 `integration_preview_unavailable` |
+
+Un plan contient `version`, `clientId`, `operation`, `state`, `foreignEdit`, une liste `changes`
+de paires `kind` et `path`, une empreinte `fingerprint` opaque, `canApply`, `willChange`, ainsi
+que `refusalReason` et `profileId` facultatifs. Les chemins sont des chemins de schéma gérés ou
+les marqueurs fixes `$snapshot`, `$ownership` et `$journal` ; une position déterminée à
+l'exécution apparaît comme `*`. Aucune valeur de configuration, aucun emplacement de fichier et
+aucune identité d'élément sélectionné n'est renvoyé.
+
+`canApply` à vrai avec `willChange` à faux signifie que l'opération réussit sans rien changer
+dans le document client géré, par exemple appliquer ce qui est déjà appliqué.
+
+Une modification de profil Aside enregistre tout de même une chose dans ce cas : la confirmation
+enregistre la préférence de synchronisation du profil avant de toucher au moindre document client.
+Désactiver un profil dont le bloc géré est déjà absent enregistre donc la préférence et laisse le
+document et son historique intacts.
+
+`integration_preview_unavailable` indique qu'aucune liste de modèles utilisable n'est actuellement
+conservée : un proxy qui vient de démarrer est un cas, une liste abandonnée parce que la
+configuration ou le cache de fournisseurs a changé en est un autre. Lire
+`GET /api/client-integrations` en établit une lorsque la découverte réussit et que la
+configuration peut être identifiée ; c'est le remède habituel, pas une garantie.
+
+## Confirmer une modification prévisualisée
+
+Les routes de modification acceptent `operation` et `planFingerprint` à côté de leur corps
+habituel. Envoyez les deux ou aucun : une requête n'en portant qu'un est rejetée, tout comme une
+requête dont l'`operation` contredit la modification demandée. Une liaison Aside porte sur un seul
+profil, car une empreinte ne peut pas décrire plusieurs fichiers qui changent indépendamment.
+
+Le serveur replanifie avant d'écrire et renvoie `409 integration_preview_stale` avec un `plan`
+recalculé lorsque la confirmation ne décrit plus ce qui se produirait. Décidez de nouveau d'après
+ce plan ; la requête n'est pas réessayée automatiquement.
+
+Une empreinte est une vérification optimiste, jamais une autorisation. L'authentification de l'API
+d'administration et les règles de propriété décident seules si une modification peut avoir lieu.
+
 La suppression ajoute une pierre tombale au lieu de réécrire le journal. Le serveur protège
 l'opération la plus récente de chaque client afin de conserver le point d'annulation actuel.
 
@@ -145,6 +192,7 @@ Voir [Combos](/fr/guides/combos/) pour les stratégies cibles, les temps de rech
 | `GET /api/debug/injection-logs` | Lire un nombre limité d'entrées de débogage de l'injection du guidage | — |
 | `GET /api/claude/inbound-debug` | Lire l'état et les entrées du débogage entrant | — |
 | `GET /api/usage` | Résumer l'utilisation par période et par interface cliente ; les réponses Codex comprennent aussi une ventilation `accounts` indexée par des libellés de journalisation stables ne contenant aucune donnée personnelle | Renvoie un résumé `error: "read_failed"` si le stockage ne peut pas être lu |
+| `GET /api/metrics` | Renvoyer les métriques texte Prometheus locales au processus : requêtes logiques, envois physiques, types de récupération, durée et TTFT. Les libellés sont limités au protocole, au résultat et à la classe de récupération ; aucun identifiant de requête ou d'identifiant secret n'est exporté. | 404 si `metricsExport.enabled` n'était pas vrai au démarrage ; l'authentification de gestion est obligatoire et les identifiants du plan de données ne donnent aucun accès |
 | `GET /api/storage` | Analyser l'utilisation du stockage Codex par catégorie | Renvoie une charge utile `error: "scan_failed"` en cas d'échec de l'analyse |
 | `POST /api/storage/cleanup/preview` | Prévisualiser le nettoyage des sessions archivées et renvoyer une empreinte contraignante | 400 `invalid_json` ou `invalid_percent` |
 | `POST /api/storage/cleanup` | Mettre en quarantaine ou supprimer définitivement l'ensemble archivé prévisualisé | 400 saisie invalide ; 409 état obsolète, occupé ou référencé ; 500 échec du système de fichiers ou de la base de données |
diff --git a/docs-site/src/content/docs/getting-started/quickstart.md b/docs-site/src/content/docs/getting-started/quickstart.md
index de2fd9a229e..042eb183045 100644
--- a/docs-site/src/content/docs/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` walks you through:
 
-1. **Pick a provider** — choose one of the 94 built-in registry presets or `custom` to type a base
+1. **Pick a provider** — choose one of the 95 built-in registry presets or `custom` to type a base
    URL and adapter.
 2. **API key** — paste a key, or reference an environment variable like `${ANTHROPIC_API_KEY}`.
 3. **Default model** — for key, local, and custom providers, accept the preset or enter a model id.
diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md
index 1039979e57f..66e28cb9ab2 100644
--- a/docs-site/src/content/docs/guides/codex-integration.md
+++ b/docs-site/src/content/docs/guides/codex-integration.md
@@ -370,6 +370,12 @@ disk, and entry ceilings; this does not recover history the client no longer has
 must handle the error explicitly and resend their full context without `previous_response_id`.
 Retrying only the same ID cannot recover missing state.
 
+The same refusal applies when the referenced state belongs to a different client task scope,
+including when the new request appears to carry complete input. The proxy cannot prove that input
+is complete, so it does not silently remove `previous_response_id` or reveal whether matching state
+exists. Retry with the complete conversation and omit `previous_response_id`; matching scopes and
+legacy continuations where both scopes are absent or blank continue to replay normally.
+
 The same recovery signal applies to every routed destination, because only the native Responses
 passthrough can answer a turn whose history this proxy lost — it forwards `previous_response_id`
 to a backend that stored the chain. Every other wire rebuilds the conversation from each request's
diff --git a/docs-site/src/content/docs/guides/codex-native-context.md b/docs-site/src/content/docs/guides/codex-native-context.md
new file mode 100644
index 00000000000..3252ea579e2
--- /dev/null
+++ b/docs-site/src/content/docs/guides/codex-native-context.md
@@ -0,0 +1,125 @@
+---
+title: Native context compatibility
+description: Eligibility, authenticated trial configuration, and limits of the Codex history and notes relay.
+---
+
+OpenCodex already relays native Codex history and notes. This is not a general memory service
+for routed providers, and exposing its HTTP endpoints does not establish that a particular
+Codex build, account, or model can use them. See [Codex integration](/guides/codex-integration/)
+for the relay's ownership, cancellation, and credential boundaries.
+
+## Two independent requirements
+
+Codex must activate the extension, and OpenCodex must identify the caller. Changing the backend
+URL solves neither requirement by itself.
+
+The inspected upstream Codex contract requires a model whose native catalog entry advertises
+`supports_experimental_context`, an eligible ChatGPT login, and a provider named exactly
+`OpenAI` with a base URL ending in `/backend-api/codex`. Its automatic activation rejects
+providers using `env_key`, `experimental_bearer_token`, command-backed `auth`, or AWS auth.
+The inspected eligibility predicate accepts ChatGPT Plus, Pro, and ProLite; this is not a claim
+that every account on those plans has working backend history endpoints.
+
+OpenCodex additionally requires an active **data-plane API key** on both the successful model
+request and the subsequent context requests. Default built-in loopback injection does not send
+that key, so it can serve models while context calls fail with `context_principal_required`
+(403). The authenticated remote provider-table form alone is not a native-context solution
+either: its `env_key` and provider name do not satisfy the Codex activation contract above.
+Never remove the principal or account-ownership checks to hide either problem.
+
+## Explicit opt-in syntax
+
+OpenCodex accepts both persisted root feature forms that Codex's `FeatureToml` accepts:
+
+```toml
+[features]
+context_management = true
+```
+
+The equivalent table form also works and is the compatible spelling for older OpenCodex
+versions that did not yet recognize the boolean form:
+
+```toml
+[features.context_management]
+experimental_mode = true
+```
+
+Use one form, not both. False, absent, and malformed values remain off. The proxy reads its own
+Codex home configuration; a CLI-only override or an opt-in present only inside a Codex profile
+does not enable its runtime gate. This change does not infer opt-in from model metadata.
+
+## Authenticated native trial profile
+
+This is a **source-checked trial configuration, not a real-account end-to-end certification**.
+Back up the Codex configuration and keep a durable task checkpoint before testing. Use a new,
+throwaway thread; do not change the provider identity of an existing working thread.
+
+Supply an existing active OpenCodex data-plane key in `OCX_CONTEXT_API_KEY` in the environment
+of the Codex process. Do not use a management/admin token or store the key in TOML. A service's
+environment is not automatically inherited by a separately launched desktop application.
+Keep the normal native Codex ChatGPT login available; the extra header does not replace OAuth.
+
+With the root feature opt-in above, the canonical ChatGPT forward provider configured in
+OpenCodex, and a current native model catalog, merge this **additional** provider and profile
+into the same Codex config. Adjust the port to the actual local proxy. Leave the root
+`model_provider` and existing provider tables unchanged.
+
+```toml
+[model_providers.ocx-native-context]
+name = "OpenAI"
+base_url = "http://127.0.0.1:10100/backend-api/codex"
+wire_api = "responses"
+requires_openai_auth = true
+supports_websockets = false
+env_http_headers = { "x-opencodex-api-key" = "OCX_CONTEXT_API_KEY" }
+
+[profiles.ocx-native-context]
+model_provider = "ocx-native-context"
+model = "gpt-6-astra"
+```
+
+Start a new CLI thread with `codex --profile ocx-native-context`. The example uses HTTP/SSE to
+keep the initial trial on the model-to-relay ownership path; it does not change the transport
+of other profiles or certify WebSocket/mid-turn-steering parity. Use the model only when the
+account's native catalog actually advertises its context capability; never force that flag
+onto a Devin, Gemini, or other routed row.
+
+The custom provider ID is intentional. Upstream Codex does not generally override built-in
+providers from `model_providers.openai`; adding an extra header there can be silently ineffective.
+The custom ID preserves the normal provider, while the exact `OpenAI` name satisfies the native
+backend predicate. Do not add `env_key` to this profile: `env_http_headers` carries local admission
+separately while `Authorization` continues to carry the native ChatGPT login. OpenCodex consumes
+the local key; it does not forward that key to ChatGPT.
+
+The root opt-in also affects other eligible native profiles. **During this trial, do not continue
+ordinary built-in loopback threads that lack the extra key.** Turn the root feature off and run
+`ocx sync` before returning to those threads. This is not an automatic or default integration
+change, and this CLI profile is not a claim about desktop profile-selection support.
+
+## Verify before resetting context
+
+First obtain a successful native model response in the new thread. Then verify a note write,
+read the same note back, and query that thread's history. Only after those operations succeed
+should a disposable test use `new_context` and check that the saved state can be recovered.
+Keep the external checkpoint even when the trial succeeds.
+
+- **403 `context_principal_required`:** no valid local data-plane key reached the proxy.
+- **409 `context_account_unavailable`:** ownership is missing or inconsistent; do not substitute
+  the current active account or retry a write blindly.
+- **404:** distinguish the proxy's disabled/unknown-endpoint response from an upstream 404.
+  The latter is not proof of an OpenCodex routing defect or an account-wide outage.
+
+A successful model call or `ocx ready` is not proof that notes, history, or state restoration
+works. Model routing, account changes, proxy restarts, and upstream endpoint availability remain
+separate concerns. No local flag can grant missing backend eligibility, and a failed context
+operation must not be reported as a successful reset. Remove the trial tables and unset the
+trial key when finished; leave the feature disabled unless using a verified authenticated path.
+
+## Upstream contracts inspected
+
+These links pin the source contract used for the configuration above, not a deployment promise:
+
+- [FeatureToml boolean/table forms](https://github.com/openai/codex/blob/78245b47af2a7aafcabe025828ceecca69db4df1/codex-rs/features/src/lib.rs)
+- [Native context eligibility](https://github.com/openai/codex/blob/78245b47af2a7aafcabe025828ceecca69db4df1/codex-rs/core/src/session/token_budget.rs)
+- [Provider identity and built-in merge rules](https://github.com/openai/codex/blob/78245b47af2a7aafcabe025828ceecca69db4df1/codex-rs/model-provider-info/src/lib.rs)
+- [History/notes use the provider's request headers and authentication](https://github.com/openai/codex/blob/78245b47af2a7aafcabe025828ceecca69db4df1/codex-rs/ext/history-notes/src/backend.rs)
diff --git a/docs-site/src/content/docs/guides/integrations.md b/docs-site/src/content/docs/guides/integrations.md
index a62114e8f32..32263f12a67 100644
--- a/docs-site/src/content/docs/guides/integrations.md
+++ b/docs-site/src/content/docs/guides/integrations.md
@@ -200,6 +200,24 @@ undoable. The switch itself stays locked, because the switch cannot know which e
 you meant to keep — only you can say so. Nothing else is relaxed: a file we cannot
 parse, or one whose structure we cannot reason about, still refuses.
 
+## Preview and confirm changes
+
+Apply, Replace, Disable, and Restore now begin with a preview. The dialog shows exactly which
+managed settings will change, including the bounded change paths and whether each change adds,
+updates, or removes a value. Review that plan before confirming.
+
+When a plan reports no changes, it means the managed client document already has the requested
+state. For a selected Aside profile, confirming can still save that profile's sync preference even
+though the managed document does not change.
+
+If the file changes after you review it, the write is refused as stale. The dialog replaces the
+old plan with the updated one and asks you to confirm again; it never retries the write
+automatically. If a preview is temporarily unavailable, reload the page normally and start the
+action again.
+
+Aside uses the same preview and confirmation flow for one selected profile at a time. **Sync all
+profiles** remains a separate bulk action and is not bound to one combined preview.
+
 ## What to expect, honestly
 
 **Formatting is generally not preserved.** Applying parses a config and writes it back
diff --git a/docs-site/src/content/docs/guides/model-routing.md b/docs-site/src/content/docs/guides/model-routing.md
index b9f1a6b34da..ac8e6ae62bb 100644
--- a/docs-site/src/content/docs/guides/model-routing.md
+++ b/docs-site/src/content/docs/guides/model-routing.md
@@ -91,6 +91,10 @@ Routing and catalog visibility are separate controls:
   deliberately inert for them.
 - `provider.disabled: true` removes that provider from catalog discovery. Explicit
   `provider/model` requests fail, and `defaultModel` / `models[]` scans skip it.
+- Routed catalog rows are cloned from the Codex-native template, so native-only delivery flags are
+  stripped during normalization: `supports_websockets`, `supports_reasoning_summaries`, and
+  `supports_experimental_context`. A routed provider never inherits the experimental-context
+  contract; inheriting it made Codex compact after nearly every step on long routed threads.
 - `providerContextCaps` applies per-provider Codex-visible context caps. `contextCapValue` is the
   dashboard default (350,000 by default), but it does nothing by itself until a provider is
   present in `providerContextCaps`. Changing the dashboard value updates every enabled cap
diff --git a/docs-site/src/content/docs/guides/providers.md b/docs-site/src/content/docs/guides/providers.md
index 90e192a97ae..cd5b5c8b61c 100644
--- a/docs-site/src/content/docs/guides/providers.md
+++ b/docs-site/src/content/docs/guides/providers.md
@@ -209,6 +209,23 @@ ocx logout <provider>
 
 Google Antigravity account and provider quota probes use fixed Google accounting endpoints, including the models fallback. They support transparent Fake-IP DNS for those destinations while retaining TLS verification, redirect rejection and private-address checks. A custom provider base URL changes model requests, not quota destinations; `NO_PROXY` continues to select the direct-route policy.
 
+### Google tool-schema loss diagnostics
+
+Google tool declarations are compiled against the selected endpoint class. When provider debug is
+on — `ocx debug provider on`, the dashboard Logs toggle, or `OCX_DEBUG=1` — schema loss during compatibility
+conversion on the omitted or `compatible` policy path emits a `[ocx:google:google-tool-schema-loss]`
+record (tail with `ocx debug provider logs -f`)
+carrying only the report version, endpoint class, a `lossy` indicator, a bounded uncertainty count,
+fixed loss categories with bounded counts, and a truncation flag. Tool and property names, paths, values, and schema text are
+never included. With an omitted or `compatible` policy, this diagnostic observes the existing
+conversion without rejecting it. Under `reject-lossy`, an initially lossy or comparison-indeterminate
+compilation is refused before dispatch; no separate loss record is emitted for the refused request. Under
+`reject-lossy`, a Vertex or Cloud Code Assist repair that would erase constraints emits a similarly
+content-free `google-tool-schema-repair` record and returns the original 400 without a changed send;
+with an omitted or `compatible` policy, the repaired request is replayed as before. Direct AI
+Studio never performs this repair. Native output schemas are outside both policy paths. See the
+[debug command reference](/reference/cli/agents/).
+
 
 After a terminal Nous refresh failure, run `ocx login nous` to reauthenticate.
 
@@ -542,8 +559,14 @@ stays as documentation of the restriction. Upstream terms:
 
 Most use the `openai-chat` adapter with a bearer key; a few that expose only an Anthropic-compatible
 endpoint (e.g. **Xiaomi MiMo**) use the `anthropic` adapter (`x-api-key`).
-Volcengine Agent Plan uses its native Responses endpoint through `openai-responses`.
-The built-in DeepSeek preset also routes `deepseek-v4-flash` over its native Responses endpoint and
+Volcengine Coding Plan and Agent Plan use their native Responses endpoints through `openai-responses`.
+During validated Ark Coding Plan tool continuations, replaying the returned Responses `reasoning` item
+answered `400 InvalidParameter`, so the Coding Plan preset drops replayed reasoning items before
+forwarding continuation input; that is lossy, and `dropResponsesReasoningItems: false` turns it off.
+An install that already saved the Coding Plan provider on `openai-chat` keeps that wire — nothing
+rewrites a stored row — so switching is a deliberate edit: set `adapter` to `openai-responses` and
+`responsesPath` to `/responses`, or delete and re-add the preset. Explicit per-model `openai-chat`
+overrides remain available either way. The built-in DeepSeek preset also routes `deepseek-v4-flash` over its native Responses endpoint and
 keeps upstream SSE streaming enabled. If that model finishes every output item but omits the final
 Responses event, opencodex applies a five-second model-scoped grace repair; malformed or partial
 streams close as incomplete rather than being reported as successful.
@@ -686,6 +709,12 @@ instead, where the same key is visible. A pasted key faces the same format check
 same live validation against the Model API as an imported one. See
 [Platform support](/reference/platform-support/) for the full per-platform picture.
 
+Both seeded `meta-muse` models expose `minimal`/`low`/`medium`/`high`/`xhigh`/`max` to
+routed clients, including Grok's effort picker. Requests use
+`User-Agent: muse-build/1.3.0 (opencodex compatibility)` so Meta accepts the Muse Code
+effort contract. An explicit provider User-Agent overrides this default and may cause
+`max` to be rejected. The `meta-model` and OpenCode Go effort ladders remain unchanged.
+
 **Read this before enabling it.** Meta scopes that credential to the Muse Code CLI, so
 using it here is an *unsupported* path. Meta does not authorize subscription coverage
 outside its own client, how these calls settle is not observable from the API, and you
@@ -971,8 +1000,11 @@ is not supported directly.
 
 Provider configuration selects the adapter; upstream transport selection is separate. Eligible
 Responses traffic can use WSS with [explicit proxy routing](/reference/proxy-formats/#json-and-sse-output).
-Invalid or unsupported WebSocket proxy settings fall back to HTTP/SSE, which uses Bun's HTTP
-proxy rules rather than the WSS-specific `ALL_PROXY` fallback.
+Invalid or unsupported WebSocket proxy settings fall back to HTTP/SSE, which uses the
+[server's configured outbound fetch](/reference/configuration/server/). A server SOCKS5 proxy from
+`config.proxy` or an inherited SOCKS5 `ALL_PROXY` uses the built-in tunnel when `NO_PROXY` does
+not exempt the target. Scheme-specific HTTP(S) proxy variables retain their separate native handling; non-SOCKS
+`ALL_PROXY` is not a native HTTP fetch route.
 
 **GitHub Copilot** is an OAuth provider (`ocx login github-copilot`) that exchanges a GitHub
 device-flow login for a short-lived Copilot API token — not a pasted API key. **GitLab Duo** remains
diff --git a/docs-site/src/content/docs/ja/getting-started/quickstart.md b/docs-site/src/content/docs/ja/getting-started/quickstart.md
index 2bfa90f2c82..f9184dfc5f6 100644
--- a/docs-site/src/content/docs/ja/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/ja/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` では次の手順を説明します。
 
-1. **プロバイダーを選択してください** — 94 個の組み込みレジストリプリセットのいずれか、または `custom` を選択してベース URL とアダプターを入力します。
+1. **プロバイダーを選択してください** — 95 個の組み込みレジストリプリセットのいずれか、または `custom` を選択してベース URL とアダプターを入力します。
 2. **API キー** — キーを貼り付けるか、`${ANTHROPIC_API_KEY}` のような環境変数を参照します。
 3. **デフォルト モデル** — キー、ローカル、カスタム プロバイダーの場合は、プリセットを受け入れるか、モデル ID を入力します。
 4. **プロキシ ポート** — デフォルトは `10100` です。
diff --git a/docs-site/src/content/docs/ja/guides/providers.md b/docs-site/src/content/docs/ja/guides/providers.md
index f8c8e553119..f60ba96b0e6 100644
--- a/docs-site/src/content/docs/ja/guides/providers.md
+++ b/docs-site/src/content/docs/ja/guides/providers.md
@@ -120,6 +120,23 @@ ocx logout <provider>
 
 Google Antigravity のアカウント・プロバイダーのクォータ確認は、モデル一覧へのフォールバックも含め、固定の Google エンドポイントを使用します。その宛先では透過 Fake-IP DNS に対応し、TLS 検証、リダイレクト拒否、プライベートアドレス検査を維持します。カスタム base URL はモデル要求にのみ適用されます。`NO_PROXY` は直接接続のポリシーを維持します。
 
+### Google ツールスキーマ損失診断
+
+Google のツール宣言は、選択されたエンドポイントクラスに合わせてコンパイルされます。
+`ocx debug provider on`、ダッシュボードの Logs トグル、または `OCX_DEBUG=1` でプロバイダー
+デバッグを有効にすると、ポリシーの省略時または `compatible` の互換性変換でのスキーマ損失は
+`[ocx:google:google-tool-schema-loss]` レコードを出力します（`ocx debug provider logs -f` で
+追跡できます）。レコードに含まれるのは、レポートのバージョン、エンドポイントクラス、
+`lossy` インジケーター、判定不能な比較の上限付き件数、上限付き件数を伴う固定の損失カテゴリ、切り詰めフラグだけです。
+ツール名、プロパティ名、パス、値、スキーマ本文は含まれません。ポリシーの省略時または
+`compatible` では変換を拒否せず観測します。`reject-lossy` では、初期コンパイルに損失がある場合、
+または上限付き比較が判定不能な場合、送信前に拒否します。拒否されたリクエストに別の損失レコードは
+出力されません。`reject-lossy` では、制約を消す Vertex または Cloud Code Assist の修復は同様に内容を含まない
+`google-tool-schema-repair` を出力し、変更送信を行わず元の 400 を返します。ポリシーの省略時または
+`compatible` では、修復済みリクエストを従来どおり再送します。直接 AI Studio は
+この修復を行いません。ネイティブ出力スキーマは両方のポリシー経路の対象外です。
+[デバッグコマンドのリファレンス](/ja/reference/cli/agents/)も参照してください。
+
 
 Nous の refresh が終端失敗した場合は、再認証に `ocx login nous` を実行してください。
 
@@ -168,7 +185,7 @@ Kiro のログインには Kiro CLI が必要です。Unix では `curl -fsSL ht
 
 ## 3. API キーカタログ
 
-opencodex には組み込みプリセットが 94 個含まれています。キー方式 78、OAuth 12、ローカル 3、
+opencodex には組み込みプリセットが 95 個含まれています。キー方式 79、OAuth 12、ローカル 3、
 デフォルト ChatGPT 転送プリセット 1 です。ダッシュボードの **Add provider** ピッカーはキー発行ページを開き、
 入力したキーを検証した後保存します(検証はプロバイダー固有です)。主な項目は以下のとおりです:
 
@@ -242,7 +259,7 @@ Cline IDE/CLI のみで API からは使えません。`minimax/minimax-m2.5` 
 
 大半は bearer キーと共に `openai-chat` アダプターを使い、Anthropic 互換エンドポイントのみを公開する一部
 (例: **Xiaomi MiMo**)は `anthropic` アダプター(`x-api-key`)を使います。
-Volcengine Agent Plan は `openai-responses` アダプターでネイティブ Responses エンドポイントを使用します。
+Volcengine Coding Plan と Agent Plan は `openai-responses` アダプターでネイティブ Responses エンドポイントを使用します。検証済みの Ark Coding Plan のツール継続では、前のターンが返した Responses の `reasoning` item をそのまま返すと `400 InvalidParameter` になるため、Coding Plan プリセットは継続入力を転送する前にその item を取り除きます。そのターンの reasoning 状態は失われるので、`dropResponsesReasoningItems: false` で無効にできます。すでに `openai-chat` で保存されている Coding Plan の設定は書き換えられず Chat のままです。切り替えるときは `adapter` を `openai-responses` に、`responsesPath` を `/responses` に手動で変更するか、プリセットを削除して追加し直してください。
 
 > **Volcengine の 3 つの課金経路:** `volcengine` は従量課金 Ark API、
 > `volcengine-coding-plan` は Coding Plan の割り当て、`volcengine-agent-plan` は Agent Plan
diff --git a/docs-site/src/content/docs/ja/reference/cli/lifecycle.md b/docs-site/src/content/docs/ja/reference/cli/lifecycle.md
index 6939c537d00..bf37bc911b6 100644
--- a/docs-site/src/content/docs/ja/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/ja/reference/cli/lifecycle.md
@@ -15,7 +15,7 @@ description: セットアップ、開始、停止、サービス、診断、同
 
 ### `ocx start [--port <port>] [--socks5 [host:port] | --socks5-off]`
 
-プロキシ サーバー (優先ポート `10100`) を起動します。PID/ランタイムポートの状態を書き込み、2 番目のライブインスタンスの起動を拒否します。優先ポートが使用中の場合、`start` はそのポートを使用しているプロセスを確認して、どちらの場合も停止します。opencodex が応答していれば起動を拒否し、それ以外は使用しているプロセスを特定できないと報告します。最初のプロキシを実行したまま Codex を 2 番目のプロキシへ向けることになるため、自動でリスナーを別のポートへ移すことはありません。別のポートは `--port` で指定するか、設定で `port: 0` を指定して OS に割り当てを依頼してください。開始時に、各プロバイダーのモデルを Codex のカタログに同期します。マネージド サービス (`OCX_SERVICE=1`) として起動されていない限り、シャットダウン時にネイティブ Codex が復元されます。
+プロキシ サーバー (優先ポート `10100`) を起動します。PID/ランタイムポートの状態を書き込み、2 番目のライブインスタンスの起動を拒否します。優先ポートが使用中の場合、`start` はそのポートを使用しているプロセスを確認して、どちらの場合も停止します。opencodex が応答していれば起動を拒否し、それ以外は使用しているプロセスを特定できないと報告します。最初のプロキシを実行したまま Codex を 2 番目のプロキシへ向けることになるため、自動でリスナーを別のポートへ移すことはありません。同じ `OPENCODEX_HOME` では別の `--port` を明示しても拒否されます。監視のみの構成も上限を適用する構成も同じ支出ジャーナルへ書き込むためです。独立した sibling には別の `OPENCODEX_HOME` を使用してください。`port: 0` はポートだけを OS に割り当てさせ、状態を分離しません。開始時に、各プロバイダーのモデルを Codex のカタログに同期します。マネージド サービス (`OCX_SERVICE=1`) として起動されていない限り、シャットダウン時にネイティブ Codex が復元されます。
 
 `--socks5`（デフォルト `127.0.0.1:10808`）は SOCKS5 URL を `config.proxy` に保存し、送信 HTTP(S) リクエストを実際の SOCKS5 トンネル経由で送信します。`--socks5-off` は保存された SOCKS5 プロキシだけを削除し、HTTP プロキシは削除しません。値は設定に保存されるため、`ocx update` 後も保持されます。URL にユーザー名とパスワードを含めることはできますが、起動ログでは非表示になります。
 
diff --git a/docs-site/src/content/docs/ja/reference/configuration/providers.md b/docs-site/src/content/docs/ja/reference/configuration/providers.md
index 844dca71278..a9fdaf8c813 100644
--- a/docs-site/src/content/docs/ja/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ja/reference/configuration/providers.md
@@ -140,6 +140,7 @@ account を削除しても mapping は保持され、同じ id を再追加す
 | `escapeBuiltinToolNames?` | `boolean` | Anthropic 互換ゲートウェイの組み込みツール名をエスケープし、返された呼び出しで復元します。 |
 | `anthropicEofTolerance?` | `boolean` | `message_stop` 前にストリームが終了しても、可視テキストまたは完全な JSON オブジェクトのツール入力が受信済みの場合に限り完了を許可します（Anthropic 互換ゲートウェイ向け）。デフォルトはオフ。 |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google トランスポート/認証モード。デフォルトは`ai-studio`です。 |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Google 専用です。省略時または `compatible` は互換スキーマと既存の非直接 400 修復を維持します。`reject-lossy` は初期損失または判定不能な上限付き比較を送信前に拒否し、制約を開く Vertex／Cloud Code Assist 修復を保留します。直接 AI Studio はこの修復を行いません。 |
 | `project?` | `string` | Vertex または Antigravity Cloud Code Assist プロジェクト ID。 |
 | `location?` | `string` |頂点の位置。環境フォールバックは `GOOGLE_CLOUD_LOCATION` です。 |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` |カーソルのみ: 標準入出力またはストリーミング可能な HTTP MCP サーバー。 |
@@ -155,11 +156,11 @@ API キープロバイダーは、リテラルキーまたは環境参照を保
 
 ダッシュボード接続テストとライブ モデル検出では、制限された GET 専用トランスポートが使用されます。送信プロキシを使用しない場合、opencodex はホスト名を一度解決し、その検証されたアドレスにのみ接続します。 HTTPS は元のホスト、SNI、および証明書の検証を保持します。プロバイダー設定では証明書チェックを無効にすることはできません。
 
-`HTTP_PROXY`、`HTTPS_PROXY`、または `ALL_PROXY` が適用される場合、これらの操作は Bun のネイティブ フェッチを維持します。 URL とリテラル アドレスのチェックは引き続き実行されますが、プロキシが最終ルート、DNS 応答、ピアを選択するため、opencodex はそのピアを固定したり検証したりできません。これは明示的なセキュリティ制限です。
+これらの操作は[サーバーで設定された送信 fetch](/ja/reference/configuration/server/)を使用します。`config.proxy` で設定された、または SOCKS5 `ALL_PROXY` から継承したサーバーの SOCKS5 プロキシは、宛先が `NO_PROXY` に一致しない場合に OpenCodex の組み込みトンネルを使用します。`HTTP_PROXY` と `HTTPS_PROXY` は Bun のネイティブ HTTP(S) 処理を維持しますが、SOCKS 以外の `ALL_PROXY` はネイティブ HTTP fetch の経路にはなりません。URL とリテラル アドレスのチェックは引き続き実行されますが、選択されたプロキシが最終ルート、DNS 応答、ピアを決めるため、opencodex はそのピアを固定したり検証したりできません。これは明示的なセキュリティ制限です。
 
 プライベート/ローカル宛先には `allowPrivateNetwork: true` が必要で、送信プロキシがアクティブな場合は、一致する `NO_PROXY` エントリが必要です。ループバックは自動的に追加されます。 CIDR エントリは解釈されないため、各 LAN ホストを明示的にリストします。マッチャーは、正確なホスト、ドメイン サフィックス、オプションのポート、括弧で囲まれた IPv6、および `*` をサポートします。たとえば、`192.168.1.50` を明示的にリストします。メタデータとリンクローカル宛先はブロックされたままになります。診断リクエストはリダイレクトを拒否し、資格情報が剥奪されたターゲットを報告します。通常のプロバイダー要求のリダイレクト レビューは、この診断ガードとは独立したままになります。
 
-Clash / Surge / Mihomo 利用者向けの fake-IP DNS 例外は 2 種類あり、いずれも DNS の*応答*にのみ適用されます。URL に書かれたリテラルアドレスは引き続き拒否されます。IANA ベンチマーク範囲 `198.18.0.0/15`（IPv4-mapped IPv6 表記を含む）は、そのホストにアウトバウンドプロキシが適用される場合に許可されます。Mihomo の既定 IPv6 fake-IP 範囲 `fdfe:dcba:9876::/48` はより厳しい条件でのみ許可されます。URL スキームに一致するプロキシ変数（`https:` は `HTTPS_PROXY`、`http:` は `HTTP_PROXY`、`ALL_PROXY` は対象外）が設定されていること、ホストが `NO_PROXY` に一致しないことが必要で、その場合リクエストはそのプロキシに明示的に固定されます。それ以外の ULA、隣接プレフィックス、実際のプライベート応答と混在した fake-IP 応答には引き続き `allowPrivateNetwork: true` が必要です。プロバイダー保存時の検証には IPv6 例外は適用されません。
+Clash / Surge / Mihomo 利用者向けの fake-IP DNS 例外は 2 種類あり、いずれも DNS の*応答*にのみ適用されます。URL に書かれたリテラルアドレスは引き続き拒否されます。IANA ベンチマーク範囲 `198.18.0.0/15`（IPv4-mapped IPv6 表記を含む）は、そのホストにアウトバウンドプロキシが適用される場合に許可されます。Mihomo の既定 IPv6 fake-IP 範囲 `fdfe:dcba:9876::/48` はより厳しい条件でのみ許可されます。URL スキームに一致するプロキシ変数（`https:` は `HTTPS_PROXY`、`http:` は `HTTP_PROXY`）または SOCKS5 の `ALL_PROXY` が設定されていること（SOCKS 以外の `ALL_PROXY` は対象外）、ホストが `NO_PROXY` に一致しないことが必要で、その場合リクエストはそのプロキシに明示的に固定されます。それ以外の ULA、隣接プレフィックス、実際のプライベート応答と混在した fake-IP 応答には引き続き `allowPrivateNetwork: true` が必要です。プロバイダー保存時の検証には IPv6 例外は適用されません。
 
 ## Codexアカウントプール
 
diff --git a/docs-site/src/content/docs/ja/reference/configuration/server.md b/docs-site/src/content/docs/ja/reference/configuration/server.md
index 96f3e618f42..a56c7bf9b0c 100644
--- a/docs-site/src/content/docs/ja/reference/configuration/server.md
+++ b/docs-site/src/content/docs/ja/reference/configuration/server.md
@@ -19,9 +19,10 @@ description: リスナー、リモート アクセス、アドミッション 
 | `shutdownTimeoutMs?` | `number` | `5000` |アクティブなターンが中止される前の正常な排出期限。 |
 | `websockets?` | `boolean` | `false` | クライアント向け Responses WebSocket パスを広告して許可します。false の場合クライアントは HTTP/SSE を使いますが、対象となる canonical ChatGPT upstream WS 最適化は無効にしません。 |
 | `corsAllowOrigins?` | `string[]` | `[]` | 追加の正確な CORS origin。ループバック origin は常に許可します。`chrome-extension://<extension-id>` など authority ベースのブラウザー拡張 origin に対応し、`*` はワイルドカードではありません。Firefox と Safari は拡張 UUID を（インストール/ブラウザー起動ごとに）再生成するため、origin が変わったらエントリを更新してください。 |
-| `apiKeys?` | `OcxApiKey[]` | `[]` |生成された `ocx_…` 資格情報は、非ループバック バインドでの管理およびデータ プレーン認証によって受け入れられました。ダッシュボードで管理。 |
+| `apiKeys?` | `OcxApiKey[]` | `[]` |生成された `ocx_…` データプレーン准入資格情報（非ループバック バインド向け）。管理 API の認可には使用できません。管理アクセスには [管理 API リファレンス](/ja/reference/management-api/) に記載された独立した資格情報を使用します。ダッシュボードで管理。 |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` |無効 |アーカイブされたセッションのクリーンアップ ポリシーをオプトインします。暗黙的に有効になることはありません。 |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` |排除可能なアプリ所有のログ、キャッシュ、BLOB、および継続ペイロードの MiB の上限。範囲は 64 ～ 4096。 RSSキャップではありません。 |
+| `metricsExport.enabled?` | `boolean` | `false` | 認証済み `GET /api/metrics` でプロセスローカルの集約リクエストメトリクスを有効にします。再起動が必要です。無効時は 404 となり、エクスポーター処理は開始されません。 |
 | `codexAutoStart?` | `boolean` | `true` | Codex を起動する前に、Codex シムで `ocx ensure` を実行させます。 False を指定すると、操作が行われないことが保証されます。 |
 | `codexShimAutoRestore?` | `boolean` | `true` |完了した外部 Codex アップデートによってインストールされたシムが置き換えられた後、インストールされているシムを復元します。環境オプトアウト: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`。 |
 | `syncResumeHistory?` | `boolean` | `true` | Codex App 履歴の互換性を元に戻すことができます。元のメタデータは `ocx stop` / `ocx restore` によってバックアップおよび復元されます。 |
diff --git a/docs-site/src/content/docs/ja/reference/management-api.md b/docs-site/src/content/docs/ja/reference/management-api.md
index 4398ff81180..3aab78aa88c 100644
--- a/docs-site/src/content/docs/ja/reference/management-api.md
+++ b/docs-site/src/content/docs/ja/reference/management-api.md
@@ -82,6 +82,49 @@ Authorization: Bearer <admin-token>
 | `GET /api/client-integrations/journal?client=...` | ロールバック操作を一覧表示します。任意でクライアントを指定でき、各行にはサーバー計算の `deletable` が含まれます。 | 400 無効なクライアント |
 | `DELETE /api/client-integrations/journal?opId=...` | 古いロールバック操作を廃止し、可能ならスナップショットも削除します。成功時の `snapshotRemoved` が `false` の場合、保守処理で再試行されます。 | 400 `opId` なし、404 存在しないか廃止済み、409 そのクライアントの最新操作 |
 
+## 統合変更のプレビュー
+
+プレビューは変更を適用せずに内容だけを示します。スナップショットも所有権記録もジャーナルも
+ロックも復旧も、いっさい書き込みません。
+
+| メソッドとパス | 目的 | 主なエラー |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | クライアント 1 つの `apply`、`overwrite`、`disable` を計画します。本文は `{ "clientId": "...", "operation": "..." }` | 400 不正なクライアントまたは操作、400 `invalid_aside_profile_path`、409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | 取り消しを計画します。本文は `{ "opId": "...", "confirmDrift": false }` | 404 該当操作なし、400 `invalid_aside_profile_path`、409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Aside プロファイル 1 つの変更を計画します。`restore` には `opId` が必要です | 400 不正な本文またはプロファイル未指定、404 該当プロファイルまたは操作なし、409 `integration_preview_unavailable` |
+
+計画には `version`、`clientId`、`operation`、`state`、`foreignEdit`、`kind` と `path` の組からなる
+`changes`、不透明な `fingerprint`、`canApply`、`willChange` が含まれ、`refusalReason` と
+`profileId` は任意です。パスは管理対象スキーマのパスか、`$snapshot`、`$ownership`、`$journal`
+の固定表記で、実行時に決まる位置は `*` になります。設定値やファイルの場所、選ばれた項目の
+名前は返しません。
+
+`canApply` が真で `willChange` が偽なら、操作は成功しますが管理対象のクライアント文書は何も
+変わりません。すでに適用済みのものを適用した場合などです。
+
+Aside プロファイルの変更はこの場合でも一つだけ保存します。確認を送ると、クライアント文書に触れる
+前にそのプロファイルの同期設定が記録されるため、管理ブロックがすでにないプロファイルを無効にすると
+設定だけが保存され、文書とその履歴はそのまま残ります。
+
+`integration_preview_unavailable` は今使えるモデル一覧がないという意味です。プロキシを起動した
+直後もそうですし、設定やプロバイダーキャッシュが変わって以前の一覧を破棄した場合もそうです。
+`GET /api/client-integrations` を読むと、取得に成功し設定を特定できたときに用意されるので、
+通常はこれで解決しますが、必ず用意されるとはかぎりません。
+
+## プレビューした変更の確定
+
+変更要求の本文に `operation` と `planFingerprint` を一緒に送ります。両方送るか両方省くかの
+どちらかで、片方だけ、または要求と異なる操作を書いた場合は拒否します。Aside はプロファイル
+1 つにしか結び付けられません。1 つのフィンガープリントで複数ファイルの変更は説明できないから
+です。
+
+サーバーは書き込む前に計画し直し、確認した内容がもう当てはまらなければ新しい計画を添えて
+`409 integration_preview_stale` を返します。自動で再試行はしないので、新しい計画を見て判断し
+直してください。
+
+フィンガープリントは楽観的な確認であって権限ではありません。変更してよいかどうかは管理 API の
+認証と所有権の規則が決めます。
+
 削除時はジャーナルを書き換えず、トゥームストーンを追記します。現在の取り消し地点を
 残すため、各クライアントの最新操作はサーバー側で保護されます。
 
@@ -124,6 +167,7 @@ Authorization: Bearer <admin-token>
 | `GET /api/debug/injection-logs` |制限付きガイダンス挿入デバッグ エントリを読み取る | — |
 | `GET /api/claude/inbound-debug` | Claude インバウンドのデバッグ状態とエントリを読む | — |
 | `GET /api/usage` |範囲とクライアント サーフェスごとの使用状況を要約する |ストレージを読み取れない場合は、`error: "read_failed"` 概要を返します。
+| `GET /api/metrics` | 論理リクエスト、物理送信、復旧種別、所要時間、TTFT のプロセスローカル Prometheus テキストメトリクスを返します。ラベルはプロトコル、結果、復旧クラスの閉じた集合のみで、リクエストや認証情報の識別子は出力しません。 | 起動時に `metricsExport.enabled` が true でなければ 404。通常の管理認証が必要で、データプレーン認証情報ではアクセスできません。 |
 | `GET /api/storage` |バケットごとの Codex ストレージ使用量をスキャン |スキャン失敗時に `error: "scan_failed"` ペイロードを返します。
 | `POST /api/storage/cleanup/preview` |アーカイブされたセッションのクリーンアップをプレビューし、バインディング ダイジェストを返します。 400 `invalid_json` または `invalid_percent` |
 | `POST /api/storage/cleanup` |プレビューされたアーカイブ セットを隔離または完全に削除します。 400 無効な入力。 409 古い/ビジー/参照状態。 500 ファイルシステム/データベース障害 |
diff --git a/docs-site/src/content/docs/ko/getting-started/quickstart.md b/docs-site/src/content/docs/ko/getting-started/quickstart.md
index 4dc6866898f..f1a179649b7 100644
--- a/docs-site/src/content/docs/ko/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/ko/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init`은 다음 과정을 안내합니다:
 
-1. **프로바이더 선택** — 내장 레지스트리 프리셋 94개 중 하나를 고르거나 `custom`을 선택해 base URL과 adapter를 직접 입력합니다.
+1. **프로바이더 선택** — 내장 레지스트리 프리셋 95개 중 하나를 고르거나 `custom`을 선택해 base URL과 adapter를 직접 입력합니다.
 2. **API 키** — 키를 붙여넣거나 `${ANTHROPIC_API_KEY}` 같은 환경 변수를 참조합니다.
 3. **기본 모델** — 키, 로컬, custom 프로바이더에서는 프리셋을 그대로 쓰거나 모델 ID를 직접 입력합니다.
 4. **프록시 포트** — 기본값은 `10100`입니다.
diff --git a/docs-site/src/content/docs/ko/guides/codex-integration.md b/docs-site/src/content/docs/ko/guides/codex-integration.md
index f1de9ec20ac..fa172286f18 100644
--- a/docs-site/src/content/docs/ko/guides/codex-integration.md
+++ b/docs-site/src/content/docs/ko/guides/codex-integration.md
@@ -211,6 +211,12 @@ upstream 요청 전에 `previous_response_not_found`를 반환합니다. Codex W
 HTTP 클라이언트는 이 오류를 직접 처리하고 `previous_response_id` 없이 전체 컨텍스트를 다시
 보내야 합니다. 같은 ID만 재시도해서는 누락된 상태를 복구할 수 없습니다.
 
+참조한 상태의 client task scope가 현재 요청과 다를 때도 같은 거부 응답을 반환합니다. 새 요청이
+전체 입력처럼 보여도 프록시는 그것이 완전한 대화인지 증명할 수 없으므로
+`previous_response_id`를 조용히 제거하거나 일치하는 상태의 존재 여부를 노출하지 않습니다.
+전체 대화를 담고 `previous_response_id`를 뺀 요청으로 명시적으로 다시 시도하세요. 정규화된
+scope가 같거나 양쪽 scope가 모두 없거나 비어 있는 기존 unscoped continuation은 계속 replay합니다.
+
 routed 목적지에는 모두 같은 복구 신호가 적용됩니다. 프록시가 잃어버린 기록을 대신 볼 수 있는
 것은 네이티브 Responses 패스스루뿐입니다. 체인을 저장해 둔 백엔드로 `previous_response_id`를
 그대로 넘기기 때문입니다. 나머지 wire는 매 턴 요청에 담긴 입력만으로 대화를 다시 구성하므로,
diff --git a/docs-site/src/content/docs/ko/guides/codex-native-context.md b/docs-site/src/content/docs/ko/guides/codex-native-context.md
new file mode 100644
index 00000000000..704f36fb17a
--- /dev/null
+++ b/docs-site/src/content/docs/ko/guides/codex-native-context.md
@@ -0,0 +1,113 @@
+---
+title: 네이티브 컨텍스트 호환성
+description: Codex history·notes 중계의 지원 조건, 인증을 유지하는 시험 설정, 검증 범위와 한계.
+---
+
+OpenCodex에는 네이티브 Codex history·notes 중계가 이미 있습니다. 다른 제공자까지 사용할 수 있는
+범용 메모리 서비스는 아닙니다. HTTP 경로가 존재한다고 모든 Codex 버전·계정·모델에서 동작하는
+것도 아닙니다. 인증과 계정 소유권 규칙은 [Codex 통합](/ko/guides/codex-integration/)을 참고하세요.
+
+## 서로 다른 두 가지 조건
+
+Codex가 확장 기능을 활성화해야 하고, OpenCodex가 요청자를 식별할 수 있어야 합니다.
+백엔드 URL만 바꾸면 두 조건이 모두 해결되는 것은 아닙니다.
+
+확인한 Codex 소스에서는 모델의 네이티브 목록에 `supports_experimental_context`가 있어야 합니다.
+적격 ChatGPT 로그인과 함께, 제공자 이름이 정확히 `OpenAI`이고 URL이 `/backend-api/codex`로
+끝나야 합니다. `env_key`, `experimental_bearer_token`, 명령형 `auth`, AWS 인증이 설정된 제공자는
+자동 활성화 대상에서 제외됩니다. 확인한 적격성 검사에는 ChatGPT Plus·Pro·ProLite가 포함되지만,
+해당 요금제의 모든 계정에서 실제 history 백엔드가 동작한다는 뜻은 아닙니다.
+
+OpenCodex는 성공한 모델 요청과 후속 컨텍스트 요청 모두에 유효한 **데이터 요청용 API 키**를
+요구합니다. 기본 내장 loopback 연결은 이 키를 보내지 않으므로 모델 응답은 성공해도
+컨텍스트 요청은 403 `context_principal_required`로 거부될 수 있습니다. 인증형 원격 제공자 설정도
+그 자체로 해결책은 아닙니다. 해당 설정의 `env_key`와 제공자 이름은 위 Codex 조건과 맞지 않습니다.
+이를 해결한다며 요청자 식별이나 계정 소유권 검사를 제거해서는 안 됩니다.
+
+## 명시적 활성화 형식
+
+OpenCodex는 Codex의 `FeatureToml`과 같이, 저장된 루트 기능 설정에서 두 형식을 인식합니다.
+
+```toml
+[features]
+context_management = true
+```
+
+다음 표 형식도 같습니다. 불리언 형식을 아직 인식하지 않는 이전 OpenCodex 버전에서는
+이 형식을 사용해야 합니다.
+
+```toml
+[features.context_management]
+experimental_mode = true
+```
+
+둘 중 하나만 사용하세요. false·누락·잘못된 값은 비활성화 상태로 남습니다. 프록시는 자신의
+Codex 홈 설정 파일을 읽으므로 CLI 인자로만 켜거나 프로필 안에만 켠 것으로는 중계가 활성화되지
+않습니다. 모델 정보만 보고 사용자의 활성화 의사를 추정하지도 않습니다.
+
+## 인증을 유지하는 네이티브 시험 프로필
+
+아래 설정은 **소스의 조건을 대조한 시험 예제이며 실제 계정의 전체 동작을 인증한 결과가 아닙니다.**
+설정 파일과 작업 체크포인트를 먼저 보관하고, 버려도 되는 새 대화에서 시험하세요.
+기존 작업 대화의 제공자 식별자를 바꾸지 마세요.
+
+현재 유효한 OpenCodex 데이터 요청용 키를 Codex 프로세스의 `OCX_CONTEXT_API_KEY` 환경변수로
+전달하세요. 관리용/admin 토큰을 사용하거나 키를 TOML에 직접 기록하면 안 됩니다.
+서비스의 환경변수가 별도로 실행한 데스크톱 앱에 자동 전달되는 것도 아닙니다.
+Codex의 정상적인 ChatGPT 로그인은 유지해야 합니다. 추가 헤더는 OAuth 로그인을 대체하지 않습니다.
+
+위 루트 기능 설정, OpenCodex의 정식 ChatGPT forward 제공자, 최신 네이티브 모델 목록이 준비된
+상태에서 아래 제공자와 프로필을 기존 Codex 설정에 **추가**하세요. 포트는 실제 로컬 프록시에
+맞추고, 루트 `model_provider`와 기존 제공자 표는 바꾸지 마세요.
+
+```toml
+[model_providers.ocx-native-context]
+name = "OpenAI"
+base_url = "http://127.0.0.1:10100/backend-api/codex"
+wire_api = "responses"
+requires_openai_auth = true
+supports_websockets = false
+env_http_headers = { "x-opencodex-api-key" = "OCX_CONTEXT_API_KEY" }
+
+[profiles.ocx-native-context]
+model_provider = "ocx-native-context"
+model = "gpt-6-astra"
+```
+
+`codex --profile ocx-native-context`로 새 CLI 대화를 시작합니다. 초기 시험은 모델 요청에서 중계로
+이어지는 소유권 경로를 확인하기 위해 HTTP/SSE를 사용합니다. 다른 프로필의 통신 방식은 바꾸지
+않으며 WebSocket·실행 중 지시 추가 기능의 동등한 동작까지 보장하지 않습니다. 실제 계정의
+네이티브 모델 목록에 컨텍스트 지원 정보가 있을 때만 해당 모델을 사용하세요. Devin·Gemini 등
+다른 제공자 모델에 지원 표시를 강제로 붙이면 안 됩니다.
+
+별도 제공자 ID를 쓰는 이유가 있습니다. Codex는 일반적으로 `model_providers.openai` 설정으로
+내장 제공자를 덮어쓰지 않으므로 그곳에 헤더를 추가해도 적용되지 않을 수 있습니다.
+별도 ID는 기존 제공자를 유지하고, 정확한 `OpenAI` 이름은 네이티브 백엔드 조건을 충족시킵니다.
+이 프로필에 `env_key`를 추가하지 마세요. `env_http_headers`는 로컬 요청자 식별을 담당하고,
+`Authorization`은 기존 ChatGPT 로그인을 유지합니다. 로컬 키는 OpenCodex에서 사용하며
+ChatGPT로 전달하지 않습니다.
+
+루트 활성화 설정은 다른 적격 네이티브 프로필에도 영향을 줍니다. **시험 중에는 추가 키를 보내지
+않는 기본 내장 loopback 대화로 원래 작업을 계속하지 마세요.** 그 대화로 돌아가기 전 루트 기능을
+끄고 `ocx sync`를 실행하세요. 자동 활성화나 기본 연결 방식 변경이 아니며, CLI 프로필 예제가
+데스크톱 앱의 프로필 선택 지원을 뜻하는 것도 아닙니다.
+
+## 컨텍스트 초기화 전 검증
+
+새 대화에서 정상적인 네이티브 모델 응답을 먼저 받아야 합니다. 이어서 메모를 쓰고 같은 내용을
+다시 읽은 뒤 그 대화의 history를 조회하세요. 이 단계들이 성공한 후에만 시험용 대화에서
+`new_context`를 사용하고 저장한 상태가 복원되는지 확인하세요. 성공해도 외부 체크포인트는 유지합니다.
+
+- **403 `context_principal_required`:** 유효한 로컬 데이터 요청용 키가 프록시에 전달되지 않았습니다.
+- **409 `context_account_unavailable`:** 소유권이 없거나 일치하지 않습니다. 현재 활성 계정으로
+  임의 대체하거나 메모 쓰기를 무작정 재시도하지 마세요.
+- **404:** 프록시의 비활성화·알 수 없는 경로 오류와 실제 상류 서버의 404를 구분해야 합니다.
+  상류 404만으로 OpenCodex 경로 결함이나 계정 전체 장애라고 판단할 수 없습니다.
+
+모델 응답 또는 `ocx ready` 성공만으로 notes·history·상태 복원이 검증되지는 않습니다.
+라우팅, 계정 변경, 프록시 재시작, 상류 경로의 가용성은 별도 조건입니다. 로컬 설정으로 없는
+상류 권한을 만들 수 없으며, 컨텍스트 작업 실패를 초기화 성공으로 처리해서도 안 됩니다.
+시험 후 프로필·제공자 표와 시험용 환경변수를 제거하고, 검증된 인증 경로를 쓸 때가 아니면
+기능을 비활성화하세요.
+
+확인한 upstream 소스와 정확한 커밋은 [영문 문서의 근거](/guides/codex-native-context/#upstream-contracts-inspected)에 있습니다.
diff --git a/docs-site/src/content/docs/ko/guides/providers.md b/docs-site/src/content/docs/ko/guides/providers.md
index 31ebaeb17b0..9e8b372e967 100644
--- a/docs-site/src/content/docs/ko/guides/providers.md
+++ b/docs-site/src/content/docs/ko/guides/providers.md
@@ -118,6 +118,22 @@ ocx logout <provider>
 
 Google Antigravity 계정·제공자 할당량 확인은 모델 목록 폴백을 포함해 고정된 Google 회계 엔드포인트를 사용합니다. 해당 목적지의 투명 Fake-IP DNS를 지원하며 TLS 검증, 리다이렉트 거부, 사설 주소 검사는 유지합니다. 사용자 지정 base URL은 모델 요청에만 적용되며 할당량 목적지는 바꾸지 않습니다. `NO_PROXY`는 기존 직접 연결 정책을 유지합니다.
 
+### Google 도구 스키마 손실 진단
+
+Google 도구 선언은 선택된 엔드포인트 클래스에 맞춰 컴파일됩니다. `ocx debug provider on`,
+대시보드 Logs 토글 또는 `OCX_DEBUG=1`로 프로바이더 디버그를 켜면 정책을 생략하거나
+`compatible`인 호환성 변환 중 스키마 손실이 발생할 때 `[ocx:google:google-tool-schema-loss]` 레코드를 기록합니다
+(`ocx debug provider logs -f`로 tail할 수 있습니다). 이 레코드에는 보고서 버전, 엔드포인트
+클래스, `lossy` 표시, 판정 불가능한 비교의 상한 개수, 상한이 있는 개수를 포함한 고정 손실 범주, 잘림 여부만 들어갑니다.
+도구명과 속성명, 경로, 값, 스키마 본문은 포함하지 않습니다. 정책을 생략하거나
+`compatible`이면 변환을 거부하지 않고 관찰합니다. `reject-lossy`에서는 초기 컴파일에 손실이 있거나
+상한 비교를 판정할 수 없으면 전송 전에 거부합니다. 거부된 요청에는 별도의 손실 레코드를 기록하지
+않습니다. `reject-lossy`에서는 제약을 지우는 Vertex 또는 Cloud Code Assist 복구가 동일하게 내용이 없는
+`google-tool-schema-repair`를 기록하고 변경 전송 없이 원래 400을 반환합니다. 정책을 생략하거나
+`compatible`이면 복구된 요청을 이전과 같이 다시 전송합니다. 직접 AI Studio는
+이 복구를 수행하지 않습니다. 네이티브 출력 스키마는 두 정책 경로 모두의 대상이 아닙니다.
+[디버그 명령어 참고 문서](/ko/reference/cli/agents/)도 확인하세요.
+
 
 Nous refresh가 종료 실패한 경우, `ocx login nous`로 재인증하세요.
 
@@ -166,7 +182,7 @@ Kiro 로그인에는 Kiro CLI가 필요합니다. Unix에서는 `curl -fsSL http
 
 ## 3. API 키 카탈로그
 
-opencodex에는 빌트인 프리셋이 94개 들어 있습니다. 키 방식 78개, OAuth 12개, 로컬 3개,
+opencodex에는 빌트인 프리셋이 95개 들어 있습니다. 키 방식 79개, OAuth 12개, 로컬 3개,
 기본 ChatGPT 포워드 프리셋 1개입니다. 대시보드의 **Add provider** 선택기는 키 발급 페이지를 열고,
 입력한 키를 검증한 뒤 저장합니다(검증은 프로바이더별로 다릅니다). 주요 항목은 다음과 같습니다:
 
@@ -241,7 +257,7 @@ Cline IDE/CLI에서만 제공되며 API로는 사용할 수 없습니다. `minim
 
 대부분은 bearer 키와 함께 `openai-chat` 어댑터를 사용하며, Anthropic 호환 엔드포인트만 노출하는 일부
 (예: **Xiaomi MiMo**)는 `anthropic` 어댑터(`x-api-key`)를 사용합니다.
-Volcengine Agent Plan은 `openai-responses` 어댑터로 네이티브 Responses 엔드포인트를 사용합니다.
+Volcengine Coding Plan과 Agent Plan은 `openai-responses` 어댑터로 네이티브 Responses 엔드포인트를 사용합니다. 검증된 Ark Coding Plan 도구 연속 호출에서는 직전 턴이 돌려준 Responses `reasoning` 항목을 그대로 다시 보내면 `400 InvalidParameter`가 나므로, Coding Plan 프리셋은 연속 입력을 전달하기 전에 그 항목을 제거합니다. 그 턴의 reasoning 상태는 사라지며 `dropResponsesReasoningItems: false`로 끌 수 있습니다. 이미 `openai-chat`으로 저장된 Coding Plan 설정은 덮어쓰지 않고 Chat 그대로 둡니다. 바꾸려면 `adapter`를 `openai-responses`로, `responsesPath`를 `/responses`로 직접 수정하거나 프리셋을 지우고 다시 추가하세요.
 
 > **Volcengine의 세 가지 과금 경로:** `volcengine`은 종량제 Ark API,
 > `volcengine-coding-plan`은 Coding Plan 할당량, `volcengine-agent-plan`은 Agent Plan
diff --git a/docs-site/src/content/docs/ko/reference/cli/lifecycle.md b/docs-site/src/content/docs/ko/reference/cli/lifecycle.md
index 4db8c09b695..e4f2913c6f6 100644
--- a/docs-site/src/content/docs/ko/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/ko/reference/cli/lifecycle.md
@@ -22,8 +22,10 @@ Codex 자동 시작 shim도 설치합니다.
 인스턴스는 시작하지 않습니다. 권장 포트가 이미 사용 중이면 `start`가 점유자를 확인한 뒤 어느 경우든
 실행을 멈춥니다. opencodex가 응답하면 시작을 거부하고, 그렇지 않으면 점유자를 식별할 수 없다고
 알립니다. 첫 번째 프록시를 실행한 채 Codex가 두 번째 프록시를 가리키게 되므로, 리스너를 다른 포트로
-자동 이동하지 않습니다. 다른 포트는 `--port`로 지정하거나, OS에 포트 할당을 요청하려면 구성에서
-`port: 0`을 설정하세요. 시작할 때는 각 공급자의 모델을 Codex 카탈로그로 동기화합니다. 종료할 때는
+자동 이동하지 않습니다. 활성 프록시와 같은 `OPENCODEX_HOME`을 사용하면 다른 `--port`를 명시해도
+시작을 거부합니다. 관찰 전용과 제한 적용 모드 모두 같은 지출 저널에 기록하기 때문입니다. 독립된 형제
+인스턴스에는 별도의 `OPENCODEX_HOME`을 사용하세요. `port: 0`은 포트만 OS에 맡기며 상태를 분리하지
+않습니다. 시작할 때는 각 공급자의 모델을 Codex 카탈로그로 동기화합니다. 종료할 때는
 기본 Codex를 복원합니다. 단, 관리형 서비스로 실행한 경우(`OCX_SERVICE=1`)는 예외입니다.
 
 `--socks5`(기본값 `127.0.0.1:10808`)는 SOCKS5 URL을 `config.proxy`에 저장하고 실제 SOCKS5
diff --git a/docs-site/src/content/docs/ko/reference/configuration/providers.md b/docs-site/src/content/docs/ko/reference/configuration/providers.md
index 61cd0de052b..55e1f4457d4 100644
--- a/docs-site/src/content/docs/ko/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ko/reference/configuration/providers.md
@@ -140,6 +140,7 @@ managed map을 활성화하면 privacy-safe selector를 만들고, 이후 계정
 | `escapeBuiltinToolNames?` | `boolean` | Anthropic 호환 게이트웨이를 위해 내장 도구 이름을 이스케이프하고, 반환된 호출에서는 다시 복원합니다. |
 | `anthropicEofTolerance?` | `boolean` | `message_stop` 전에 스트림이 끝나도 표시 텍스트 또는 완전한 JSON 객체 툴 입력을 받은 경우에만 완료를 허용합니다（Anthropic 호환 게이트웨이용）. 기본값은 꺼짐. |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google 전송/인증 모드입니다. 기본값은 `ai-studio`입니다. |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Google 전용입니다. 생략하거나 `compatible`이면 호환 스키마와 기존 비직접 400 복구를 유지합니다. `reject-lossy`는 초기 손실 또는 판정 불가능한 상한 비교를 전송 전에 거부하고 제약을 개방하는 Vertex 또는 Cloud Code Assist 복구를 보류합니다. 직접 AI Studio는 이 복구를 수행하지 않습니다. |
 | `project?` | `string` | Vertex 또는 Antigravity Cloud Code Assist 프로젝트 id입니다. |
 | `location?` | `string` | Vertex 위치입니다. 환경 변수 폴백은 `GOOGLE_CLOUD_LOCATION`입니다. |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | Cursor 전용입니다. stdio 또는 Streamable HTTP MCP 서버입니다. |
@@ -155,11 +156,11 @@ API 키 공급자는 리터럴 키나 환경 참조를 둘 수 있습니다. OAu
 
 대시보드 연결 테스트와 라이브 모델 발견은 범위가 제한된 GET 전용 전송을 사용합니다. 아웃바운드 프록시가 없으면 opencodex는 호스트 이름을 한 번만 확인하고, 검증된 주소로만 연결합니다. HTTPS는 원래 Host, SNI, 인증서 검증을 유지하며, 공급자 설정으로 인증서 검사를 끌 수는 없습니다.
 
-`HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`가 적용되면 이 작업들은 Bun의 네이티브 fetch를 그대로 사용합니다. URL과 리터럴 주소 검사는 계속 실행되지만, 최종 경로, DNS 응답, 피어는 프록시가 고르므로 opencodex는 그 피어를 고정하거나 검증할 수 없습니다. 이는 명시적인 보안 한계입니다.
+이 작업들은 [서버에 설정된 아웃바운드 fetch](/ko/reference/configuration/server/)를 사용합니다. `config.proxy`로 설정했거나 SOCKS5 `ALL_PROXY`에서 상속된 서버 SOCKS5 프록시는 대상이 `NO_PROXY`에 걸리지 않을 때 OpenCodex의 내장 터널을 사용합니다. `HTTP_PROXY`와 `HTTPS_PROXY`는 Bun의 네이티브 HTTP(S) 처리를 그대로 사용하지만, SOCKS가 아닌 `ALL_PROXY`는 네이티브 HTTP fetch 경로가 아닙니다. URL과 리터럴 주소 검사는 계속 실행되지만, 선택된 프록시가 최종 경로, DNS 응답, 피어를 고르므로 opencodex는 그 피어를 고정하거나 검증할 수 없습니다. 이는 명시적인 보안 한계입니다.
 
 사설/로컬 목적지는 `allowPrivateNetwork: true`가 필요하며, 아웃바운드 프록시가 활성화된 경우에는 일치하는 `NO_PROXY` 항목도 필요합니다. loopback은 자동으로 추가됩니다. CIDR 항목은 해석하지 않으므로 각 LAN 호스트는 따로 적어야 합니다. matcher는 정확한 호스트, 도메인 접미사, 선택적 포트, 괄호로 감싼 IPv6, `*`를 지원합니다. 예를 들면 `192.168.1.50`은 따로 적어야 합니다. 메타데이터와 link-local 목적지는 계속 차단됩니다. 진단 요청은 리디렉션을 거부하고, 자격 증명이 제거된 대상만 보고합니다. 일반적인 공급자 요청의 리디렉션 검토는 이 진단 가드와 별도로 유지됩니다.
 
-Clash / Surge / Mihomo 사용자를 위한 fake-IP DNS 예외는 두 가지이며, 둘 다 DNS *응답*에만 적용됩니다. URL에 적힌 리터럴 주소는 그대로 거부됩니다. IANA 벤치마크 대역 `198.18.0.0/15`(IPv4-mapped IPv6 표기 포함)은 해당 호스트에 아웃바운드 프록시가 적용될 때 허용됩니다. Mihomo 기본 IPv6 fake-IP 대역 `fdfe:dcba:9876::/48`은 더 엄격한 조건에서만 허용됩니다. URL 스킴에 맞는 프록시 변수(`https:`는 `HTTPS_PROXY`, `http:`는 `HTTP_PROXY`, `ALL_PROXY`는 해당 없음)가 설정되어 있어야 하고, 호스트가 `NO_PROXY`에 걸리지 않아야 하며, 그 경우 요청은 해당 프록시에 명시적으로 묶여 나갑니다. 그 밖의 ULA, 인접 프리픽스, 실제 사설 응답과 섞인 fake-IP 응답은 여전히 `allowPrivateNetwork: true`가 필요합니다. 프로바이더 저장 시점 검증에는 IPv6 예외가 적용되지 않습니다.
+Clash / Surge / Mihomo 사용자를 위한 fake-IP DNS 예외는 두 가지이며, 둘 다 DNS *응답*에만 적용됩니다. URL에 적힌 리터럴 주소는 그대로 거부됩니다. IANA 벤치마크 대역 `198.18.0.0/15`(IPv4-mapped IPv6 표기 포함)은 해당 호스트에 아웃바운드 프록시가 적용될 때 허용됩니다. Mihomo 기본 IPv6 fake-IP 대역 `fdfe:dcba:9876::/48`은 더 엄격한 조건에서만 허용됩니다. URL 스킴에 맞는 프록시 변수(`https:`는 `HTTPS_PROXY`, `http:`는 `HTTP_PROXY`) 또는 SOCKS5 `ALL_PROXY`가 설정되어 있어야 하고(SOCKS가 아닌 `ALL_PROXY`는 해당 없음), 호스트가 `NO_PROXY`에 걸리지 않아야 하며, 그 경우 요청은 해당 프록시에 명시적으로 묶여 나갑니다. 그 밖의 ULA, 인접 프리픽스, 실제 사설 응답과 섞인 fake-IP 응답은 여전히 `allowPrivateNetwork: true`가 필요합니다. 프로바이더 저장 시점 검증에는 IPv6 예외가 적용되지 않습니다.
 
 ## Codex 계정 풀
 
diff --git a/docs-site/src/content/docs/ko/reference/configuration/server.md b/docs-site/src/content/docs/ko/reference/configuration/server.md
index da43750851a..72012aa7ec8 100644
--- a/docs-site/src/content/docs/ko/reference/configuration/server.md
+++ b/docs-site/src/content/docs/ko/reference/configuration/server.md
@@ -19,9 +19,10 @@ description: 리스너, 원격 접근, admission 키, 타임아웃, 저장소, 
 | `shutdownTimeoutMs?` | `number` | `5000` | 진행 중인 turn을 중단하기 전에 허용하는 정상 종료 드레인 기한입니다. |
 | `websockets?` | `boolean` | `false` | 클라이언트용 Responses WebSocket 경로를 광고하고 허용합니다. `false`이면 클라이언트는 HTTP/SSE를 사용하며, 적격 canonical ChatGPT 업스트림 WS 최적화는 비활성화하지 않습니다. |
 | `corsAllowOrigins?` | `string[]` | `[]` | CORS에서 추가로 허용할 정확한 origin입니다. 루프백 origin은 항상 허용됩니다. `chrome-extension://<extension-id>` 같은 authority 기반 브라우저 확장 origin을 지원하며, `*`는 와일드카드가 아닙니다. Firefox와 Safari는 확장 UUID를 (설치/브라우저 실행 때마다) 새로 만드므로 origin이 바뀌면 항목을 갱신하세요. |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | 비루프백 바인드에서 관리 API와 데이터 플레인 인증이 허용하는 생성된 `ocx_…` 자격 증명입니다. 대시보드에서 관리합니다. |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | 비루프백 바인드에서 데이터 플레인 요청만 허용하는 생성된 `ocx_…` 자격 증명입니다. 관리 API는 허가하지 않으며, 관리 접근에는 [관리 API 레퍼런스](/ko/reference/management-api/)에 설명된 별도의 자격 증명을 사용합니다. 대시보드에서 관리합니다. |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | disabled | 선택적으로 활성화하는 보관 세션 정리 정책입니다. 절대 암묵적으로 활성화되지 않습니다. |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | 제거 가능한 앱 소유 로그, 캐시, blob, continuation payload에 대한 MiB 단위 상한입니다. 범위는 64–4096이며 RSS 상한은 아닙니다. |
+| `metricsExport.enabled?` | `boolean` | `false` | 인증된 `GET /api/metrics`에서 프로세스 로컬 집계 요청 메트릭을 활성화합니다. 재시작이 필요하며, 비활성화 상태에서는 404를 반환하고 exporter 동작을 시작하지 않습니다. |
 | `codexAutoStart?` | `boolean` | `true` | Codex shim이 Codex를 실행하기 전에 `ocx ensure`를 돌리도록 허용합니다. `false`이면 ensure는 아무 작업도 하지 않습니다. |
 | `codexShimAutoRestore?` | `boolean` | `true` | 완료된 외부 Codex 업데이트가 설치된 shim을 교체한 뒤 복원합니다. 환경 변수로 끌 수 있습니다: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. |
 | `syncResumeHistory?` | `boolean` | `true` | 되돌릴 수 있는 Codex App history 호환성입니다. 원래 메타데이터는 `ocx stop` / `ocx restore`가 백업하고 복원합니다. |
diff --git a/docs-site/src/content/docs/ko/reference/management-api.md b/docs-site/src/content/docs/ko/reference/management-api.md
index b2c7951e89b..eb153c9caeb 100644
--- a/docs-site/src/content/docs/ko/reference/management-api.md
+++ b/docs-site/src/content/docs/ko/reference/management-api.md
@@ -86,6 +86,48 @@ Authorization: Bearer <admin-token>
 | `GET /api/client-integrations/journal?client=...` | 롤백 작업을 조회합니다. 특정 클라이언트로 제한할 수 있으며 각 행에는 서버가 계산한 `deletable` 값이 포함됩니다. | 400 잘못된 클라이언트 |
 | `DELETE /api/client-integrations/journal?opId=...` | 이전 롤백 작업을 폐기하고 가능한 경우 스냅샷도 제거합니다. 성공 응답의 `snapshotRemoved`가 `false`면 유지보수 재시도를 위해 정리 작업이 보존됩니다. | 400 `opId` 누락, 404 없거나 이미 폐기된 작업, 409 해당 클라이언트의 최신 작업 |
 
+## 통합 변경 미리 보기
+
+미리 보기는 변경 내용을 적용하지 않고 보여 줍니다. 스냅샷도, 소유권 기록도, 저널도, 잠금도,
+복구도 남기지 않습니다.
+
+| 메서드 및 경로 | 목적 | 주요 오류 |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | 클라이언트 하나의 `apply`, `overwrite`, `disable`을 계획합니다. 본문은 `{ "clientId": "...", "operation": "..." }` | 400 잘못된 클라이언트나 작업, 400 `invalid_aside_profile_path`, 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | 실행 취소를 계획합니다. 본문은 `{ "opId": "...", "confirmDrift": false }` | 404 없는 작업, 400 `invalid_aside_profile_path`, 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Aside 프로필 하나의 변경을 계획합니다. `restore`에는 `opId`가 필요합니다 | 400 잘못된 본문이나 프로필 미지정, 404 없는 프로필이나 작업, 409 `integration_preview_unavailable` |
+
+계획에는 `version`, `clientId`, `operation`, `state`, `foreignEdit`, `kind`와 `path` 쌍으로 이루어진
+`changes`, 불투명한 `fingerprint`, `canApply`, `willChange`가 담기고 `refusalReason`과
+`profileId`는 선택 항목입니다. 경로는 관리 대상 스키마 경로이거나 `$snapshot`, `$ownership`,
+`$journal` 표식이며, 실행 중에 정해지는 자리는 `*`로 적습니다. 설정 값이나 파일 위치, 선택된
+항목의 이름은 돌려주지 않습니다.
+
+`canApply`가 참인데 `willChange`가 거짓이면 작업은 성공하지만 관리 대상 클라이언트 문서에서는
+아무것도 바뀌지 않습니다. 이미 적용된 것을 다시 적용하는 경우가 그렇습니다.
+
+Aside 프로필 변경은 이때도 한 가지를 저장합니다. 확인을 보내면 클라이언트 문서에 손대기 전에 그
+프로필의 동기화 설정이 먼저 기록되므로, 관리 블록이 이미 없는 프로필을 끄면 설정만 저장되고
+문서와 기록은 그대로 남습니다.
+
+`integration_preview_unavailable`은 지금 쓸 수 있는 모델 목록이 없다는 뜻입니다. 프록시를 막
+시작했을 때도 그렇고, 설정이나 공급자 캐시가 바뀌어 기존 목록을 버린 경우에도 그렇습니다.
+`GET /api/client-integrations`를 읽으면 조회가 성공하고 설정을 확인할 수 있을 때 목록이
+준비되므로, 보통은 이렇게 해결되지만 항상 보장되지는 않습니다.
+
+## 미리 본 변경 확정하기
+
+변경 요청 본문에 `operation`과 `planFingerprint`를 함께 보냅니다. 둘 다 보내거나 둘 다
+생략해야 하며, 하나만 보내거나 요청과 다른 작업을 적으면 거부합니다. Aside는 프로필 하나에만
+묶을 수 있습니다. 지문 하나로 여러 파일의 변경을 설명할 수는 없기 때문입니다.
+
+서버는 쓰기 전에 다시 계획해 보고, 확인한 내용이 더 이상 맞지 않으면 새 계획을 담아
+`409 integration_preview_stale`을 돌려줍니다. 자동으로 다시 시도하지 않으니 새 계획을 보고
+다시 결정하면 됩니다.
+
+지문은 낙관적 확인일 뿐 권한이 아닙니다. 변경을 허용할지는 관리 인증과 소유권 규칙이
+결정합니다.
+
 삭제는 저널을 다시 쓰지 않고 툼스톤을 추가합니다. 현재 실행 취소 지점을 유지하기 위해
 각 클라이언트의 최신 작업은 서버에서 삭제하지 못하게 보호합니다.
 
@@ -128,6 +170,7 @@ Authorization: Bearer <admin-token>
 | `GET /api/debug/injection-logs` | 제한된 guidance-injection debug 항목을 읽습니다 | — |
 | `GET /api/claude/inbound-debug` | Claude inbound debug 상태와 항목을 읽습니다 | — |
 | `GET /api/usage` | 범위와 클라이언트 surface별 사용량을 요약합니다 | 저장소를 읽을 수 없으면 `error: "read_failed"` 요약을 반환합니다 |
+| `GET /api/metrics` | 논리 요청, 실제 송신, 복구 종류, 소요 시간, TTFT에 대한 프로세스 로컬 Prometheus 텍스트 메트릭을 반환합니다. label은 protocol, result, recovery class의 닫힌 집합만 사용하며 요청·자격 증명 식별자는 내보내지 않습니다. | 시작 시 `metricsExport.enabled`가 true가 아니면 404; 일반 관리 인증이 필요하며 데이터 플레인 자격 증명으로는 접근할 수 없습니다 |
 | `GET /api/storage` | bucket별 Codex 저장소 사용량을 검사합니다 | 검사 실패 시 `error: "scan_failed"` payload를 반환합니다 |
 | `POST /api/storage/cleanup/preview` | archived-session cleanup을 미리 보고 binding digest를 반환합니다 | 400 `invalid_json` 또는 `invalid_percent` |
 | `POST /api/storage/cleanup` | 미리 본 archived set을 격리하거나 영구적으로 제거합니다 | 400 잘못된 입력; 409 오래되었음/바쁨/참조됨 상태; 500 파일 시스템/데이터베이스 실패 |
diff --git a/docs-site/src/content/docs/reference/adapters.md b/docs-site/src/content/docs/reference/adapters.md
index 4da02652ae7..793a4522fe6 100644
--- a/docs-site/src/content/docs/reference/adapters.md
+++ b/docs-site/src/content/docs/reference/adapters.md
@@ -131,8 +131,11 @@ exception.
 
 Adapter selection does not select the upstream transport. Eligible requests can use the
 [upstream WebSocket proxy route](/reference/proxy-formats/#json-and-sse-output); invalid or unsupported
-WebSocket proxy settings fall back to HTTP/SSE. HTTP fetch-based Responses handling uses Bun's
-HTTP proxy rules and does not inherit the WSS-specific `ALL_PROXY` fallback.
+WebSocket proxy settings fall back to HTTP/SSE. HTTP fetch-based Responses handling uses the
+[configured outbound fetch](/reference/configuration/server/#server-fields): a server SOCKS5 proxy from
+`config.proxy` or a SOCKS5 `ALL_PROXY` uses the built-in tunnel when `NO_PROXY` does not exempt
+the target. Scheme-specific HTTP(S) proxy variables retain their separate native handling;
+non-SOCKS `ALL_PROXY` is not a native HTTP fetch route.
 
 Noncanonical Responses gateways receive Codex's client-executed `tool_search` declaration as a
 collision-safe public function tool. Matching request history and JSON/SSE function calls are
diff --git a/docs-site/src/content/docs/reference/cli/lifecycle.md b/docs-site/src/content/docs/reference/cli/lifecycle.md
index 54c42a9d68b..e8380c73ca6 100644
--- a/docs-site/src/content/docs/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/reference/cli/lifecycle.md
@@ -22,10 +22,12 @@ Start the proxy server (preferred port `10100`). It writes PID/runtime-port stat
 start a second live instance. When the preferred port is occupied, `start` asks the holder who it
 is and stops either way: it refuses outright when an opencodex answers there, and reports an
 unidentified holder otherwise. It never moves the listener to another port on its own, because that
-would leave the first proxy running and re-point Codex at the second. Name a different port with
-`--port`, or set `port: 0` in the config to ask the OS for one. On start it syncs each provider's
-models into Codex's catalog. On shutdown it restores native Codex — unless it was launched as a
-managed service (`OCX_SERVICE=1`).
+would leave the first proxy running and re-point Codex at the second. An explicit different
+`--port` is still refused when the live proxy shares this `OPENCODEX_HOME`, because observe-only
+and enforced spend accounting both write the same journal. Use a separate `OPENCODEX_HOME` for an
+independent sibling; `port: 0` only asks the OS for that instance's port and does not separate its
+state. On start it syncs each provider's models into Codex's catalog. On shutdown it restores
+native Codex — unless it was launched as a managed service (`OCX_SERVICE=1`).
 
 `--socks5` (default `127.0.0.1:10808`) saves `config.proxy` as a SOCKS5 URL and routes outbound
 HTTP(S) through a real SOCKS5 tunnel. `--socks5-off` clears only that saved SOCKS5 proxy; it
diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index e218f7ff36f..29f66c70ffa 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -146,12 +146,13 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | `responsesPath?` | `string` | Relative resource path for key-auth `openai-responses` requests. It must start with `/` and contain no scheme, query, or fragment. |
 | `chatCompletionsPath?` | `string` | Relative resource path for `openai-chat` requests, the mirror of `responsesPath` and subject to the same shape rules. Needed when one upstream serves Chat Completions and Responses under different prefixes: a per-model wire override changes the adapter and leaves `baseUrl` alone, so without this an opted-in Chat request would be sent to the Responses base. Z.AI is the shipped example. |
 | `allowEncryptedV2AgentTasks?` | `boolean` | Disabled by default. Trust a direct key-auth `openai-responses` provider to consume or relay opaque encrypted V2 sub-agent tasks unchanged. Eligible routes skip `agentTaskRecovery`; all other routes keep the existing recovery or fail-closed behavior. OpenCodex does not decrypt, translate, or recover tasks sent through this opt-in. |
-| `upstreamWebsocket?` | `boolean` | Opt-in upstream Responses WebSocket transport for `openai-responses` requests (default false). When the upstream supports the Responses WebSocket protocol, streaming POST requests to the configured Responses path (default `/v1/responses`) are dialed as WSS over an HTTPS base URL and re-encoded to SSE for the usual pipeline. Forward providers use `{baseUrl}/responses`; key-auth providers use `responsesPath`, or the legacy `/v1/responses` fallback. This mirrors the canonical ChatGPT backend optimization for OpenAI-compatible gateways (for example sub2api) whose WebSocket ingress is measurably faster than its SSE queue. Plain HTTP remains on SSE; non-Responses paths and `openai-chat` requests stay on HTTP. |
+| `upstreamWebsocket?` | `boolean` | Opt-in upstream Responses WebSocket transport for `openai-responses` requests (default false). Honored only for the first-party `https://api.openai.com/v1` upstream; custom-provider endpoints always use bounded HTTP/SSE because Bun cannot enforce an inbound WebSocket message limit before allocating the complete message. The canonical ChatGPT transport is unaffected. Plain HTTP remains on SSE; non-Responses paths and `openai-chat` requests stay on HTTP. |
 | `supportsServiceTier?` | `boolean` | Tri-state canonical Fast capability fallback. `true` publishes Fast in the catalog, satisfies service-tier routing requirements, contributes a supported fingerprint, and lets fast mode inject the provider's canonical wire value on a compatible final adapter. `false` strips the field and never injects, and exact model declarations cannot reopen it. Absent leaves the provider unclassified: fast mode does not inject or normalize a canonical caller value, and caller values obey the final wire's forwarding permission (`chatServiceTier` on Chat; passthrough on Responses). The registry classifies canonical OpenAI (`true`), DeepSeek, and Volcengine Ark (`false`); set it explicitly only for custom gateways that genuinely support tiers. |
 | `modelSupportsServiceTier?` | `Record<string, boolean>` | Exact upstream model capability overrides. Exact `true` enables canonical Fast for that model; exact `false` narrows provider defaults. An explicit provider-level `supportsServiceTier: false` remains fail-closed and cannot be reopened. Exact `true` does not authorize foreign caller-tier forwarding on Chat. Undeclared models fall back to provider-wide behavior. Management `PATCH /api/providers` merges entries and accepts `null` to clear one. |
 | `chatServiceTier?` | `boolean` | Provider-wide Chat-wire opt-in for forwarding caller `service_tier` values. On a classified route it governs foreign values such as `flex`, not proxy-owned canonical Fast after capability validation; on an unclassified route it governs every caller value because no Fast capability has been validated. Exact model capability does not authorize foreign forwarding. Responses routes retain their capability-based caller forwarding behavior. |
 | `promptCacheKey?` | `boolean` | Provider-wide `openai-chat` opt-in for forwarding a `prompt_cache_key`. The adapter forwards the key it is given and never invents one, but the key is not always the caller's: Claude Messages translation derives one from `metadata.user_id`, or from a model/system/tools cohort when no metadata is sent. Default off. Enable only when the upstream documents support, because strict gateways may reject the unknown field with HTTP 400. |
 | `preserveResponsesReasoningContent?` | `boolean` | Keep plaintext reasoning content on replayed Responses reasoning items instead of blanking it (blanking is the ChatGPT backend's rule). Enable for upstreams whose contract accepts reasoning replay, such as DeepSeek. Proxy-minted `ocxr1` envelopes are always stripped. |
+| `dropResponsesReasoningItems?` | `boolean` | Remove replayed Responses `reasoning` items from continuation input entirely, instead of forwarding them with blanked content. This is lossy: summaries, item ids, and `encrypted_content` go with them, so no reasoning item from the previous turn remains in the forwarded input. It does not remove `previous_response_id`, so an upstream holding its own turn state may still reach it. Enable only for an upstream that rejects reasoning replay outright — the built-in Volcengine Ark Coding Plan preset sets it because validated tool continuations answered `400 InvalidParameter` otherwise. Set it to `false` on that provider to forward reasoning items again. |
 | `disabled?` | `boolean` | Keep the provider on disk but exclude it from routing and model/catalog listings. |
 | `apiKey?` | `string` | API key, an `${ENV_VAR}` / `$ENV_VAR` reference, or a `keychain:<provider>` reference written by `ocx provider keychain <name> store`. References resolve at request time. See [Storing keys in the OS keychain](#storing-keys-in-the-os-keychain). |
 | `apiKeyTransport?` | `"x-api-key" \| "bearer"` | Anthropic key header style. Defaults to native `x-api-key`; valid only for key-auth `anthropic` providers. |
@@ -171,7 +172,7 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | `defaultMaxOutputTokens?` | `number` | Provider-wide `openai-chat` fallback when the client omits `max_output_tokens`. |
 | `modelMaxOutputTokens?` | `Record<string, number>` | Positive per-model `openai-chat` fallback budgets; exact/pattern matches beat the provider default. |
 | `modelCosts?` | `Record<string, Cost4>` | Per-model display prices (USD per 1M tokens), keyed by that provider's exact upstream model id — not a provider identifier or a routed `provider/model` label, e.g. `{ "deepseek-v4-flash": { "input": 0.14, "output": 0.28, "cacheRead": 0.0028, "cacheWrite": 0 } }`. Any model id is a valid key — custom providers may target any OpenAI-compatible endpoint through the `openai-chat` adapter, and local or internal provider ids work even when they are absent from the built-in catalogs. User-configured prices win over the built-in catalogs in the Logs `~$` and Usage estimates; historical entries are repriced from the current overlay, so editing a price can move past totals. The fallback order is user `modelCosts` → exact official correction → jawcode catalog → expected-price overlay → model-level vendor fallback, and an explicit all-zero user entry means a known-zero estimate; delete that model entry to restore automatic pricing. All-zero catalog metadata still falls through. Each rate must be a non-negative finite number at most 1,000,000 (USD per 1M tokens); out-of-range rows are rejected by the management boundary and dropped on load. Display-time estimation only: overlays never affect routing, account selection, quotas, or billing. |
-| `headers?` | `Record<string, string>` | Extra upstream headers. Authorization, cookies, API-key headers, embedded newlines, and invalid names are rejected. |
+| `headers?` | `Record<string, string>` | Extra upstream headers. Authorization, cookies, API-key headers, embedded newlines, and invalid names are rejected. Requests that ride the provider outbound wrapper — model discovery, connection tests, and other proxy-originated diagnostics such as the Ollama show probe — send `User-Agent: opencodex` unless a User-Agent is set here or by the provider preset. |
 | `openRouterRouting?` | `OpenRouterProviderRouting` | Default OpenRouter `order`, `only`, and `allowFallbacks` preferences; valid only for canonical OpenRouter with `openai-chat`. |
 | `modelOpenRouterRouting?` | `Record<string, OpenRouterProviderRouting>` | Exact model-id overrides that replace the provider-wide OpenRouter preference. |
 | `vercelGatewayRouting?` | `VercelGatewayRouting` | Default Vercel AI Gateway `order`, `only`, and `sort` (`"cost"` \| `"ttft"` \| `"tps"`) preferences; valid only for canonical Vercel AI Gateway with `openai-chat`. |
@@ -180,11 +181,12 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | `codexAccountMode?` | `"pool" \| "direct"` | Canonical `openai` only; defaults to Pool. Direct bypasses pool state. |
 | `refreshPolicy?` | `"proactive" \| "lazy-only" \| "disabled"` | Override this OAuth provider's Token Guardian policy. |
 | `reasoningEfforts?` | `string[]` | Provider-wide Codex reasoning labels to advertise and send. For `google`-adapter providers, a configured ladder also asserts `thinkingLevel` capability: direct and Vertex non-image requests send the selected effort as `generationConfig.thinkingConfig.thinkingLevel`, while Cloud Code Assist uses its envelope-specific path. |
-| `modelReasoningEfforts?` | `Record<string, string[]>` | Per-model labels. An empty list hides effort control. As with `reasoningEfforts`, each configured `google`-adapter ladder asserts `thinkingLevel` capability; direct and Vertex non-image requests use the flat Gemini path, while Cloud Code Assist sends it under its request envelope. |
+| `modelReasoningEfforts?` | `Record<string, string[]>` | Per-model labels. An empty list hides effort control. As with `reasoningEfforts`, each configured `google`-adapter ladder asserts `thinkingLevel` capability; direct and Vertex non-image requests use the flat Gemini path, while Cloud Code Assist sends it under its request envelope. An adapter that ships its own per-model table (currently `command-code`) lets that table win at the wire for models it knows, so set `modelReasoningEffortsAuthoritative` as well to widen such a row. |
+| `modelReasoningEffortsAuthoritative?` | `boolean` | Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the catalog. Without it, an adapter that ships its own per-model effort table (currently `command-code`) advertises your widened ladder in the picker and then strips the extra rung on the way out. It is opt-in because presets are seeded with the shipped table, so a stored row alone cannot prove you wrote it rather than an older release. With it set, a rung the upstream refuses is returned as that error instead of being silently retried without the effort — you asked for it, so you see the answer. |
 | `modelSuppressSyntheticMax?` | `Record<string, boolean>` | Catalog-only per-model switch. `true` prevents OpenCodex from adding a missing synthetic `max` rung while retaining a provider-declared `max` and continuing to add `ultra` to reasoning-capable ladders. A preserved row that already contains `max` keeps it until healthy discovery rebuilds that row, because the catalog does not persist whether an older `max` was synthetic. If a configured default names a suppressed missing `max`, the catalog falls back to the highest real rung below it. Codex uses the same ladder membership for the picker and explicit `spawn_agent` effort validation, so an explicit `max` spawn can fail client-side before proxy clamping; `ultra` remains the supported harness path. |
 | `modelSupportsReasoningSummaries?` | `Record<string, boolean>` | Set a model to `false` to stop advertising summaries and strip summary-delivery fields. |
 | `modelReasoningSummaryDelivery?` | `Record<string, "sequential" \| "sequential_cutoff" \| "concurrent" \| "concurrent_cutoff">` | Per-model Responses delivery enum; rewrites an existing delivery field. |
-| `modelAdapters?` | `Record<string, string>` | Per-model `openai-chat` or `openai-responses` wire override for mixed-wire gateways. Explicit entries beat registry defaults. The OpenCode Go preset selects Responses for `gpt-5.6-luna` while leaving sibling models on their documented wires; DeepSeek can select native Responses for `deepseek-v4-flash`; and GitHub Copilot declares Responses-only defaults for the following models (`gpt-5.3-codex`, `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-6-astra`, `grok-4.5`, `grok-4.6`, `mai-code-1.1-flash`, `mai-code-1-flash-picker`) because those models reject `/chat/completions` for agent traffic. Models without a built-in default (for example `gpt-5.4-nano`) can be opted in here. Single-wire upstream pins and canonical ChatGPT forward reject overrides. |
+| `modelAdapters?` | `Record<string, string>` | Per-model `openai-chat` or `openai-responses` wire override for mixed-wire gateways. Explicit entries beat registry defaults. The OpenCode Go preset selects Responses for `gpt-5.6-luna` while leaving sibling models on their documented wires; DeepSeek can select native Responses for `deepseek-v4-flash`; Alibaba Token Plan (Beijing) serves `qwen3.8-flash`, `qwen3.7-plus`, and `glm-5.3` over its native Responses API on the same base, verified end to end on that gateway, so they can be opted in here while the wire default stays Chat; and GitHub Copilot declares Responses-only defaults for the following models (`gpt-5.3-codex`, `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.5`, `gpt-5.6-luna`, `gpt-5.6-sol`, `gpt-5.6-terra`, `gpt-6-astra`, `grok-4.5`, `grok-4.6`, `mai-code-1.1-flash`, `mai-code-1-flash-picker`) because those models reject `/chat/completions` for agent traffic. Models without a built-in default (for example `gpt-5.4-nano`) can be opted in here. Single-wire upstream pins and canonical ChatGPT forward reject overrides. |
 | xAI Chat Completions (dashboard / CLI) | switch | Grok 4.5/4.6 OAuth Responses requests default to Responses. Existing Chat overrides are migrated once on upgrade; later Chat choices are preserved. Turn on to select Chat for both models, off to select Responses. CLI: `ocx provider edit xai --xai-chat on` or `--xai-chat off` (running proxy required). Mixed means only one model currently uses Chat. Other overrides and tier policy stay unchanged. API-key and translated Chat/Anthropic defaults are unchanged. |
 | `xaiResponsesXSearch?` | `boolean` | Disabled by default. On an xAI Responses destination, append the provider-hosted `x_search` declaration only when a live `web_search` tool survives final request normalization. Existing declarations are not duplicated, caller `tool_choice`/`allowed_tools` selectors are never widened, and this is separate from the web-search sidecar's `search.xSearch` options. |
 | `modelPreferHostedTools?` | `Record<string,string[]>` | Exact-model opt-in for non-forward Responses gateways that reserve a hosted-tool namespace. Currently accepts only `["image_generation"]`; a matching model must use the `openai-responses` wire and support that hosted tool. It removes colliding client `image_gen` declarations and rewrites their selectors to preserve caller tool choice. For OpenAI API virtual `-pro` models, the selected public ID is matched first and the resolved base wire-model ID is a fallback. `modelAdapters` resolves the public ID first, then the base ID; the second resolution determines the final wire. Other models retain normal alias behavior. |
@@ -218,6 +220,7 @@ Providers can expose a built-in shorthand, such as `agy` for `google-antigravity
 | `escapeBuiltinToolNames?` | `boolean` | Escape built-in tool names for Anthropic-compatible gateways and restore them in returned calls. |
 | `anthropicEofTolerance?` | `boolean` | Let an Anthropic-compatible gateway complete a stream that ends before `message_stop`, only when visible text or a complete JSON-object tool input was received. Off by default. |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google transport/auth mode. Default `ai-studio`. |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Google only. Omitted/`compatible` preserves the compatible tool schema and existing non-direct 400 repair. `reject-lossy` rejects initial schema loss or an indeterminate bounded comparison before dispatch and withholds a Vertex or Cloud Code Assist repair that would open constraints. Direct AI Studio never performs that repair. |
 | `directGeminiWireRenames?` | `boolean` | Google only. Applies only to direct AI Studio requests. Omitted or `true` keeps the `-tiered` wire rename for Gemini Flash ids (`gemini-3.7-flash` -> `gemini-3.7-flash-tiered`); `false` sends the requested bare ids to the wire unchanged. Vertex preserves the requested model ID, and Cloud Code Assist routing is unchanged. Set `false` when the configured upstream still serves the bare ids. |
 | `project?` | `string` | Vertex or Antigravity Cloud Code Assist project id. |
 | — | — | Antigravity account quota probes (`retrieveUserQuota` and `retrieveUserQuotaSummary`) always go to Google's own Cloud Code host through the pinned outbound transport, regardless of a configured `baseUrl`; the account bearer is never sent to an operator-configured endpoint and a redirect aborts the probe. Only the model-list fallback still honors `baseUrl`. |
@@ -516,9 +519,14 @@ outbound proxy, opencodex resolves the hostname once and connects only to that v
 HTTPS retains the original Host, SNI, and certificate verification; provider config cannot disable
 certificate checks.
 
-When `HTTP_PROXY`, `HTTPS_PROXY`, or `ALL_PROXY` applies, these operations keep Bun's native fetch.
-URL and literal-address checks still run, but the proxy chooses the final route, DNS answer, and peer,
-so opencodex cannot pin or verify that peer. This is an explicit security limitation.
+These operations use the [server's configured outbound fetch](/reference/configuration/server/).
+A server SOCKS5 proxy — set with
+`config.proxy` or inherited from a SOCKS5 `ALL_PROXY` — uses OpenCodex's built-in tunnel when
+`NO_PROXY` does not exempt the target. Scheme-specific `HTTP_PROXY` and
+`HTTPS_PROXY` retain Bun's native HTTP(S) handling, while a non-SOCKS `ALL_PROXY` is not a native
+HTTP fetch route. URL and literal-address checks still run, but a selected proxy chooses the final
+route, DNS answer, and peer, so opencodex cannot pin or verify that peer. This is an explicit
+security limitation.
 
 Private/local destinations require `allowPrivateNetwork: true` and, when an outbound proxy is active,
 a matching `NO_PROXY` entry. Loopback is added automatically; list each LAN host explicitly because
@@ -532,8 +540,9 @@ Two fake-IP DNS accommodations exist for Clash / Surge / Mihomo users, and both
 *answers* only — a literal address in the URL is still rejected. The IANA benchmark range
 `198.18.0.0/15` (and its IPv4-mapped IPv6 spellings) is accepted whenever an outbound proxy applies
 to the host. Mihomo's default IPv6 fake-IP range `fdfe:dcba:9876::/48` is accepted on a stricter
-gate: the proxy variable that matches the URL scheme (`HTTPS_PROXY` for `https:`, `HTTP_PROXY` for
-`http:`; `ALL_PROXY` does not count) must be set, the host must not match `NO_PROXY`, and the
+gate: the proxy variable that matches the URL scheme (`HTTPS_PROXY` for
+`https:`, `HTTP_PROXY` for `http:`) or a SOCKS5 `ALL_PROXY` must be set (a non-SOCKS `ALL_PROXY` does
+not count), the host must not match `NO_PROXY`, and the
 request is then bound to that proxy explicitly. Any other ULA, an adjacent prefix, or a fake-IP answer
 mixed with a real private answer still requires `allowPrivateNetwork: true`. Provider save-time
 validation never applies the IPv6 accommodation.
@@ -1121,6 +1130,20 @@ The raw provider editor and provider API expose this map. POST/PUT replace an ex
 
 An explicit `modelCapabilities.<id>.inputModalities` now takes precedence over legacy modality hints for that exact routed model. A text-only declaration uses the existing vision sidecar to replace images with descriptions; if no sidecar is available, the request receives an explicit omission marker before dispatch. Native Chat image requests divert through this path. The catalog can still advertise image attachment support because the proxy provides the description step. Context-tier and video processing declarations remain inert pending their transport support.
 
+An input-modality declaration on a **custom model row** — the Input modalities checkboxes in the
+Models tab, or `inputModalities` on `customModels[]` — also takes precedence over the provider's
+legacy vision hints (`noVisionModels`, `modelInputModalities`) for that exact provider and model
+id. Declare `text, image` on a custom row and images reach that model even when the provider row
+lists it as text-only; declare only `text` and it is routed through the vision sidecar. This is
+the same precedence the catalog already applied, so the advertised row and the request now agree.
+`modelCapabilities` stays above it, because that is the dedicated per-model capability axis —
+including the write made by `ocx provider edit <provider> --model <id> --text-only`. A custom row
+that leaves the modalities blank inherits the provider row instead of claiming text-only.
+Every consumer that answers "can this model take an image" applies one rule to the declaration:
+image is absent from the list. A row declaring only `audio` or `video` therefore counts as
+image-incapable, rather than being treated as a text model by one predicate and an image target
+by the other.
+
 ### Renamed API-key presets
 
 A provider saved under another name, such as `CommandCode`, inherits missing reasoning-effort metadata when its adapter and fixed API-key endpoint match a registry preset. Your explicit per-model lists, including `[]`, remain authoritative. An omitted provider-wide list inherits the preset default; an explicit list remains unchanged. This does not match OAuth, unrelated endpoints, or templated/custom endpoint presets.
diff --git a/docs-site/src/content/docs/reference/configuration/server.md b/docs-site/src/content/docs/reference/configuration/server.md
index 779e0cee358..6deae1998c5 100644
--- a/docs-site/src/content/docs/reference/configuration/server.md
+++ b/docs-site/src/content/docs/reference/configuration/server.md
@@ -12,7 +12,7 @@ runs helper features around provider requests.
 | --- | --- | --- | --- |
 | `port` | `number` | `10100` | Proxy listen port. |
 | `hostname?` | `string` | `"127.0.0.1"` | Bind address. A non-loopback bind requires a data-admission token, resolved from `OPENCODEX_API_AUTH_TOKEN`, then `OCX_API_TOKEN_FILE`, then the installed owner-only `service-api-token` — nothing has to be exported by hand. See [Remote access](#remote-access). |
-| `proxy?` | `string` | — | Outbound HTTP(S) or SOCKS5 proxy URL (`socks5://host:port`), `${ENV_VAR}`, or `"auto"`. HTTP URLs apply to `HTTP_PROXY` / `HTTPS_PROXY` when those are unset. SOCKS5 URLs use OpenCodex's real SOCKS5 transport and are also exposed through `ALL_PROXY` (`ocx start --socks5`); inherited `HTTP(S)_PROXY` is cleared in this process. Loopback stays in `NO_PROXY`. `"auto"` reads the Windows system proxy (WinINET `ProxyEnable`/`ProxyServer`, `https=` then `http=` entry) once at process start and logs the host it chose. On other platforms, or when the system proxy is off, SOCKS-only, or unreadable, it uses direct egress and says so. PAC/WPAD and live proxy changes are not followed; restart the service after changing the system proxy. |
+| `proxy?` | `string` | — | Outbound HTTP(S) or SOCKS5 proxy URL (`socks5://host:port`), `${ENV_VAR}`, or `"auto"`. HTTP URLs apply to `HTTP_PROXY` / `HTTPS_PROXY` when those are unset. SOCKS5 URLs use OpenCodex's real SOCKS5 transport and are also exposed through `ALL_PROXY` (`ocx start --socks5`); inherited `HTTP(S)_PROXY` is cleared in this process. Loopback stays in `NO_PROXY`. `"auto"` reads the Windows system proxy (WinINET `ProxyEnable`/`ProxyServer`) once at process start, preserves distinct `http=` and `https=` entries, and logs the hosts it chose. A bare `ProxyServer` value applies to both schemes. On other platforms, or when the system proxy is off, SOCKS-only, or unreadable, it uses direct egress and says so. PAC/WPAD and live proxy changes are not followed; restart the service after changing the system proxy. |
 | `noProxy?` | `string \| string[]` | — | Hosts that bypass `proxy`, merged with inherited `NO_PROXY` and loopback entries. A string may use comma-separated `NO_PROXY` syntax or `${ENV_VAR}`. |
 | `emptyCompletionRetry?` | `boolean` | `false` | Opt in to one identical Responses retry when a turn has no text or tool call, including a stream that ends before a terminal event. The retry may be billable. `OCX_EMPTY_COMPLETION_RETRY=0` disables it without changing config; combo and routed-compaction turns remain excluded. |
 | `dropCodexSafetyBuffering?` | `boolean` | `false` | Remove optional client-facing hints from canonical Codex Responses passthrough: the two `x-codex-safety-buffering-enabled` / `x-codex-safety-buffering-faster-model` response headers, `response.metadata` events whose metadata type is `safety_buffering`, and top-level `safety_buffering` fields. Other headers, response data, policy refusals and failures are preserved. This does not disable provider safety enforcement or upstream buffering. Native `codex.response.metadata.headers` WebSocket metadata and `/responses/compact` are outside this filter. |
@@ -24,10 +24,12 @@ runs helper features around provider requests.
 | `codexNativeSteering?` | `boolean` | `false` | Experimental, native-only mid-turn steering on the Responses WebSocket endpoint. Requires `websockets: true`, a compatible upstream/client, and a pinned account/model/tool surface. Validated generation settings can change in explicit saved-result continuations. Does not enable translated models or HTTP fallback. See [native steering](/guides/codex-integration/#experimental-native-mid-turn-steering). |
 | `codexNativeInjection?` | `boolean` | `false` | Experimental saved function-result injection on compatible native multi-agent WebSocket turns. Requires `websockets: true`, explicit `multi_agent.enabled`, and an eligible provider. Separate from steering; no automatic tool rerun or recovery create. See [native injection](/guides/codex-integration/#experimental-native-function-result-injection). |
 | `corsAllowOrigins?` | `string[]` | `[]` | Additional exact origins allowed by CORS. Loopback origins are always allowed. Authority-based browser extension origins such as `chrome-extension://<extension-id>` are supported; `*` is not a wildcard. Firefox and Safari regenerate the extension UUID (per install / per browser launch), so update the entry when the origin changes. |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | Generated `ocx_…` credentials accepted by management and data-plane auth on non-loopback binds. Dashboard-managed. |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | Generated `ocx_…` data-plane admission credentials on non-loopback binds. They do not authorize management APIs; management access uses the separate credential documented in the [management reference](/reference/management-api/). Dashboard-managed. |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | disabled | Opt-in archived-session cleanup policy. Never enabled implicitly. |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | Cap in MiB for evictable app-owned logs, caches, blobs, and continuation payloads. Range 64–4096; not an RSS cap. |
-| `spend?` | `{ root?: { maxTokens?: number }; identity?: { maxTokens?: number }; pool?: { maxTokens?: number }; retentionDays?: number }` | unset | Durable token ceilings, off unless you write one. Each scope bounds settled spend plus in-flight reservations plus unresolved spend: `root` is one task including its whole fan-out, `identity` is one account across every task it serves, and `pool` is one provider pool. They intersect, so a request is admitted only when all three have room — which is what holds a ceiling against a client that mints a new task id per request. A reservation is the request's whole input plus its enforceable output ceiling, counted as if every cached prefix misses. Spend survives a restart, so it does not roll forward the way the send-count window does; raising or removing the value is what grants more. `maxTokens` must be a positive integer (0 would refuse everything), `retentionDays` is 1–365 and defaults to 7, and an unknown key in this section is rejected rather than ignored. A refusal is a local HTTP 429 carrying `x-opencodex-local-refusal: workflow_spend_exhausted`, and its message names the scope and the ceiling; no provider is contacted. |
+| `metricsExport.enabled?` | `boolean` | `false` | Enable process-local aggregate request metrics at authenticated `GET /api/metrics`. Restart required; disabled mode returns 404 and starts no exporter activity. |
+| `spend?` | `{ root?: { maxTokens?: number }; identity?: { maxTokens?: number }; pool?: { maxTokens?: number }; retentionDays?: number }` | unset | Durable token ceilings, off unless you write one. Each scope bounds settled spend plus in-flight reservations plus unresolved spend: `root` is one task including its whole fan-out, `identity` is one account across every task it serves, and `pool` is one provider pool. They intersect, so a request is admitted only when all three have room — which is what holds a ceiling against a client that mints a new task id per request. A reservation is the request's whole input plus its enforceable output ceiling, counted as if every cached prefix misses. Observe-only mode still journals, so every server owns the state directory's single-writer lease; an explicit sibling must use a separate `OPENCODEX_HOME`. Spend survives an ordinary process restart when its writes reached the filesystem, but the journal does not promise survival across host power loss because each append is not fsynced. Raising or removing the value is what grants more. `maxTokens` must be a positive integer (0 would refuse everything), `retentionDays` is 1–365 and defaults to 7, and an unknown key in this section is rejected rather than ignored. A refusal is a local HTTP 429 carrying `x-opencodex-local-refusal: workflow_spend_exhausted`, and its message names the scope and the ceiling; no provider is contacted. |
+
 | `codexAutoStart?` | `boolean` | `true` | Let the Codex shim run `ocx ensure` before launching Codex. False makes ensure a no-op. |
 | `codexShimAutoRestore?` | `boolean` | `true` | Restore an installed shim after a completed external Codex update replaces it. Environment opt-out: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. |
 | `codexDesktopAuthless?` | `boolean` | `false` | Opt-in authless Codex Desktop routing on a loopback bind: inject the dedicated `opencodex` provider with `requires_openai_auth = false` so Desktop opens without a ChatGPT login. Ignored on non-loopback binds. `ocx system settings --desktop-authless on`. See [Codex integration](/guides/codex-integration/#authless-codex-desktop-opt-in). |
@@ -494,6 +496,68 @@ Auto auth selects subscription when stored Claude auth is found, proxy when none
 subscription with a warning when detection is inconclusive. See
 [Claude Code auth mode](/guides/claude-code/#auth-mode).
 
+## Compaction routing
+
+In **Dashboard → Overview → Compaction routing**, choose a model, which triggers it applies to,
+and an optional reasoning effort, then click **Save**. Select **Use conversation model** and save
+to remove the override. Changes apply to the next compaction request without restarting the proxy.
+
+Set `compactionRouting` in OpenCodex `config.json` to override the model Codex's compaction
+requests use. The setting is disabled when omitted.
+
+```json
+{
+  "compactionRouting": {
+    "model": "provider/model-id",
+    "reasoningEffort": "low",
+    "triggers": ["manual"]
+  }
+}
+```
+
+`model` accepts native model IDs, provider-qualified model IDs, and configured combos.
+`reasoningEffort` is optional; omit it to preserve the incoming effort. Supported declarations
+are `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max`, and `ultra`.
+Existing provider effort rules still apply. The native `/responses/compact` endpoint keeps
+its existing behavior and does not forward reasoning settings.
+
+`triggers` names which compaction requests the override covers, using Codex's own
+`compaction.trigger` values: `"manual"` for a `/compact` you typed, `"auto"` for the automatic
+compaction Codex runs when a thread approaches its context limit. Omit `triggers` and the
+override applies to manual `/compact` only, leaving automatic compaction exactly where it
+routes today. Use `["auto"]` or `["manual", "auto"]` to route automatic compaction as well.
+
+Routing automatic compaction is what lets a long thread on a routed provider keep going when
+the canonical OpenAI quota is exhausted. Codex picks a bare native model for the compaction
+turn, and OpenCodex reserves that for an enabled canonical `openai` provider whenever one
+exists, so the compaction fails with a quota error before the routed turn begins even though
+the thread itself runs elsewhere. Naming `"auto"` here points the compaction at a
+provider-qualified model with its own credentials and quota.
+
+OpenCodex changes only requests with explicit `request_kind: "compaction"` metadata whose
+`compaction.trigger` is one of the values you listed, sent to `/v1/responses/compact` or to
+`/v1/responses` with a `compaction_trigger` input item. Later conversation turns keep their
+original routing and settings. Missing, malformed, or conflicting metadata does not activate the
+override, including on older clients without trigger metadata; when several copies of the
+metadata are supplied they must name the same trigger. WebSocket requests use each frame's
+metadata rather than the connection's earlier handshake metadata.
+
+The selected model's provider receives the entire conversation for summarization, including
+conversations that normally run on another provider. A combo selector sends it to every combo
+target, including failover targets. The dashboard panel states this next to the model picker
+and names the destination provider, or the combo's target providers, once a model is chosen.
+When the override covers automatic compaction, that transfer happens without you asking for it,
+at whatever point Codex decides to compact; the dashboard panel says so as well.
+The override reuses the existing compaction handlers and summary formats. When the selected
+model shares the conversation model's provider and account-routing identity (provider name,
+Codex account mode, and account namespace), the request keeps the caller's credential and may
+use that backend's native compact endpoint. Otherwise, including when either side is a combo or
+the conversation model is remembered as a combo target, OpenCodex runs the portable summarizer
+instead, so the summary stays readable when the conversation resumes on its own model, and the
+caller's credential does not cross to the other provider. The selected model must support the
+input size and content. Restart the proxy after editing
+`config.json` by hand. Dashboard saves apply immediately.
+
 ## Shadow calls
 
 Codex uses small helper models for tasks such as titles and commit messages. Enable
diff --git a/docs-site/src/content/docs/reference/management-api.md b/docs-site/src/content/docs/reference/management-api.md
index d03a78f5f42..4f47ad8bbc1 100644
--- a/docs-site/src/content/docs/reference/management-api.md
+++ b/docs-site/src/content/docs/reference/management-api.md
@@ -124,6 +124,51 @@ nonnegative integer account ID returned by the profile list; it is not a browser
 | `POST /api/client-integrations/aside/profiles/{profileId}/restore` | Undo an operation using `{ "opId": "..." }`; optional `confirmDrift: true` permits replacing later edits | 404 missing operation/profile; 409 busy, mismatch, or required drift confirmation; 410 expired snapshot; 500 save/write failure |
 | `POST /api/client-integrations/aside/sync` | Refresh enabled profiles through the server's mutation owner; body `{}` | 400 nonempty body/profile selector; 409 busy; 207 per-profile refusals |
 
+## Previewing an integration change
+
+A preview reports what a change would do without doing it. These routes write nothing: no
+snapshot, no ownership record, no journal row, no lock, and no maintenance or recovery.
+
+| Route | Purpose | Notable responses |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | Plan `apply`, `overwrite` or `disable` for one client; body `{ "clientId": "...", "operation": "..." }` | 400 invalid client or operation; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | Plan an undo; body `{ "opId": "...", "confirmDrift": false }` | 404 unknown operation; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Plan one Aside profile's change, including `restore` with an `opId` | 400 invalid body or unscoped request; 404 unknown profile or operation, 409 `integration_preview_unavailable` |
+
+A plan carries `version`, `clientId`, `operation`, `state`, `foreignEdit`, a `changes` list of
+`kind` and `path` pairs, an opaque `fingerprint`, `canApply`, `willChange`, and an optional
+`refusalReason` and `profileId`. Paths are managed schema paths or the fixed `$snapshot`,
+`$ownership` and `$journal` markers; a position chosen at runtime appears as `*`. No
+configuration value, file location or selected member identity is returned.
+
+`canApply: true` with `willChange: false` means the operation succeeds and changes nothing in
+the managed client document, such as applying what is already applied.
+
+An Aside profile change still saves one thing in that case. Confirming it records the desired sync
+preference for that profile before any client document is touched, so disabling a profile whose
+managed block is already absent stores the preference and leaves the document and its history
+untouched.
+
+`integration_preview_unavailable` means no usable model roster is currently retained. A freshly
+started proxy is one way to be in that state; a roster retired because the configuration or the
+provider cache moved is another. Reading `GET /api/client-integrations` establishes one when
+discovery succeeds and the configuration can be identified, so it is the usual remedy rather than
+a guarantee.
+
+## Confirming a previewed change
+
+Mutation routes accept `operation` and `planFingerprint` alongside their existing body. Send both
+or neither: a request carrying one is rejected, as is one whose `operation` disagrees with the
+change being requested. Aside bindings apply to a single profile, because one fingerprint cannot
+describe several independently changing files.
+
+The server re-plans before writing anything and returns `409 integration_preview_stale` with a
+freshly computed `plan` when the confirmation no longer describes what would happen. Decide again
+against the new plan; the request is not retried automatically.
+
+A fingerprint is an optimistic check, never authorization. Management authentication and every
+ownership rule still decide whether a change may happen at all.
+
 Bulk PUT returns `{ ok, clientId, changed, state, message, results }`; each result identifies
 its `profileId` and reports the writer outcome. Sync returns `{ ok, clientId, results }`, with
 per-profile refresh outcomes. Both return HTTP 200 when all returned attempts succeed and
@@ -220,6 +265,7 @@ by the current window size.
 | `GET /api/debug/injection-logs` | Read bounded guidance-injection debug entries | — |
 | `GET /api/claude/inbound-debug` | Read Claude inbound debug state and entries | — |
 | `GET /api/usage` | Scan the usage ledger into compact aggregates of readable rows, then incrementally fold verified appends; summarize by preset or inclusive custom window and client surface, with a Codex `accounts` breakdown keyed by stable non-PII log labels | 400 invalid custom bounds; returns an `error: "read_failed"` summary if storage cannot be read |
+| `GET /api/metrics` | Return process-local Prometheus text metrics for logical requests, physical sends, recovery kinds, duration, and TTFT. Labels are closed to protocol, result, and recovery class; request and credential identifiers are never exported. | 404 when `metricsExport.enabled` was not true at startup; ordinary management authentication is required and data-plane credentials grant no access |
 | `GET /api/storage` | Scan Codex storage usage by bucket | Returns an `error: "scan_failed"` payload on scan failure |
 | `POST /api/storage/cleanup/preview` | Preview archived-session cleanup and return a binding digest | 400 `invalid_json` or `invalid_percent` |
 | `POST /api/storage/cleanup` | Quarantine or permanently remove the previewed archived set | 400 invalid input; 409 stale/busy/referenced state; 500 filesystem/database failure |
@@ -230,6 +276,20 @@ by the current window size.
 | `POST /api/storage/cleanup-policy/run` | Start a manual cleanup-policy run | 409 `already_running`; 500 `cleanup_failed` |
 | `GET /api/storage/cleanup-policy/test-stream` | Test-only policy stream hook | 404 `not_found` when unavailable |
 
+`GET /api/metrics` returns `Content-Type: text/plain;version=0.0.4`. Counters and histograms
+reset when the process restarts; `opencodex_metrics_process_start_time_seconds` identifies that
+boundary. Histogram buckets are cumulative and end with `le="+Inf"`, equal to the family count.
+
+| Metric family | Labels | Meaning |
+| --- | --- | --- |
+| `opencodex_logical_requests_total` | `protocol`, `result` | One observation per finalized logical request. |
+| `opencodex_physical_sends_total` | `protocol` | Actual upstream sends summed from finalized attempts. |
+| `opencodex_recoveries_total` | `protocol`, `recovery` | Distinct recovery kinds observed per attempt, projected to a closed class. |
+| `opencodex_request_duration_seconds` | `protocol`, `result` | Fixed-bucket duration histogram for finalized requests. |
+| `opencodex_ttft_seconds` | `protocol`, `result` | Fixed-bucket TTFT histogram for requests with observed first output. |
+| `opencodex_ttft_missing_total` | `protocol`, `result` | Complementary count for requests without observed TTFT. |
+| `opencodex_metrics_process_start_time_seconds` | none | Process-local reset boundary. |
+
 If a scanned row exceeds the existing parser size limit, `GET /api/usage` and `GET /api/keys`
 keep the readable-row aggregates and add `usageIncomplete: true` with
 `usageIncompleteReason: "oversized_rows"` at response level. This diagnostic survives cached
diff --git a/docs-site/src/content/docs/reference/proxy-formats.md b/docs-site/src/content/docs/reference/proxy-formats.md
index f10e232f571..eda4190dee6 100644
--- a/docs-site/src/content/docs/reference/proxy-formats.md
+++ b/docs-site/src/content/docs/reference/proxy-formats.md
@@ -255,11 +255,16 @@ uses an unsupported protocol, opencodex skips the WebSocket attempt and uses HTT
 dialing the upstream directly.
 
 These rules belong to the upstream WebSocket transport, independently of the selected provider
-adapter. HTTP fetch-based Responses requests, including SSE fallback, use Bun's HTTP proxy rules
-and do not use `ALL_PROXY`. `config.proxy` fills missing `HTTP_PROXY`/`HTTPS_PROXY` values; the
-resulting scheme-specific value also takes precedence over an existing `ALL_PROXY` for WebSocket.
-For an HTTPS upstream that requires a proxy, set `HTTPS_PROXY` or `config.proxy`; `HTTP_PROXY`
-alone leaves both WSS and its HTTPS fallback without a scheme-matched proxy.
+adapter. HTTP fetch-based Responses requests, including SSE fallback, use the
+[configured outbound fetch](/reference/configuration/server/#server-fields). A server SOCKS5 proxy — set
+with `config.proxy` or inherited from a SOCKS5 `ALL_PROXY` — uses OpenCodex's built-in tunnel when
+`NO_PROXY`/`no_proxy` does not exempt the target. Scheme-specific
+`HTTP_PROXY`/`HTTPS_PROXY` values retain Bun's native HTTP(S) handling, while a non-SOCKS
+`ALL_PROXY` is not a native HTTP fetch route. `config.proxy` fills missing
+`HTTP_PROXY`/`HTTPS_PROXY` values; the resulting scheme-specific value also takes precedence over
+an existing `ALL_PROXY` for WebSocket. For an HTTPS upstream that requires a proxy, set
+`HTTPS_PROXY` or `config.proxy`; `HTTP_PROXY` alone leaves both WSS and its HTTPS fallback without
+a scheme-matched proxy.
 
 Every terminal Responses usage object includes both detail objects, even when the provider did not
 report those details:
diff --git a/docs-site/src/content/docs/ru/getting-started/quickstart.md b/docs-site/src/content/docs/ru/getting-started/quickstart.md
index d841ded5abe..1b086c7db2c 100644
--- a/docs-site/src/content/docs/ru/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/ru/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` проведёт вас по следующим шагам:
 
-1. **Выбор провайдера** — выберите один из 94 встроенных пресетов реестра или `custom`, чтобы
+1. **Выбор провайдера** — выберите один из 95 встроенных пресетов реестра или `custom`, чтобы
    ввести базовый URL и адаптер вручную.
 2. **API-ключ** — вставьте ключ или сошлитесь на переменную окружения вида `${ANTHROPIC_API_KEY}`.
 3. **Модель по умолчанию** — для провайдеров с ключом, локальных и `custom` примите значение из
diff --git a/docs-site/src/content/docs/ru/guides/providers.md b/docs-site/src/content/docs/ru/guides/providers.md
index ef8a0289fff..a79efd4d6d4 100644
--- a/docs-site/src/content/docs/ru/guides/providers.md
+++ b/docs-site/src/content/docs/ru/guides/providers.md
@@ -129,6 +129,25 @@ ocx logout <provider>
 
 Проверки квот аккаунтов и провайдера Google Antigravity используют фиксированные адреса Google, включая резервный запрос списка моделей. Для этих адресов поддерживается прозрачный Fake-IP DNS с сохранением проверки TLS, запрета перенаправлений и проверки частных адресов. Пользовательский base URL меняет только запросы моделей; `NO_PROXY` сохраняет политику прямого подключения.
 
+### Диагностика потерь схем инструментов Google
+
+Объявления инструментов Google компилируются для выбранного класса конечной точки. Когда отладка
+провайдера включена командой `ocx debug provider on`, переключателем Logs в дашборде или переменной
+`OCX_DEBUG=1`, потеря схемы при преобразовании совместимости на пути с отсутствующей политикой или
+`compatible` записывает событие
+`[ocx:google:google-tool-schema-loss]` (следите за ним через `ocx debug provider logs -f`). Оно
+содержит только версию отчёта, класс конечной точки, индикатор `lossy`, ограниченный счётчик
+неопределённых сравнений, фиксированные категории потерь с ограниченными счётчиками и признак усечения. Имена инструментов и свойств, пути, значения
+и текст схемы не включаются. При отсутствии политики или `compatible` преобразование только
+наблюдается. При `reject-lossy` начальная компиляция с потерей или неопределённым результатом
+ограниченного сравнения отклоняется до отправки; отдельное событие потери для отклонённого запроса
+не записывается. При `reject-lossy`
+восстановление Vertex или Cloud Code Assist, снимающее ограничения, пишет столь же безопасное событие
+`google-tool-schema-repair` и возвращает исходный 400 без изменённой отправки; при отсутствии политики
+или при `compatible` исправленный запрос повторяется как прежде. Прямой AI Studio
+такое восстановление не выполняет. Нативные схемы вывода исключены из обоих путей. См.
+[справочник команд отладки](/ru/reference/cli/agents/).
+
 
 После терминального сбоя обновления Nous выполните `ocx login nous`, чтобы пройти повторную аутентификацию.
 
@@ -179,7 +198,7 @@ Inline JSON и лишние позиционные аргументы откло
 
 ## 3. Каталог API-ключей
 
-opencodex поставляется с 94 встроенными пресетами: 78 на основе ключей, 12 OAuth, три локальных и
+opencodex поставляется с 95 встроенными пресетами: 79 на основе ключей, 12 OAuth, три локальных и
 один пресет ChatGPT-форварда по умолчанию. Селектор **Add provider** в дашборде открывает страницу
 выдачи ключей провайдера, проверяет ключ и сохраняет его; проверка зависит от провайдера.
 Наиболее заметные записи:
@@ -272,7 +291,7 @@ Zen может отвечать общими 429 без заголовков `Re
 Большинство использует адаптер `openai-chat` с bearer-ключом; немногие провайдеры, предоставляющие
 только Anthropic-совместимую конечную точку (например, **Xiaomi MiMo**), используют адаптер
 `anthropic` (`x-api-key`).
-Volcengine Agent Plan использует нативную конечную точку Responses через адаптер `openai-responses`.
+Volcengine Coding Plan и Agent Plan используют нативные конечные точки Responses через адаптер `openai-responses`. В проверенных продолжениях с вызовом инструментов на Ark Coding Plan повторная отправка элемента `reasoning`, возвращённого предыдущим ходом, даёт `400 InvalidParameter`, поэтому пресет Coding Plan удаляет такие элементы перед пересылкой входа продолжения. Состояние reasoning того хода при этом теряется; отключается через `dropResponsesReasoningItems: false`. Уже сохранённая конфигурация Coding Plan с `openai-chat` не переписывается и остаётся на Chat: чтобы перейти, вручную смените `adapter` на `openai-responses` и `responsesPath` на `/responses` либо удалите и заново добавьте пресет.
 
 > **Три маршрута тарификации Volcengine:** `volcengine` — Ark API с оплатой по факту,
 > `volcengine-coding-plan` расходует квоту Coding Plan, а `volcengine-agent-plan` — квоту Agent
diff --git a/docs-site/src/content/docs/ru/reference/cli/lifecycle.md b/docs-site/src/content/docs/ru/reference/cli/lifecycle.md
index 5bdde33ae2d..f338d75388f 100644
--- a/docs-site/src/content/docs/ru/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/ru/reference/cli/lifecycle.md
@@ -25,8 +25,10 @@ PID/runtime-port, а попытка поднять второй живой эк
 занят, `start` проверяет, кто его удерживает, и в любом случае останавливается: он отказывается от
 запуска, если там отвечает opencodex, а иначе сообщает о неопознанном владельце порта. Прокси
 никогда сам не переносит listener на другой порт, поскольку тогда первый прокси продолжил бы
-работать, а Codex был бы перенаправлен на второй. Укажите другой порт через `--port` или задайте
-`port: 0` в конфигурации, чтобы порт назначила ОС. На старте прокси синхронизирует модели каждого
+работать, а Codex был бы перенаправлен на второй. Явно указанный другой `--port` также отклоняется
+при общем `OPENCODEX_HOME`: режим наблюдения и режим с лимитами оба пишут в один журнал расходов.
+Для независимого соседнего экземпляра используйте отдельный `OPENCODEX_HOME`; `port: 0` поручает
+ОС выбрать только порт и не разделяет состояние. На старте прокси синхронизирует модели каждого
 провайдера в каталог Codex. При shutdown он восстанавливает native Codex — если только прокси не
 был запущен как managed service (`OCX_SERVICE=1`).
 
diff --git a/docs-site/src/content/docs/ru/reference/configuration/providers.md b/docs-site/src/content/docs/ru/reference/configuration/providers.md
index f30de5b380e..21227ef1abd 100644
--- a/docs-site/src/content/docs/ru/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ru/reference/configuration/providers.md
@@ -153,6 +153,7 @@ cross-route credential fallback не существует. Строки API GPT-
 | `escapeBuiltinToolNames?` | `boolean` | Экранировать built-in tool name'ы для Anthropic-compatible gateway'ев и восстанавливать их в возвращаемых call'ах. |
 | `anthropicEofTolerance?` | `boolean` | Позволяет Anthropic-совместимому шлюзу завершить поток до `message_stop`, только если получен видимый текст или полный JSON-объект аргументов инструмента. По умолчанию выключено. |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Режим транспорта/аутентификации Google. По умолчанию `ai-studio`. |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Только Google. Отсутствие поля или `compatible` сохраняет совместимую схему и существующее недиректное восстановление после 400. `reject-lossy` отклоняет начальную потерю или неопределённый результат ограниченного сравнения до отправки и блокирует восстановление Vertex или Cloud Code Assist, которое сняло бы ограничения. Прямой AI Studio такое восстановление не выполняет. |
 | `project?` | `string` | Идентификатор проекта Vertex или Antigravity Cloud Code Assist. |
 | `location?` | `string` | Локация Vertex; fallback через окружение — `GOOGLE_CLOUD_LOCATION`. |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | Только Cursor: MCP-серверы в режимах stdio или Streamable HTTP. |
@@ -174,10 +175,13 @@ GET-запросов. Если outbound-proxy не настроен, opencodex 
 подключается только к этому проверенному адресу. Для HTTPS сохраняются исходные Host, SNI и
 проверка сертификата; отключить проверку сертификата конфигурация провайдера не может.
 
-Если активны `HTTP_PROXY`, `HTTPS_PROXY` или `ALL_PROXY`, эти операции оставляют встроенный fetch
-Bun. Проверки URL и literal-address всё равно выполняются, но итоговый маршрут, DNS-ответ и peer
-всё же выбирает прокси, поэтому opencodex не может зафиксировать или проверить этого peer'а. Это
-осознанное ограничение безопасности.
+Эти операции используют [настроенный исходящий fetch сервера](/ru/reference/configuration/server/).
+SOCKS5-прокси сервера — заданный через `config.proxy` или унаследованный из SOCKS5 `ALL_PROXY` —
+использует встроенный туннель OpenCodex, если цель не совпадает с `NO_PROXY`.
+`HTTP_PROXY` и `HTTPS_PROXY` сохраняют нативную обработку HTTP(S) в Bun, а `ALL_PROXY` не-SOCKS
+не является маршрутом нативного HTTP fetch. Проверки URL и literal-address всё равно выполняются,
+но выбранный прокси определяет итоговый маршрут, DNS-ответ и peer, поэтому opencodex не может
+зафиксировать или проверить этого peer'а. Это осознанное ограничение безопасности.
 
 Private/local destination требуют `allowPrivateNetwork: true` и, если активен outbound-proxy,
 подходящей записи в `NO_PROXY`. Loopback добавляется автоматически; каждый LAN-host нужно
@@ -187,7 +191,7 @@ domain suffix, необязательные порты, IPv6 в квадратн
 не следуют redirect'ам и в результатах показывают только credential-stripped target. Проверка
 redirect'ов для обычных provider-request'ов реализована отдельно и к этому guard не относится.
 
-Для пользователей Clash / Surge / Mihomo предусмотрены два исключения fake-IP DNS, и оба применяются только к DNS-*ответам* — литеральный адрес в URL по-прежнему отклоняется. Диапазон IANA benchmark `198.18.0.0/15` (включая IPv4-mapped IPv6 записи) принимается, когда к хосту применяется исходящий прокси. Диапазон IPv6 fake-IP по умолчанию в Mihomo `fdfe:dcba:9876::/48` принимается при более строгом условии: должна быть задана переменная прокси, соответствующая схеме URL (`HTTPS_PROXY` для `https:`, `HTTP_PROXY` для `http:`; `ALL_PROXY` не учитывается), хост не должен совпадать с `NO_PROXY`, и тогда запрос явно привязывается к этому прокси. Любой другой ULA, соседний префикс или fake-IP ответ вперемешку с реальным приватным ответом по-прежнему требуют `allowPrivateNetwork: true`. Валидация при сохранении провайдера никогда не применяет IPv6-исключение.
+Для пользователей Clash / Surge / Mihomo предусмотрены два исключения fake-IP DNS, и оба применяются только к DNS-*ответам* — литеральный адрес в URL по-прежнему отклоняется. Диапазон IANA benchmark `198.18.0.0/15` (включая IPv4-mapped IPv6 записи) принимается, когда к хосту применяется исходящий прокси. Диапазон IPv6 fake-IP по умолчанию в Mihomo `fdfe:dcba:9876::/48` принимается при более строгом условии: должна быть задана переменная прокси, соответствующая схеме URL (`HTTPS_PROXY` для `https:`, `HTTP_PROXY` для `http:`) или SOCKS5 `ALL_PROXY` (`ALL_PROXY` не-SOCKS не учитывается), хост не должен совпадать с `NO_PROXY`, и тогда запрос явно привязывается к этому прокси. Любой другой ULA, соседний префикс или fake-IP ответ вперемешку с реальным приватным ответом по-прежнему требуют `allowPrivateNetwork: true`. Валидация при сохранении провайдера никогда не применяет IPv6-исключение.
 
 ## Пул аккаунтов Codex
 
diff --git a/docs-site/src/content/docs/ru/reference/configuration/server.md b/docs-site/src/content/docs/ru/reference/configuration/server.md
index e7de12e052a..e7e5b142319 100644
--- a/docs-site/src/content/docs/ru/reference/configuration/server.md
+++ b/docs-site/src/content/docs/ru/reference/configuration/server.md
@@ -20,9 +20,10 @@ description: Listener, удалённый доступ, admission key, тайм
 | `shutdownTimeoutMs?` | `number` | `5000` | Дедлайн graceful-drain до принудительного прерывания активных turn'ов. |
 | `websockets?` | `boolean` | `false` | Объявляет и разрешает клиентский WebSocket-путь Responses. При false клиенты используют HTTP/SSE; это не отключает подходящую upstream WS-оптимизацию canonical ChatGPT. |
 | `corsAllowOrigins?` | `string[]` | `[]` | Дополнительные точные origin, разрешённые CORS. Loopback-origin разрешены всегда. Поддерживаются authority-based origin браузерных расширений, например `chrome-extension://<extension-id>`; `*` не является маской. Firefox и Safari пересоздают UUID расширения (при каждой установке/запуске браузера), поэтому обновляйте запись при смене origin. |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | Сгенерированные credentials `ocx_…`, принимаемые для management и data-plane auth на не-loopback bind'ах. Управляются через дашборд. |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | Сгенерированные credentials `ocx_…` для data-plane admission на не-loopback bind'ах. Они не авторизуют management API; доступ к management использует отдельный credential, описанный в [management reference](/ru/reference/management-api/). Управляются через дашборд. |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | disabled | Opt-in policy очистки архивированных сессий. Никогда не включается неявно. |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | Лимит в MiB для eviction-friendly app-owned log'ов, cache'ей, blob'ов и continuation payload'ов. Это не RSS-cap. Диапазон 64–4096. |
+| `metricsExport.enabled?` | `boolean` | `false` | Включает локальные для процесса агрегированные метрики запросов на аутентифицированном `GET /api/metrics`. Требуется перезапуск; в выключенном состоянии маршрут возвращает 404 и экспортёр не запускает никакой активности. |
 | `codexAutoStart?` | `boolean` | `true` | Разрешает shim'у Codex запускать `ocx ensure` перед стартом Codex. При false `ensure` становится no-op. |
 | `codexShimAutoRestore?` | `boolean` | `true` | Восстанавливает установленный shim после завершённого внешнего обновления Codex, которое заменило его. Для отключения через окружение: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. |
 | `syncResumeHistory?` | `boolean` | `true` | Обратимый режим совместимости истории Codex App. Исходные metadata резервируются и восстанавливаются через `ocx stop` / `ocx restore`. |
diff --git a/docs-site/src/content/docs/ru/reference/management-api.md b/docs-site/src/content/docs/ru/reference/management-api.md
index 978744bbb0d..793b6e9a612 100644
--- a/docs-site/src/content/docs/ru/reference/management-api.md
+++ b/docs-site/src/content/docs/ru/reference/management-api.md
@@ -104,6 +104,51 @@ GUI-сессия в стиле loopback не выпускается.
 | `GET /api/client-integrations/journal?client=...` | Получить операции отката, при необходимости только для одного клиента. Каждая запись содержит вычисленный сервером флаг `deletable`. | 400 неверный клиент |
 | `DELETE /api/client-integrations/journal?opId=...` | Исключить старую операцию отката и по возможности удалить её снимок. В успешном ответе `snapshotRemoved: false` означает, что очистка сохранена для повторной попытки обслуживания. | 400 нет `opId`; 404 операция отсутствует или уже исключена; 409 последняя операция клиента |
 
+## Предварительный просмотр изменения интеграции
+
+Предпросмотр показывает, что сделало бы изменение, не делая его. Эти маршруты ничего не пишут:
+ни снимка, ни записи о владении, ни строки журнала, ни блокировки, ни обслуживания, ни
+восстановления.
+
+| Метод и путь | Назначение | Основные ошибки |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | Спланировать `apply`, `overwrite` или `disable` для одного клиента; тело `{ "clientId": "...", "operation": "..." }` | 400 неверный клиент или операция; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | Спланировать отмену; тело `{ "opId": "...", "confirmDrift": false }` | 404 операция не найдена; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Спланировать изменение одного профиля Aside; для `restore` нужен `opId` | 400 неверное тело или профиль не указан; 404 профиль или операция не найдены; 409 `integration_preview_unavailable` |
+
+План содержит `version`, `clientId`, `operation`, `state`, `foreignEdit`, список `changes` из пар
+`kind` и `path`, непрозрачный `fingerprint`, `canApply` и `willChange`; `refusalReason` и
+`profileId` необязательны. Пути — это управляемые пути схемы либо фиксированные метки
+`$snapshot`, `$ownership` и `$journal`; позиция, определяемая во время работы, показывается как
+`*`. Ни значения конфигурации, ни расположение файлов, ни имя выбранного элемента не возвращаются.
+
+`canApply` истинно при `willChange` ложном означает, что операция завершится успешно и ничего не
+изменит в управляемом клиентском документе, например повторное применение уже применённого.
+
+Изменение профиля Aside в этом случае всё же кое-что сохраняет: подтверждение записывает настройку
+синхронизации профиля до того, как будет затронут хоть один клиентский документ. Поэтому отключение
+профиля, управляемый блок которого уже отсутствует, сохраняет настройку и оставляет документ и его
+историю нетронутыми.
+
+`integration_preview_unavailable` означает, что сейчас нет пригодного списка моделей: только что
+запущенный прокси — один такой случай, список, отброшенный из-за изменения конфигурации или кэша
+провайдеров, — другой. Чтение `GET /api/client-integrations` формирует его, когда обнаружение
+прошло успешно и конфигурацию удалось определить; это обычное решение, а не гарантия.
+
+## Подтверждение просмотренного изменения
+
+Маршруты изменения принимают `operation` и `planFingerprint` рядом с обычным телом. Отправляйте
+оба или ни одного: запрос только с одним отклоняется, как и запрос, `operation` которого не
+совпадает с запрошенным изменением. Привязка Aside относится к одному профилю, поскольку один
+отпечаток не может описать несколько независимо меняющихся файлов.
+
+Перед записью сервер планирует заново и возвращает `409 integration_preview_stale` с заново
+вычисленным `plan`, когда подтверждение больше не описывает происходящее. Примите решение
+заново по новому плану; запрос не повторяется автоматически.
+
+Отпечаток — это оптимистичная проверка, а не разрешение. Возможность изменения по-прежнему
+определяют аутентификация управляющего API и правила владения.
+
 Удаление добавляет отметку вместо перезаписи журнала. Сервер защищает последнюю операцию каждого
 клиента, чтобы сохранить текущую точку отмены.
 
@@ -146,6 +191,7 @@ GUI-сессия в стиле loopback не выпускается.
 | `GET /api/debug/injection-logs` | Прочитать ограниченные guidance-injection debug-записи | — |
 | `GET /api/claude/inbound-debug` | Прочитать состояние и записи Claude inbound debug | — |
 | `GET /api/usage` | Сводка usage по диапазону и client surface | При сбое чтения storage вернёт summary с `error: "read_failed"` |
+| `GET /api/metrics` | Вернуть локальные для процесса текстовые метрики Prometheus: логические запросы, физические отправки, виды восстановления, длительность и TTFT. Метки ограничены закрытыми наборами protocol, result и recovery class; идентификаторы запросов и учётных данных не экспортируются. | 404, если `metricsExport.enabled` не был true при запуске; требуется обычная management-аутентификация, data-plane credentials доступа не дают |
 | `GET /api/storage` | Просканировать использование storage Codex по bucket'ам | При ошибке scan вернёт payload с `error: "scan_failed"` |
 | `POST /api/storage/cleanup/preview` | Предпросмотр cleanup archived-session и возврат binding digest | 400 `invalid_json` or `invalid_percent` |
 | `POST /api/storage/cleanup` | Поместить preview'нутый архивный набор в quarantine или удалить его навсегда | 400 invalid input; 409 stale/busy/referenced state; 500 filesystem/database failure |
diff --git a/docs-site/src/content/docs/tr/getting-started/quickstart.md b/docs-site/src/content/docs/tr/getting-started/quickstart.md
index 2c9445ffd77..6a595544d76 100644
--- a/docs-site/src/content/docs/tr/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/tr/getting-started/quickstart.md
@@ -14,7 +14,7 @@ ocx init
 
 `ocx init` adım adım size rehberlik eder:
 
-1. **Bir sağlayıcı seçin** — yerleşik kayıt defterindeki 94 önayardan birini
+1. **Bir sağlayıcı seçin** — yerleşik kayıt defterindeki 95 önayardan birini
    veya bir temel URL ile adaptör yazmak için `custom` seçeneğini belirleyin.
 2. **API anahtarı** — bir anahtar yapıştırın veya `${ANTHROPIC_API_KEY}` gibi
    bir ortam değişkenine başvurun.
@@ -119,4 +119,3 @@ ocx restore back  # Codex'i hala çalışan proxy üzerinden tekrar yönlendirin
 - [Nasıl Çalışır](/tr/getting-started/how-it-works/) — her isteğe ne olur?
 - [Sağlayıcılar](/tr/guides/providers/) — kimlik doğrulamanın her yolu.
 - [Yapılandırma](/tr/reference/configuration/) — tam `config.json` referansı.
-
diff --git a/docs-site/src/content/docs/tr/guides/integrations.md b/docs-site/src/content/docs/tr/guides/integrations.md
index 1ea3cd065b9..c1cc94e2a33 100644
--- a/docs-site/src/content/docs/tr/guides/integrations.md
+++ b/docs-site/src/content/docs/tr/guides/integrations.md
@@ -155,6 +155,24 @@ Kimi Code, gjc, MiniMax Code, Raycast — bütün belge olarak yazılan YAML, JS
 kendi girdilerimiz düzenlenmişse, anahtar kilitlenir ve hangi düzenlemelerin
 size ait olduğunu tahmin etmek yerine devre dışı bırakmayı reddeder.
 
+## Değişiklikleri önizleyin ve onaylayın
+
+Uygula, Değiştir, Devre dışı bırak ve Geri yükle işlemleri artık bir önizlemeyle başlar. İletişim
+kutusu, yönetilen ayarlardan tam olarak hangilerinin değişeceğini, sınırlı değişiklik yollarını ve
+her değişikliğin bir değer eklediğini, güncellediğini veya kaldırdığını gösterir. Onaylamadan önce bu
+planı inceleyin.
+
+Bir plan değişiklik olmadığını bildiriyorsa yönetilen istemci belgesi zaten istenen durumdadır. Seçili
+bir Aside profilinde onaylama, yönetilen belge değişmese bile profilin eşitleme tercihini kaydedebilir.
+
+Dosya siz inceledikten sonra değişirse yazma işlemi eski plan nedeniyle reddedilir. İletişim kutusu
+eski planı güncel planla değiştirir ve yeniden açıkça onaylamanızı ister; yazma işlemini hiçbir zaman
+otomatik olarak yeniden denemez. Önizleme geçici olarak kullanılamıyorsa sayfayı normal şekilde
+yenileyin ve işlemi yeniden başlatın.
+
+Aside, aynı önizleme ve onay akışını bir defada seçili tek bir profil için kullanır. **Tüm profilleri
+eşitle** ayrı bir toplu işlem olarak kalır ve tek bir birleşik önizlemeye bağlı değildir.
+
 ## Dürüstçe ne beklenmeli?
 
 **Biçimlendirme genellikle korunmaz.** Uygulama işlemi bir yapılandırmayı
diff --git a/docs-site/src/content/docs/tr/guides/providers.md b/docs-site/src/content/docs/tr/guides/providers.md
index 7bdb43d7928..abca3a24279 100644
--- a/docs-site/src/content/docs/tr/guides/providers.md
+++ b/docs-site/src/content/docs/tr/guides/providers.md
@@ -144,6 +144,24 @@ ocx logout <saglayici>
 
 Google Antigravity hesap ve sağlayıcı kota sorguları, model listesine geri dönüş dahil sabit Google uç noktalarını kullanır. Bu hedefler için şeffaf Fake-IP DNS desteklenirken TLS doğrulaması, yönlendirme reddi ve özel adres kontrolleri korunur. Özel base URL yalnızca model isteklerini değiştirir; `NO_PROXY` doğrudan bağlantı politikasını korur.
 
+### Google araç şeması kayıp tanılaması
+
+Google araç bildirimleri seçilen uç nokta sınıfına göre derlenir. Sağlayıcı hata ayıklaması
+`ocx debug provider on`, kontrol panelindeki Logs anahtarı veya `OCX_DEBUG=1` ile açıldığında,
+politika yokken veya `compatible` iken uyumluluk dönüşümü sırasında oluşan şema kaybı bir
+`[ocx:google:google-tool-schema-loss]` kaydı yayınlar
+(`ocx debug provider logs -f` ile takip edin). Kayıt yalnızca rapor sürümünü, uç nokta sınıfını,
+bir `lossy` göstergesini, sınırlı bir belirsiz karşılaştırma sayısını, sınırlı sayımlara sahip sabit kayıp kategorilerini ve kesilme işaretini
+taşır. Araç ve özellik adları, yollar, değerler ve şema metni hiçbir zaman dahil edilmez. Politika
+yoksa veya `compatible` ise dönüşüm reddedilmeden gözlemlenir. `reject-lossy` altında, ilk derleme
+kayıplıysa veya sınırlı karşılaştırmanın sonucu belirsizse gönderimden önce reddedilir; reddedilen
+istek için ayrı bir kayıp kaydı yayınlanmaz.
+`reject-lossy` altında, kısıtları kaldıracak bir Vertex veya Cloud Code Assist onarımı
+aynı şekilde içeriksiz bir `google-tool-schema-repair` kaydı üretir ve değiştirilmiş gönderim yapmadan
+özgün 400 yanıtını döndürür; politika yoksa veya `compatible` ise onarılan istek daha önce olduğu gibi
+yeniden gönderilir. Doğrudan AI Studio bu onarımı yapmaz. Yerel çıktı şemaları iki politika yolunun da
+dışındadır. [Hata ayıklama komutu başvurusuna](/tr/reference/cli/agents/) bakın.
+
 
 Uç bir Nous yenileme hatasından sonra yeniden kimlik doğrulamak için `ocx login
 nous` çalıştırın.
@@ -298,7 +316,7 @@ olmayan bir makineden oturum açmak bundan etkilenmez.
 
 ## 3. API anahtarı kataloğu
 
-opencodex 94 yerleşik önayar ile birlikte gelir: 78 anahtar tabanlı, 12
+opencodex 95 yerleşik önayar ile birlikte gelir: 79 anahtar tabanlı, 12
 OAuth, üç yerel ve bir varsayılan ChatGPT iletme önayarı. Kontrol panelinin
 **Sağlayıcı ekle** seçicisi bir anahtar sağlayıcısının kontrol panelini açar,
 anahtarı doğrular ve saklar; doğrulama sağlayıcıya özgüdür. Dikkate değer
diff --git a/docs-site/src/content/docs/tr/reference/cli/lifecycle.md b/docs-site/src/content/docs/tr/reference/cli/lifecycle.md
index f2b72af51c0..ffa5b19df50 100644
--- a/docs-site/src/content/docs/tr/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/tr/reference/cli/lifecycle.md
@@ -26,9 +26,11 @@ durumunu yazar ve ikinci bir canlı örneği başlatmayı reddeder. Tercih edile
 doluysa `start`, portu tutan süreci sorgular ve her iki durumda da durur: orada bir
 opencodex yanıt veriyorsa başlatmayı reddeder, aksi halde portu tutan sürecin
 tanımlanamadığını bildirir. İlk proxy'yi çalışır durumda bırakıp Codex'i ikinciye
-yönlendireceği için dinleyiciyi kendiliğinden başka bir porta taşımaz. `--port` ile
-farklı bir port belirtin veya işletim sisteminden bir port istemek için yapılandırmada
-`port: 0` ayarlayın. Başlangıçta her sağlayıcının modellerini Codex'in kataloğuna
+yönlendireceği için dinleyiciyi kendiliğinden başka bir porta taşımaz. Aynı
+`OPENCODEX_HOME` kullanılırken farklı bir `--port` açıkça verilse de başlangıç reddedilir;
+yalnızca gözlem ve sınır uygulama kiplerinin ikisi de aynı harcama günlüğüne yazar. Bağımsız
+bir kardeş örnek için ayrı bir `OPENCODEX_HOME` kullanın. `port: 0` yalnızca port seçimini
+işletim sistemine bırakır, durumu ayırmaz. Başlangıçta her sağlayıcının modellerini Codex'in kataloğuna
 senkronize eder. Kapatıldığında — yönetilen bir servis olarak başlatılmadığı sürece
 (`OCX_SERVICE=1`) — yerel Codex'i geri yükler.
 
diff --git a/docs-site/src/content/docs/tr/reference/configuration/providers.md b/docs-site/src/content/docs/tr/reference/configuration/providers.md
index b29dcdcf44f..57f5d867189 100644
--- a/docs-site/src/content/docs/tr/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/tr/reference/configuration/providers.md
@@ -154,6 +154,7 @@ alanlı seçilmiş kimlikleri yalın kimliklere yeniden yazar.
 | `escapeBuiltinToolNames?` | `boolean` | Anthropic uyumlu ağ geçitleri için yerleşik araç adlarından kaçış yapın ve döndürülen çağrılarda bunları geri yükleyin. |
 | `anthropicEofTolerance?` | `boolean` | Yalnızca görünür metin veya eksiksiz bir JSON nesnesi araç girdisi alındığında, Anthropic uyumlu bir ağ geçidinin `message_stop` öncesinde biten bir akışı tamamlamasına izin verin. Varsayılan olarak kapalıdır. |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google aktarım/kimlik doğrulama modu. Varsayılan `ai-studio`. |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | Yalnızca Google. Alanın atlanması veya `compatible`, uyumlu şemayı ve mevcut doğrudan olmayan 400 onarımını korur. `reject-lossy`, ilk kaybı veya sonucu belirsiz sınırlı bir karşılaştırmayı gönderimden önce reddeder ve kısıtları açacak Vertex ya da Cloud Code Assist onarımını engeller. Doğrudan AI Studio bu onarımı yapmaz. |
 | `project?` | `string` | Vertex veya Antigravity Cloud Code Assist proje kimliği. |
 | `location?` | `string` | Vertex konumu; ortam geri dönüşü `GOOGLE_CLOUD_LOCATION`'dır. |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | Yalnızca Cursor: stdio veya Akışlanabilir HTTP MCP sunucuları. |
@@ -177,9 +178,11 @@ kez çözer ve yalnızca bu doğrulanmış adrese bağlanır. HTTPS orijinal Hos
 ve sertifika doğrulamasını korur; sağlayıcı yapılandırması sertifika
 denetimlerini devre dışı bırakamaz.
 
-`HTTP_PROXY`, `HTTPS_PROXY` veya `ALL_PROXY` geçerli olduğunda bu işlemler
-Bun'ın yerel getirmesini korur. URL ve değişmez adres denetimleri hala çalışır,
-ancak proxy son rotayı, DNS yanıtını ve eşi seçer, bu nedenle opencodex bu eşi
+Bu işlemler [sunucunun yapılandırılmış giden fetch yolunu](/tr/reference/configuration/server/)
+kullanır. `config.proxy` ile ayarlanan veya SOCKS5 `ALL_PROXY`'den devralınan sunucu SOCKS5 proxy'si,
+hedef `NO_PROXY` ile eşleşmediğinde OpenCodex'in yerleşik tünelini kullanır. `HTTP_PROXY` ve `HTTPS_PROXY`, Bun'ın yerel HTTP(S) işlemesini korur; SOCKS olmayan bir
+`ALL_PROXY` ise yerel HTTP fetch rotası değildir. URL ve değişmez adres denetimleri hâlâ çalışır,
+ancak seçilen proxy son rotayı, DNS yanıtını ve eşi belirler; bu nedenle opencodex bu eşi
 sabitleyemez veya doğrulayamaz. Bu açık bir güvenlik sınırlamasıdır.
 
 Özel/yerel hedefler `allowPrivateNetwork: true` ve giden bir proxy etkin
@@ -192,7 +195,7 @@ hedefleri engellenmiş olarak kalır. Teşhis istekleri yönlendirmeleri reddede
 kimlik bilgisi kaldırılmış bir hedef bildirir. Sıradan sağlayıcı isteği yeniden
 yönlendirme incelemesi bu teşhis korumasından ayrı kalır.
 
-Clash / Surge / Mihomo kullanıcıları için iki fake-IP DNS istisnası vardır ve ikisi de yalnızca DNS *yanıtlarına* uygulanır; URL'deki literal adres yine reddedilir. IANA benchmark aralığı `198.18.0.0/15` (IPv4-mapped IPv6 yazımları dahil), ana bilgisayara bir giden proxy uygulandığında kabul edilir. Mihomo'nun varsayılan IPv6 fake-IP aralığı `fdfe:dcba:9876::/48` daha sıkı bir koşulla kabul edilir: URL şemasıyla eşleşen proxy değişkeni (`https:` için `HTTPS_PROXY`, `http:` için `HTTP_PROXY`; `ALL_PROXY` sayılmaz) ayarlı olmalı, ana bilgisayar `NO_PROXY` ile eşleşmemeli ve istek daha sonra açıkça o proxy'ye bağlanır. Diğer tüm ULA'lar, komşu önekler veya gerçek bir özel yanıtla karışık fake-IP yanıtları hâlâ `allowPrivateNetwork: true` gerektirir. Sağlayıcı kaydetme zamanı doğrulaması IPv6 istisnasını hiçbir zaman uygulamaz.
+Clash / Surge / Mihomo kullanıcıları için iki fake-IP DNS istisnası vardır ve ikisi de yalnızca DNS *yanıtlarına* uygulanır; URL'deki literal adres yine reddedilir. IANA benchmark aralığı `198.18.0.0/15` (IPv4-mapped IPv6 yazımları dahil), ana bilgisayara bir giden proxy uygulandığında kabul edilir. Mihomo'nun varsayılan IPv6 fake-IP aralığı `fdfe:dcba:9876::/48` daha sıkı bir koşulla kabul edilir: URL şemasıyla eşleşen proxy değişkeni (`https:` için `HTTPS_PROXY`, `http:` için `HTTP_PROXY`) veya bir SOCKS5 `ALL_PROXY` ayarlı olmalı (SOCKS olmayan `ALL_PROXY` sayılmaz), ana bilgisayar `NO_PROXY` ile eşleşmemeli ve istek daha sonra açıkça o proxy'ye bağlanır. Diğer tüm ULA'lar, komşu önekler veya gerçek bir özel yanıtla karışık fake-IP yanıtları hâlâ `allowPrivateNetwork: true` gerektirir. Sağlayıcı kaydetme zamanı doğrulaması IPv6 istisnasını hiçbir zaman uygulamaz.
 
 ## Codex hesap havuzu
 
diff --git a/docs-site/src/content/docs/tr/reference/configuration/server.md b/docs-site/src/content/docs/tr/reference/configuration/server.md
index 4472046cdc9..d55e6001e2f 100644
--- a/docs-site/src/content/docs/tr/reference/configuration/server.md
+++ b/docs-site/src/content/docs/tr/reference/configuration/server.md
@@ -20,9 +20,10 @@ yardımcı özellikleri nasıl çalıştıracağını kontrol eder.
 | `shutdownTimeoutMs?` | `number` | `5000` | Aktif turlar iptal edilmeden önce zarif boşaltma süresi sınırı. |
 | `websockets?` | `boolean` | `false` | Responses WebSocket yolu için `supports_websockets` bildirin. False, HTTP/SSE'yi tutar. |
 | `corsAllowOrigins?` | `string[]` | `[]` | CORS tarafından izin verilen ek tam kaynaklar. Geri döngü kaynaklarına her zaman izin verilir. `chrome-extension://<extension-id>` gibi yetki tabanlı tarayıcı uzantısı kaynakları desteklenir; `*` bir joker karakter değildir. Firefox ve Safari uzantı UUID'sini yeniden oluşturur (yükleme başına / tarayıcı başlatma başına), bu nedenle kaynak değiştiğinde girdiyi güncelleyin. |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | Geri döngü olmayan bağlamalarda yönetim ve veri düzlemi kimlik doğrulaması tarafından kabul edilen oluşturulmuş `ocx_…` kimlik bilgileri. Kontrol paneli tarafından yönetilir. |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | Geri döngü olmayan bağlamalarda veri düzlemi kabulü için oluşturulmuş `ocx_…` kimlik bilgileri. Yönetim API'lerini yetkilendirmezler; yönetim erişimi [yönetim API referansında](/tr/reference/management-api/) açıklanan ayrı kimlik bilgisini kullanır. Kontrol paneli tarafından yönetilir. |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | devre dışı | İsteğe bağlı arşivlenmiş oturum temizleme politikası. Asla örtük olarak etkinleştirilmez. |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | Çıkarılabilir uygulamaya ait günlükler, önbellekler, bloblar ve devam yükleri için MiB cinsinden sınır. Aralık 64–4096; bir RSS sınırı değildir. |
+| `metricsExport.enabled?` | `boolean` | `false` | Kimliği doğrulanmış `GET /api/metrics` üzerinde süreç yerel toplu istek metriklerini etkinleştirir. Yeniden başlatma gerekir; devre dışıyken yol 404 döndürür ve dışa aktarıcı etkinliği başlamaz. |
 | `codexAutoStart?` | `boolean` | `true` | Codex dolgusunun Codex'i başlatmadan önce `ocx ensure` çalıştırmasına izin verin. False, ensure'ı bir işlem yapmayan (no-op) hale getirir. |
 | `codexShimAutoRestore?` | `boolean` | `true` | Tamamlanan harici bir Codex güncellemesi değiştirdikten sonra kurulu bir dolguyu geri yükleyin. Ortam vazgeçmesi: `OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`. |
 | `syncResumeHistory?` | `boolean` | `true` | Tersine çevrilebilir Codex App geçmişi uyumluluğu. Orijinal meta veriler yedeklenir ve `ocx stop` / `ocx restore` tarafından geri yüklenir. |
diff --git a/docs-site/src/content/docs/tr/reference/management-api.md b/docs-site/src/content/docs/tr/reference/management-api.md
index 354310f01ef..63beca196dc 100644
--- a/docs-site/src/content/docs/tr/reference/management-api.md
+++ b/docs-site/src/content/docs/tr/reference/management-api.md
@@ -110,6 +110,49 @@ bakın.
 | `GET /api/client-integrations/journal?client=...` | Geri alma işlemlerini, isteğe bağlı olarak tek bir istemci için listeler. Her satır sunucunun hesapladığı `deletable` alanını içerir. | 400 geçersiz istemci |
 | `DELETE /api/client-integrations/journal?opId=...` | Eski bir geri alma işlemini kullanımdan kaldırır ve mümkünse anlık görüntüsünü siler. Başarılı yanıtta `snapshotRemoved: false`, temizliğin bakım yeniden denemesi için saklandığını belirtir. | 400 eksik `opId`; 404 bulunmayan veya zaten kaldırılmış işlem; 409 istemcinin en yeni işlemi |
 
+## Entegrasyon değişikliğini önizleme
+
+Önizleme, bir değişikliğin ne yapacağını yapmadan gösterir. Bu yollar hiçbir şey yazmaz: anlık
+görüntü, sahiplik kaydı, günlük satırı, kilit, bakım ve kurtarma yoktur.
+
+| Yöntem ve yol | Amaç | Önemli hatalar |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | Tek bir istemci için `apply`, `overwrite` veya `disable` planlar; gövde `{ "clientId": "...", "operation": "..." }` | 400 geçersiz istemci veya işlem; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | Bir geri almayı planlar; gövde `{ "opId": "...", "confirmDrift": false }` | 404 işlem bulunamadı; 400 `invalid_aside_profile_path`; 409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | Tek bir Aside profilinin değişikliğini planlar; `restore` için `opId` gerekir | 400 geçersiz gövde veya profil belirtilmemiş; 404 profil veya işlem bulunamadı; 409 `integration_preview_unavailable` |
+
+Plan; `version`, `clientId`, `operation`, `state`, `foreignEdit`, `kind` ve `path` çiftlerinden
+oluşan bir `changes` listesi, opak bir `fingerprint`, `canApply` ve `willChange` içerir;
+`refusalReason` ile `profileId` isteğe bağlıdır. Yollar ya yönetilen şema yollarıdır ya da sabit
+`$snapshot`, `$ownership` ve `$journal` işaretleridir; çalışma sırasında belirlenen bir konum `*`
+olarak görünür. Hiçbir yapılandırma değeri, dosya konumu veya seçilen öğenin adı döndürülmez.
+
+`canApply` doğru ve `willChange` yanlışsa işlem başarılı olur ama yönetilen istemci belgesinde
+hiçbir şey değişmez; örneğin zaten uygulanmış olanı yeniden uygulamak.
+
+Aside profil değişikliği bu durumda yine de bir şey kaydeder: onay, herhangi bir istemci belgesine
+dokunulmadan önce o profilin eşitleme tercihini yazar. Bu yüzden yönetilen bloğu zaten bulunmayan
+bir profili kapatmak yalnızca tercihi saklar, belgeyi ve geçmişini olduğu gibi bırakır.
+
+`integration_preview_unavailable`, şu anda kullanılabilir bir model listesi tutulmadığını belirtir:
+yeni başlamış bir vekil bunun bir hâlidir, yapılandırma ya da sağlayıcı önbelleği değiştiği için
+bırakılmış bir liste de öyle. `GET /api/client-integrations` okunduğunda keşif başarılı olur ve
+yapılandırma belirlenebilirse liste oluşur; bu her zamanki çözümdür, bir güvence değildir.
+
+## Önizlenen değişikliği onaylama
+
+Değişiklik yolları, olağan gövdenin yanında `operation` ve `planFingerprint` kabul eder. İkisini
+birlikte gönderin ya da hiçbirini: yalnızca birini taşıyan bir istek reddedilir, `operation` değeri
+istenen değişiklikle çelişen bir istek de öyle. Aside bağlaması tek bir profile içindir; çünkü bir
+parmak izi birbirinden bağımsız değişen birden çok dosyayı anlatamaz.
+
+Sunucu yazmadan önce yeniden planlar ve onay artık olacak olanı anlatmıyorsa yeniden hesaplanmış
+bir `plan` ile `409 integration_preview_stale` döndürür. Yeni plana bakarak yeniden karar verin;
+istek kendiliğinden yinelenmez.
+
+Parmak izi iyimser bir denetimdir, yetkilendirme değildir. Bir değişikliğin yapılıp
+yapılamayacağına yönetim API kimlik doğrulaması ve sahiplik kuralları karar verir.
+
 Silme, günlüğü yeniden yazmak yerine bir silme kaydı ekler. Geçerli geri alma noktasını korumak için
 her istemcinin en yeni işlemi sunucu tarafında korunur.
 
@@ -153,6 +196,7 @@ Hedef stratejileri, soğuma süreleri, takma adlar ve yönlendirme hataları iç
 | `GET /api/debug/injection-logs` | Sınırlı rehberlik enjeksiyonu hata ayıklama girdilerini okuyun | — |
 | `GET /api/claude/inbound-debug` | Claude gelen hata ayıklama durumunu ve girdilerini okuyun | — |
 | `GET /api/usage` | Kullanımı aralığa ve istemci yüzeyine göre özetleyin; Codex yanıtları ayrıca kararlı PII olmayan günlük etiketlerine göre anahtarlanan bir `accounts` dökümü içerir | Depolama okunamıyorsa bir `error: "read_failed"` özeti döndürür |
+| `GET /api/metrics` | Mantıksal istekler, fiziksel gönderimler, kurtarma türleri, süre ve TTFT için süreç yerel Prometheus metin metriklerini döndürür. Etiketler kapalı protokol, sonuç ve kurtarma sınıfı kümeleriyle sınırlıdır; istek veya kimlik bilgisi tanımlayıcıları dışa aktarılmaz. | Başlangıçta `metricsExport.enabled` true değilse 404; olağan yönetim kimlik doğrulaması gerekir ve veri düzlemi kimlik bilgileri erişim sağlamaz |
 | `GET /api/storage` | Sepete göre Codex depolama kullanımını tarayın | Tarama hatasında bir `error: "scan_failed"` yükü döndürür |
 | `POST /api/storage/cleanup/preview` | Arşivlenmiş oturum temizliğini önizleyin ve bağlayıcı bir özet döndürün | 400 `invalid_json` veya `invalid_percent` |
 | `POST /api/storage/cleanup` | Önizlenen arşivlenmiş kümeyi karantinaya alın veya kalıcı olarak kaldırın | 400 geçersiz girdi; 409 eski/meşgul/başvurulan durum; 500 dosya sistemi/veritabanı hatası |
diff --git a/docs-site/src/content/docs/zh-cn/getting-started/quickstart.md b/docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
index 4d005640355..e965b159a6b 100644
--- a/docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/zh-cn/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` 会引导你完成：
 
-1. **选择 provider** — 从内置 registry 的 94 个预设中选择一个，或选择 `custom` 手动输入 base URL 和 adapter。
+1. **选择 provider** — 从内置 registry 的 95 个预设中选择一个，或选择 `custom` 手动输入 base URL 和 adapter。
 2. **API key** — 粘贴一个 key，或引用一个环境变量，例如 `${ANTHROPIC_API_KEY}`。
 3. **默认模型** — 对于 key、本地和 custom provider，接受预设值或输入模型 id。
 4. **代理端口** — 默认为 `10100`。
diff --git a/docs-site/src/content/docs/zh-cn/guides/providers.md b/docs-site/src/content/docs/zh-cn/guides/providers.md
index f5a2ce23584..d2f4d1b5f5e 100644
--- a/docs-site/src/content/docs/zh-cn/guides/providers.md
+++ b/docs-site/src/content/docs/zh-cn/guides/providers.md
@@ -112,6 +112,20 @@ ocx logout <provider>
 
 Google Antigravity 账户和提供方的配额查询（包括模型列表回退）使用固定的 Google 计量端点。这些目标支持透明 Fake-IP DNS，同时保留 TLS 验证、重定向拒绝和私有地址检查。自定义 base URL 仅改变模型请求，不改变配额目标；`NO_PROXY` 仍使用直连策略。
 
+### Google 工具架构损失诊断
+
+Google 工具声明会按所选端点类别进行编译。通过 `ocx debug provider on`、仪表盘 Logs 开关或
+`OCX_DEBUG=1` 启用提供方调试后，在省略策略或使用 `compatible` 的路径上，兼容性转换中的架构损失会输出一条
+`[ocx:google:google-tool-schema-loss]` 记录（可用 `ocx debug provider logs -f` 持续查看），
+其中仅包含报告版本、端点类别、`lossy` 指示器、有上限的不确定比较计数、带有上限计数的固定损失类别和截断标志，
+绝不包含工具名、属性名、路径、值或架构文本。省略策略或使用 `compatible` 时只观察转换。
+在 `reject-lossy` 下，如果初始编译有损或有界比较结果不确定，则会在发送前拒绝；被拒绝的
+请求不会另行输出损失记录。在 `reject-lossy` 下，会移除约束的
+Vertex 或 Cloud Code Assist 修复会输出同样不含内容的 `google-tool-schema-repair` 记录，并在不发送
+修改请求的情况下返回原始 400；省略策略或使用 `compatible` 时，会像以前一样重放修复后的请求。
+直连 AI Studio 不执行该修复。原生输出架构不属于这两条策略路径。
+请参阅[调试命令参考](/zh-cn/reference/cli/agents/)。
+
 
 Nous refresh 发生终止性失败后，请运行 `ocx login nous` 重新认证。
 
@@ -159,7 +173,7 @@ Kiro 登录需要 Kiro CLI：Unix 使用 `curl -fsSL https://cli.kiro.dev/instal
 
 ## 3. API 密钥目录
 
-opencodex 内置 94 个预设：78 个密钥预设、12 个 OAuth 预设、3 个本地预设，以及 1 个默认的
+opencodex 内置 95 个预设：79 个密钥预设、12 个 OAuth 预设、3 个本地预设，以及 1 个默认的
 ChatGPT 转发预设。仪表盘的 **Add provider** 选择器会打开密钥提供商的控制台，验证并保存密钥。
 验证因提供商而异。主要条目包括：
 
@@ -232,7 +246,7 @@ Cline IDE/CLI 中提供，不能通过 API 使用；`minimax/minimax-m2.5` 是
 通往同一批模型的受支持路径，是使用 [opencode.ai/auth](https://opencode.ai/auth) 获取的 OpenCode Zen API 密钥、走带密钥的 **`opencode-zen`** 预设。若 OpenCode 之后公布了免密钥层级的第三方接入方式，opencodex 可以跟进；在此之前，这个预设的作用是记录该限制。上游条款：[opencode.ai/docs/zen](https://opencode.ai/docs/zen/)。
 
 大多数使用带 bearer 密钥的 `openai-chat` adapter；少数仅暴露 Anthropic 兼容端点的提供商（例如 **Xiaomi MiMo**）使用 `anthropic` adapter（`x-api-key`）。
-火山方舟 Agent Plan 通过 `openai-responses` adapter 使用原生 Responses 端点。
+火山方舟 Coding Plan 和 Agent Plan 都通过 `openai-responses` adapter 使用原生 Responses 端点。在已验证的 Ark Coding Plan 工具调用 continuation 中，回放上一次 Responses 返回的 `reasoning` item 会触发 `400 InvalidParameter`，因此 Coding Plan 预设会在转发 continuation input 前移除这类 replayed reasoning item；这会丢失该轮的 reasoning 状态，可用 `dropResponsesReasoningItems: false` 关闭。已经保存为 `openai-chat` 的 Coding Plan 配置不会被改写，仍按 Chat 走；如需切换，请手动把 `adapter` 改为 `openai-responses` 并把 `responsesPath` 设为 `/responses`，或删除后重新添加该预设。显式的逐模型 `openai-chat` override 仍可使用。
 内置 DeepSeek preset 同样会让 `deepseek-v4-flash` 使用原生 Responses 端点，并保留上游 SSE
 流式输出。如果该模型已经完成全部输出项却缺少最终 Responses 事件，opencodex 会应用模型级
 5 秒宽限修复；不完整或格式异常的流会以 incomplete 结束，不会被误报为成功。
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md b/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md
index f482b1701e2..30687e2b81e 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/lifecycle.md
@@ -15,7 +15,7 @@ description: 安装、启动、停止、服务、诊断、同步和更新命令
 
 ### `ocx start [--port <port>] [--socks5 [host:port] | --socks5-off]`
 
-启动代理服务器（首选端口 `10100`）。它会写入 PID/运行时端口状态，并拒绝启动第二个存活实例。当首选端口已被占用时，`start` 会探测占用者，并且无论结果如何都会停止：如果那里响应的是 opencodex，它会直接拒绝启动；否则会报告无法识别的占用者。它绝不会自行把监听地址移到其他端口，因为那会让第一个代理继续运行，并将 Codex 重新指向第二个代理。使用 `--port` 指定其他端口，或在配置中设置 `port: 0`，让操作系统分配端口。启动时，它会把每个提供方的模型同步到 Codex 的目录中。关闭时，它会恢复原生 Codex，除非它是作为受管服务启动的（`OCX_SERVICE=1`）。
+启动代理服务器（首选端口 `10100`）。它会写入 PID/运行时端口状态，并拒绝启动第二个存活实例。当首选端口已被占用时，`start` 会探测占用者，并且无论结果如何都会停止：如果那里响应的是 opencodex，它会直接拒绝启动；否则会报告无法识别的占用者。它绝不会自行把监听地址移到其他端口，因为那会让第一个代理继续运行，并将 Codex 重新指向第二个代理。即使显式指定不同的 `--port`，共用同一个 `OPENCODEX_HOME` 时也会拒绝启动，因为仅观察模式和启用上限的模式都会写入同一个支出日志。独立的同级实例必须使用单独的 `OPENCODEX_HOME`；`port: 0` 只让操作系统分配端口，并不会隔离状态。启动时，它会把每个提供方的模型同步到 Codex 的目录中。关闭时，它会恢复原生 Codex，除非它是作为受管服务启动的（`OCX_SERVICE=1`）。
 
 `--socks5`（默认 `127.0.0.1:10808`）会将 SOCKS5 URL 保存到 `config.proxy`，并通过真正的 SOCKS5 隧道转发出站 HTTP(S) 请求。`--socks5-off` 只会清除已保存的 SOCKS5 代理，不会删除 HTTP 代理。该值保存在配置中，因此会在 `ocx update` 后保留。URL 可以包含用户名和密码，但启动日志会将其隐藏。
 
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
index a529fb0eab8..e0e61490a1d 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
@@ -140,6 +140,7 @@ selector，而不是分配一个新名称。
 | `escapeBuiltinToolNames?` | `boolean` | 为 Anthropic 兼容网关转义内置工具名，并在返回的调用中恢复。 |
 | `anthropicEofTolerance?` | `boolean` | 允许 Anthropic 兼容网关在 `message_stop` 前结束流，仅当已收到可见文本或完整的 JSON 对象工具输入时。默认关闭。 |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google 传输/身份验证模式。默认 `ai-studio`。 |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | 仅限 Google。省略或设为 `compatible` 时保留兼容架构和现有的非直连 400 修复。`reject-lossy` 会在发送前拒绝初始损失或结果不确定的有界比较，并阻止会放宽约束的 Vertex 或 Cloud Code Assist 修复。直连 AI Studio 从不执行该修复。 |
 | `project?` | `string` | Vertex 或 Antigravity Cloud Code Assist 项目 id。 |
 | `location?` | `string` | Vertex 位置；环境变量回退为 `GOOGLE_CLOUD_LOCATION`。 |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | 仅 Cursor：stdio 或 Streamable HTTP MCP 服务器。 |
@@ -155,11 +156,11 @@ API key 提供者可以持有字面量 key，或环境引用。OAuth 提供者
 
 仪表板连接测试和实时模型发现使用受限的、仅 GET 传输。没有出站代理时，opencodex 只会解析一次主机名，并仅连接到该已验证地址。HTTPS 仍会保留原始 Host、SNI 和证书验证；提供者配置不能关闭证书检查。
 
-当 `HTTP_PROXY`、`HTTPS_PROXY` 或 `ALL_PROXY` 生效时，这些操作会继续使用 Bun 的原生 fetch。URL 和字面量地址检查仍会执行，但最终路由、DNS 解析结果和对端由代理决定，因此 opencodex 无法固定或验证该对端。这是一个明确的安全限制。
+这些操作使用[服务器配置的出站 fetch](/zh-cn/reference/configuration/server/)。通过 `config.proxy` 设置或继承自 SOCKS5 `ALL_PROXY` 的服务器 SOCKS5 代理，在目标不匹配 `NO_PROXY` 时使用 OpenCodex 的内置隧道。`HTTP_PROXY` 和 `HTTPS_PROXY` 保留 Bun 的原生 HTTP(S) 处理，而非 SOCKS 的 `ALL_PROXY` 不是原生 HTTP fetch 路由。URL 和字面量地址检查仍会执行，但所选代理会决定最终路由、DNS 解析结果和对端，因此 opencodex 无法固定或验证该对端。这是一个明确的安全限制。
 
 私有/本地目标需要 `allowPrivateNetwork: true`，并且在出站代理启用时，还需要匹配的 `NO_PROXY` 条目。回环地址会自动加入；每个 LAN 主机都必须显式列出，因为 CIDR 条目不会被解释。匹配器支持精确主机、域后缀、可选端口、带方括号的 IPv6 以及 `*`；例如，应显式列出 `192.168.1.50`。元数据和链路本地目标仍会被阻止。诊断请求会拒绝重定向，并报告一个已剥离凭据的目标。普通提供者请求的重定向审查仍然独立于这个诊断保护。
 
-面向 Clash / Surge / Mihomo 用户的 fake-IP DNS 例外有两种，且都只作用于 DNS *应答*——URL 中的字面地址仍会被拒绝。IANA 基准段 `198.18.0.0/15`（含 IPv4-mapped IPv6 写法）在该主机适用出站代理时被接受。Mihomo 默认的 IPv6 fake-IP 段 `fdfe:dcba:9876::/48` 采用更严格的门槛：必须设置与 URL 协议匹配的代理变量（`https:` 对应 `HTTPS_PROXY`，`http:` 对应 `HTTP_PROXY`，`ALL_PROXY` 不算），主机不能命中 `NO_PROXY`，随后请求会被显式绑定到该代理。其他 ULA、相邻前缀，或与真实私网应答混合的 fake-IP 应答仍需要 `allowPrivateNetwork: true`。提供方保存时的校验不应用该 IPv6 例外。
+面向 Clash / Surge / Mihomo 用户的 fake-IP DNS 例外有两种，且都只作用于 DNS *应答*——URL 中的字面地址仍会被拒绝。IANA 基准段 `198.18.0.0/15`（含 IPv4-mapped IPv6 写法）在该主机适用出站代理时被接受。Mihomo 默认的 IPv6 fake-IP 段 `fdfe:dcba:9876::/48` 采用更严格的门槛：必须设置与 URL 协议匹配的代理变量（`https:` 对应 `HTTPS_PROXY`，`http:` 对应 `HTTP_PROXY`）或 SOCKS5 的 `ALL_PROXY`（非 SOCKS 的 `ALL_PROXY` 不算），主机不能命中 `NO_PROXY`，随后请求会被显式绑定到该代理。其他 ULA、相邻前缀，或与真实私网应答混合的 fake-IP 应答仍需要 `allowPrivateNetwork: true`。提供方保存时的校验不应用该 IPv6 例外。
 
 ## Codex 账户池
 
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/server.md b/docs-site/src/content/docs/zh-cn/reference/configuration/server.md
index ef0699f2045..618bafc1d5c 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration/server.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration/server.md
@@ -20,9 +20,10 @@ description: 监听、远程访问、准入密钥、超时、存储、侧车、
 | `shutdownTimeoutMs?` | `number` | `5000` | 优雅停机截止时间，超过后会中止仍在进行中的请求。 |
 | `websockets?` | `boolean` | `false` | 声明并允许面向客户端的 Responses WebSocket 路径。设为 false 时客户端使用 HTTP/SSE；它不会禁用符合条件的 canonical ChatGPT 上游 WS 优化。 |
 | `corsAllowOrigins?` | `string[]` | `[]` | CORS 额外允许的精确 origin。loopback origin 始终允许；支持 `chrome-extension://<扩展 ID>` 等基于 authority 的浏览器扩展 origin，`*` 不是通配符。Firefox 和 Safari 会（每次安装/启动浏览器时）重新生成扩展 UUID，origin 变化后请更新该条目。 |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | 管理平面和非回环绑定上的数据平面身份验证可接受的已生成 `ocx_…` 凭据。由仪表板管理。 |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | 生成的 `ocx_…` 数据平面准入凭据（用于非回环绑定）。它们不授权管理 API；管理访问使用[管理 API 参考](/zh-cn/reference/management-api/)中说明的独立凭据。由仪表板管理。 |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | disabled | 可选启用的归档会话清理策略。不会被隐式启用。 |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | 可逐出应用自有日志、缓存、blob 和续传载荷的内存上限，单位 MiB。范围 64–4096；不是 RSS 上限。 |
+| `metricsExport.enabled?` | `boolean` | `false` | 在经过认证的 `GET /api/metrics` 上启用进程本地的请求聚合指标。需要重启；禁用时该路径返回 404，且不会启动任何导出活动。 |
 | `codexAutoStart?` | `boolean` | `true` | 允许 Codex shim 在启动 Codex 之前运行 `ocx ensure`。设为 false 会让 ensure 变成无操作。 |
 | `codexShimAutoRestore?` | `boolean` | `true` | 在完成外部 Codex 更新并覆盖安装的 shim 之后恢复该 shim。环境退出开关：`OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`。 |
 | `syncResumeHistory?` | `boolean` | `true` | 可逆的 Codex App 历史兼容性。原始元数据会被备份，并由 `ocx stop` / `ocx restore` 恢复。 |
diff --git a/docs-site/src/content/docs/zh-cn/reference/management-api.md b/docs-site/src/content/docs/zh-cn/reference/management-api.md
index 480accdf331..cc4396173f6 100644
--- a/docs-site/src/content/docs/zh-cn/reference/management-api.md
+++ b/docs-site/src/content/docs/zh-cn/reference/management-api.md
@@ -86,6 +86,43 @@ Authorization: Bearer <admin-token>
 | `GET /api/client-integrations/journal?client=...` | 列出回滚操作，也可限定为单个客户端。每一项都包含由服务器计算的 `deletable` 字段。 | 400 客户端无效 |
 | `DELETE /api/client-integrations/journal?opId=...` | 停用一条较旧的回滚操作，并在可能时删除其快照。成功响应中的 `snapshotRemoved: false` 表示清理任务已保留，等待维护重试。 | 400 缺少 `opId`；404 操作不存在或已停用；409 该客户端的最新操作 |
 
+## 预览集成变更
+
+预览只展示变更会做什么，而不会执行它。这些路由不写入任何内容：不留快照、不留归属记录、不留
+日志行、不加锁、不做维护和恢复。
+
+| 方法与路径 | 用途 | 主要错误 |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | 为一个客户端规划 `apply`、`overwrite` 或 `disable`；请求体为 `{ "clientId": "...", "operation": "..." }` | 400 客户端或操作无效；400 `invalid_aside_profile_path`；409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | 规划一次撤销；请求体为 `{ "opId": "...", "confirmDrift": false }` | 404 操作不存在；400 `invalid_aside_profile_path`；409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | 规划单个 Aside 配置档的变更；`restore` 需要 `opId` | 400 请求体无效或未指定配置档；404 配置档或操作不存在；409 `integration_preview_unavailable` |
+
+计划包含 `version`、`clientId`、`operation`、`state`、`foreignEdit`，由 `kind` 与 `path` 组成的
+`changes` 列表，不透明的 `fingerprint`，以及 `canApply` 和 `willChange`；`refusalReason` 与
+`profileId` 为可选。路径要么是受管理的结构路径，要么是 `$snapshot`、`$ownership`、`$journal`
+这三个固定标记；运行时才确定的位置显示为 `*`。不会返回任何配置值、文件位置或所选条目的名称。
+
+`canApply` 为真而 `willChange` 为假，表示操作会成功，但受管理的客户端文档不会有任何改动，例如
+重复应用已经应用过的内容。
+
+Aside 配置档的变更在这种情况下仍会保存一件事：确认之后，会先记录该配置档的同步偏好，然后才去动
+客户端文档。因此关闭一个受管理区块已经不存在的配置档，只会保存偏好，文档及其历史保持不变。
+
+`integration_preview_unavailable` 表示当前没有可用的模型清单：代理刚启动是一种情况，因配置或
+提供方缓存变化而弃用了原有清单也是一种情况。读取 `GET /api/client-integrations` 会在探测成功
+且能确认配置时建立清单，因此这通常是解决办法，但并非必然建立。
+
+## 确认已预览的变更
+
+变更路由接受与原有请求体并列的 `operation` 和 `planFingerprint`。两者要么都发送，要么都省略：
+只带其中一个会被拒绝，`operation` 与所请求的变更不一致也会被拒绝。Aside 的绑定只针对单个配置
+档，因为一个指纹无法描述多个各自独立变化的文件。
+
+服务器在写入前会重新规划，若确认的内容已不再符合实际，会返回 `409 integration_preview_stale`
+并附上重新计算的 `plan`。请根据新计划再做一次决定；请求不会自动重试。
+
+指纹只是乐观校验，不是授权。变更是否被允许，仍由管理 API 的认证和归属规则决定。
+
 删除操作会追加墓碑记录，而不会重写日志。服务器会保护每个客户端的最新操作，
 以保留当前的撤销点。
 
@@ -128,6 +165,7 @@ Authorization: Bearer <admin-token>
 | `GET /api/debug/injection-logs` | 读取有上限的 guidance-injection 调试条目 | — |
 | `GET /api/claude/inbound-debug` | 读取 Claude 入站调试状态和条目 | — |
 | `GET /api/usage` | 按范围和客户端界面汇总使用情况 | 若无法读取存储，则返回带有 `error: "read_failed"` 的摘要 |
+| `GET /api/metrics` | 返回进程本地的 Prometheus 文本指标，涵盖逻辑请求、实际发送、恢复类型、持续时间和 TTFT。标签仅使用协议、结果和恢复类别的封闭集合；绝不导出请求或凭据标识。 | 启动时 `metricsExport.enabled` 不为 true 则返回 404；需要普通管理认证，数据平面凭据不能访问 |
 | `GET /api/storage` | 按桶扫描 Codex 存储使用情况 | 扫描失败时返回带有 `error: "scan_failed"` 的载荷 |
 | `POST /api/storage/cleanup/preview` | 预览已归档会话清理并返回绑定摘要 | 400 `invalid_json` 或 `invalid_percent` |
 | `POST /api/storage/cleanup` | 隔离或永久移除预览出的归档集合 | 400 输入无效；409 过期/忙碌/被引用状态；500 文件系统/数据库失败 |
diff --git a/docs-site/src/content/docs/zh-tw/getting-started/quickstart.md b/docs-site/src/content/docs/zh-tw/getting-started/quickstart.md
index 54a69275182..3af31658c5a 100644
--- a/docs-site/src/content/docs/zh-tw/getting-started/quickstart.md
+++ b/docs-site/src/content/docs/zh-tw/getting-started/quickstart.md
@@ -13,7 +13,7 @@ ocx init
 
 `ocx init` 會引導你完成:
 
-1. **選擇 provider** —— 從內建 registry 的 94 個預設中選擇一個，或選擇 `custom` 手動輸入
+1. **選擇 provider** —— 從內建 registry 的 95 個預設中選擇一個，或選擇 `custom` 手動輸入
    base URL 和 adapter。
 2. **API key** —— 貼上一個 key,或引用一個環境變數,例如 `${ANTHROPIC_API_KEY}`。
 3. **預設模型** —— 對於 API key、本機和 custom provider，可接受預設值或輸入模型 id。
diff --git a/docs-site/src/content/docs/zh-tw/guides/integrations.md b/docs-site/src/content/docs/zh-tw/guides/integrations.md
index 0d5fdecd138..c0f9ef2bf82 100644
--- a/docs-site/src/content/docs/zh-tw/guides/integrations.md
+++ b/docs-site/src/content/docs/zh-tw/guides/integrations.md
@@ -84,6 +84,21 @@ opencodex 從自己的環境讀取這些變數。如果你的 gateway 以 profil
 
 停用只移除 opencodex 記錄為自己寫入的條目。如果你的檔案在我們寫入之後有變更，後續行為取決於我們自己的條目是否完好，以及檔案的格式。對於嚴格 JSON 設定檔（OpenCode、Pi），在我們的區塊**旁邊**進行的編輯——例如新增 MCP 伺服器或你自己的 provider——會顯示為**需要更新**：重新整理會在保留你的條目的前提下合併寫入，但格式可能會被正規化。例外情況是 JSON 無法精確重寫的內容——例如 `1e999` 這類非有限數字、重寫會被四捨五入的數字（極大的整數，或小到會塌縮成零的數字）、`-0`、同一個物件裡重複出現的鍵，或巢狀層數超過 1000 層——此時開關會鎖定，確保沒有任何值被悄悄改動或刪除。**OMP、DSH 與 Hermes** 同樣不受旁邊編輯影響，但原因不同：它們的 writer 只逐位元組修補自己的 `providers.opencodex` 範圍，檔案其餘部分從不會被重寫。至於其餘可以包含註解的格式（OpenClaw、Kimi Code、gjc、MiniMax Code、Raycast——以整份文件寫出的 YAML、JSON5 與 TOML），或當我們自己的條目被編輯過時，開關會鎖定，停用會拒絕執行，而不是猜測哪些編輯是你的。
 
+## 預覽並確認變更
+
+套用、取代、停用與回復現在都會先顯示預覽。對話框會明確列出哪些受管理的設定將會變更，
+包括範圍有限的變更路徑，以及每項變更是新增、更新或移除值。請先檢視計畫，再進行確認。
+
+當計畫顯示沒有變更時，表示受管理的用戶端文件已處於要求的狀態。對選取的 Aside 設定檔，
+即使受管理的文件沒有變更，確認後仍可能儲存該設定檔的同步偏好。
+
+如果檔案在你檢視後又有變更，寫入會因計畫過期而被拒絕。對話框會用更新後的計畫取代舊
+計畫，並要求你再次明確確認；它絕不會自動重試寫入。如果預覽暫時無法使用，請正常重新
+載入頁面，再重新開始該操作。
+
+Aside 會對一次選取的單一設定檔使用相同的預覽與確認流程。**同步所有設定檔**仍是獨立的
+批次操作，不會綁定到單一合併預覽。
+
 ## 誠實的預期
 
 **格式通常不會被保留。** 套用會解析設定並重新寫出，所以 JSON、JSON5 與 TOML 可能被重新格式化，JSON5 或 TOML 中的註解會遺失。OMP 與 DSH 是例外：它們的 YAML writer 分別只修補 `providers.opencodex` 與 `llm-pi-ai.providers.opencodex`，逐位元組保留無關的 provider 註解與格式。如果無法安全地識別那個確切的來源範圍，操作會拒絕執行。對其他客戶端，當你需要先前的檔案位元組時請使用 Restore：快照是逐字的副本。
diff --git a/docs-site/src/content/docs/zh-tw/guides/providers.md b/docs-site/src/content/docs/zh-tw/guides/providers.md
index 0eb613864a5..47594ee2578 100644
--- a/docs-site/src/content/docs/zh-tw/guides/providers.md
+++ b/docs-site/src/content/docs/zh-tw/guides/providers.md
@@ -117,6 +117,20 @@ ocx logout <provider>
 
 Google Antigravity 帳戶與供應商的配額查詢（包括模型清單備援）使用固定的 Google 計量端點。這些目標支援透明 Fake-IP DNS，同時保留 TLS 驗證、重新導向拒絕與私有位址檢查。自訂 base URL 只改變模型請求，不改變配額目標；`NO_PROXY` 仍使用直連政策。
 
+### Google 工具結構描述損失診斷
+
+Google 工具宣告會依所選端點類別進行編譯。透過 `ocx debug provider on`、儀表板 Logs 開關或
+`OCX_DEBUG=1` 啟用供應商偵錯後，在省略政策或使用 `compatible` 的路徑上，相容性轉換中的結構描述損失會輸出一筆
+`[ocx:google:google-tool-schema-loss]` 記錄（可用 `ocx debug provider logs -f` 持續查看），
+其中只包含報告版本、端點類別、`lossy` 指標、有上限的不確定比較計數、帶有上限計數的固定損失類別與截斷旗標，
+絕不包含工具名稱、屬性名稱、路徑、值或結構描述文字。省略政策或使用 `compatible` 時只觀察
+轉換。在 `reject-lossy` 下，若初始編譯有損或有界比較結果不確定，會在傳送前拒絕；被拒絕的
+請求不會另外輸出損失記錄。在 `reject-lossy` 下，會移除限制的
+Vertex 或 Cloud Code Assist 修復會輸出同樣不含內容的 `google-tool-schema-repair` 記錄，並在不傳送
+修改請求的情況下回傳原始 400；省略政策或使用 `compatible` 時，會像以前一樣重播修復後的請求。
+直接 AI Studio 不執行此修復。原生輸出結構描述不屬於這兩條政策路徑。請參閱
+[偵錯命令參考](/zh-tw/reference/cli/agents/)。
+
 
 終端 Nous refresh 失敗後，執行 `ocx login nous` 重新認證。
 
@@ -225,7 +239,7 @@ database 並移除目前的 WAL、SHM 與 journal sidecar，再發布先前的 s
 
 ## 3. API 金鑰目錄
 
-opencodex 內建 94 個 preset：78 個 key-based、12 個 OAuth、3 個 local，以及 1 個預設 ChatGPT-forward
+opencodex 內建 95 個 preset：79 個 key-based、12 個 OAuth、3 個 local，以及 1 個預設 ChatGPT-forward
 preset。儀表板的 **Add provider** picker 會開啟 key provider 的 dashboard、驗證金鑰並儲存；驗證方式
 依 provider 而異。主要條目如下。
 
@@ -311,7 +325,7 @@ key，走帶 key 的 **`opencode-zen`** preset。若 OpenCode 日後公布 keyle
 跟進；在此之前，這個 preset 的作用是記錄該限制。上游條款：[opencode.ai/docs/zen](https://opencode.ai/docs/zen/)。
 
 大多數 provider 使用帶 bearer key 的 `openai-chat` adapter；少數只提供 Anthropic-compatible endpoint 的
-provider，例如 **Xiaomi MiMo**，使用 `anthropic` adapter（`x-api-key`）。Volcengine Agent Plan 透過
+provider，例如 **Xiaomi MiMo**，使用 `anthropic` adapter（`x-api-key`）。在已驗證的 Ark Coding Plan 工具 continuation 中，把上一輪 Responses 回傳的 `reasoning` item 原樣送回會得到 `400 InvalidParameter`，因此 Coding Plan preset 會在轉送 continuation input 前移除這類 item；該輪的 reasoning 狀態會因此遺失，可用 `dropResponsesReasoningItems: false` 關閉。已經以 `openai-chat` 儲存的 Coding Plan 設定不會被改寫，仍走 Chat；要切換請手動把 `adapter` 改成 `openai-responses`、`responsesPath` 設為 `/responses`，或刪除後重新加入該 preset。Volcengine Coding Plan 與 Agent Plan 透過
 `openai-responses` 使用原生 Responses endpoint。內建 DeepSeek preset 也會把 `deepseek-v4-flash` 路由到
 原生 Responses endpoint，並保持上游 SSE streaming。若該模型完成所有 output item 卻省略最後的
 Responses event，opencodex 會套用 5 秒、model-scoped 的 grace repair；malformed 或 partial stream 會以
diff --git a/docs-site/src/content/docs/zh-tw/reference/cli/lifecycle.md b/docs-site/src/content/docs/zh-tw/reference/cli/lifecycle.md
index da2a7e08479..d9c104d3c91 100644
--- a/docs-site/src/content/docs/zh-tw/reference/cli/lifecycle.md
+++ b/docs-site/src/content/docs/zh-tw/reference/cli/lifecycle.md
@@ -15,7 +15,7 @@ description: 安裝、啟動、停止、服務、診斷、同步與更新指令
 
 ### `ocx start [--port <port>] [--socks5 [host:port] | --socks5-off]`
 
-啟動代理伺服器（偏好連接埠 `10100`）。它寫入 PID/runtime-port 狀態，並拒絕啟動第二個即時實例。偏好連接埠被佔用時，`start` 會探測佔用者，且無論結果如何都會停止：若回應的是 opencodex，它會直接拒絕啟動；否則會回報無法識別的佔用者。它絕不會自行將監聽位置移到其他連接埠，因為這會讓第一個代理繼續執行，並將 Codex 重新指向第二個代理。請用 `--port` 指定其他連接埠，或在設定中設為 `port: 0`，讓作業系統指派連接埠。啟動時它將每個供應商的模型同步到 Codex 目錄。關閉時它還原原生 Codex——除非它是作為受管服務啟動的（`OCX_SERVICE=1`）。
+啟動代理伺服器（偏好連接埠 `10100`）。它寫入 PID/runtime-port 狀態，並拒絕啟動第二個即時實例。偏好連接埠被佔用時，`start` 會探測佔用者，且無論結果如何都會停止：若回應的是 opencodex，它會直接拒絕啟動；否則會回報無法識別的佔用者。它絕不會自行將監聽位置移到其他連接埠，因為這會讓第一個代理繼續執行，並將 Codex 重新指向第二個代理。即使明確指定不同的 `--port`，共用同一個 `OPENCODEX_HOME` 時仍會拒絕啟動，因為僅觀察模式和啟用上限的模式都會寫入同一份支出日誌。獨立的同層實例必須使用不同的 `OPENCODEX_HOME`；`port: 0` 只讓作業系統指派連接埠，不會隔離狀態。啟動時它將每個供應商的模型同步到 Codex 目錄。關閉時它還原原生 Codex——除非它是作為受管服務啟動的（`OCX_SERVICE=1`）。
 
 `--socks5`（預設 `127.0.0.1:10808`）會將 SOCKS5 URL 儲存到 `config.proxy`，並透過真正的 SOCKS5 通道轉送對外 HTTP(S) 請求。`--socks5-off` 只會清除已儲存的 SOCKS5 代理，不會刪除 HTTP 代理。此值儲存在設定中，因此會在 `ocx update` 後保留。URL 可以包含使用者名稱和密碼，但啟動記錄會隱藏它們。
 
diff --git a/docs-site/src/content/docs/zh-tw/reference/configuration/providers.md b/docs-site/src/content/docs/zh-tw/reference/configuration/providers.md
index ca3868f66e4..395ec06ec77 100644
--- a/docs-site/src/content/docs/zh-tw/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/zh-tw/reference/configuration/providers.md
@@ -110,6 +110,7 @@ ocx models provider openrouter on
 | `noVisionModels?` | `string[]` | 透過視覺 sidecar 發送的純文字模型；比對容忍 Ollama `:size` 標籤。 |
 | `escapeBuiltinToolNames?` | `boolean` | 為 Anthropic 相容閘道轉義內建工具名稱，並在回傳的呼叫中還原它們。 |
 | `googleMode?` | `"ai-studio" \| "vertex" \| "cloud-code-assist"` | Google 傳輸／認證模式。預設 `ai-studio`。 |
+| `googleToolSchemaPolicy?` | `"compatible" \| "reject-lossy"` | 僅限 Google。省略或設為 `compatible` 時保留相容結構描述與既有的非直接 400 修復。`reject-lossy` 會在傳送前拒絕初始損失或結果不確定的有界比較，並阻止會放寬限制的 Vertex 或 Cloud Code Assist 修復。直接 AI Studio 不會執行該修復。 |
 | `project?` | `string` | Vertex 或 Antigravity Cloud Code Assist 專案 id。 |
 | `location?` | `string` | Vertex 位置；環境後備為 `GOOGLE_CLOUD_LOCATION`。 |
 | `mcpServers?` | `Record<string, CursorMcpServerConfig>` | 僅 Cursor：stdio 或 Streamable HTTP MCP 伺服器。 |
@@ -125,11 +126,11 @@ API-key 供應商可持有字面值金鑰或環境參考。OAuth 供應商使用
 
 儀表板連線測試與即時模型探索使用有界的 GET-only 傳輸。在沒有對外代理的情況下，opencodex 解析主機名稱一次並僅連接到該已驗證位址。HTTPS 保留原始 Host、SNI 與憑證驗證；供應商設定無法停用憑證檢查。
 
-當 `HTTP_PROXY`、`HTTPS_PROXY` 或 `ALL_PROXY` 適用時，這些操作保留 Bun 的原生 fetch。URL 與字面位址檢查仍會執行，但代理選擇最終路由、DNS 答案與對等端，因此 opencodex 無法 pin 或驗證該對等端。這是明確的安全限制。
+這些操作使用[伺服器設定的對外 fetch](/zh-tw/reference/configuration/server/)。以 `config.proxy` 設定或繼承自 SOCKS5 `ALL_PROXY` 的伺服器 SOCKS5 代理，在目標不符合 `NO_PROXY` 時使用 OpenCodex 的內建通道。`HTTP_PROXY` 與 `HTTPS_PROXY` 保留 Bun 的原生 HTTP(S) 處理，而非 SOCKS 的 `ALL_PROXY` 不是原生 HTTP fetch 路由。URL 與字面位址檢查仍會執行，但所選代理會決定最終路由、DNS 答案與對等端，因此 opencodex 無法 pin 或驗證該對等端。這是明確的安全限制。
 
 私有／本機目的地需要 `allowPrivateNetwork: true`，且當對外代理活躍時需要相符的 `NO_PROXY` 項目。回送會自動加入；請明確列出每個 LAN 主機，因為 CIDR 項目不被解讀。比對器支援精確主機、網域後綴、可選連接埠、方括號 IPv6 與 `*`；例如，明確列出 `192.168.1.50`。中繼資料與 link-link 目標保持被封鎖。診斷請求拒絕重新導向並回報已剝離憑證的目標。普通供應商請求的重新導向審查與此診斷防護分開。
 
-針對 Clash / Surge / Mihomo 使用者的 fake-IP DNS 例外有兩種，且都只作用於 DNS *回應*——URL 中的字面位址仍會被拒絕。IANA 基準區段 `198.18.0.0/15`（含 IPv4-mapped IPv6 寫法）在該主機適用對外代理時被接受。Mihomo 預設的 IPv6 fake-IP 區段 `fdfe:dcba:9876::/48` 採更嚴格的門檻：必須設定與 URL 協定相符的代理變數（`https:` 對應 `HTTPS_PROXY`，`http:` 對應 `HTTP_PROXY`，`ALL_PROXY` 不算），主機不得命中 `NO_PROXY`，之後請求會被明確綁定到該代理。其他 ULA、相鄰前綴，或與真實私網回應混合的 fake-IP 回應仍需要 `allowPrivateNetwork: true`。提供者儲存時的驗證不套用此 IPv6 例外。
+針對 Clash / Surge / Mihomo 使用者的 fake-IP DNS 例外有兩種，且都只作用於 DNS *回應*——URL 中的字面位址仍會被拒絕。IANA 基準區段 `198.18.0.0/15`（含 IPv4-mapped IPv6 寫法）在該主機適用對外代理時被接受。Mihomo 預設的 IPv6 fake-IP 區段 `fdfe:dcba:9876::/48` 採更嚴格的門檻：必須設定與 URL 協定相符的代理變數（`https:` 對應 `HTTPS_PROXY`，`http:` 對應 `HTTP_PROXY`）或 SOCKS5 的 `ALL_PROXY`（非 SOCKS 的 `ALL_PROXY` 不算），主機不得命中 `NO_PROXY`，之後請求會被明確綁定到該代理。其他 ULA、相鄰前綴，或與真實私網回應混合的 fake-IP 回應仍需要 `allowPrivateNetwork: true`。提供者儲存時的驗證不套用此 IPv6 例外。
 
 ## Codex 帳號池
 
diff --git a/docs-site/src/content/docs/zh-tw/reference/configuration/server.md b/docs-site/src/content/docs/zh-tw/reference/configuration/server.md
index 5fb998fb33f..cfb61730e72 100644
--- a/docs-site/src/content/docs/zh-tw/reference/configuration/server.md
+++ b/docs-site/src/content/docs/zh-tw/reference/configuration/server.md
@@ -18,9 +18,10 @@ description: 監聽器、遠端存取、許可金鑰、逾時、儲存、sidecar
 | `shutdownTimeoutMs?` | `number` | `5000` | 在中止活躍回合前的優雅排空截止時間。 |
 | `websockets?` | `boolean` | `false` | 廣告並允許面向 client 的 Responses WebSocket 路徑。False 時 client 使用 HTTP/SSE；不會停用符合條件的 canonical ChatGPT upstream WS 最佳化。 |
 | `corsAllowOrigins?` | `string[]` | `[]` | 額外的精確 CORS 來源。回送來源恆被允許。 |
-| `apiKeys?` | `OcxApiKey[]` | `[]` | 生成的 `ocx_…` 憑證，在非回送綁定上被管理與 data-plane 認證接受。由儀表板管理。 |
+| `apiKeys?` | `OcxApiKey[]` | `[]` | 生成的 `ocx_…` data-plane 准入憑證（用於非回送綁定）。它們不授權管理 API；管理存取使用[管理 API 參考](/zh-tw/reference/management-api/)中說明的獨立憑證。由儀表板管理。 |
 | `storageCleanupPolicy?` | `StorageCleanupPolicy` | 停用 | 選擇加入的已封存 session 清理政策。永不隱含啟用。 |
 | `appOwnedMemoryBudgetMb?` | `number` | `256` | 以 MiB 為單位、可被驅逐的 app 擁有日誌、快取、blob 與 continuation payload 上限。範圍 64–4096；非 RSS 上限。 |
+| `metricsExport.enabled?` | `boolean` | `false` | 在已驗證的 `GET /api/metrics` 啟用程序本機的彙總請求指標。需要重新啟動；停用時路徑回傳 404，且不會啟動任何匯出活動。 |
 | `codexAutoStart?` | `boolean` | `true` | 讓 Codex shim 在啟動 Codex 前執行 `ocx ensure`。False 使 ensure 為 no-op。 |
 | `codexShimAutoRestore?` | `boolean` | `true` | 在完成的外部 Codex 更新取代已安裝的 shim 後還原它。環境退出：`OPENCODEX_CODEX_SHIM_AUTO_RESTORE=0`。 |
 | `syncResumeHistory?` | `boolean` | `true` | 可逆的 Codex App 歷史相容性。原始中繼資料由 `ocx stop` / `ocx restore` 備份並還原。 |
diff --git a/docs-site/src/content/docs/zh-tw/reference/management-api.md b/docs-site/src/content/docs/zh-tw/reference/management-api.md
index 4342a698e06..10094e71816 100644
--- a/docs-site/src/content/docs/zh-tw/reference/management-api.md
+++ b/docs-site/src/content/docs/zh-tw/reference/management-api.md
@@ -82,6 +82,43 @@ Session 簽發在需要 data-plane 認證時停用，這包含遠端綁定。遠
 | `GET /api/client-integrations/journal?client=...` | 列出復原操作，也可限定為單一用戶端。每一項都包含由伺服器計算的 `deletable` 欄位。 | 400 用戶端無效 |
 | `DELETE /api/client-integrations/journal?opId=...` | 停用一筆較舊的復原操作，並在可能時刪除其快照。成功回應中的 `snapshotRemoved: false` 表示清理工作已保留，等待維護重試。 | 400 缺少 `opId`；404 操作不存在或已停用；409 該用戶端的最新操作 |
 
+## 預覽整合變更
+
+預覽只呈現變更會做什麼，而不會執行。這些路由不寫入任何內容：不留快照、不留歸屬紀錄、不留
+日誌列、不加鎖、不做維護與復原。
+
+| 方法與路徑 | 用途 | 主要錯誤 |
+| --- | --- | --- |
+| `POST /api/client-integrations/preview` | 為單一用戶端規劃 `apply`、`overwrite` 或 `disable`；請求內容為 `{ "clientId": "...", "operation": "..." }` | 400 用戶端或操作無效；400 `invalid_aside_profile_path`；409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/restore/preview` | 規劃一次復原；請求內容為 `{ "opId": "...", "confirmDrift": false }` | 404 操作不存在；400 `invalid_aside_profile_path`；409 `integration_preview_unavailable` |
+| `POST /api/client-integrations/aside/profiles/{profileId}/preview` | 規劃單一 Aside 設定檔的變更；`restore` 需要 `opId` | 400 請求內容無效或未指定設定檔；404 設定檔或操作不存在；409 `integration_preview_unavailable` |
+
+計畫包含 `version`、`clientId`、`operation`、`state`、`foreignEdit`，由 `kind` 與 `path` 組成的
+`changes` 清單，不透明的 `fingerprint`，以及 `canApply` 與 `willChange`；`refusalReason` 與
+`profileId` 為選用。路徑要麼是受管理的結構路徑，要麼是 `$snapshot`、`$ownership`、`$journal`
+這三個固定標記；執行時才決定的位置會顯示為 `*`。不會回傳任何設定值、檔案位置或所選項目的名稱。
+
+`canApply` 為真而 `willChange` 為假，表示操作會成功，但受管理的用戶端文件不會有任何變動，例如
+重複套用已經套用過的內容。
+
+Aside 設定檔的變更在這種情況下仍會儲存一件事：確認之後，會先記錄該設定檔的同步偏好，之後才會動
+用戶端文件。因此關閉一個受管理區塊已經不存在的設定檔，只會儲存偏好，文件與其歷史維持不變。
+
+`integration_preview_unavailable` 表示目前沒有可用的模型清單：代理剛啟動是一種情況，因設定或
+供應方快取變動而捨棄原有清單也是一種情況。讀取 `GET /api/client-integrations` 會在探測成功
+且能確認設定時建立清單，因此這通常是解決方式，但並非必然建立。
+
+## 確認已預覽的變更
+
+變更路由接受與原有請求內容並列的 `operation` 與 `planFingerprint`。兩者要麼都送出，要麼都省略：
+只帶其中一個會被拒絕，`operation` 與所請求的變更不一致也會被拒絕。Aside 的綁定只針對單一設定
+檔，因為一個指紋無法描述多個各自獨立變動的檔案。
+
+伺服器在寫入前會重新規劃，若確認的內容已不再符合實際，會回傳 `409 integration_preview_stale`
+並附上重新計算的 `plan`。請依新計畫再做一次決定；請求不會自動重試。
+
+指紋只是樂觀檢查，不是授權。變更是否被允許，仍由管理 API 的驗證與歸屬規則決定。
+
 刪除操作會附加墓碑記錄，而不會重寫日誌。伺服器會保護每個用戶端的最新操作，
 以保留目前的復原點。
 
@@ -124,6 +161,7 @@ Session 簽發在需要 data-plane 認證時停用，這包含遠端綁定。遠
 | `GET /api/debug/injection-logs` | 讀取有界的 guidance-injection 除錯項目 | — |
 | `GET /api/claude/inbound-debug` | 讀取 Claude inbound 除錯狀態與項目 | — |
 | `GET /api/usage` | 依範圍與客戶端介面摘要用量 | 若儲存無法讀取則回傳 `error: "read_failed"` 摘要 |
+| `GET /api/metrics` | 回傳程序本機的 Prometheus 文字指標，涵蓋邏輯請求、實際傳送、復原種類、持續時間與 TTFT。標籤僅使用 protocol、result 與 recovery class 的封閉集合；絕不匯出請求或憑證識別碼。 | 啟動時 `metricsExport.enabled` 不為 true 則回傳 404；需要一般管理驗證，資料平面憑證不能存取 |
 | `GET /api/storage` | 依 bucket 掃描 Codex 儲存用量 | 掃描失敗時回傳 `error: "scan_failed"` payload |
 | `POST /api/storage/cleanup/preview` | 預覽已封存 session 清理並回傳綁定摘要 | 400 `invalid_json` 或 `invalid_percent` |
 | `POST /api/storage/cleanup` | 隔離或永久移除預覽的已封存集合 | 400 無效輸入；409 過時／忙碌／被參照狀態；500 檔案系統／資料庫失敗 |
diff --git a/gui/src/components/CompactionRoutingPanel.tsx b/gui/src/components/CompactionRoutingPanel.tsx
new file mode 100644
index 00000000000..e2285891447
--- /dev/null
+++ b/gui/src/components/CompactionRoutingPanel.tsx
@@ -0,0 +1,207 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useT, type TKey } from "../i18n/shared";
+import { IconAlert } from "../icons";
+import { Select } from "../ui";
+import { createBoundedFetch } from "../bounded-fetch";
+import { requireJson, type ModelInfo } from "../pages/dashboard-shared";
+import { formatNamespacedModelId } from "../provider-icons";
+
+type Setting = { model: string; reasoningEffort?: string; triggers?: string[] } | null;
+const EFFORTS = ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"];
+const TRIGGERS = ["manual", "auto"];
+/**
+ * One picker over the two trigger sets the config allows. "manual" is sent as an omitted
+ * `triggers`, so the default save keeps the exact payload the manual-only override used.
+ */
+const TRIGGER_CHOICES = ["manual", "manual+auto", "auto"] as const;
+const TRIGGER_LABELS: Record<string, TKey> = {
+  "manual": "compactionRouting.triggersManual",
+  "manual+auto": "compactionRouting.triggersBoth",
+  "auto": "compactionRouting.triggersAuto",
+};
+
+function triggersToChoice(value: string[] | undefined): string {
+  if (!value) return "manual";
+  const auto = value.includes("auto");
+  return value.includes("manual") ? (auto ? "manual+auto" : "manual") : (auto ? "auto" : "manual");
+}
+
+function choiceToTriggers(choice: string): string[] | undefined {
+  if (choice === "auto") return ["auto"];
+  if (choice === "manual+auto") return ["manual", "auto"];
+  return undefined;
+}
+
+function readComboProviders(payload: unknown): Record<string, string[]> {
+  const combos = (payload as { combos?: unknown })?.combos;
+  if (!Array.isArray(combos)) return {};
+  const result: Record<string, string[]> = {};
+  for (const combo of combos) {
+    if (!combo || typeof combo !== "object" || typeof (combo as { id?: unknown }).id !== "string") continue;
+    const targets = (combo as { targets?: unknown }).targets;
+    const providers = Array.isArray(targets)
+      ? targets.map(target => (target as { provider?: unknown })?.provider).filter((value): value is string => typeof value === "string")
+      : [];
+    result[(combo as { id: string }).id] = [...new Set(providers)];
+  }
+  return result;
+}
+
+function readSetting(payload: { compactionRouting?: unknown }): Setting {
+  const value = payload.compactionRouting;
+  if (value == null) return null;
+  if (!value || typeof value !== "object" || !("model" in value) || typeof value.model !== "string" || !value.model.trim()) {
+    throw new Error("invalid settings");
+  }
+  const effort = "reasoningEffort" in value ? value.reasoningEffort : undefined;
+  if (effort !== undefined && (typeof effort !== "string" || !EFFORTS.includes(effort))) throw new Error("invalid effort");
+  const triggers = "triggers" in value ? value.triggers : undefined;
+  if (triggers !== undefined && (!Array.isArray(triggers) || triggers.length === 0
+    || !triggers.every(entry => typeof entry === "string" && TRIGGERS.includes(entry))
+    || new Set(triggers).size !== triggers.length)) throw new Error("invalid triggers");
+  return {
+    model: value.model,
+    ...(effort ? { reasoningEffort: effort as string } : {}),
+    ...(triggers ? { triggers: triggers as string[] } : {}),
+  };
+}
+
+export default function CompactionRoutingPanel(props: { apiBase: string; models: ModelInfo[] }) {
+  return <CompactionRoutingControls key={props.apiBase} {...props} />;
+}
+
+function CompactionRoutingControls({ apiBase, models }: { apiBase: string; models: ModelInfo[] }) {
+  const t = useT();
+  const [saved, setSaved] = useState<Setting | undefined>(undefined);
+  const [model, setModel] = useState("");
+  const [effort, setEffort] = useState("");
+  const [triggers, setTriggers] = useState("manual");
+  const [busy, setBusy] = useState(false);
+  const [loadError, setLoadError] = useState(false);
+  const [feedback, setFeedback] = useState<"saved" | "failed" | null>(null);
+  const [comboProviders, setComboProviders] = useState<Record<string, string[]>>({});
+  const active = useRef(false);
+  const pending = useRef<ReturnType<typeof createBoundedFetch> | null>(null);
+
+  const accept = useCallback((value: Setting) => {
+    setSaved(value);
+    setModel(value?.model ?? "");
+    setEffort(value?.reasoningEffort ?? "");
+    setTriggers(triggersToChoice(value?.triggers));
+  }, []);
+
+  const load = useCallback(async () => {
+    if (pending.current) return;
+    const request = createBoundedFetch(15_000);
+    pending.current = request;
+    setLoadError(false);
+    try {
+      const response = await fetch(`${apiBase}/api/settings`, { signal: request.signal });
+      const value = readSetting(await requireJson(response));
+      if (active.current && pending.current === request) accept(value);
+      const combos = await fetch(`${apiBase}/api/combos`, { signal: request.signal }).then(requireJson).then(readComboProviders).catch(() => ({}));
+      if (active.current && pending.current === request) setComboProviders(combos);
+    } catch {
+      if (active.current && pending.current === request) setLoadError(true);
+    } finally {
+      request.clear();
+      if (pending.current === request) pending.current = null;
+    }
+  }, [apiBase, accept]);
+
+  useEffect(() => {
+    active.current = true;
+    const timer = window.setTimeout(() => { void load(); }, 0);
+    return () => {
+      window.clearTimeout(timer);
+      active.current = false;
+      pending.current?.controller.abort();
+      pending.current?.clear();
+      pending.current = null;
+    };
+  }, [load]);
+
+  const save = async () => {
+    if (pending.current || saved === undefined) return;
+    const request = createBoundedFetch(15_000);
+    pending.current = request;
+    setBusy(true);
+    setFeedback(null);
+    try {
+      const response = await fetch(`${apiBase}/api/settings`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          compactionRouting: model
+            ? {
+              model,
+              ...(effort ? { reasoningEffort: effort } : {}),
+              ...(choiceToTriggers(triggers) ? { triggers: choiceToTriggers(triggers) } : {}),
+            }
+            : null,
+        }),
+        signal: request.signal,
+      });
+      const value = readSetting(await requireJson(response));
+      if (active.current && pending.current === request) {
+        accept(value);
+        setFeedback("saved");
+      }
+    } catch {
+      if (active.current && pending.current === request) setFeedback("failed");
+    } finally {
+      request.clear();
+      if (active.current && pending.current === request) setBusy(false);
+      if (pending.current === request) pending.current = null;
+    }
+  };
+
+  const options = [{ value: "", label: t("compactionRouting.currentModel") },
+    ...[...new Set([...models.map(item => item.namespaced), ...(model ? [model] : [])])]
+      .map(value => ({ value, label: formatNamespacedModelId(value, t) }))];
+  const disabled = busy || saved === undefined || loadError;
+  const dirty = model !== (saved?.model ?? "")
+    || effort !== (saved?.reasoningEffort ?? "")
+    || triggers !== triggersToChoice(saved?.triggers);
+  const namespace = model.slice(0, Math.max(model.indexOf("/"), 0));
+  const combo = namespace === "combo" ? model.slice(namespace.length + 1) : "";
+  const provider = namespace && !combo ? namespace : model;
+  const providers = comboProviders[combo]?.join(", ") || t("compactionRouting.comboProvidersUnknown");
+  const routesAutomatic = triggers !== "manual";
+
+  return (
+    <section className="panel" aria-labelledby="compaction-routing-title" aria-busy={busy || (saved === undefined && !loadError)}>
+      <div className="spread" style={{ alignItems: "flex-start", flexWrap: "wrap" }}>
+        <div style={{ flex: "1 1 20rem", minWidth: 0 }}>
+          <div className="font-semibold" id="compaction-routing-title">{t("compactionRouting.title")}</div>
+          <div className="muted setting-hint">{t("compactionRouting.description")}</div>
+          <div className="muted setting-hint">{t("compactionRouting.dataNotice")}</div>
+          <div className="muted setting-hint">{t("compactionRouting.effortHint")}</div>
+        </div>
+        <div className="dash-delegation-controls" style={{ flex: "0 1 auto" }}>
+          <Select id="compaction-routing-model" value={model} options={options} disabled={disabled}
+            label={t("compactionRouting.model")}
+            onChange={value => { setModel(value); if (!value) { setEffort(""); setTriggers("manual"); } setFeedback(null); }} />
+          <Select id="compaction-routing-triggers" value={triggers} disabled={disabled || !model} align="right"
+            label={t("compactionRouting.triggers")}
+            options={TRIGGER_CHOICES.map(value => ({ value, label: t(TRIGGER_LABELS[value]!) }))}
+            onChange={value => { setTriggers(value); setFeedback(null); }} />
+          <Select id="compaction-routing-effort" value={effort} disabled={disabled || !model} align="right"
+            label={t("compactionRouting.effort")}
+            options={[{ value: "", label: t("compactionRouting.currentEffort") }, ...EFFORTS.map(value => ({ value, label: t(`models.reasoningEffort.${value}` as TKey) }))]}
+            onChange={value => { setEffort(value); setFeedback(null); }} />
+          <button type="button" className="btn btn-primary btn-sm" disabled={disabled || !dirty} onClick={() => { void save(); }}>
+            {busy ? t("common.saving") : t("common.save")}
+          </button>
+        </div>
+      </div>
+      {provider && <div className="notice-warn" role="note" style={{ marginTop: 12 }}><IconAlert width={14} /> {combo
+        ? t("compactionRouting.comboWarning", { combo: model, providers })
+        : t("compactionRouting.providerWarning", { provider })}</div>}
+      {provider && routesAutomatic && <div className="notice-warn" role="note" style={{ marginTop: 12 }}><IconAlert width={14} /> {t("compactionRouting.autoNotice")}</div>}
+      {loadError && <div className="notice notice-err" role="alert" style={{ marginTop: 12, marginBottom: 0 }}>{t("compactionRouting.loadFailed")} <button type="button" className="btn btn-ghost btn-sm" onClick={() => { void load(); }}>{t("common.retry")}</button></div>}
+      {feedback === "failed" && <div className="notice notice-err" role="alert" style={{ marginTop: 12, marginBottom: 0 }}>{t("compactionRouting.saveFailed")}</div>}
+      {feedback === "saved" && <div className="muted setting-hint" role="status">{t("compactionRouting.saved")}</div>}
+    </section>
+  );
+}
diff --git a/gui/src/components/codex-set/PromptLayerDialog.tsx b/gui/src/components/codex-set/PromptLayerDialog.tsx
index 3b8ae51920a..98d2bc1d779 100644
--- a/gui/src/components/codex-set/PromptLayerDialog.tsx
+++ b/gui/src/components/codex-set/PromptLayerDialog.tsx
@@ -154,9 +154,11 @@ export default function PromptLayerDialog({
               ? t("codexSet.dialog.emptySource", { path: text.sourcePath ?? "" })
               : text?.reason === "not-rendered"
                 ? t("codexSet.dialog.notRendered")
-                : text?.reason === "not-exposed"
-                  ? t("codexSet.dialog.notExposed")
-                  : t("codexSet.dialog.textUnavailable")}
+                : text?.reason === "unmapped"
+                  ? t("codexSet.dialog.unmapped")
+                  : text?.reason === "not-exposed"
+                    ? t("codexSet.dialog.notExposed")
+                    : t("codexSet.dialog.textUnavailable")}
           </p>
         )}
       </div>
diff --git a/gui/src/hooks/useGrokResetCoupons.ts b/gui/src/hooks/useGrokResetCoupons.ts
index 3296f7cacb4..8bf4e86679a 100644
--- a/gui/src/hooks/useGrokResetCoupons.ts
+++ b/gui/src/hooks/useGrokResetCoupons.ts
@@ -34,7 +34,7 @@ export type GrokCouponEntry =
 
 export interface GrokRedeemOutcome {
   ok: boolean;
-  /** Settled ledger code, or `aborted`/`network` when the request never settled. */
+  /** Settled ledger code, or `aborted` when delivery may have succeeded. */
   code: string;
   replayed: boolean;
 }
@@ -101,11 +101,6 @@ function byExpiry(coupons: GrokResetCoupon[]): GrokResetCoupon[] {
   return coupons.toSorted((a, b) => expiryRank(a) - expiryRank(b));
 }
 
-function wasAborted(error: unknown, signal: AbortSignal): boolean {
-  if (signal.aborted) return true;
-  return Boolean(error && typeof error === "object" && (error as { name?: unknown }).name === "AbortError");
-}
-
 export function useGrokResetCoupons({ apiBase, accountIds, enabled }: {
   apiBase: string;
   accountIds: string[];
@@ -196,10 +191,10 @@ export function useGrokResetCoupons({ apiBase, accountIds, enabled }: {
       const code = settledCode(data);
       await read(accountId, epoch.current);
       return { ok: code === "redeemed", code, replayed };
-    } catch (error) {
-      // An aborted redemption is an unknown outcome, not a failure: the route may
-      // still be executing it. The caller must stop posting, not retry.
-      return { ok: false, code: wasAborted(error, bounded.signal) ? "aborted" : "network", replayed: false };
+    } catch {
+      // Any transport rejection after dispatch has an unknown outcome: the route
+      // may still be executing it. The caller must stop posting, not retry.
+      return { ok: false, code: "aborted", replayed: false };
     } finally {
       bounded.clear();
     }
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 8a48248ba7e..1f75761045e 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -352,6 +352,25 @@ export const de: Record<TKey, string> = {
   "dash.visionSidecar": "Vision-Sidecar",
   "dash.visionSidecarHint": "Backend und Modell zur Bildbeschreibung für reine Textmodelle auswählen.",
   "dash.visionOff": "Aus",
+  "compactionRouting.title": "Komprimierungs-Routing",
+  "compactionRouting.description": "Wähle ein Modell für Codex-Komprimierungsanfragen und welche Auslöser es abdeckt. Spätere Nachrichten behalten die Gesprächseinstellungen.",
+  "compactionRouting.model": "Komprimierungsmodell",
+  "compactionRouting.effort": "Denkaufwand",
+  "compactionRouting.triggers": "Gilt für",
+  "compactionRouting.triggersManual": "Nur manuelles /compact",
+  "compactionRouting.triggersBoth": "Manuell und automatisch",
+  "compactionRouting.triggersAuto": "Nur automatisch",
+  "compactionRouting.currentModel": "Gesprächsmodell verwenden",
+  "compactionRouting.currentEffort": "Anfrageaufwand beibehalten",
+  "compactionRouting.effortHint": "Der Denkaufwand gilt, wenn der Komprimierungsendpunkt ihn unterstützt. Das Modell muss das gesamte Gespräch verarbeiten können.",
+  "compactionRouting.dataNotice": "Eine abgedeckte Komprimierungsanfrage sendet das gesamte Gespräch zur Zusammenfassung an den Anbieter des gewählten Modells, auch wenn das Gespräch bei einem anderen Anbieter läuft.",
+  "compactionRouting.autoNotice": "Automatische Komprimierung läuft von selbst, daher kann ein langes Gespräch an diesen Anbieter gehen, ohne dass du es angefordert hast.",
+  "compactionRouting.providerWarning": "Mit dieser Einstellung sendet jede abgedeckte Komprimierungsanfrage den vollständigen Gesprächsinhalt zur Zusammenfassung an {provider}.",
+  "compactionRouting.comboWarning": "Mit dieser Einstellung sendet jede abgedeckte Komprimierungsanfrage den vollständigen Gesprächsinhalt zur Zusammenfassung an jedes Ziel der Combo {combo} ({providers}), einschließlich Failover-Zielen.",
+  "compactionRouting.comboProvidersUnknown": "ihre konfigurierten Zielanbieter",
+  "compactionRouting.loadFailed": "Komprimierungseinstellungen konnten nicht geladen werden.",
+  "compactionRouting.saved": "Komprimierungseinstellungen gespeichert.",
+  "compactionRouting.saveFailed": "Speichern fehlgeschlagen. Deine Änderungen sind noch vorhanden; versuche es erneut.",
   "dash.shadowCallIntercept": "Shadow-Call-Abfangen",
   "dash.shadowCallInterceptHint": "Fängt die Hintergrund-Hilfsaufrufe der Codex-App ({models}) ab und leitet sie an das gewählte Modell um.",
   "dash.shadowCallWarning": "⚠ Bei Aktivierung werden ALLE Anfragen an {models} durch das gewählte Modell ersetzt.",
@@ -678,6 +697,7 @@ export const de: Record<TKey, string> = {
   "models.reasoningEffort.high": "Hoch",
   "models.reasoningEffort.xhigh": "Sehr hoch",
   "models.reasoningEffort.max": "Maximal",
+  "models.reasoningEffort.ultra": "Ultra",
   "models.tipProvider": "Anbieter",
   "models.tipContext": "Kontext",
   "models.tipModalities": "Modalitäten",
@@ -1084,6 +1104,7 @@ export const de: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "In der gelesenen Runde hat diese Ebene nichts gesendet. Abschnitte werden nur bei Änderungen erneut gesendet, daher kann eine einzelne Stichprobe sie nicht enthalten.",
   "codexSet.dialog.emptySource": "Die Datei unter {path} existiert, ist aber leer, daher sendet diese Ebene nichts.",
   "codexSet.dialog.notExposed": "Der Basis-Prompt läuft außerhalb der Nachrichtenliste, die Codex ausgeben kann, und lässt sich hier nicht anzeigen. Ersetzen ist über model_instructions_file möglich.",
+  "codexSet.dialog.unmapped": "Für diese Ebene gibt es noch keine bestätigte Zuordnung in der Prompt-Ausgabe, daher kann ihr Text hier noch nicht angezeigt werden.",
   "codexSet.dialog.textUnavailable": "Der Codex-Prompt konnte auf diesem Rechner nicht gelesen werden, daher ist der Text nicht verfügbar.",
   "codexSet.class.base": "Basisanweisungen",
   "codexSet.class.config-toggle": "Hier umschaltbar",
@@ -1311,6 +1332,50 @@ export const de: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "Vorher wird ein Snapshot gespeichert, deshalb steht dieser Schritt unten in der Rollback-Liste und kann zurückgenommen werden.",
   "integrations.dialog.overwrite.confirm": "Ersetzen",
   "integrations.action.overwrite": "Ersetzen",
+  "integrations.preview.loading": "Der genaue Änderungsplan wird geladen…",
+  "integrations.preview.failed": "Der Änderungsplan konnte nicht geladen werden. Es wurde nichts geändert.",
+  "integrations.preview.stale": "Die Integration wurde während der Bestätigung geändert. Prüfe den aktualisierten Plan und bestätige erneut.",
+  "integrations.dialog.apply.title": "Diese Integration anwenden?",
+  "integrations.dialog.apply.changes": "opencodex fügt der Client-Konfiguration seine verwalteten Anbieter-Einstellungen hinzu.",
+  "integrations.dialog.apply.breakage": "Der Client verwendet die Modelle, die diese opencodex-Instanz derzeit bereitstellt.",
+  "integrations.dialog.apply.undo": "Zuerst wird eine Sicherung gespeichert; die Änderung kann im Rollback-Center rückgängig gemacht werden.",
+  "integrations.dialog.apply.confirm": "Anwenden",
+  "integrations.dialog.disable.title": "Diese Integration deaktivieren?",
+  "integrations.dialog.disable.changes": "Nur Einstellungen im Besitz von opencodex werden entfernt.",
+  "integrations.dialog.disable.breakage": "Der Client verwendet keine über diese opencodex-Instanz gerouteten Modelle mehr.",
+  "integrations.dialog.disable.undo": "Zuerst wird eine Sicherung gespeichert; die Änderung kann im Rollback-Center rückgängig gemacht werden.",
+  "integrations.dialog.disable.confirm": "Deaktivieren",
+  "integrations.plan.heading": "Server-Änderungsplan",
+  "integrations.plan.operation": "Vorgang: {operation}",
+  "integrations.plan.operation.apply": "Anwenden",
+  "integrations.plan.operation.overwrite": "Ersetzen",
+  "integrations.plan.operation.disable": "Deaktivieren",
+  "integrations.plan.operation.restore": "Wiederherstellen",
+  "integrations.plan.change.add": "Hinzufügen",
+  "integrations.plan.change.replace": "Ersetzen",
+  "integrations.plan.change.remove": "Entfernen",
+  "integrations.plan.change.snapshot": "Sicherung speichern",
+  "integrations.plan.change.ownership": "Besitznachweis aktualisieren",
+  "integrations.plan.change.journal": "Rollback-Eintrag aufzeichnen",
+  "integrations.plan.foreign.none": "Keine externen Änderungen erkannt.",
+  "integrations.plan.foreign.unowned": "Ein nicht von opencodex verwalteter Einstellungsblock wird ersetzt.",
+  "integrations.plan.foreign.foreignEdit": "Änderungen im von opencodex verwalteten Block werden ersetzt.",
+  "integrations.plan.foreign.drift": "Die Datei wurde seit diesem Rollback-Punkt geändert.",
+  "integrations.plan.noop.applied": "Am verwalteten Client-Dokument sind keine Änderungen nötig; die Integrationseinstellungen sind bereits vorhanden.",
+  "integrations.plan.noop.disabled": "Am verwalteten Client-Dokument sind keine Änderungen nötig; die Integrationseinstellungen sind bereits entfernt.",
+  "integrations.plan.noop.profilePreference": "Die Synchronisierungseinstellung des Profils wird beim Bestätigen trotzdem gespeichert.",
+  "integrations.plan.refused": "Der Server kann diesen Plan nicht sicher anwenden.",
+  "integrations.plan.refusal.notInstalled": "Der Client ist nicht installiert. Installiere ihn, aktualisiere diese Seite und zeige die Änderung erneut an.",
+  "integrations.plan.refusal.conflict": "Die verwalteten Einstellungen stehen im Konflikt mit der aktuellen Datei. Prüfe die Datei oder verwende Ersetzen, wenn diese Aktion verfügbar ist.",
+  "integrations.plan.refusal.unsafe": "Die Client-Konfiguration kann nicht sicher geändert werden. Repariere oder ersetze die Datei und versuche es erneut.",
+  "integrations.plan.refusal.nonLoopback": "Dieser Client benötigt eine Loopback-Proxyadresse. Verwende localhost, einen Tunnel oder eine lokale Weiterleitung.",
+  "integrations.plan.refusal.driftRequiresConfirm": "Die Datei wurde nach diesem Rollback-Punkt geändert. Prüfe vor der Wiederherstellung den Drift-Plan.",
+  "integrations.plan.refusal.snapshotExpired": "Die Sicherung für diesen Rollback-Punkt ist abgelaufen und kann nicht mehr wiederhergestellt werden.",
+  "integrations.plan.refusal.writeFailed": "Der Server konnte keinen sicheren Schreibvorgang vorbereiten. Aktualisiere den Integrationsstatus und versuche es erneut.",
+  "integrations.mutation.pending": "Die bestätigte Änderung wird angewendet…",
+  "integrations.bulk.breakage": "Jeder Client verwendet keine über diese opencodex-Instanz gerouteten Modelle mehr.",
+  "integrations.bulk.undo": "Jeder Client behält seine eigene Sicherung und seinen Rollback-Eintrag.",
+  "integrations.bulk.confirm": "Alle deaktivieren",
   "integrations.semantics.opencode": "Gilt nur für direkte Starts von der Festplatte; die Umgebungsinjektion von ocx opencode hat Vorrang.",
   "integrations.semantics.pi": "Gilt für neue Sitzungen.",
   "integrations.semantics.omp": "Starten Sie OMP neu, um den Katalog zu laden.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 9be7b42263b..4146debb96d 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -370,6 +370,25 @@ export const en = {
   "dash.visionTimeout": "Timeout",
   "dash.visionTimeoutInvalid": "Enter an integer from {min} to {max} milliseconds.",
   "dash.visionAdvancedPopover": "Advanced vision settings",
+  "compactionRouting.title": "Compaction routing",
+  "compactionRouting.description": "Choose a model for Codex compaction requests and which triggers it covers. Later messages keep the conversation settings.",
+  "compactionRouting.model": "Compaction model",
+  "compactionRouting.effort": "Reasoning effort",
+  "compactionRouting.triggers": "Applies to",
+  "compactionRouting.triggersManual": "Manual /compact only",
+  "compactionRouting.triggersBoth": "Manual and automatic",
+  "compactionRouting.triggersAuto": "Automatic only",
+  "compactionRouting.currentModel": "Use conversation model",
+  "compactionRouting.currentEffort": "Keep request effort",
+  "compactionRouting.effortHint": "Reasoning applies where supported by the compaction endpoint. The model must accept the full conversation.",
+  "compactionRouting.dataNotice": "A covered compaction request sends the entire conversation to the selected model's provider for summarization, even when the conversation runs on another provider.",
+  "compactionRouting.autoNotice": "Automatic compaction runs on its own, so a long conversation can be sent to that provider without you asking for it.",
+  "compactionRouting.providerWarning": "With this setting, every covered compaction request sends the full conversation contents to {provider} for summarization.",
+  "compactionRouting.comboWarning": "With this setting, every covered compaction request sends the full conversation contents to every target of combo {combo} ({providers}), including failover targets, for summarization.",
+  "compactionRouting.comboProvidersUnknown": "its configured target providers",
+  "compactionRouting.loadFailed": "Could not load compaction settings.",
+  "compactionRouting.saved": "Compaction settings saved.",
+  "compactionRouting.saveFailed": "Could not save. Your changes are still here; try again.",
   "dash.shadowCallIntercept": "Shadow Call Intercept",
   "dash.shadowCallInterceptHint": "Intercepts Codex App's background helper calls ({models}) for title generation and commit messages and redirects them to your chosen model.",
   "dash.shadowCallWarning": "⚠ When enabled, ALL requests for {models} will be replaced with the selected model.",
@@ -707,6 +726,7 @@ export const en = {
   "models.reasoningEffort.high": "High",
   "models.reasoningEffort.xhigh": "Extra high",
   "models.reasoningEffort.max": "Maximum",
+  "models.reasoningEffort.ultra": "Ultra",
   "models.tipProvider": "Provider",
   "models.tipContext": "Context",
   "models.tipModalities": "Modalities",
@@ -1631,6 +1651,7 @@ export const en = {
 "codexSet.dialog.notRendered": "This layer sent nothing on the turn we read. Sections are only re-sent when they change, so an unchanged layer is absent from a single sample.",
   "codexSet.dialog.emptySource": "The file at {path} exists but is empty, so this layer sends nothing.",
   "codexSet.dialog.notExposed": "The base prompt travels outside the message list Codex can print, so it cannot be shown here. Replacing it is possible through model_instructions_file.",
+  "codexSet.dialog.unmapped": "This layer has no confirmed mapping in the prompt output, so its text cannot be shown here yet.",
   "codexSet.dialog.textUnavailable": "The Codex prompt could not be read on this machine, so the text is unavailable.",
   "codexSet.class.base": "Base instructions",
   "codexSet.class.config-toggle": "Switchable here",
@@ -1899,6 +1920,50 @@ export const en = {
   "integrations.dialog.overwrite.undo": "A snapshot is saved first, so this appears in the rollback list below and can be undone.",
   "integrations.dialog.overwrite.confirm": "Replace",
   "integrations.action.overwrite": "Replace",
+  "integrations.preview.loading": "Loading the exact change plan…",
+  "integrations.preview.failed": "The change plan could not be loaded. Nothing was changed.",
+  "integrations.preview.stale": "The integration changed while you were confirming. Review the updated plan and confirm again.",
+  "integrations.dialog.apply.title": "Apply this integration?",
+  "integrations.dialog.apply.changes": "opencodex will add its managed provider settings to the client configuration.",
+  "integrations.dialog.apply.breakage": "The client will use the models currently exposed by this opencodex instance.",
+  "integrations.dialog.apply.undo": "A backup is saved first, and the change can be undone from the rollback center.",
+  "integrations.dialog.apply.confirm": "Apply",
+  "integrations.dialog.disable.title": "Disable this integration?",
+  "integrations.dialog.disable.changes": "Only settings owned by opencodex will be removed.",
+  "integrations.dialog.disable.breakage": "The client will stop using models routed through this opencodex instance.",
+  "integrations.dialog.disable.undo": "A backup is saved first, and the change can be undone from the rollback center.",
+  "integrations.dialog.disable.confirm": "Disable",
+  "integrations.plan.heading": "Server change plan",
+  "integrations.plan.operation": "Operation: {operation}",
+  "integrations.plan.operation.apply": "Apply",
+  "integrations.plan.operation.overwrite": "Replace",
+  "integrations.plan.operation.disable": "Disable",
+  "integrations.plan.operation.restore": "Restore",
+  "integrations.plan.change.add": "Add",
+  "integrations.plan.change.replace": "Replace",
+  "integrations.plan.change.remove": "Remove",
+  "integrations.plan.change.snapshot": "Save backup",
+  "integrations.plan.change.ownership": "Update ownership record",
+  "integrations.plan.change.journal": "Record rollback entry",
+  "integrations.plan.foreign.none": "No outside edits were detected.",
+  "integrations.plan.foreign.unowned": "A settings block not owned by opencodex will be replaced.",
+  "integrations.plan.foreign.foreignEdit": "Edits inside the opencodex-managed block will be replaced.",
+  "integrations.plan.foreign.drift": "The file has changed since this rollback point.",
+  "integrations.plan.noop.applied": "No changes to the managed client document are needed; its integration settings are already present.",
+  "integrations.plan.noop.disabled": "No changes to the managed client document are needed; its integration settings are already absent.",
+  "integrations.plan.noop.profilePreference": "The profile sync preference will still be saved when you confirm.",
+  "integrations.plan.refused": "The server cannot safely apply this plan.",
+  "integrations.plan.refusal.notInstalled": "The client is not installed. Install it, refresh this page, and preview the change again.",
+  "integrations.plan.refusal.conflict": "The managed settings conflict with the current file. Review the file or use Replace when that action is available.",
+  "integrations.plan.refusal.unsafe": "The client configuration cannot be changed safely. Repair or replace the file before trying again.",
+  "integrations.plan.refusal.nonLoopback": "This client requires a loopback proxy address. Use localhost access, a tunnel, or a local forwarder before trying again.",
+  "integrations.plan.refusal.driftRequiresConfirm": "The file changed after this rollback point. Review the drift-aware plan before restoring.",
+  "integrations.plan.refusal.snapshotExpired": "The backup for this rollback point has expired, so it can no longer be restored.",
+  "integrations.plan.refusal.writeFailed": "The server could not prepare a safe write. Refresh the integration state before trying again.",
+  "integrations.mutation.pending": "Applying the confirmed change…",
+  "integrations.bulk.breakage": "Each client will stop using models routed through this opencodex instance.",
+  "integrations.bulk.undo": "Each client keeps its own backup and rollback entry.",
+  "integrations.bulk.confirm": "Disable all",
   "integrations.semantics.opencode": "Direct disk launches only; ocx opencode environment injection takes precedence.",
   "integrations.semantics.pi": "Applies to new sessions.",
   "integrations.semantics.omp": "Restart OMP to load the catalog.",
diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts
index 9c119d17d3b..1153c7329b2 100644
--- a/gui/src/i18n/fr.ts
+++ b/gui/src/i18n/fr.ts
@@ -360,6 +360,25 @@ export const fr: Record<TKey, string> = {
   "dash.visionTimeout": "Délai d’expiration",
   "dash.visionTimeoutInvalid": "Saisissez un entier compris entre {min} et {max} millisecondes.",
   "dash.visionAdvancedPopover": "Paramètres de vision avancés",
+  "compactionRouting.title": "Routage de la compaction",
+  "compactionRouting.description": "Choisissez un modèle pour les requêtes de compaction de Codex et les déclencheurs qu’il couvre. Les messages suivants conservent les paramètres de la conversation.",
+  "compactionRouting.model": "Modèle de compaction",
+  "compactionRouting.effort": "Effort de raisonnement",
+  "compactionRouting.triggers": "S’applique à",
+  "compactionRouting.triggersManual": "/compact manuel uniquement",
+  "compactionRouting.triggersBoth": "Manuelle et automatique",
+  "compactionRouting.triggersAuto": "Automatique uniquement",
+  "compactionRouting.currentModel": "Utiliser le modèle de la conversation",
+  "compactionRouting.currentEffort": "Conserver l’effort de la requête",
+  "compactionRouting.effortHint": "Le raisonnement s’applique si le point de terminaison de compaction le prend en charge. Le modèle doit accepter toute la conversation.",
+  "compactionRouting.dataNotice": "Une requête de compaction couverte envoie toute la conversation au fournisseur du modèle choisi pour la résumer, même si la conversation s’exécute chez un autre fournisseur.",
+  "compactionRouting.autoNotice": "La compaction automatique se déclenche d’elle-même : une longue conversation peut donc partir chez ce fournisseur sans que vous l’ayez demandé.",
+  "compactionRouting.providerWarning": "Avec ce réglage, chaque requête de compaction couverte envoie l’intégralité du contenu de la conversation à {provider} pour la résumer.",
+  "compactionRouting.comboWarning": "Avec ce réglage, chaque requête de compaction couverte envoie l’intégralité du contenu de la conversation à chaque cible du combo {combo} ({providers}), y compris les cibles de bascule, pour le résumer.",
+  "compactionRouting.comboProvidersUnknown": "ses fournisseurs cibles configurés",
+  "compactionRouting.loadFailed": "Impossible de charger les paramètres de compaction.",
+  "compactionRouting.saved": "Paramètres de compaction enregistrés.",
+  "compactionRouting.saveFailed": "Échec de l’enregistrement. Vos modifications sont conservées ; réessayez.",
   "dash.shadowCallIntercept": "Interception des appels fantômes",
   "dash.shadowCallInterceptHint": "Intercepte les appels auxiliaires en arrière-plan de l’application Codex ({models}) pour générer les titres et les messages de commit, puis les redirige vers le modèle choisi.",
   "dash.shadowCallWarning": "⚠ Lorsque cette option est activée, TOUTES les requêtes destinées à {models} sont remplacées par le modèle sélectionné.",
@@ -692,6 +711,7 @@ export const fr: Record<TKey, string> = {
   "models.reasoningEffort.high": "Élevé",
   "models.reasoningEffort.xhigh": "Très élevé",
   "models.reasoningEffort.max": "Maximum",
+  "models.reasoningEffort.ultra": "Ultra",
   "models.tipProvider": "Fournisseur",
   "models.tipContext": "Contexte",
   "models.tipModalities": "Modalités",
@@ -1604,6 +1624,7 @@ export const fr: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "Lors du tour que nous avons lu, cette couche n'a rien envoyé. Les sections ne sont renvoyées qu'en cas de changement : un seul échantillon peut donc ne pas la contenir.",
   "codexSet.dialog.emptySource": "Le fichier {path} existe mais il est vide : cette couche n'envoie donc rien.",
   "codexSet.dialog.notExposed": "L'invite de base circule en dehors de la liste de messages que Codex peut afficher ; elle ne peut donc pas être montrée ici. On peut la remplacer via model_instructions_file.",
+  "codexSet.dialog.unmapped": "Cette couche n'a pas encore de correspondance confirmée dans la sortie de l'invite ; son texte ne peut donc pas encore être affiché ici.",
   "codexSet.dialog.textUnavailable": "L'invite Codex n'a pas pu être lue sur cette machine, le texte est donc indisponible.",
   "codexSet.class.base": "Instructions de base",
   "codexSet.class.config-toggle": "Modifiable ici",
@@ -1831,6 +1852,50 @@ export const fr: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "Un instantané est enregistré au préalable : cette opération apparaît dans la liste de restauration ci-dessous et peut être annulée.",
   "integrations.dialog.overwrite.confirm": "Remplacer",
   "integrations.action.overwrite": "Remplacer",
+  "integrations.preview.loading": "Chargement du plan de modification exact…",
+  "integrations.preview.failed": "Le plan de modification n’a pas pu être chargé. Rien n’a été modifié.",
+  "integrations.preview.stale": "L’intégration a changé pendant la confirmation. Vérifiez le plan mis à jour et confirmez à nouveau.",
+  "integrations.dialog.apply.title": "Appliquer cette intégration ?",
+  "integrations.dialog.apply.changes": "opencodex ajoutera ses paramètres de fournisseur gérés à la configuration du client.",
+  "integrations.dialog.apply.breakage": "Le client utilisera les modèles actuellement exposés par cette instance opencodex.",
+  "integrations.dialog.apply.undo": "Une sauvegarde est d’abord créée et la modification peut être annulée depuis le centre de restauration.",
+  "integrations.dialog.apply.confirm": "Appliquer",
+  "integrations.dialog.disable.title": "Désactiver cette intégration ?",
+  "integrations.dialog.disable.changes": "Seuls les paramètres appartenant à opencodex seront supprimés.",
+  "integrations.dialog.disable.breakage": "Le client cessera d’utiliser les modèles routés par cette instance opencodex.",
+  "integrations.dialog.disable.undo": "Une sauvegarde est d’abord créée et la modification peut être annulée depuis le centre de restauration.",
+  "integrations.dialog.disable.confirm": "Désactiver",
+  "integrations.plan.heading": "Plan de modification du serveur",
+  "integrations.plan.operation": "Opération : {operation}",
+  "integrations.plan.operation.apply": "Appliquer",
+  "integrations.plan.operation.overwrite": "Remplacer",
+  "integrations.plan.operation.disable": "Désactiver",
+  "integrations.plan.operation.restore": "Restaurer",
+  "integrations.plan.change.add": "Ajouter",
+  "integrations.plan.change.replace": "Remplacer",
+  "integrations.plan.change.remove": "Supprimer",
+  "integrations.plan.change.snapshot": "Enregistrer une sauvegarde",
+  "integrations.plan.change.ownership": "Mettre à jour l’enregistrement de propriété",
+  "integrations.plan.change.journal": "Enregistrer l’entrée de restauration",
+  "integrations.plan.foreign.none": "Aucune modification externe détectée.",
+  "integrations.plan.foreign.unowned": "Un bloc de paramètres n’appartenant pas à opencodex sera remplacé.",
+  "integrations.plan.foreign.foreignEdit": "Les modifications dans le bloc géré par opencodex seront remplacées.",
+  "integrations.plan.foreign.drift": "Le fichier a changé depuis ce point de restauration.",
+  "integrations.plan.noop.applied": "Aucune modification du document client géré n’est nécessaire ; ses paramètres d’intégration sont déjà présents.",
+  "integrations.plan.noop.disabled": "Aucune modification du document client géré n’est nécessaire ; ses paramètres d’intégration sont déjà absents.",
+  "integrations.plan.noop.profilePreference": "La préférence de synchronisation du profil sera tout de même enregistrée après confirmation.",
+  "integrations.plan.refused": "Le serveur ne peut pas appliquer ce plan en toute sécurité.",
+  "integrations.plan.refusal.notInstalled": "Le client n’est pas installé. Installez-le, actualisez cette page et prévisualisez à nouveau la modification.",
+  "integrations.plan.refusal.conflict": "Les paramètres gérés sont en conflit avec le fichier actuel. Vérifiez le fichier ou utilisez Remplacer si cette action est disponible.",
+  "integrations.plan.refusal.unsafe": "La configuration du client ne peut pas être modifiée en toute sécurité. Réparez ou remplacez le fichier avant de réessayer.",
+  "integrations.plan.refusal.nonLoopback": "Ce client exige une adresse proxy en boucle locale. Utilisez localhost, un tunnel ou un transfert local avant de réessayer.",
+  "integrations.plan.refusal.driftRequiresConfirm": "Le fichier a changé après ce point de restauration. Vérifiez le plan tenant compte des changements avant de restaurer.",
+  "integrations.plan.refusal.snapshotExpired": "La sauvegarde de ce point de restauration a expiré et ne peut plus être restaurée.",
+  "integrations.plan.refusal.writeFailed": "Le serveur n’a pas pu préparer une écriture sûre. Actualisez l’état de l’intégration avant de réessayer.",
+  "integrations.mutation.pending": "Application de la modification confirmée…",
+  "integrations.bulk.breakage": "Chaque client cessera d’utiliser les modèles routés par cette instance opencodex.",
+  "integrations.bulk.undo": "Chaque client conserve sa propre sauvegarde et son entrée de restauration.",
+  "integrations.bulk.confirm": "Tout désactiver",
   "integrations.semantics.opencode": "Uniquement pour les lancements directs depuis le disque ; l’injection d’environnement par ocx opencode est prioritaire.",
   "integrations.semantics.pi": "S’applique aux nouvelles sessions.",
   "integrations.semantics.omp": "Redémarrez OMP pour charger le catalogue.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index dd283a9299c..64a68f59419 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -361,6 +361,25 @@ export const ja: Record<TKey, string> = {
   "dash.visionSidecar": "ビジョンサイドカー",
   "dash.visionSidecarHint": "テキスト専用ルーティングモデルで画像を説明するために使うバックエンドとモデルを選択します。",
   "dash.visionOff": "オフ",
+  "compactionRouting.title": "圧縮ルーティング",
+  "compactionRouting.description": "Codex の圧縮リクエストに使うモデルと、その適用対象を選択します。以降のメッセージは会話の設定を維持します。",
+  "compactionRouting.model": "圧縮モデル",
+  "compactionRouting.effort": "推論の強度",
+  "compactionRouting.triggers": "適用対象",
+  "compactionRouting.triggersManual": "手動の /compact のみ",
+  "compactionRouting.triggersBoth": "手動と自動",
+  "compactionRouting.triggersAuto": "自動のみ",
+  "compactionRouting.currentModel": "会話のモデルを使用",
+  "compactionRouting.currentEffort": "リクエストの推論強度を維持",
+  "compactionRouting.effortHint": "圧縮エンドポイントが対応している場合に推論設定が適用されます。モデルは会話全体を受け入れられる必要があります。",
+  "compactionRouting.dataNotice": "適用対象の圧縮リクエストは、会話が別のプロバイダーで動いていても、会話全体を選択したモデルのプロバイダーへ送信して要約します。",
+  "compactionRouting.autoNotice": "自動圧縮はユーザーが求めなくても実行されるため、長い会話が知らないうちにそのプロバイダーへ送信されることがあります。",
+  "compactionRouting.providerWarning": "この設定では、適用対象の圧縮リクエストのたびに会話の全内容が要約のために {provider} へ送信されます。",
+  "compactionRouting.comboWarning": "この設定では、適用対象の圧縮リクエストのたびに会話の全内容が、フェイルオーバー先を含むコンボ {combo} のすべてのターゲット（{providers}）へ要約のために送信されます。",
+  "compactionRouting.comboProvidersUnknown": "設定済みのターゲットプロバイダー",
+  "compactionRouting.loadFailed": "圧縮設定を読み込めませんでした。",
+  "compactionRouting.saved": "圧縮設定を保存しました。",
+  "compactionRouting.saveFailed": "保存できませんでした。変更内容は保持されています。再試行してください。",
   "dash.shadowCallIntercept": "シャドウコール傍受",
   "dash.shadowCallInterceptHint": "Codex App のバックグラウンドヘルパー呼び出し({models}: タイトル生成、コミットメッセージ)を傍受し、選択したモデルにリダイレクトします。",
   "dash.shadowCallWarning": "⚠ オンにすると、{models} へのリクエストがすべて選択したモデルに置き換えられます。",
@@ -1529,6 +1548,7 @@ export const ja: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "確認したターンでは、このレイヤーは何も送信していません。各セクションは内容が変わったときだけ再送されるため、一度の確認では欠けて見えることがあります。",
   "codexSet.dialog.emptySource": "{path} のファイルは存在しますが空のため、このレイヤーは何も送信しません。",
   "codexSet.dialog.notExposed": "基本プロンプトは Codex が出力するメッセージ一覧の外を通るため、ここには表示できません。model_instructions_file で置き換えることは可能です。",
+  "codexSet.dialog.unmapped": "このレイヤーにはプロンプト出力内で確認済みの対応付けがまだないため、ここにはテキストを表示できません。",
   "codexSet.dialog.textUnavailable": "このマシンでは Codex のプロンプトを読み取れず、原文を表示できません。",
   "codexSet.class.base": "基本指示",
   "codexSet.class.config-toggle": "ここで切り替え可能",
@@ -1756,6 +1776,50 @@ export const ja: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "先にスナップショットを保存するので、下のロールバック一覧に残り、元に戻せます。",
   "integrations.dialog.overwrite.confirm": "置き換える",
   "integrations.action.overwrite": "置き換える",
+  "integrations.preview.loading": "正確な変更プランを読み込んでいます…",
+  "integrations.preview.failed": "変更プランを読み込めませんでした。変更は行われていません。",
+  "integrations.preview.stale": "確認中に統合の状態が変わりました。更新されたプランを確認して、もう一度確定してください。",
+  "integrations.dialog.apply.title": "この統合を適用しますか？",
+  "integrations.dialog.apply.changes": "opencodex が管理するプロバイダー設定をクライアント設定に追加します。",
+  "integrations.dialog.apply.breakage": "クライアントは、この opencodex インスタンスが現在公開しているモデルを使用します。",
+  "integrations.dialog.apply.undo": "先にバックアップが保存され、ロールバックセンターから元に戻せます。",
+  "integrations.dialog.apply.confirm": "適用",
+  "integrations.dialog.disable.title": "この統合を無効にしますか？",
+  "integrations.dialog.disable.changes": "opencodex が所有する設定だけを削除します。",
+  "integrations.dialog.disable.breakage": "クライアントは、この opencodex インスタンス経由のモデルを使用しなくなります。",
+  "integrations.dialog.disable.undo": "先にバックアップが保存され、ロールバックセンターから元に戻せます。",
+  "integrations.dialog.disable.confirm": "無効にする",
+  "integrations.plan.heading": "サーバー変更プラン",
+  "integrations.plan.operation": "操作: {operation}",
+  "integrations.plan.operation.apply": "適用",
+  "integrations.plan.operation.overwrite": "置き換え",
+  "integrations.plan.operation.disable": "無効化",
+  "integrations.plan.operation.restore": "復元",
+  "integrations.plan.change.add": "追加",
+  "integrations.plan.change.replace": "置き換え",
+  "integrations.plan.change.remove": "削除",
+  "integrations.plan.change.snapshot": "バックアップを保存",
+  "integrations.plan.change.ownership": "所有権記録を更新",
+  "integrations.plan.change.journal": "ロールバック履歴を記録",
+  "integrations.plan.foreign.none": "外部の編集は検出されませんでした。",
+  "integrations.plan.foreign.unowned": "opencodex が所有していない設定ブロックを置き換えます。",
+  "integrations.plan.foreign.foreignEdit": "opencodex 管理ブロック内の編集を置き換えます。",
+  "integrations.plan.foreign.drift": "このロールバック地点以降にファイルが変更されています。",
+  "integrations.plan.noop.applied": "管理対象のクライアント文書を変更する必要はありません。統合設定はすでに存在します。",
+  "integrations.plan.noop.disabled": "管理対象のクライアント文書を変更する必要はありません。統合設定はすでに存在しません。",
+  "integrations.plan.noop.profilePreference": "確認すると、プロファイルの同期設定は引き続き保存されます。",
+  "integrations.plan.refused": "サーバーはこのプランを安全に適用できません。",
+  "integrations.plan.refusal.notInstalled": "クライアントがインストールされていません。インストール後にページを更新し、変更をもう一度確認してください。",
+  "integrations.plan.refusal.conflict": "管理対象の設定が現在のファイルと競合しています。ファイルを確認するか、利用可能な場合は置き換えを使用してください。",
+  "integrations.plan.refusal.unsafe": "クライアント設定を安全に変更できません。ファイルを修復または置き換えてから再試行してください。",
+  "integrations.plan.refusal.nonLoopback": "このクライアントにはループバックのプロキシアドレスが必要です。localhost、トンネル、またはローカル転送を使用してください。",
+  "integrations.plan.refusal.driftRequiresConfirm": "このロールバック地点以降にファイルが変更されました。変更を考慮したプランを確認してから復元してください。",
+  "integrations.plan.refusal.snapshotExpired": "このロールバック地点のバックアップは期限切れのため、復元できません。",
+  "integrations.plan.refusal.writeFailed": "サーバーは安全な書き込みを準備できませんでした。統合状態を更新してから再試行してください。",
+  "integrations.mutation.pending": "確認済みの変更を適用しています…",
+  "integrations.bulk.breakage": "各クライアントは、この opencodex インスタンス経由のモデルを使用しなくなります。",
+  "integrations.bulk.undo": "各クライアントに個別のバックアップとロールバック履歴が残ります。",
+  "integrations.bulk.confirm": "すべて無効にする",
   "integrations.semantics.opencode": "ディスクから直接起動した場合にのみ適用されます。ocx opencode の環境注入が優先されます。",
   "integrations.semantics.pi": "新しいセッションから適用されます。",
   "integrations.semantics.omp": "カタログを読み込むには OMP を再起動してください。",
@@ -2555,6 +2619,7 @@ export const ja: Record<TKey, string> = {
   "models.reasoningEffort.high": "高",
   "models.reasoningEffort.xhigh": "非常に高",
   "models.reasoningEffort.max": "最大",
+  "models.reasoningEffort.ultra": "ウルトラ",
   "models.tipProvider": "Provider",
   "models.tipContext": "Context",
   "models.tipModalities": "Modalities",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 1a1909a74f1..d5a4a9392c5 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -356,6 +356,25 @@ export const ko: Record<TKey, string> = {
   "dash.visionSidecar": "비전 사이드카",
   "dash.visionSidecarHint": "텍스트 전용 라우팅 모델이 이미지를 읽을 때 쓸 백엔드와 모델을 고릅니다.",
   "dash.visionOff": "끔",
+  "compactionRouting.title": "압축 라우팅",
+  "compactionRouting.description": "Codex 압축 요청에 사용할 모델과 적용 대상을 선택하세요. 이후 메시지는 대화 설정을 유지합니다.",
+  "compactionRouting.model": "압축 모델",
+  "compactionRouting.effort": "추론 수준",
+  "compactionRouting.triggers": "적용 대상",
+  "compactionRouting.triggersManual": "수동 /compact만",
+  "compactionRouting.triggersBoth": "수동과 자동",
+  "compactionRouting.triggersAuto": "자동만",
+  "compactionRouting.currentModel": "대화 모델 사용",
+  "compactionRouting.currentEffort": "요청의 추론 수준 유지",
+  "compactionRouting.effortHint": "압축 엔드포인트가 지원하는 경우 추론 설정이 적용됩니다. 모델은 전체 대화를 수용할 수 있어야 합니다.",
+  "compactionRouting.dataNotice": "적용 대상 압축 요청은 대화가 다른 프로바이더에서 실행 중이더라도 전체 대화를 선택한 모델의 프로바이더로 보내 요약합니다.",
+  "compactionRouting.autoNotice": "자동 압축은 사용자가 요청하지 않아도 실행되므로, 긴 대화가 예고 없이 해당 프로바이더로 전송될 수 있습니다.",
+  "compactionRouting.providerWarning": "이 설정을 사용하면 적용 대상 압축 요청마다 전체 대화 내용이 요약을 위해 {provider}로 전송됩니다.",
+  "compactionRouting.comboWarning": "이 설정을 사용하면 적용 대상 압축 요청마다 전체 대화 내용이 장애 조치 대상을 포함한 콤보 {combo}의 모든 대상({providers})으로 요약을 위해 전송됩니다.",
+  "compactionRouting.comboProvidersUnknown": "구성된 대상 프로바이더",
+  "compactionRouting.loadFailed": "압축 설정을 불러올 수 없습니다.",
+  "compactionRouting.saved": "압축 설정을 저장했습니다.",
+  "compactionRouting.saveFailed": "저장하지 못했습니다. 변경 사항은 유지됩니다. 다시 시도하세요.",
   "dash.shadowCallIntercept": "쉐도우 호출 가로채기",
   "dash.shadowCallInterceptHint": "Codex 앱이 제목·커밋 메시지 생성에 쓰는 백그라운드 호출({models})을 가로채 선택한 모델로 바꿉니다.",
   "dash.shadowCallWarning": "⚠ 활성화하면 {models} 요청이 모두 선택한 모델로 대체됩니다.",
@@ -689,6 +708,7 @@ export const ko: Record<TKey, string> = {
   "models.reasoningEffort.high": "높음",
   "models.reasoningEffort.xhigh": "매우 높음",
   "models.reasoningEffort.max": "최대",
+  "models.reasoningEffort.ultra": "울트라",
   "models.tipProvider": "프로바이더",
   "models.tipContext": "컨텍스트",
   "models.tipModalities": "모달리티",
@@ -1122,6 +1142,7 @@ export const ko: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "확인한 턴에서는 이 레이어가 아무것도 보내지 않았습니다. 각 섹션은 내용이 바뀔 때만 다시 전송되므로, 한 번 확인한 것만으로는 빠져 보일 수 있습니다.",
   "codexSet.dialog.emptySource": "{path} 파일은 있지만 비어 있어서 이 레이어는 아무것도 보내지 않습니다.",
   "codexSet.dialog.notExposed": "기본 프롬프트는 Codex가 출력하는 메시지 목록 밖으로 전달되어 여기서 보여줄 수 없습니다. 대신 model_instructions_file로 교체할 수 있습니다.",
+  "codexSet.dialog.unmapped": "이 레이어는 프롬프트 출력에서 확인된 매핑이 아직 없어 여기에서 텍스트를 표시할 수 없습니다.",
   "codexSet.dialog.textUnavailable": "이 컴퓨터에서 Codex 프롬프트를 읽지 못해 원문을 표시할 수 없습니다.",
   "codexSet.class.base": "기본 지침",
   "codexSet.class.config-toggle": "여기서 전환 가능",
@@ -1347,6 +1368,50 @@ export const ko: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "먼저 스냅숏을 저장하므로 아래 되돌리기 목록에 남고 다시 되돌릴 수 있습니다.",
   "integrations.dialog.overwrite.confirm": "덮어쓰기",
   "integrations.action.overwrite": "덮어쓰기",
+  "integrations.preview.loading": "정확한 변경 계획을 불러오는 중…",
+  "integrations.preview.failed": "변경 계획을 불러오지 못했습니다. 아무것도 변경하지 않았습니다.",
+  "integrations.preview.stale": "확인하는 동안 통합 상태가 바뀌었습니다. 갱신된 계획을 검토하고 다시 확인하세요.",
+  "integrations.dialog.apply.title": "이 통합을 적용할까요?",
+  "integrations.dialog.apply.changes": "opencodex가 관리하는 공급자 설정을 클라이언트 구성에 추가합니다.",
+  "integrations.dialog.apply.breakage": "클라이언트는 현재 이 opencodex 인스턴스가 제공하는 모델을 사용합니다.",
+  "integrations.dialog.apply.undo": "먼저 백업을 저장하며 롤백 센터에서 변경을 되돌릴 수 있습니다.",
+  "integrations.dialog.apply.confirm": "적용",
+  "integrations.dialog.disable.title": "이 통합을 비활성화할까요?",
+  "integrations.dialog.disable.changes": "opencodex가 소유한 설정만 제거합니다.",
+  "integrations.dialog.disable.breakage": "클라이언트는 이 opencodex 인스턴스를 통해 라우팅되는 모델을 더 이상 사용하지 않습니다.",
+  "integrations.dialog.disable.undo": "먼저 백업을 저장하며 롤백 센터에서 변경을 되돌릴 수 있습니다.",
+  "integrations.dialog.disable.confirm": "비활성화",
+  "integrations.plan.heading": "서버 변경 계획",
+  "integrations.plan.operation": "작업: {operation}",
+  "integrations.plan.operation.apply": "적용",
+  "integrations.plan.operation.overwrite": "교체",
+  "integrations.plan.operation.disable": "비활성화",
+  "integrations.plan.operation.restore": "복원",
+  "integrations.plan.change.add": "추가",
+  "integrations.plan.change.replace": "교체",
+  "integrations.plan.change.remove": "제거",
+  "integrations.plan.change.snapshot": "백업 저장",
+  "integrations.plan.change.ownership": "소유권 기록 갱신",
+  "integrations.plan.change.journal": "롤백 항목 기록",
+  "integrations.plan.foreign.none": "외부 편집이 감지되지 않았습니다.",
+  "integrations.plan.foreign.unowned": "opencodex가 소유하지 않은 설정 블록을 교체합니다.",
+  "integrations.plan.foreign.foreignEdit": "opencodex 관리 블록 안의 편집 내용을 교체합니다.",
+  "integrations.plan.foreign.drift": "이 롤백 시점 이후 파일이 변경되었습니다.",
+  "integrations.plan.noop.applied": "관리되는 클라이언트 문서는 변경할 필요가 없습니다. 통합 설정이 이미 있습니다.",
+  "integrations.plan.noop.disabled": "관리되는 클라이언트 문서는 변경할 필요가 없습니다. 통합 설정이 이미 없습니다.",
+  "integrations.plan.noop.profilePreference": "확인하면 프로필 동기화 설정은 계속 저장됩니다.",
+  "integrations.plan.refused": "서버가 이 계획을 안전하게 적용할 수 없습니다.",
+  "integrations.plan.refusal.notInstalled": "클라이언트가 설치되어 있지 않습니다. 설치한 뒤 페이지를 새로 고치고 변경 사항을 다시 미리 확인하세요.",
+  "integrations.plan.refusal.conflict": "관리 설정이 현재 파일과 충돌합니다. 파일을 검토하거나 사용할 수 있다면 교체 작업을 선택하세요.",
+  "integrations.plan.refusal.unsafe": "클라이언트 구성을 안전하게 변경할 수 없습니다. 파일을 복구하거나 교체한 뒤 다시 시도하세요.",
+  "integrations.plan.refusal.nonLoopback": "이 클라이언트에는 루프백 프록시 주소가 필요합니다. localhost, 터널 또는 로컬 포워더를 사용한 뒤 다시 시도하세요.",
+  "integrations.plan.refusal.driftRequiresConfirm": "이 롤백 시점 이후 파일이 변경되었습니다. 변경 상태를 반영한 계획을 검토한 뒤 복원하세요.",
+  "integrations.plan.refusal.snapshotExpired": "이 롤백 시점의 백업이 만료되어 더 이상 복원할 수 없습니다.",
+  "integrations.plan.refusal.writeFailed": "서버가 안전한 쓰기 작업을 준비하지 못했습니다. 통합 상태를 새로 고친 뒤 다시 시도하세요.",
+  "integrations.mutation.pending": "확인한 변경 사항을 적용하는 중…",
+  "integrations.bulk.breakage": "각 클라이언트는 이 opencodex 인스턴스를 통해 라우팅되는 모델을 더 이상 사용하지 않습니다.",
+  "integrations.bulk.undo": "각 클라이언트는 자체 백업과 롤백 항목을 유지합니다.",
+  "integrations.bulk.confirm": "모두 비활성화",
   "integrations.semantics.opencode": "디스크에서 직접 실행할 때만 적용됩니다. ocx opencode의 환경 주입이 우선합니다.",
   "integrations.semantics.pi": "새 세션부터 적용됩니다.",
   "integrations.semantics.omp": "카탈로그를 불러오려면 OMP를 재시작하세요.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 485c0b302a7..631637977eb 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -361,6 +361,25 @@ export const ru: Record<TKey, string> = {
   "dash.visionSidecar": "Сайдкар для изображений",
   "dash.visionSidecarHint": "Выберите бэкенд и модель, которые описывают изображения для маршрутизируемых моделей, работающих только с текстом.",
   "dash.visionOff": "Выкл",
+  "compactionRouting.title": "Маршрутизация сжатия",
+  "compactionRouting.description": "Выберите модель для запросов сжатия Codex и то, какие триггеры она охватывает. Последующие сообщения сохраняют настройки разговора.",
+  "compactionRouting.model": "Модель сжатия",
+  "compactionRouting.effort": "Уровень рассуждений",
+  "compactionRouting.triggers": "Применяется к",
+  "compactionRouting.triggersManual": "Только ручной /compact",
+  "compactionRouting.triggersBoth": "Ручное и автоматическое",
+  "compactionRouting.triggersAuto": "Только автоматическое",
+  "compactionRouting.currentModel": "Использовать модель разговора",
+  "compactionRouting.currentEffort": "Сохранить уровень из запроса",
+  "compactionRouting.effortHint": "Уровень рассуждений применяется, если его поддерживает конечная точка сжатия. Модель должна вмещать весь разговор.",
+  "compactionRouting.dataNotice": "Охваченный запрос сжатия отправляет весь разговор провайдеру выбранной модели для составления сводки, даже если разговор идёт у другого провайдера.",
+  "compactionRouting.autoNotice": "Автоматическое сжатие запускается само, поэтому длинный разговор может уйти этому провайдеру без вашего запроса.",
+  "compactionRouting.providerWarning": "С этой настройкой каждый охваченный запрос сжатия отправляет полное содержимое разговора провайдеру {provider} для составления сводки.",
+  "compactionRouting.comboWarning": "С этой настройкой каждый охваченный запрос сжатия отправляет полное содержимое разговора каждой цели комбо {combo} ({providers}), включая резервные цели, для составления сводки.",
+  "compactionRouting.comboProvidersUnknown": "его настроенные целевые провайдеры",
+  "compactionRouting.loadFailed": "Не удалось загрузить настройки сжатия.",
+  "compactionRouting.saved": "Настройки сжатия сохранены.",
+  "compactionRouting.saveFailed": "Не удалось сохранить. Изменения остались; попробуйте снова.",
   "dash.shadowCallIntercept": "Перехват теневых вызовов",
   "dash.shadowCallInterceptHint": "Перехватывает фоновые служебные вызовы Codex App ({models}: генерация заголовков, сообщений коммитов) и перенаправляет их на выбранную вами модель.",
   "dash.shadowCallWarning": "⚠ Когда функция включена, ВСЕ запросы к {models} будут заменены выбранной моделью.",
@@ -691,6 +710,7 @@ export const ru: Record<TKey, string> = {
   "models.reasoningEffort.high": "Высокий",
   "models.reasoningEffort.xhigh": "Очень высокий",
   "models.reasoningEffort.max": "Максимальный",
+  "models.reasoningEffort.ultra": "Ультра",
   "models.tipProvider": "Провайдер",
   "models.tipContext": "Контекст",
   "models.tipModalities": "Модальности",
@@ -1599,6 +1619,7 @@ export const ru: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "На прочитанном нами шаге этот слой ничего не отправил. Разделы пересылаются только при изменении, поэтому в одной выборке слой может отсутствовать.",
   "codexSet.dialog.emptySource": "Файл {path} существует, но пуст, поэтому этот слой ничего не отправляет.",
   "codexSet.dialog.notExposed": "Базовый промпт передаётся вне списка сообщений, который Codex может напечатать, поэтому показать его здесь нельзя. Заменить его можно через model_instructions_file.",
+  "codexSet.dialog.unmapped": "Для этого слоя пока нет подтверждённого сопоставления в выводе промпта, поэтому его текст ещё нельзя показать здесь.",
   "codexSet.dialog.textUnavailable": "На этой машине не удалось прочитать промпт Codex, поэтому текст недоступен.",
   "codexSet.class.base": "Базовые инструкции",
   "codexSet.class.config-toggle": "Переключается здесь",
@@ -1826,6 +1847,50 @@ export const ru: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "Снимок сохраняется заранее, поэтому операция попадёт в список откатов ниже и её можно отменить.",
   "integrations.dialog.overwrite.confirm": "Заменить",
   "integrations.action.overwrite": "Заменить",
+  "integrations.preview.loading": "Загрузка точного плана изменений…",
+  "integrations.preview.failed": "Не удалось загрузить план изменений. Ничего не изменено.",
+  "integrations.preview.stale": "Интеграция изменилась во время подтверждения. Проверьте обновлённый план и подтвердите снова.",
+  "integrations.dialog.apply.title": "Применить эту интеграцию?",
+  "integrations.dialog.apply.changes": "opencodex добавит управляемые настройки провайдера в конфигурацию клиента.",
+  "integrations.dialog.apply.breakage": "Клиент будет использовать модели, доступные через этот экземпляр opencodex.",
+  "integrations.dialog.apply.undo": "Сначала сохраняется резервная копия; изменение можно отменить в центре отката.",
+  "integrations.dialog.apply.confirm": "Применить",
+  "integrations.dialog.disable.title": "Отключить эту интеграцию?",
+  "integrations.dialog.disable.changes": "Будут удалены только настройки, принадлежащие opencodex.",
+  "integrations.dialog.disable.breakage": "Клиент перестанет использовать модели, направляемые через этот экземпляр opencodex.",
+  "integrations.dialog.disable.undo": "Сначала сохраняется резервная копия; изменение можно отменить в центре отката.",
+  "integrations.dialog.disable.confirm": "Отключить",
+  "integrations.plan.heading": "План изменений сервера",
+  "integrations.plan.operation": "Операция: {operation}",
+  "integrations.plan.operation.apply": "Применить",
+  "integrations.plan.operation.overwrite": "Заменить",
+  "integrations.plan.operation.disable": "Отключить",
+  "integrations.plan.operation.restore": "Восстановить",
+  "integrations.plan.change.add": "Добавить",
+  "integrations.plan.change.replace": "Заменить",
+  "integrations.plan.change.remove": "Удалить",
+  "integrations.plan.change.snapshot": "Сохранить резервную копию",
+  "integrations.plan.change.ownership": "Обновить запись владения",
+  "integrations.plan.change.journal": "Записать точку отката",
+  "integrations.plan.foreign.none": "Внешние изменения не обнаружены.",
+  "integrations.plan.foreign.unowned": "Блок настроек, не принадлежащий opencodex, будет заменён.",
+  "integrations.plan.foreign.foreignEdit": "Изменения внутри блока opencodex будут заменены.",
+  "integrations.plan.foreign.drift": "Файл изменился после этой точки отката.",
+  "integrations.plan.noop.applied": "Управляемый документ клиента изменять не нужно: настройки интеграции уже присутствуют.",
+  "integrations.plan.noop.disabled": "Управляемый документ клиента изменять не нужно: настройки интеграции уже отсутствуют.",
+  "integrations.plan.noop.profilePreference": "После подтверждения настройка синхронизации профиля всё равно будет сохранена.",
+  "integrations.plan.refused": "Сервер не может безопасно применить этот план.",
+  "integrations.plan.refusal.notInstalled": "Клиент не установлен. Установите его, обновите страницу и снова просмотрите изменение.",
+  "integrations.plan.refusal.conflict": "Управляемые настройки конфликтуют с текущим файлом. Проверьте файл или используйте замену, если она доступна.",
+  "integrations.plan.refusal.unsafe": "Конфигурацию клиента нельзя безопасно изменить. Исправьте или замените файл перед повторной попыткой.",
+  "integrations.plan.refusal.nonLoopback": "Этому клиенту нужен адрес прокси в loopback. Используйте localhost, туннель или локальную переадресацию.",
+  "integrations.plan.refusal.driftRequiresConfirm": "Файл изменился после этой точки отката. Проверьте план с учётом изменений перед восстановлением.",
+  "integrations.plan.refusal.snapshotExpired": "Резервная копия для этой точки отката истекла и больше не может быть восстановлена.",
+  "integrations.plan.refusal.writeFailed": "Сервер не смог подготовить безопасную запись. Обновите состояние интеграции перед повторной попыткой.",
+  "integrations.mutation.pending": "Применение подтверждённого изменения…",
+  "integrations.bulk.breakage": "Каждый клиент перестанет использовать модели, направляемые через этот экземпляр opencodex.",
+  "integrations.bulk.undo": "У каждого клиента останется собственная резервная копия и запись отката.",
+  "integrations.bulk.confirm": "Отключить все",
   "integrations.semantics.opencode": "Действует только при прямом запуске с диска; внедрение окружения через ocx opencode имеет приоритет.",
   "integrations.semantics.pi": "Применяется к новым сеансам.",
   "integrations.semantics.omp": "Перезапустите OMP, чтобы загрузить каталог.",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index a1d59281c99..1646ccb8251 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -362,6 +362,25 @@ export const tr: Record<TKey, string> = {
   "dash.visionSidecar": "Görsel yan aracı (sidecar)",
   "dash.visionSidecarHint": "Salt metin modeller için görselleri tanımlamakta kullanılan arka ucu ve modeli seçin.",
   "dash.visionOff": "Kapalı",
+  "compactionRouting.title": "Özetleme yönlendirmesi",
+  "compactionRouting.description": "Codex özetleme istekleri için bir model ve bunun hangi tetikleyicileri kapsadığını seçin. Sonraki mesajlar konuşma ayarlarını korur.",
+  "compactionRouting.model": "Özetleme modeli",
+  "compactionRouting.effort": "Akıl yürütme düzeyi",
+  "compactionRouting.triggers": "Şunlara uygulanır",
+  "compactionRouting.triggersManual": "Yalnızca manuel /compact",
+  "compactionRouting.triggersBoth": "Manuel ve otomatik",
+  "compactionRouting.triggersAuto": "Yalnızca otomatik",
+  "compactionRouting.currentModel": "Konuşma modelini kullan",
+  "compactionRouting.currentEffort": "İsteğin düzeyini koru",
+  "compactionRouting.effortHint": "Akıl yürütme, özetleme uç noktası destekliyorsa uygulanır. Model tüm konuşmayı kabul edebilmelidir.",
+  "compactionRouting.dataNotice": "Kapsama giren bir özetleme isteği, konuşma başka bir sağlayıcıda yürütülse bile konuşmanın tamamını özetlenmek üzere seçilen modelin sağlayıcısına gönderir.",
+  "compactionRouting.autoNotice": "Otomatik özetleme kendiliğinden çalışır; bu nedenle uzun bir konuşma siz istemeden o sağlayıcıya gidebilir.",
+  "compactionRouting.providerWarning": "Bu ayarla kapsama giren her özetleme isteği, konuşmanın tüm içeriğini özetlenmek üzere {provider} sağlayıcısına gönderir.",
+  "compactionRouting.comboWarning": "Bu ayarla kapsama giren her özetleme isteği, konuşmanın tüm içeriğini yedek hedefler dahil {combo} kombosunun her hedefine ({providers}) özetlenmek üzere gönderir.",
+  "compactionRouting.comboProvidersUnknown": "yapılandırılmış hedef sağlayıcıları",
+  "compactionRouting.loadFailed": "Özetleme ayarları yüklenemedi.",
+  "compactionRouting.saved": "Özetleme ayarları kaydedildi.",
+  "compactionRouting.saveFailed": "Kaydedilemedi. Değişiklikleriniz korunuyor; tekrar deneyin.",
   "dash.shadowCallIntercept": "Gölge Çağrı Yakalama",
   "dash.shadowCallInterceptHint": "Codex App'in arka plan yardımcı çağrılarını ({models}) başlık oluşturma ve commit mesajları için yakalar ve seçtiğiniz modele yönlendirir.",
   "dash.shadowCallWarning": "⚠ Etkinleştirildiğinde, {models} için olan TÜM istekler seçilen modelle değiştirilecektir.",
@@ -694,6 +713,7 @@ export const tr: Record<TKey, string> = {
   "models.reasoningEffort.high": "Yüksek",
   "models.reasoningEffort.xhigh": "Çok yüksek",
   "models.reasoningEffort.max": "Maksimum",
+  "models.reasoningEffort.ultra": "Ultra",
   "models.tipProvider": "Sağlayıcı",
   "models.tipContext": "Bağlam",
   "models.tipModalities": "Girdi Türleri",
@@ -1618,6 +1638,7 @@ export const tr: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "Okuduğumuz turda bu katman hiçbir şey göndermedi. Bölümler yalnızca değiştiklerinde yeniden gönderilir, bu yüzden tek bir örnekte görünmeyebilir.",
   "codexSet.dialog.emptySource": "{path} konumundaki dosya var ancak boş, bu yüzden bu katman hiçbir şey göndermiyor.",
   "codexSet.dialog.notExposed": "Temel istem, Codex'in yazdırabildiği mesaj listesinin dışından geçtiği için burada gösterilemez. model_instructions_file ile değiştirilebilir.",
+  "codexSet.dialog.unmapped": "Bu katmanın istem çıktısında henüz doğrulanmış bir eşlemesi yok, bu nedenle metni burada henüz gösterilemiyor.",
   "codexSet.dialog.textUnavailable": "Bu makinede Codex istemi okunamadı, bu yüzden metin kullanılamıyor.",
   "codexSet.class.base": "Temel talimatlar",
   "codexSet.class.config-toggle": "Buradan değiştirilebilir",
@@ -1845,6 +1866,50 @@ export const tr: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "Önce bir anlık görüntü kaydedilir; bu işlem aşağıdaki geri alma listesinde görünür ve geri alınabilir.",
   "integrations.dialog.overwrite.confirm": "Değiştir",
   "integrations.action.overwrite": "Değiştir",
+  "integrations.preview.loading": "Kesin değişiklik planı yükleniyor…",
+  "integrations.preview.failed": "Değişiklik planı yüklenemedi. Hiçbir şey değiştirilmedi.",
+  "integrations.preview.stale": "Onay sırasında entegrasyon değişti. Güncellenen planı inceleyip yeniden onaylayın.",
+  "integrations.dialog.apply.title": "Bu entegrasyon uygulansın mı?",
+  "integrations.dialog.apply.changes": "opencodex, yönettiği sağlayıcı ayarlarını istemci yapılandırmasına ekleyecek.",
+  "integrations.dialog.apply.breakage": "İstemci, bu opencodex örneğinin sunduğu modelleri kullanacak.",
+  "integrations.dialog.apply.undo": "Önce yedek kaydedilir; değişiklik geri alma merkezinden geri alınabilir.",
+  "integrations.dialog.apply.confirm": "Uygula",
+  "integrations.dialog.disable.title": "Bu entegrasyon devre dışı bırakılsın mı?",
+  "integrations.dialog.disable.changes": "Yalnızca opencodex’e ait ayarlar kaldırılacak.",
+  "integrations.dialog.disable.breakage": "İstemci, bu opencodex örneği üzerinden yönlendirilen modelleri kullanmayı bırakacak.",
+  "integrations.dialog.disable.undo": "Önce yedek kaydedilir; değişiklik geri alma merkezinden geri alınabilir.",
+  "integrations.dialog.disable.confirm": "Devre dışı bırak",
+  "integrations.plan.heading": "Sunucu değişiklik planı",
+  "integrations.plan.operation": "İşlem: {operation}",
+  "integrations.plan.operation.apply": "Uygula",
+  "integrations.plan.operation.overwrite": "Değiştir",
+  "integrations.plan.operation.disable": "Devre dışı bırak",
+  "integrations.plan.operation.restore": "Geri yükle",
+  "integrations.plan.change.add": "Ekle",
+  "integrations.plan.change.replace": "Değiştir",
+  "integrations.plan.change.remove": "Kaldır",
+  "integrations.plan.change.snapshot": "Yedek kaydet",
+  "integrations.plan.change.ownership": "Sahiplik kaydını güncelle",
+  "integrations.plan.change.journal": "Geri alma kaydı oluştur",
+  "integrations.plan.foreign.none": "Dış düzenleme algılanmadı.",
+  "integrations.plan.foreign.unowned": "opencodex’e ait olmayan bir ayar bloğu değiştirilecek.",
+  "integrations.plan.foreign.foreignEdit": "opencodex yönetimli blok içindeki düzenlemeler değiştirilecek.",
+  "integrations.plan.foreign.drift": "Dosya bu geri alma noktasından sonra değişti.",
+  "integrations.plan.noop.applied": "Yönetilen istemci belgesinde değişiklik gerekmiyor; entegrasyon ayarları zaten mevcut.",
+  "integrations.plan.noop.disabled": "Yönetilen istemci belgesinde değişiklik gerekmiyor; entegrasyon ayarları zaten yok.",
+  "integrations.plan.noop.profilePreference": "Onayladığınızda profil eşitleme tercihi yine de kaydedilir.",
+  "integrations.plan.refused": "Sunucu bu planı güvenle uygulayamıyor.",
+  "integrations.plan.refusal.notInstalled": "İstemci yüklü değil. İstemciyi yükleyin, sayfayı yenileyin ve değişikliği yeniden önizleyin.",
+  "integrations.plan.refusal.conflict": "Yönetilen ayarlar mevcut dosyayla çakışıyor. Dosyayı inceleyin veya varsa Değiştir işlemini kullanın.",
+  "integrations.plan.refusal.unsafe": "İstemci yapılandırması güvenle değiştirilemiyor. Yeniden denemeden önce dosyayı onarın veya değiştirin.",
+  "integrations.plan.refusal.nonLoopback": "Bu istemci bir geri döngü proxy adresi gerektiriyor. localhost, tünel veya yerel yönlendirme kullanın.",
+  "integrations.plan.refusal.driftRequiresConfirm": "Dosya bu geri alma noktasından sonra değişti. Geri yüklemeden önce değişikliği dikkate alan planı inceleyin.",
+  "integrations.plan.refusal.snapshotExpired": "Bu geri alma noktasının yedeği sona erdiği için artık geri yüklenemez.",
+  "integrations.plan.refusal.writeFailed": "Sunucu güvenli bir yazma işlemi hazırlayamadı. Yeniden denemeden önce entegrasyon durumunu yenileyin.",
+  "integrations.mutation.pending": "Onaylanan değişiklik uygulanıyor…",
+  "integrations.bulk.breakage": "Her istemci, bu opencodex örneği üzerinden yönlendirilen modelleri kullanmayı bırakacak.",
+  "integrations.bulk.undo": "Her istemci kendi yedeğini ve geri alma kaydını tutar.",
+  "integrations.bulk.confirm": "Tümünü devre dışı bırak",
   "integrations.semantics.opencode": "Doğrudan disk başlatmaları.",
   "integrations.semantics.pi": "Yeni oturumlara uygulanır.",
   "integrations.semantics.hermes": "Yeni oturumlara uygulanır.",
diff --git a/gui/src/i18n/vi.ts b/gui/src/i18n/vi.ts
index a6ef50b7f8e..3d726cc35e7 100644
--- a/gui/src/i18n/vi.ts
+++ b/gui/src/i18n/vi.ts
@@ -354,6 +354,25 @@ export const vi: Record<TKey, string> = {
   "dash.visionTimeout": "Thời gian chờ (Timeout)",
   "dash.visionTimeoutInvalid": "Vui lòng nhập một số nguyên từ {min} đến {max} milliseconds.",
   "dash.visionAdvancedPopover": "Cài đặt vision nâng cao",
+  "compactionRouting.title": "Định tuyến nén",
+  "compactionRouting.description": "Chọn model cho các yêu cầu nén của Codex và những trường hợp nó áp dụng. Các tin nhắn sau vẫn giữ thiết lập của cuộc trò chuyện.",
+  "compactionRouting.model": "Model nén",
+  "compactionRouting.effort": "Mức suy luận",
+  "compactionRouting.triggers": "Áp dụng cho",
+  "compactionRouting.triggersManual": "Chỉ /compact thủ công",
+  "compactionRouting.triggersBoth": "Thủ công và tự động",
+  "compactionRouting.triggersAuto": "Chỉ tự động",
+  "compactionRouting.currentModel": "Dùng model của cuộc trò chuyện",
+  "compactionRouting.currentEffort": "Giữ mức suy luận của yêu cầu",
+  "compactionRouting.effortHint": "Mức suy luận được áp dụng nếu điểm cuối nén hỗ trợ. Model phải tiếp nhận được toàn bộ cuộc trò chuyện.",
+  "compactionRouting.dataNotice": "Yêu cầu nén thuộc phạm vi áp dụng sẽ gửi toàn bộ cuộc trò chuyện đến nhà cung cấp của model đã chọn để tóm tắt, ngay cả khi cuộc trò chuyện đang chạy ở nhà cung cấp khác.",
+  "compactionRouting.autoNotice": "Nén tự động tự chạy, nên một cuộc trò chuyện dài có thể được gửi đến nhà cung cấp đó mà bạn không yêu cầu.",
+  "compactionRouting.providerWarning": "Với thiết lập này, mỗi yêu cầu nén thuộc phạm vi áp dụng sẽ gửi toàn bộ nội dung cuộc trò chuyện đến {provider} để tóm tắt.",
+  "compactionRouting.comboWarning": "Với thiết lập này, mỗi yêu cầu nén thuộc phạm vi áp dụng sẽ gửi toàn bộ nội dung cuộc trò chuyện đến mọi đích của combo {combo} ({providers}), bao gồm cả đích dự phòng, để tóm tắt.",
+  "compactionRouting.comboProvidersUnknown": "các nhà cung cấp đích đã cấu hình của nó",
+  "compactionRouting.loadFailed": "Không thể tải cài đặt nén.",
+  "compactionRouting.saved": "Đã lưu cài đặt nén.",
+  "compactionRouting.saveFailed": "Không thể lưu. Thay đổi của bạn vẫn còn; hãy thử lại.",
   "dash.shadowCallIntercept": "Shadow Call Intercept",
   "dash.shadowCallInterceptHint": "Chặn các lệnh gọi helper nền ({models}) của ứng dụng Codex để tạo tiêu đề và commit messages, sau đó chuyển hướng chúng đến model bạn đã chọn.",
   "dash.shadowCallWarning": "⚠ Khi được bật, TẤT CẢ yêu cầu đối với {models} sẽ được thay thế bằng model được chọn.",
@@ -686,6 +705,7 @@ export const vi: Record<TKey, string> = {
   "models.reasoningEffort.high": "Cao (High)",
   "models.reasoningEffort.xhigh": "Rất cao (Extra high)",
   "models.reasoningEffort.max": "Tối đa (Maximum)",
+  "models.reasoningEffort.ultra": "Tối thượng (Ultra)",
   "models.tipProvider": "Nhà cung cấp",
   "models.tipContext": "Ngữ cảnh",
   "models.tipModalities": "Đầu vào (Modalities)",
@@ -1580,6 +1600,7 @@ export const vi: Record<TKey, string> = {
   "codexSet.dialog.sourceBytes": "{bytes} byte",
   "codexSet.dialog.emptySource": "Tệp tại {path} tồn tại nhưng không có dữ liệu, vì vậy layer này không gửi đi nội dung nào cả.",
   "codexSet.dialog.notExposed": "Base prompt di chuyển bên ngoài danh sách tin nhắn mà Codex có thể in ra, vì vậy không thể hiển thị ở đây. Tuy nhiên có thể thay thế nó thông qua model_instructions_file.",
+  "codexSet.dialog.unmapped": "Lớp này chưa có ánh xạ được xác nhận trong đầu ra prompt, vì vậy chưa thể hiển thị văn bản của nó ở đây.",
   "codexSet.dialog.textUnavailable": "Không thể đọc prompt Codex trên máy này, do đó văn bản không khả dụng.",
   "codexSet.class.base": "Base instructions",
   "codexSet.class.config-toggle": "Có thể chuyển đổi tại đây",
@@ -1848,6 +1869,50 @@ export const vi: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "Một bản sao lưu sẽ được lưu trước tiên, do đó thao tác này sẽ xuất hiện trong danh sách hoàn tác bên dưới và có thể được khôi phục.",
   "integrations.dialog.overwrite.confirm": "Thay thế",
   "integrations.action.overwrite": "Thay thế",
+  "integrations.preview.loading": "Đang tải kế hoạch thay đổi chính xác…",
+  "integrations.preview.failed": "Không thể tải kế hoạch thay đổi. Không có gì bị thay đổi.",
+  "integrations.preview.stale": "Tích hợp đã thay đổi trong lúc xác nhận. Hãy xem kế hoạch mới và xác nhận lại.",
+  "integrations.dialog.apply.title": "Áp dụng tích hợp này?",
+  "integrations.dialog.apply.changes": "opencodex sẽ thêm các cài đặt nhà cung cấp do nó quản lý vào cấu hình máy khách.",
+  "integrations.dialog.apply.breakage": "Máy khách sẽ dùng các mô hình hiện được phiên bản opencodex này cung cấp.",
+  "integrations.dialog.apply.undo": "Bản sao lưu được lưu trước và có thể hoàn tác thay đổi trong trung tâm khôi phục.",
+  "integrations.dialog.apply.confirm": "Áp dụng",
+  "integrations.dialog.disable.title": "Tắt tích hợp này?",
+  "integrations.dialog.disable.changes": "Chỉ các cài đặt thuộc opencodex sẽ bị xóa.",
+  "integrations.dialog.disable.breakage": "Máy khách sẽ ngừng dùng các mô hình được định tuyến qua phiên bản opencodex này.",
+  "integrations.dialog.disable.undo": "Bản sao lưu được lưu trước và có thể hoàn tác thay đổi trong trung tâm khôi phục.",
+  "integrations.dialog.disable.confirm": "Tắt",
+  "integrations.plan.heading": "Kế hoạch thay đổi từ máy chủ",
+  "integrations.plan.operation": "Thao tác: {operation}",
+  "integrations.plan.operation.apply": "Áp dụng",
+  "integrations.plan.operation.overwrite": "Thay thế",
+  "integrations.plan.operation.disable": "Tắt",
+  "integrations.plan.operation.restore": "Khôi phục",
+  "integrations.plan.change.add": "Thêm",
+  "integrations.plan.change.replace": "Thay thế",
+  "integrations.plan.change.remove": "Xóa",
+  "integrations.plan.change.snapshot": "Lưu bản sao",
+  "integrations.plan.change.ownership": "Cập nhật bản ghi quyền sở hữu",
+  "integrations.plan.change.journal": "Ghi mục khôi phục",
+  "integrations.plan.foreign.none": "Không phát hiện chỉnh sửa bên ngoài.",
+  "integrations.plan.foreign.unowned": "Một khối cài đặt không thuộc opencodex sẽ bị thay thế.",
+  "integrations.plan.foreign.foreignEdit": "Các chỉnh sửa trong khối do opencodex quản lý sẽ bị thay thế.",
+  "integrations.plan.foreign.drift": "Tệp đã thay đổi kể từ điểm khôi phục này.",
+  "integrations.plan.noop.applied": "Không cần thay đổi tài liệu máy khách được quản lý; cài đặt tích hợp đã có sẵn.",
+  "integrations.plan.noop.disabled": "Không cần thay đổi tài liệu máy khách được quản lý; cài đặt tích hợp đã không còn.",
+  "integrations.plan.noop.profilePreference": "Tùy chọn đồng bộ hồ sơ vẫn sẽ được lưu khi bạn xác nhận.",
+  "integrations.plan.refused": "Máy chủ không thể áp dụng kế hoạch này một cách an toàn.",
+  "integrations.plan.refusal.notInstalled": "Máy khách chưa được cài đặt. Hãy cài đặt, làm mới trang và xem trước thay đổi lần nữa.",
+  "integrations.plan.refusal.conflict": "Cài đặt được quản lý xung đột với tệp hiện tại. Hãy xem lại tệp hoặc dùng Thay thế khi có thể.",
+  "integrations.plan.refusal.unsafe": "Không thể thay đổi cấu hình máy khách một cách an toàn. Hãy sửa hoặc thay tệp trước khi thử lại.",
+  "integrations.plan.refusal.nonLoopback": "Máy khách này cần địa chỉ proxy loopback. Hãy dùng localhost, đường hầm hoặc chuyển tiếp cục bộ.",
+  "integrations.plan.refusal.driftRequiresConfirm": "Tệp đã thay đổi sau điểm khôi phục này. Hãy xem kế hoạch có tính đến thay đổi trước khi khôi phục.",
+  "integrations.plan.refusal.snapshotExpired": "Bản sao lưu cho điểm khôi phục này đã hết hạn nên không thể khôi phục nữa.",
+  "integrations.plan.refusal.writeFailed": "Máy chủ không thể chuẩn bị thao tác ghi an toàn. Hãy làm mới trạng thái tích hợp trước khi thử lại.",
+  "integrations.mutation.pending": "Đang áp dụng thay đổi đã xác nhận…",
+  "integrations.bulk.breakage": "Mỗi máy khách sẽ ngừng dùng các mô hình được định tuyến qua phiên bản opencodex này.",
+  "integrations.bulk.undo": "Mỗi máy khách giữ bản sao lưu và mục khôi phục riêng.",
+  "integrations.bulk.confirm": "Tắt tất cả",
   "integrations.semantics.opencode": "Chỉ khởi chạy trực tiếp trên đĩa; việc inject môi trường ocx opencode sẽ được ưu tiên.",
   "integrations.semantics.pi": "Áp dụng cho các session mới.",
   "integrations.semantics.omp": "Khởi động lại OMP để tải catalog.",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 0ca62560f43..cb4513ba7ef 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -251,6 +251,25 @@ export const zhTW: Record<TKey, string> = {
   "dash.visionSidecar": "視覺附屬服務",
   "dash.visionSidecarHint": "選擇純文字路由模型描述圖像時使用的後端和模型。",
   "dash.visionOff": "關閉",
+  "compactionRouting.title": "壓縮路由",
+  "compactionRouting.description": "選擇 Codex 壓縮請求使用的模型，以及它涵蓋哪些觸發方式。後續訊息保留對話設定。",
+  "compactionRouting.model": "壓縮模型",
+  "compactionRouting.effort": "推理強度",
+  "compactionRouting.triggers": "適用於",
+  "compactionRouting.triggersManual": "僅手動 /compact",
+  "compactionRouting.triggersBoth": "手動與自動",
+  "compactionRouting.triggersAuto": "僅自動",
+  "compactionRouting.currentModel": "使用對話模型",
+  "compactionRouting.currentEffort": "保留請求的推理強度",
+  "compactionRouting.effortHint": "推理設定僅在壓縮端點支援時生效。模型必須能容納完整對話。",
+  "compactionRouting.dataNotice": "涵蓋的壓縮請求會將整個對話傳送給所選模型的供應商進行摘要，即使對話正在其他供應商上執行。",
+  "compactionRouting.autoNotice": "自動壓縮會自行觸發，因此長對話可能在你沒有主動要求的情況下被傳送給該供應商。",
+  "compactionRouting.providerWarning": "啟用此設定後，每個涵蓋的壓縮請求都會將完整對話內容傳送給 {provider} 進行摘要。",
+  "compactionRouting.comboWarning": "啟用此設定後，每個涵蓋的壓縮請求都會將完整對話內容傳送給組合 {combo} 的每個目標（{providers}），包括容錯移轉目標，以進行摘要。",
+  "compactionRouting.comboProvidersUnknown": "其已設定的目標供應商",
+  "compactionRouting.loadFailed": "無法載入壓縮設定。",
+  "compactionRouting.saved": "壓縮設定已儲存。",
+  "compactionRouting.saveFailed": "儲存失敗。變更仍然保留，請重試。",
   "dash.shadowCallIntercept": "影子呼叫攔截",
   "dash.shadowCallInterceptHint": "攔截 Codex 應用的背景 helper 呼叫（{models}）以生成標題與提交訊息，並將它們重定向到您選擇的模型。",
   "dash.shadowCallWarning": "⚠ 啟用後，{models} 的所有請求將被替換為所選模型。",
@@ -555,6 +574,7 @@ export const zhTW: Record<TKey, string> = {
   "models.reasoningEffort.high": "高",
   "models.reasoningEffort.xhigh": "極高",
   "models.reasoningEffort.max": "最高",
+  "models.reasoningEffort.ultra": "超高",
   "models.tipProvider": "供應商",
   "models.tipContext": "上下文",
   "models.tipModalities": "模態",
@@ -1375,6 +1395,7 @@ export const zhTW: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "在我們讀取的那一輪中，此層沒有傳送任何內容。各區段只在內容變更時才會重新傳送，因此單次取樣可能看不到它。",
   "codexSet.dialog.emptySource": "{path} 檔案存在但為空，因此此層不會傳送任何內容。",
   "codexSet.dialog.notExposed": "基礎提示詞不在 Codex 可列印的訊息清單中傳遞，因此無法在此顯示。可以透過 model_instructions_file 取代它。",
+  "codexSet.dialog.unmapped": "此層在提示詞輸出中尚無已確認的對應，因此暫時無法在此顯示其文字。",
   "codexSet.dialog.textUnavailable": "本機無法讀取 Codex 提示詞，因此無法顯示原文。",
   "codexSet.class.base": "基礎指令",
   "codexSet.class.config-toggle": "可在此切換",
@@ -2485,6 +2506,50 @@ export const zhTW: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "會先儲存快照，因此這次操作會出現在下方的還原清單中，可以復原。",
   "integrations.dialog.overwrite.confirm": "替換",
   "integrations.action.overwrite": "替換",
+  "integrations.preview.loading": "正在載入精確的變更計畫…",
+  "integrations.preview.failed": "無法載入變更計畫。未進行任何變更。",
+  "integrations.preview.stale": "確認期間整合狀態已變更。請檢視更新後的計畫並再次確認。",
+  "integrations.dialog.apply.title": "套用此整合？",
+  "integrations.dialog.apply.changes": "opencodex 會將其管理的供應商設定加入用戶端設定。",
+  "integrations.dialog.apply.breakage": "用戶端將使用此 opencodex 執行個體目前提供的模型。",
+  "integrations.dialog.apply.undo": "系統會先儲存備份，可在回復中心復原此變更。",
+  "integrations.dialog.apply.confirm": "套用",
+  "integrations.dialog.disable.title": "停用此整合？",
+  "integrations.dialog.disable.changes": "只會移除 opencodex 擁有的設定。",
+  "integrations.dialog.disable.breakage": "用戶端將停止使用透過此 opencodex 執行個體路由的模型。",
+  "integrations.dialog.disable.undo": "系統會先儲存備份，可在回復中心復原此變更。",
+  "integrations.dialog.disable.confirm": "停用",
+  "integrations.plan.heading": "伺服器變更計畫",
+  "integrations.plan.operation": "操作：{operation}",
+  "integrations.plan.operation.apply": "套用",
+  "integrations.plan.operation.overwrite": "替換",
+  "integrations.plan.operation.disable": "停用",
+  "integrations.plan.operation.restore": "還原",
+  "integrations.plan.change.add": "新增",
+  "integrations.plan.change.replace": "替換",
+  "integrations.plan.change.remove": "移除",
+  "integrations.plan.change.snapshot": "儲存備份",
+  "integrations.plan.change.ownership": "更新擁有權記錄",
+  "integrations.plan.change.journal": "記錄回復項目",
+  "integrations.plan.foreign.none": "未偵測到外部編輯。",
+  "integrations.plan.foreign.unowned": "將替換不屬於 opencodex 的設定區塊。",
+  "integrations.plan.foreign.foreignEdit": "將替換 opencodex 管理區塊內的編輯。",
+  "integrations.plan.foreign.drift": "檔案在此回復點之後已變更。",
+  "integrations.plan.noop.applied": "不需要變更受管理的用戶端文件；整合設定已存在。",
+  "integrations.plan.noop.disabled": "不需要變更受管理的用戶端文件；整合設定已不存在。",
+  "integrations.plan.noop.profilePreference": "確認後仍會儲存設定檔同步偏好。",
+  "integrations.plan.refused": "伺服器無法安全地套用此計畫。",
+  "integrations.plan.refusal.notInstalled": "用戶端尚未安裝。請先安裝、重新整理此頁面，再次預覽變更。",
+  "integrations.plan.refusal.conflict": "受管理的設定與目前檔案衝突。請檢查檔案，或在可用時使用「替換」。",
+  "integrations.plan.refusal.unsafe": "無法安全地變更用戶端設定。請修復或替換檔案後再試一次。",
+  "integrations.plan.refusal.nonLoopback": "此用戶端需要迴路代理位址。請使用 localhost、通道或本機轉送後再試一次。",
+  "integrations.plan.refusal.driftRequiresConfirm": "檔案在此回復點後已變更。請先檢視包含變更的計畫再還原。",
+  "integrations.plan.refusal.snapshotExpired": "此回復點的備份已過期，無法再還原。",
+  "integrations.plan.refusal.writeFailed": "伺服器無法準備安全寫入。請重新整理整合狀態後再試一次。",
+  "integrations.mutation.pending": "正在套用已確認的變更…",
+  "integrations.bulk.breakage": "每個用戶端都將停止使用透過此 opencodex 執行個體路由的模型。",
+  "integrations.bulk.undo": "每個用戶端都會保留各自的備份和回復項目。",
+  "integrations.bulk.confirm": "全部停用",
   "integrations.semantics.opencode": "僅適用於直接從磁碟啟動；ocx opencode 的環境注入優先。",
   "integrations.semantics.pi": "適用於新工作階段。",
   "integrations.semantics.omp": "重新啟動 OMP 以載入模型目錄。",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 277cda2e64b..aa5049f34ce 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -356,6 +356,25 @@ export const zh: Record<TKey, string> = {
   "dash.visionSidecar": "视觉附属服务",
   "dash.visionSidecarHint": "选择纯文本路由模型描述图像时使用的后端和模型。",
   "dash.visionOff": "关闭",
+  "compactionRouting.title": "压缩路由",
+  "compactionRouting.description": "选择 Codex 压缩请求使用的模型，以及它覆盖哪些触发方式。后续消息保留对话设置。",
+  "compactionRouting.model": "压缩模型",
+  "compactionRouting.effort": "推理强度",
+  "compactionRouting.triggers": "适用于",
+  "compactionRouting.triggersManual": "仅手动 /compact",
+  "compactionRouting.triggersBoth": "手动和自动",
+  "compactionRouting.triggersAuto": "仅自动",
+  "compactionRouting.currentModel": "使用对话模型",
+  "compactionRouting.currentEffort": "保留请求的推理强度",
+  "compactionRouting.effortHint": "推理设置仅在压缩端点支持时生效。模型必须能容纳完整对话。",
+  "compactionRouting.dataNotice": "被覆盖的压缩请求会将整个对话发送给所选模型的提供商进行摘要，即使对话正在其他提供商上运行。",
+  "compactionRouting.autoNotice": "自动压缩会自行触发，因此长对话可能在你没有主动要求的情况下被发送给该提供商。",
+  "compactionRouting.providerWarning": "启用此设置后，每个被覆盖的压缩请求都会将完整对话内容发送给 {provider} 进行摘要。",
+  "compactionRouting.comboWarning": "启用此设置后，每个被覆盖的压缩请求都会将完整对话内容发送给组合 {combo} 的每个目标（{providers}），包括故障转移目标，以进行摘要。",
+  "compactionRouting.comboProvidersUnknown": "其已配置的目标提供商",
+  "compactionRouting.loadFailed": "无法加载压缩设置。",
+  "compactionRouting.saved": "压缩设置已保存。",
+  "compactionRouting.saveFailed": "保存失败。更改仍然保留，请重试。",
   "dash.shadowCallIntercept": "影子调用拦截",
   "dash.shadowCallInterceptHint": "拦截 Codex 应用的后台辅助调用（{models}：标题生成、提交消息）并重定向到所选模型。",
   "dash.shadowCallWarning": "⚠ 启用后，所有对 {models} 的请求都将被替换为所选模型。",
@@ -686,6 +705,7 @@ export const zh: Record<TKey, string> = {
   "models.reasoningEffort.high": "高",
   "models.reasoningEffort.xhigh": "极高",
   "models.reasoningEffort.max": "最高",
+  "models.reasoningEffort.ultra": "超高",
   "models.tipProvider": "提供方",
   "models.tipContext": "上下文",
   "models.tipModalities": "模态",
@@ -1103,6 +1123,7 @@ export const zh: Record<TKey, string> = {
 "codexSet.dialog.notRendered": "在我们读取的那一轮中，此层没有发送任何内容。各部分仅在内容变化时才会重新发送，因此单次采样可能看不到它。",
   "codexSet.dialog.emptySource": "{path} 文件存在但为空，因此此层不会发送任何内容。",
   "codexSet.dialog.notExposed": "基础提示词不在 Codex 可打印的消息列表中传递，因此无法在此显示。可以通过 model_instructions_file 替换它。",
+  "codexSet.dialog.unmapped": "此层在提示词输出中尚无已确认的映射，因此暂时无法在此显示其文本。",
   "codexSet.dialog.textUnavailable": "本机无法读取 Codex 提示词，因此无法显示原文。",
   "codexSet.class.base": "基础指令",
   "codexSet.class.config-toggle": "可在此切换",
@@ -1328,6 +1349,50 @@ export const zh: Record<TKey, string> = {
   "integrations.dialog.overwrite.undo": "会先保存快照，因此这次操作会出现在下方的回滚列表中，可以撤销。",
   "integrations.dialog.overwrite.confirm": "替换",
   "integrations.action.overwrite": "替换",
+  "integrations.preview.loading": "正在加载准确的更改计划…",
+  "integrations.preview.failed": "无法加载更改计划。未进行任何更改。",
+  "integrations.preview.stale": "确认期间集成状态已变化。请查看更新后的计划并再次确认。",
+  "integrations.dialog.apply.title": "应用此集成？",
+  "integrations.dialog.apply.changes": "opencodex 会将其管理的提供商设置添加到客户端配置。",
+  "integrations.dialog.apply.breakage": "客户端将使用此 opencodex 实例当前提供的模型。",
+  "integrations.dialog.apply.undo": "系统会先保存备份，可在回滚中心撤销此更改。",
+  "integrations.dialog.apply.confirm": "应用",
+  "integrations.dialog.disable.title": "禁用此集成？",
+  "integrations.dialog.disable.changes": "仅移除 opencodex 拥有的设置。",
+  "integrations.dialog.disable.breakage": "客户端将停止使用通过此 opencodex 实例路由的模型。",
+  "integrations.dialog.disable.undo": "系统会先保存备份，可在回滚中心撤销此更改。",
+  "integrations.dialog.disable.confirm": "禁用",
+  "integrations.plan.heading": "服务器更改计划",
+  "integrations.plan.operation": "操作：{operation}",
+  "integrations.plan.operation.apply": "应用",
+  "integrations.plan.operation.overwrite": "替换",
+  "integrations.plan.operation.disable": "禁用",
+  "integrations.plan.operation.restore": "恢复",
+  "integrations.plan.change.add": "添加",
+  "integrations.plan.change.replace": "替换",
+  "integrations.plan.change.remove": "移除",
+  "integrations.plan.change.snapshot": "保存备份",
+  "integrations.plan.change.ownership": "更新所有权记录",
+  "integrations.plan.change.journal": "记录回滚条目",
+  "integrations.plan.foreign.none": "未检测到外部编辑。",
+  "integrations.plan.foreign.unowned": "将替换不属于 opencodex 的设置块。",
+  "integrations.plan.foreign.foreignEdit": "将替换 opencodex 管理块内的编辑。",
+  "integrations.plan.foreign.drift": "文件在此回滚点之后发生了变化。",
+  "integrations.plan.noop.applied": "无需更改托管的客户端文档；集成设置已存在。",
+  "integrations.plan.noop.disabled": "无需更改托管的客户端文档；集成设置已不存在。",
+  "integrations.plan.noop.profilePreference": "确认后仍会保存配置文件同步偏好。",
+  "integrations.plan.refused": "服务器无法安全地应用此计划。",
+  "integrations.plan.refusal.notInstalled": "客户端尚未安装。请先安装，刷新此页面，然后重新预览更改。",
+  "integrations.plan.refusal.conflict": "托管设置与当前文件冲突。请检查文件，或在可用时使用“替换”。",
+  "integrations.plan.refusal.unsafe": "无法安全地更改客户端配置。请修复或替换文件后重试。",
+  "integrations.plan.refusal.nonLoopback": "此客户端需要环回代理地址。请使用 localhost、隧道或本地转发后重试。",
+  "integrations.plan.refusal.driftRequiresConfirm": "文件在此回滚点后发生了变化。请先查看包含变化的计划再恢复。",
+  "integrations.plan.refusal.snapshotExpired": "此回滚点的备份已过期，无法再恢复。",
+  "integrations.plan.refusal.writeFailed": "服务器无法准备安全写入。请刷新集成状态后重试。",
+  "integrations.mutation.pending": "正在应用已确认的更改…",
+  "integrations.bulk.breakage": "每个客户端都将停止使用通过此 opencodex 实例路由的模型。",
+  "integrations.bulk.undo": "每个客户端都会保留各自的备份和回滚条目。",
+  "integrations.bulk.confirm": "全部禁用",
   "integrations.semantics.opencode": "仅适用于直接从磁盘启动；ocx opencode 的环境注入优先。",
   "integrations.semantics.pi": "对新会话生效。",
   "integrations.semantics.omp": "重启 OMP 以加载模型目录。",
diff --git a/gui/src/pages/ClaudeDesktop.tsx b/gui/src/pages/ClaudeDesktop.tsx
index 9c17a994da5..3878f7d5b42 100644
--- a/gui/src/pages/ClaudeDesktop.tsx
+++ b/gui/src/pages/ClaudeDesktop.tsx
@@ -56,6 +56,25 @@ interface DesktopStatus {
   health: { lastRequestAt: string | null; requestCount: number; errorCount: number };
 }
 
+/**
+ * The status poll accepts any JSON today, so an error-shaped or malformed OK
+ * payload would be cached and rendered as a real status until the next poll.
+ * Validate before trusting either the wire or the cache.
+ */
+function isDesktopStatus(value: unknown): value is DesktopStatus {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as Record<string, unknown>;
+  const health = v.health as Record<string, unknown> | null | undefined;
+  return typeof v.desiredEnabled === "boolean"
+    && typeof v.applied === "boolean"
+    && (v.appliedAt === null || typeof v.appliedAt === "string")
+    && typeof v.stale === "boolean"
+    && typeof health === "object" && health !== null
+    && (health.lastRequestAt === null || typeof health.lastRequestAt === "string")
+    && typeof health.requestCount === "number"
+    && typeof health.errorCount === "number";
+}
+
 interface DesktopResponse {
   profile: DesktopProfile;
   models: DesktopModel[];
@@ -271,21 +290,24 @@ export default function ClaudeDesktop({
   const statusCacheKey = `ocx.claude-desktop.status.v1:${apiBase}`;
   const statusResourceKey = `claude-desktop-status:${apiBase}`;
   const cachedStatusEntry = readSessionListCacheEntry<DesktopStatus>(statusCacheKey);
+  const cachedStatus = cachedStatusEntry && isDesktopStatus(cachedStatusEntry.data)
+    ? cachedStatusEntry.data
+    : null;
   const statusResource = useDataSurface<DesktopStatus>(
     statusResourceKey,
     [apiBase],
     async (signal) => {
       const response = await fetch(`${apiBase}/api/claude-desktop/status`, { signal });
-      const next = await readJsonIfOk<DesktopStatus>(response);
-      if (!next) throw new Error("Claude Desktop status unavailable");
+      const next = await readJsonIfOk<unknown>(response);
+      if (!isDesktopStatus(next)) throw new Error("Claude Desktop status unavailable");
       writeSessionListCacheEntry(statusCacheKey, next);
       return next;
     },
     // Polled, so no staleAfterMs: the cadence already keeps it fresh.
-    { isEmpty: () => false, pollMs: 5000, enabled: active, initialData: cachedStatusEntry?.data ?? undefined },
+    { isEmpty: () => false, pollMs: 5000, enabled: active, initialData: cachedStatus ?? undefined },
   );
   const statusState = statusResource.state;
-  const status = statusState.data ?? cachedStatusEntry?.data ?? null;
+  const status = statusState.data ?? cachedStatus;
   const statusFailed = statusState.showError;
 
   const moveModel = (route: string, family: Family) => {
diff --git a/gui/src/pages/dashboard-overview-panels.tsx b/gui/src/pages/dashboard-overview-panels.tsx
index 8009d044232..9d6a9e43684 100644
--- a/gui/src/pages/dashboard-overview-panels.tsx
+++ b/gui/src/pages/dashboard-overview-panels.tsx
@@ -1,3 +1,4 @@
+import CompactionRoutingPanel from "../components/CompactionRoutingPanel";
 import MemoryObservabilityCard from "../components/MemoryObservabilityCard";
 import type { useDashboardData } from "./use-dashboard-data";
 import {
@@ -18,6 +19,7 @@ export function DashboardOverviewPanels(props: Dash) {
         <DashboardMaintenancePanel d={props} />
       </div>
       <DashboardSidecarPanels d={props} />
+      <CompactionRoutingPanel apiBase={props.apiBase} models={props.models} />
       <MemoryObservabilityCard apiBase={props.apiBase} />
     </>
   );
diff --git a/gui/src/pages/integrations/AsideProfilesPage.tsx b/gui/src/pages/integrations/AsideProfilesPage.tsx
index 8d1434dacf4..c7981995379 100644
--- a/gui/src/pages/integrations/AsideProfilesPage.tsx
+++ b/gui/src/pages/integrations/AsideProfilesPage.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { useT } from "../../i18n/shared";
 import { useDataSurface } from "../../data-surface";
 import { DataSurfaceSkeleton } from "../../components/data-surface";
@@ -7,11 +7,30 @@ import { markFor } from "../../components/integration-marks";
 import { Notice, Switch } from "../../ui";
 import IntegrationStateBadge from "./IntegrationStateBadge";
 import FileIntegrationPage from "./FileIntegrationPage";
+import ConsequenceDialog, { type ConsequenceCopy } from "./ConsequenceDialog";
 import { describeRefusal, describeAsideProfileOutcome } from "./refusal-copy";
 import type { AsideProfileOutcome } from "./aside-profile-contract";
-import { IntegrationApiError, toggleIntegration } from "./integration-api";
+import {
+  bindingFor,
+  IntegrationApiError,
+  isIntegrationPreviewUnavailable,
+  previewIntegrationMutation,
+  toggleIntegration,
+  type IntegrationMutationPlan,
+} from "./integration-api";
 import { loadAsideProfiles, syncAsideProfiles, type AsideProfileStatus } from "./aside-profile-api";
 
+const PROFILE_APPLY_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.apply.title", changesKey: "integrations.dialog.apply.changes",
+  breakageKey: "integrations.dialog.apply.breakage", undoKey: "integrations.dialog.apply.undo",
+  confirmKey: "integrations.dialog.apply.confirm",
+};
+const PROFILE_DISABLE_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.disable.title", changesKey: "integrations.dialog.disable.changes",
+  breakageKey: "integrations.dialog.disable.breakage", undoKey: "integrations.dialog.disable.undo",
+  confirmKey: "integrations.dialog.disable.confirm",
+};
+
 export default function AsideProfilesPage({ apiBase, active = true }: { apiBase: string; active?: boolean }) {
   const t = useT();
   const [selected, setSelected] = useState<AsideProfileStatus | null>(null);
@@ -19,6 +38,19 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
   const pendingRef = useRef(false);
   const [failure, setFailure] = useState<string | null>(null);
   const [profileFailures, setProfileFailures] = useState<Map<number, string>>(new Map());
+  const [planned, setPlanned] = useState<{
+    profile: AsideProfileStatus;
+    enabled: boolean;
+    plan: IntegrationMutationPlan | null;
+    loading: boolean;
+    failure: string | null;
+  } | null>(null);
+  const previewAbortRef = useRef<AbortController | null>(null);
+  const previewGenerationRef = useRef(0);
+  useEffect(() => () => {
+    previewGenerationRef.current += 1;
+    previewAbortRef.current?.abort();
+  }, []);
   const fetchProfiles = useCallback((signal: AbortSignal) => loadAsideProfiles(apiBase, signal), [apiBase]);
   const resource = useDataSurface(`aside-profiles:${apiBase}`, [apiBase], fetchProfiles, {
     enabled: active,
@@ -28,7 +60,7 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
   const data = resource.state.data;
   const profiles = data?.profiles ?? [];
   const loadError = resource.state.showError || Boolean(data?.error);
-  const busy = pending !== null || resource.state.refreshing;
+  const busy = pending !== null || resource.state.refreshing || planned !== null;
   const label = (profile: AsideProfileStatus) => profile.name || t("integrations.aside.profile", { id: profile.profileId });
 
   const reconcileOutcomes = (outcomes: AsideProfileOutcome[]) => setProfileFailures(previous => {
@@ -48,17 +80,23 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
     } else setFailure(describeRefusal(t, error));
   };
 
-  const mutate = async (enabled: boolean, profileId?: number) => {
+  const mutate = async (enabled: boolean, profileId?: number, plan?: IntegrationMutationPlan) => {
     if (pendingRef.current) return;
     pendingRef.current = true;
     setPending(profileId ?? "all");
     setFailure(null);
     try {
-      const result = await toggleIntegration(apiBase, "aside", enabled, undefined, undefined, profileId);
+      const result = await toggleIntegration(apiBase, "aside", {
+        enabled, profileId, ...(plan ? { binding: bindingFor(plan) } : {}),
+      });
       reconcileOutcomes(result.results ?? (profileId === undefined ? profiles.map(row => row.profileId) : [profileId])
         .map(id => ({ profileId: id, ok: true })));
     }
-    catch (error) { failed(error, profileId); }
+    catch (error) {
+      if (plan && error instanceof IntegrationApiError && error.stalePlan) throw error;
+      failed(error, profileId);
+      if (plan) throw new Error(describeRefusal(t, error), { cause: error });
+    }
     finally {
       // Even a refused writer may have durably saved desired sync preferences.
       resource.refresh();
@@ -66,6 +104,36 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
       setPending(null);
     }
   };
+  const requestProfileMutation = async (profile: AsideProfileStatus, enabled: boolean) => {
+    if (pendingRef.current || planned) return;
+    const controller = new AbortController();
+    const generation = previewGenerationRef.current + 1;
+    previewGenerationRef.current = generation;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = controller;
+    setPlanned({ profile, enabled, plan: null, loading: true, failure: null });
+    try {
+      const plan = await previewIntegrationMutation(apiBase, "aside", enabled ? "apply" : "disable", controller.signal, profile.profileId);
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      previewAbortRef.current = null;
+      setPlanned({ profile, enabled, plan, loading: false, failure: null });
+    } catch (error) {
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      previewAbortRef.current = null;
+      if (isIntegrationPreviewUnavailable(error)) {
+        setPlanned(null);
+        resource.refresh();
+        return;
+      }
+      setPlanned({ profile, enabled, plan: null, loading: false, failure: t("integrations.preview.failed") });
+    }
+  };
+  const closePlanned = () => {
+    previewGenerationRef.current += 1;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = null;
+    setPlanned(null);
+  };
   const sync = async () => {
     if (pendingRef.current) return;
     pendingRef.current = true;
@@ -150,10 +218,10 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
                 <div className="aside-profile-controls">
                   <IntegrationStateBadge state={profile.state} installed={profile.installed} id={`aside-profile-state-${profile.profileId}`} />
                   {needsUpdate && <button type="button" className="btn btn-ghost btn-sm" disabled={busy || loadError}
-                    aria-label={t("integrations.aside.retry", { name })} onClick={() => void mutate(profile.enabled, profile.profileId)}>
+                    aria-label={t("integrations.aside.retry", { name })} onClick={() => void requestProfileMutation(profile, profile.enabled)}>
                     {t("common.retry")}
                   </button>}
-                  <Switch on={profile.enabled} onClick={() => void mutate(!profile.enabled, profile.profileId)}
+                  <Switch on={profile.enabled} onClick={() => void requestProfileMutation(profile, !profile.enabled)}
                     disabled={busy || loadError || locked} label={t("integrations.aside.toggle", { name })} />
                 </div>
               </div>
@@ -161,6 +229,20 @@ export default function AsideProfilesPage({ apiBase, active = true }: { apiBase:
           })}
         </div>
       )}
+      {planned && (
+        <ConsequenceDialog
+          copy={planned.enabled ? PROFILE_APPLY_COPY : PROFILE_DISABLE_COPY}
+          plan={planned.plan}
+          planLoading={planned.loading}
+          planFailure={planned.failure}
+          onClose={closePlanned}
+          onConfirm={async plan => {
+            if (!plan) return;
+            await mutate(planned.enabled, planned.profile.profileId, plan);
+            setPlanned(null);
+          }}
+        />
+      )}
     </section>
   );
 }
diff --git a/gui/src/pages/integrations/ConsequenceDialog.tsx b/gui/src/pages/integrations/ConsequenceDialog.tsx
index 94ec1ac4f3f..9ddaf95d871 100644
--- a/gui/src/pages/integrations/ConsequenceDialog.tsx
+++ b/gui/src/pages/integrations/ConsequenceDialog.tsx
@@ -1,6 +1,8 @@
 import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
 import { useT, type TKey } from "../../i18n/shared";
 import { Notice } from "../../ui";
+import IntegrationPlanDetails, { type LabeledIntegrationPlan } from "./IntegrationPlanDetails";
+import { IntegrationApiError, type IntegrationMutationPlan } from "./integration-api";
 
 export interface ConsequenceCopy {
   titleKey: TKey;
@@ -21,49 +23,93 @@ function CopySlot({ copyKey, vars }: { copyKey: TKey; vars?: Record<string, stri
   return <p>{before}<code>{path}</code>{after.join(path)}</p>;
 }
 
+function planHasRollback(plan: IntegrationMutationPlan): boolean {
+  return plan.changes.some(change => change.kind === "snapshot" || change.kind === "journal");
+}
+
 export default function ConsequenceDialog({
   copy,
+  plan = null,
+  plans,
+  hasUnboundAction = false,
+  planStale = false,
+  planLoading = false,
+  planFailure = null,
   onConfirm,
   onClose,
 }: {
   copy: ConsequenceCopy;
-  onConfirm: () => Promise<void> | void;
+  plan?: IntegrationMutationPlan | null;
+  plans?: readonly LabeledIntegrationPlan[];
+  hasUnboundAction?: boolean;
+  planStale?: boolean;
+  planLoading?: boolean;
+  planFailure?: string | null;
+  onConfirm: (plan?: IntegrationMutationPlan) => Promise<void> | void;
   onClose: () => void;
 }) {
   const t = useT();
   const dialogRef = useRef<HTMLDialogElement>(null);
+  const triggerRef = useRef<HTMLElement | null>(null);
   const [pending, setPending] = useState(false);
   const [failure, setFailure] = useState<string | null>(null);
+  const [staleOverride, setStaleOverride] = useState<{
+    sourceFingerprint: string | null;
+    plan: IntegrationMutationPlan;
+  } | null>(null);
   const titleId = "integration-consequence-dialog-title";
+  const planRequired = plan !== null || planLoading || planFailure !== null || plans !== undefined;
+  const activePlan = staleOverride?.sourceFingerprint === (plan?.fingerprint ?? null)
+    ? staleOverride.plan
+    : plan;
+  const stale = staleOverride?.sourceFingerprint === (plan?.fingerprint ?? null);
+  const noActionableBulkTarget = plans !== undefined
+    && !hasUnboundAction
+    && !plans.some(item => item.plan.canApply);
+  const showUndo = !planRequired
+    || (activePlan ? planHasRollback(activePlan) : plans?.some(item => planHasRollback(item.plan)) === true);
+  const dismiss = useCallback(() => {
+    if (!pending) onClose();
+  }, [onClose, pending]);
 
   useEffect(() => {
     const dialog = dialogRef.current;
+    const active = document.activeElement;
+    triggerRef.current = active?.tagName === "BUTTON" ? active as HTMLElement : null;
     if (dialog && !dialog.open) dialog.showModal();
-    return () => { if (dialog?.open) dialog.close(); };
+    return () => {
+      if (dialog?.open) dialog.close();
+      if (triggerRef.current?.isConnected) triggerRef.current.focus?.();
+    };
   }, []);
 
   const handleCancel = useCallback((event: React.SyntheticEvent) => {
     event.preventDefault();
-    if (!pending) onClose();
-  }, [onClose, pending]);
+    dismiss();
+  }, [dismiss]);
 
   const confirm = useCallback(async () => {
     if (pending) return;
     setPending(true);
     setFailure(null);
     try {
-      await onConfirm();
+      await onConfirm(activePlan ?? undefined);
     } catch (error) {
+      if (error instanceof IntegrationApiError && error.stalePlan) {
+        setStaleOverride({ sourceFingerprint: plan?.fingerprint ?? null, plan: error.stalePlan });
+        return;
+      }
       setFailure(error instanceof Error ? error.message : t("integrations.error.generic"));
+    } finally {
       setPending(false);
     }
-  }, [onConfirm, pending, t]);
+  }, [activePlan, onConfirm, pending, plan?.fingerprint, t]);
 
   const slots: ReactNode[] = [
     <CopySlot key="changes" copyKey={copy.changesKey} vars={copy.vars} />,
     <CopySlot key="breakage" copyKey={copy.breakageKey} vars={copy.vars} />,
-    <CopySlot key="undo" copyKey={copy.undoKey} vars={copy.vars} />,
   ];
+  if (showUndo) slots.push(<CopySlot key="undo" copyKey={copy.undoKey} vars={copy.vars} />);
   if (copy.sideEffectKey) {
     slots.push(<CopySlot key="side-effect" copyKey={copy.sideEffectKey} vars={copy.vars} />);
   }
@@ -73,6 +119,7 @@ export default function ConsequenceDialog({
       ref={dialogRef}
       className="modal-overlay"
       aria-labelledby={titleId}
+      aria-busy={pending}
       onCancel={handleCancel}
     >
       <button
@@ -80,19 +127,26 @@ export default function ConsequenceDialog({
         className="modal-backdrop-dismiss"
         aria-label={t("common.close")}
         tabIndex={-1}
-        onClick={() => { if (!pending) onClose(); }}
+        onClick={dismiss}
       />
       <div className="modal-card integration-consequence-dialog" role="document">
         <div className="modal-head">
           <h3 id={titleId}>{t(copy.titleKey, copy.vars)}</h3>
-          <button type="button" className="btn btn-ghost btn-sm" onClick={onClose} disabled={pending}>
+          <button type="button" className="btn btn-ghost btn-sm" onClick={dismiss} disabled={pending}>
             {t("common.close")}
           </button>
         </div>
         <div className="integration-consequence-body">{slots}</div>
+        <div role="status" aria-live="polite" aria-atomic="true">
+          {planLoading && <p>{t("integrations.preview.loading")}</p>}
+          {pending && <p>{t("integrations.mutation.pending")}</p>}
+          {(stale || planStale) && <Notice tone="err">{t("integrations.preview.stale")}</Notice>}
+          {planFailure && <Notice tone="err">{planFailure}</Notice>}
+        </div>
+        <IntegrationPlanDetails plan={activePlan} plans={plans} />
         {failure && <Notice tone="err">{failure}</Notice>}
         <div className="modal-actions">
-          <button type="button" className="btn btn-primary" onClick={() => void confirm()} disabled={pending}>
+          <button type="button" className="btn btn-primary" onClick={() => void confirm()} disabled={pending || planLoading || Boolean(planFailure) || (planRequired && !activePlan && plans === undefined) || noActionableBulkTarget || activePlan?.canApply === false}>
             {t(copy.confirmKey)}
           </button>
         </div>
diff --git a/gui/src/pages/integrations/FileIntegrationPage.tsx b/gui/src/pages/integrations/FileIntegrationPage.tsx
index b1f8ec37374..3ee7db1b967 100644
--- a/gui/src/pages/integrations/FileIntegrationPage.tsx
+++ b/gui/src/pages/integrations/FileIntegrationPage.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { useDataSurface } from "../../data-surface";
 import { DataSurfaceSkeleton } from "../../components/data-surface";
 import { useT, type TKey } from "../../i18n/shared";
@@ -14,12 +14,18 @@ import { describeRefusal } from "./refusal-copy";
 import {
   loadIntegrationJournal,
   loadIntegrationState,
+  previewIntegrationMutation,
   toggleIntegration,
+  bindingFor,
+  IntegrationApiError,
   deleteJournalEntry,
+  isIntegrationPreviewUnavailable,
   isMissingJournalEntry,
   type FileIntegrationClientId,
   type IntegrationJournalRow,
   type IntegrationStatus,
+  type IntegrationMutationPlan,
+  type IntegrationPlanOperation,
 } from "./integration-api";
 
 export type { FileIntegrationClientId };
@@ -45,6 +51,22 @@ function overwriteCopy(reason: string | undefined, path: string): ConsequenceCop
   };
 }
 
+const APPLY_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.apply.title",
+  changesKey: "integrations.dialog.apply.changes",
+  breakageKey: "integrations.dialog.apply.breakage",
+  undoKey: "integrations.dialog.apply.undo",
+  confirmKey: "integrations.dialog.apply.confirm",
+};
+
+const DISABLE_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.disable.title",
+  changesKey: "integrations.dialog.disable.changes",
+  breakageKey: "integrations.dialog.disable.breakage",
+  undoKey: "integrations.dialog.disable.undo",
+  confirmKey: "integrations.dialog.disable.confirm",
+};
+
 const SEMANTICS_KEY: Record<FileIntegrationClientId, TKey> = {
   opencode: "integrations.semantics.opencode",
   pi: "integrations.semantics.pi",
@@ -101,8 +123,19 @@ export default function FileIntegrationPage({
   const [restoring, setRestoring] = useState<IntegrationJournalRow | null>(null);
   /* The row awaiting delete confirmation. */
   const [deleting, setDeleting] = useState<IntegrationJournalRow | null>(null);
-  /* Open only while the user is confirming an overwrite. */
-  const [overwriting, setOverwriting] = useState(false);
+  const [plannedMutation, setPlannedMutation] = useState<{
+    operation: Exclude<IntegrationPlanOperation, "restore">;
+    plan: IntegrationMutationPlan | null;
+    loading: boolean;
+    failure: string | null;
+  } | null>(null);
+  const previewAbortRef = useRef<AbortController | null>(null);
+  const previewGenerationRef = useRef(0);
+
+  useEffect(() => () => {
+    previewGenerationRef.current += 1;
+    previewAbortRef.current?.abort();
+  }, []);
 
   const fetchState = useCallback(
     (signal: AbortSignal) => loadIntegrationState(apiBase, client, signal, profileId),
@@ -144,14 +177,54 @@ export default function FileIntegrationPage({
     void historyResource.refresh();
   };
 
-  const mutate = async (enabled: boolean) => {
+  const requestMutation = async (operation: Exclude<IntegrationPlanOperation, "restore">) => {
+    if (!status || pending || plannedMutation) return;
+    const controller = new AbortController();
+    const generation = previewGenerationRef.current + 1;
+    previewGenerationRef.current = generation;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = controller;
+    setPlannedMutation({ operation, plan: null, loading: true, failure: null });
+    try {
+      const plan = await previewIntegrationMutation(apiBase, client, operation, controller.signal, profileId);
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      previewAbortRef.current = null;
+      setPlannedMutation({ operation, plan, loading: false, failure: null });
+    } catch (error) {
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      previewAbortRef.current = null;
+      if (isIntegrationPreviewUnavailable(error)) {
+        setPlannedMutation(null);
+        refresh();
+        return;
+      }
+      setPlannedMutation({ operation, plan: null, loading: false, failure: t("integrations.preview.failed") });
+    }
+  };
+
+  const closePlannedMutation = () => {
+    previewGenerationRef.current += 1;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = null;
+    setPlannedMutation(null);
+  };
+
+  const mutate = async (plan: IntegrationMutationPlan) => {
     if (!status || pending) return;
     setPending(true);
     setFailure(null);
     try {
-      await toggleIntegration(apiBase, client, enabled, undefined, undefined, profileId);
+      await toggleIntegration(apiBase, client, {
+        enabled: plan.operation !== "disable",
+        overwriteConflict: plan.operation === "overwrite",
+        profileId,
+        binding: bindingFor(plan),
+      });
+      setPlannedMutation(null);
     } catch (error) {
-      setFailure(describeRefusal(t, error));
+      refresh();
+      if (error instanceof IntegrationApiError && error.stalePlan) throw error;
+      throw new Error(describeRefusal(t, error), { cause: error });
     } finally {
       refresh();
       setPending(false);
@@ -167,19 +240,6 @@ export default function FileIntegrationPage({
    * Errors are NOT swallowed here -- they propagate so ConsequenceDialog can
    * render them inside the dialog, where the user still has the cancel button.
    */
-  const overwrite = async () => {
-    if (!status) return;
-    setFailure(null);
-    try {
-      await toggleIntegration(apiBase, client, true, undefined, true, profileId);
-      refresh();
-    } catch (error) {
-      setFailure(describeRefusal(t, error));
-      refresh();
-      throw error;
-    }
-  };
-
   /*
    * The switch means exactly what its label says.
    *
@@ -189,7 +249,7 @@ export default function FileIntegrationPage({
    * to remove the block; updating a stale block is a separate action with its
    * own button below.
    */
-  const toggle = () => void mutate(!(status && (profileId !== undefined ? status.enabled : (status.state === "current" || status.state === "stale"))));
+  const toggle = () => void requestMutation(enabled ? "disable" : "apply");
 
   if (!status) {
     return (
@@ -241,7 +301,7 @@ export default function FileIntegrationPage({
         <button
           type="button"
           className="btn btn-ghost"
-          onClick={() => void mutate(true)}
+          onClick={() => void requestMutation("apply")}
           disabled={pending}
         >
           {t("integrations.action.refresh")}
@@ -259,7 +319,7 @@ export default function FileIntegrationPage({
         <button
           type="button"
           className="btn btn-danger"
-          onClick={() => setOverwriting(true)}
+          onClick={() => void requestMutation("overwrite")}
           disabled={pending}
         >
           {t("integrations.action.overwrite")}
@@ -344,14 +404,16 @@ export default function FileIntegrationPage({
           }}
         />
       )}
-      {overwriting && (
+      {plannedMutation && (
         <ConsequenceDialog
-          copy={overwriteCopy(status.reason, status.configPath)}
-          onClose={() => setOverwriting(false)}
-          onConfirm={async () => {
-            await overwrite();
-            setOverwriting(false);
-          }}
+          copy={plannedMutation.operation === "overwrite"
+            ? overwriteCopy(status.reason, status.configPath)
+            : plannedMutation.operation === "disable" ? DISABLE_COPY : APPLY_COPY}
+          plan={plannedMutation.plan}
+          planLoading={plannedMutation.loading}
+          planFailure={plannedMutation.failure}
+          onClose={closePlannedMutation}
+          onConfirm={async plan => { if (plan) await mutate(plan); }}
         />
       )}
     </section>
diff --git a/gui/src/pages/integrations/IntegrationPlanDetails.tsx b/gui/src/pages/integrations/IntegrationPlanDetails.tsx
new file mode 100644
index 00000000000..742794de93c
--- /dev/null
+++ b/gui/src/pages/integrations/IntegrationPlanDetails.tsx
@@ -0,0 +1,93 @@
+import { useT, type TKey } from "../../i18n/shared";
+import type { FileIntegrationClientId, IntegrationMutationPlan, IntegrationPlanChangeKind, IntegrationPlanForeignEdit, IntegrationPlanOperation } from "./integration-api";
+
+export interface LabeledIntegrationPlan {
+  clientId: FileIntegrationClientId;
+  label: string;
+  plan: IntegrationMutationPlan;
+}
+
+const OPERATION_KEYS: Record<IntegrationPlanOperation, TKey> = {
+  apply: "integrations.plan.operation.apply",
+  overwrite: "integrations.plan.operation.overwrite",
+  disable: "integrations.plan.operation.disable",
+  restore: "integrations.plan.operation.restore",
+};
+
+const CHANGE_KEYS: Record<IntegrationPlanChangeKind, TKey> = {
+  add: "integrations.plan.change.add",
+  replace: "integrations.plan.change.replace",
+  remove: "integrations.plan.change.remove",
+  snapshot: "integrations.plan.change.snapshot",
+  ownership: "integrations.plan.change.ownership",
+  journal: "integrations.plan.change.journal",
+};
+
+const FOREIGN_EDIT_KEYS: Record<IntegrationPlanForeignEdit, TKey> = {
+  none: "integrations.plan.foreign.none",
+  unowned: "integrations.plan.foreign.unowned",
+  "foreign-edit": "integrations.plan.foreign.foreignEdit",
+  drift: "integrations.plan.foreign.drift",
+};
+
+const REFUSAL_KEYS: Partial<Record<string, TKey>> = {
+  not_installed: "integrations.plan.refusal.notInstalled",
+  conflict: "integrations.plan.refusal.conflict",
+  unsafe: "integrations.plan.refusal.unsafe",
+  non_loopback: "integrations.plan.refusal.nonLoopback",
+  drift_requires_confirm: "integrations.plan.refusal.driftRequiresConfirm",
+  snapshot_expired: "integrations.plan.refusal.snapshotExpired",
+  write_failed: "integrations.plan.refusal.writeFailed",
+};
+
+function Plan({ plan }: { plan: IntegrationMutationPlan }) {
+  const t = useT();
+  const refusalKey = plan.refusalReason ? REFUSAL_KEYS[plan.refusalReason] : undefined;
+  return (
+    <div className="integration-plan-details">
+      <p className="integration-plan-operation">
+        {t("integrations.plan.operation", { operation: t(OPERATION_KEYS[plan.operation]) })}
+      </p>
+      {plan.foreignEdit !== "none" && <p>{t(FOREIGN_EDIT_KEYS[plan.foreignEdit])}</p>}
+      {!plan.willChange && plan.canApply && (
+        <>
+          <p>{t(plan.operation === "disable" ? "integrations.plan.noop.disabled" : "integrations.plan.noop.applied")}</p>
+          {plan.profileId !== undefined && <p>{t("integrations.plan.noop.profilePreference")}</p>}
+        </>
+      )}
+      {!plan.canApply && <p>{t(refusalKey ?? "integrations.plan.refused")}</p>}
+      {plan.changes.length > 0 && (
+        <ul className="integration-plan-changes">
+          {plan.changes.map(change => (
+            <li key={`${change.kind}:${change.path}`}>
+              <span>{t(CHANGE_KEYS[change.kind])}</span> <code>{change.path}</code>
+            </li>
+          ))}
+        </ul>
+      )}
+    </div>
+  );
+}
+
+export default function IntegrationPlanDetails({
+  plan,
+  plans,
+}: {
+  plan?: IntegrationMutationPlan | null;
+  plans?: readonly LabeledIntegrationPlan[];
+}) {
+  const t = useT();
+  if (!plan && (!plans || plans.length === 0)) return null;
+  return (
+    <section className="integration-plan" aria-labelledby="integration-plan-heading">
+      <h4 id="integration-plan-heading">{t("integrations.plan.heading")}</h4>
+      {plan && <Plan plan={plan} />}
+      {plans?.map(item => (
+        <section key={`${item.clientId}:${item.plan.fingerprint}`} className="integration-plan-group">
+          <h5>{item.label}</h5>
+          <Plan plan={item.plan} />
+        </section>
+      ))}
+    </section>
+  );
+}
diff --git a/gui/src/pages/integrations/IntegrationsOverview.tsx b/gui/src/pages/integrations/IntegrationsOverview.tsx
index bc93e27b195..846016f970d 100644
--- a/gui/src/pages/integrations/IntegrationsOverview.tsx
+++ b/gui/src/pages/integrations/IntegrationsOverview.tsx
@@ -27,12 +27,19 @@ import {
   loadGrokFenceStatus,
   loadIntegrationJournal,
   loadIntegrationStates,
+  previewIntegrationMutation,
   toggleIntegration,
+  bindingFor,
   deleteJournalEntry,
+  IntegrationApiError,
+  isIntegrationPreviewUnavailable,
   isMissingJournalEntry,
   type IntegrationJournalRow,
   type IntegrationStatus,
+  type IntegrationMutationPlan,
+  type IntegrationPlanOperation,
 } from "./integration-api";
+import type { LabeledIntegrationPlan } from "./IntegrationPlanDetails";
 import {
   loadNativeIntegrations,
   NativeApiError,
@@ -66,6 +73,51 @@ const DESKTOP_DISABLE_COPY: ConsequenceCopy = {
   confirmKey: "integrations.dialog.desktop.confirm",
 };
 
+const FILE_APPLY_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.apply.title",
+  changesKey: "integrations.dialog.apply.changes",
+  breakageKey: "integrations.dialog.apply.breakage",
+  undoKey: "integrations.dialog.apply.undo",
+  confirmKey: "integrations.dialog.apply.confirm",
+};
+
+const FILE_DISABLE_COPY: ConsequenceCopy = {
+  titleKey: "integrations.dialog.disable.title",
+  changesKey: "integrations.dialog.disable.changes",
+  breakageKey: "integrations.dialog.disable.breakage",
+  undoKey: "integrations.dialog.disable.undo",
+  confirmKey: "integrations.dialog.disable.confirm",
+};
+
+const BULK_DISABLE_COPY: ConsequenceCopy = {
+  titleKey: "integrations.bulk.title",
+  changesKey: "integrations.bulk.body",
+  breakageKey: "integrations.bulk.breakage",
+  undoKey: "integrations.bulk.undo",
+  confirmKey: "integrations.bulk.confirm",
+};
+
+interface BulkDisableAction {
+  clientId: IntegrationStatus["clientId"];
+  label: string;
+  /** Aggregate Aside mutations intentionally stay unbound; one fingerprint cannot describe every profile. */
+  plan: IntegrationMutationPlan | null;
+}
+
+interface BulkDisableState {
+  actions: BulkDisableAction[];
+  loading: boolean;
+  failure: string | null;
+  stale: boolean;
+  failures: string[];
+}
+
+function labeledPlansFor(actions: readonly BulkDisableAction[]): LabeledIntegrationPlan[] {
+  return actions.flatMap(item => item.plan
+    ? [{ clientId: item.clientId, label: item.label, plan: item.plan }]
+    : []);
+}
+
 function isApplied(status: IntegrationStatus): boolean {
   return status.state === "current" || status.state === "stale";
 }
@@ -193,8 +245,18 @@ export default function IntegrationsOverview({
   const [deleting, setDeleting] = useState<IntegrationJournalRow | null>(null);
   const [cardResults, setCardResults] = useState<Partial<Record<OverviewRow["id"], { tone: "ok" | "err"; text: string }>>>({});
   const [pendingToggle, setPendingToggle] = useState<OverviewRow | null>(null);
-  /* The conflicted row awaiting overwrite confirmation. */
-  const [pendingOverwrite, setPendingOverwrite] = useState<OverviewRow | null>(null);
+  const [plannedCard, setPlannedCard] = useState<{
+    row: OverviewRow;
+    operation: Exclude<IntegrationPlanOperation, "restore">;
+    plan: IntegrationMutationPlan | null;
+    loading: boolean;
+    failure: string | null;
+  } | null>(null);
+  const [bulkPlans, setBulkPlans] = useState<BulkDisableState | null>(null);
+  const cardPreviewAbortRef = useRef<AbortController | null>(null);
+  const cardPreviewGenerationRef = useRef(0);
+  const bulkPreviewAbortRef = useRef<AbortController | null>(null);
+  const bulkPreviewGenerationRef = useRef(0);
   const restoreFocusRef = useRef<HTMLButtonElement | null>(null);
 
   useEffect(() => {
@@ -205,6 +267,13 @@ export default function IntegrationsOverview({
     if (trigger.isConnected) trigger.focus();
   }, [pendingToggle]);
 
+  useEffect(() => () => {
+    cardPreviewGenerationRef.current += 1;
+    bulkPreviewGenerationRef.current += 1;
+    cardPreviewAbortRef.current?.abort();
+    bulkPreviewAbortRef.current?.abort();
+  }, []);
+
   const fetchStates = useCallback(
     async (signal: AbortSignal) => (await loadIntegrationStates(apiBase, signal)).clients,
     [apiBase],
@@ -312,11 +381,10 @@ export default function IntegrationsOverview({
   const installedFileClients = clients.filter(client => client.installed);
   /*
    * "Settled" is what separates a client the server omitted from one whose
-   * list has not answered yet. Only a cold state means we have never had an
-   * answer; a stale-with-error state still holds real rows.
+   * list has not answered yet. `undefined` covers both pre-response and cold
+   * failures, while a stale-with-error state still holds real rows.
    */
-  const clientsSettled = statesResource.state.kind !== "cold"
-    && statesResource.state.kind !== "retrying-cold";
+  const clientsSettled = statesResource.state.data !== undefined;
   const native = nativeResource.state.data ?? null;
   // `readOptional` returns null for a failed probe. Only an actual array is a
   // settled contract; an empty array is meaningful and removes both switches.
@@ -371,14 +439,51 @@ export default function IntegrationsOverview({
    * single-client PUT the card uses, so every client gets its own snapshot and
    * its own journal row, and one refusal cannot silently swallow the rest.
    */
-  const disableAll = async () => {
-    if (bulkPending || appliedClients.length === 0) return;
-    // Title then body, so the prompt names the action before its consequences.
-    const prompt = [t("integrations.bulk.title"), t("integrations.bulk.body")].join("\n\n");
-    if (!confirm(prompt)) return;
+  const requestDisableAll = async () => {
+    if (bulkPending || bulkPlans || appliedClients.length === 0) return;
+    const controller = new AbortController();
+    const generation = bulkPreviewGenerationRef.current + 1;
+    bulkPreviewGenerationRef.current = generation;
+    bulkPreviewAbortRef.current?.abort();
+    bulkPreviewAbortRef.current = controller;
+    setBulkPlans({ actions: [], loading: true, failure: null, stale: false, failures: [] });
+    try {
+      const actions = await Promise.all(appliedClients.map(async client => {
+        const row = rows.find(candidate => candidate.status?.clientId === client.clientId);
+        if (client.clientId === "aside") {
+          return { clientId: client.clientId, label: row ? t(row.labelKey) : client.clientId, plan: null };
+        }
+        const plan = await previewIntegrationMutation(apiBase, client.clientId, "disable", controller.signal);
+        return { clientId: client.clientId, label: row ? t(row.labelKey) : client.clientId, plan };
+      }));
+      if (controller.signal.aborted || generation !== bulkPreviewGenerationRef.current) return;
+      bulkPreviewAbortRef.current = null;
+      setBulkPlans({ actions, loading: false, failure: null, stale: false, failures: [] });
+    } catch (error) {
+      if (controller.signal.aborted || generation !== bulkPreviewGenerationRef.current) return;
+      bulkPreviewAbortRef.current = null;
+      if (isIntegrationPreviewUnavailable(error)) {
+        setBulkPlans(null);
+        refresh();
+        return;
+      }
+      setBulkPlans({ actions: [], loading: false, failure: t("integrations.preview.failed"), stale: false, failures: [] });
+    }
+  };
+
+  const closeBulkPlans = () => {
+    bulkPreviewGenerationRef.current += 1;
+    bulkPreviewAbortRef.current?.abort();
+    bulkPreviewAbortRef.current = null;
+    setBulkPlans(null);
+  };
+
+  const disableAll = async (state: BulkDisableState) => {
+    if (bulkPending || state.actions.length === 0) return;
     setBulkPending(true);
     setBulkResult(null);
-    const failed: string[] = [];
+    const failed = [...state.failures];
+    const staleActions: BulkDisableAction[] = [];
     /*
      * Sequential ON PURPOSE — do not convert this to `Promise.all`.
      *
@@ -393,19 +498,39 @@ export default function IntegrationsOverview({
      * Six loopback requests are cheap; a lost ownership record is not.
      */
     // Bulk disable remains file-clients-only; Grok must keep its consequence gate.
-    for (const client of appliedClients) {
+    for (const item of state.actions) {
+      if (item.plan && !item.plan.canApply) {
+        failed.push(`${item.clientId}: ${t("integrations.plan.refused")}`);
+        continue;
+      }
       try {
         // react-doctor-disable-next-line react-doctor/async-await-in-loop -- serial on purpose; see the block comment above
-        await toggleIntegration(apiBase, client.clientId, false);
+        await toggleIntegration(apiBase, item.clientId, {
+          enabled: false,
+          ...(item.plan ? { binding: bindingFor(item.plan) } : {}),
+        });
       } catch (error) {
+        if (item.plan && error instanceof IntegrationApiError && error.stalePlan) {
+          staleActions.push({ ...item, plan: error.stalePlan });
+          continue;
+        }
         // Report which clients survived rather than a single opaque failure:
         // a partial result the user cannot see is worse than none.
         // `describeRefusal` keeps the snapshot path and the residual warning,
         // which a bare message would drop for exactly the clients that need
         // manual recovery.
-        failed.push(`${client.clientId}: ${describeRefusal(t, error)}`);
+        failed.push(`${item.clientId}: ${describeRefusal(t, error)}`);
       }
     }
+    if (staleActions.length > 0) {
+      refresh();
+      setBulkPending(false);
+      setBulkPlans({ actions: staleActions, loading: false, failure: null, stale: true, failures: failed });
+      setBulkResult(failed.length === 0
+        ? null
+        : { tone: "err", text: t("integrations.bulk.partial", { clients: failed.join("; ") }) });
+      return;
+    }
     /*
      * Confirm the outcome against the server before claiming it.
      *
@@ -425,6 +550,7 @@ export default function IntegrationsOverview({
     if (unsettled && failed.length === 0) failed.push(t("integrations.error.stale"));
     refresh();
     setBulkPending(false);
+    setBulkPlans(null);
     setBulkResult(failed.length === 0
       ? { tone: "ok", text: t("integrations.bulk.success") }
       : { tone: "err", text: t("integrations.bulk.partial", { clients: failed.join("; ") }) });
@@ -455,14 +581,21 @@ export default function IntegrationsOverview({
     });
   };
 
-  const toggleCard = async (row: OverviewRow, next: boolean) => {
+  const toggleCard = async (row: OverviewRow, next: boolean, plan?: IntegrationMutationPlan) => {
     if (cardPending) return;
     if (!row.toggle) return;
     setCardPending(row.id);
     setCardResult(row.id, null);
     try {
       if (row.status) {
-        await toggleIntegration(apiBase, row.status.clientId, next);
+        if (!plan && row.status.clientId !== "aside") return;
+        await toggleIntegration(apiBase, row.status.clientId, {
+          enabled: next,
+          ...(plan ? {
+            overwriteConflict: plan.operation === "overwrite",
+            binding: bindingFor(plan),
+          } : {}),
+        });
         refresh();
       } else if (row.toggle === "claude" || row.toggle === "grok" || row.toggle === "codex" || row.toggle === "claude-desktop") {
         const result = await toggleNativeIntegration(apiBase, row.toggle, next);
@@ -479,18 +612,64 @@ export default function IntegrationsOverview({
         refreshNativeDetails();
       }
     } catch (error) {
+      if (row.status && error instanceof IntegrationApiError && error.stalePlan) throw error;
       setCardResult(row.id, {
         tone: "err",
         text: describeRefusal(t, error, undefined, row.togglePath ?? undefined),
       });
       if (row.toggle === "claude" || row.toggle === "grok" || row.toggle === "codex" || row.toggle === "claude-desktop") refreshNativeDetails();
+      if (row.status) {
+        throw new Error(describeRefusal(t, error, undefined, row.togglePath ?? undefined), { cause: error });
+      }
     } finally {
       setCardPending(null);
     }
   };
 
+  const requestFilePlan = async (row: OverviewRow, operation: Exclude<IntegrationPlanOperation, "restore">) => {
+    if (!row.status || plannedCard) return;
+    const controller = new AbortController();
+    const generation = cardPreviewGenerationRef.current + 1;
+    cardPreviewGenerationRef.current = generation;
+    cardPreviewAbortRef.current?.abort();
+    cardPreviewAbortRef.current = controller;
+    setPlannedCard({ row, operation, plan: null, loading: true, failure: null });
+    try {
+      const plan = await previewIntegrationMutation(apiBase, row.status.clientId, operation, controller.signal);
+      if (controller.signal.aborted || generation !== cardPreviewGenerationRef.current) return;
+      cardPreviewAbortRef.current = null;
+      setPlannedCard({ row, operation, plan, loading: false, failure: null });
+    } catch (error) {
+      if (controller.signal.aborted || generation !== cardPreviewGenerationRef.current) return;
+      cardPreviewAbortRef.current = null;
+      if (isIntegrationPreviewUnavailable(error)) {
+        setPlannedCard(null);
+        refresh();
+        return;
+      }
+      setPlannedCard({ row, operation, plan: null, loading: false, failure: t("integrations.preview.failed") });
+    }
+  };
+
+  const closePlannedCard = () => {
+    cardPreviewGenerationRef.current += 1;
+    cardPreviewAbortRef.current?.abort();
+    cardPreviewAbortRef.current = null;
+    setPlannedCard(null);
+  };
+
   const requestToggle = (row: OverviewRow, next: boolean) => {
-    if (row.status || next || row.id === "claude" || row.toggle === null) {
+    if (row.status && row.status.clientId !== "aside") {
+      void requestFilePlan(row, next ? "apply" : "disable");
+      return;
+    }
+    if (row.status?.clientId === "aside") {
+      // Aggregate Aside mutations have no confirmation dialog to consume a rejection.
+      // toggleCard already stores the visible refusal and clears cardPending in finally.
+      void toggleCard(row, next).catch(() => {});
+      return;
+    }
+    if (next || row.id === "claude" || row.toggle === null) {
       void toggleCard(row, next);
       return;
     }
@@ -509,24 +688,6 @@ export default function IntegrationsOverview({
    *
    * Errors propagate so the dialog can show them while the user still has cancel.
    */
-  const overwriteCard = async (row: OverviewRow) => {
-    if (!row.status) return;
-    setCardPending(row.id);
-    setCardResult(row.id, null);
-    try {
-      await toggleIntegration(apiBase, row.status.clientId, true, undefined, true);
-      refresh();
-    } catch (error) {
-      setCardResult(row.id, {
-        tone: "err",
-        text: describeRefusal(t, error, undefined, row.togglePath ?? undefined),
-      });
-      throw error;
-    } finally {
-      setCardPending(null);
-    }
-  };
-
   return (
     <section className="integrations-overview">
       <div className="integration-summary">
@@ -560,8 +721,8 @@ export default function IntegrationsOverview({
         <button
           type="button"
           className="btn btn-ghost"
-          onClick={() => void disableAll()}
-          disabled={bulkPending || appliedClients.length === 0}
+          onClick={() => void requestDisableAll()}
+          disabled={bulkPending || Boolean(bulkPlans) || appliedClients.length === 0}
         >
           {t("integrations.summary.disableAll")}
         </button>
@@ -618,7 +779,7 @@ export default function IntegrationsOverview({
               onOpen={() => navigateHash(row.hash)}
               onToggle={row.toggle ? () => requestToggle(row, !(row.toggleOn ?? row.applied)) : null}
               onOverwrite={row.status !== null && row.status.state === "conflict" && row.installed
-                ? () => setPendingOverwrite(row)
+                ? () => void requestFilePlan(row, "overwrite")
                 : null}
             />
           ))}
@@ -724,25 +885,41 @@ export default function IntegrationsOverview({
           }}
         />
       )}
-      {pendingOverwrite && pendingOverwrite.status && (
+      {plannedCard && plannedCard.row.status && (
         <ConsequenceDialog
-          copy={{
+          copy={plannedCard.operation === "overwrite" ? {
             titleKey: "integrations.dialog.overwrite.title",
-            changesKey: pendingOverwrite.status.reason === "foreign-edit"
+            changesKey: plannedCard.row.status.reason === "foreign-edit"
               ? "integrations.dialog.overwrite.changesForeign"
               : "integrations.dialog.overwrite.changesUnowned",
             breakageKey: "integrations.dialog.overwrite.breakage",
             undoKey: "integrations.dialog.overwrite.undo",
             confirmKey: "integrations.dialog.overwrite.confirm",
-            vars: { path: pendingOverwrite.status.configPath },
-          }}
-          onClose={() => setPendingOverwrite(null)}
-          onConfirm={async () => {
-            await overwriteCard(pendingOverwrite);
-            setPendingOverwrite(null);
+            vars: { path: plannedCard.row.status.configPath },
+          } : plannedCard.operation === "disable" ? FILE_DISABLE_COPY : FILE_APPLY_COPY}
+          plan={plannedCard.plan}
+          planLoading={plannedCard.loading}
+          planFailure={plannedCard.failure}
+          onClose={closePlannedCard}
+          onConfirm={async plan => {
+            if (!plan) return;
+            await toggleCard(plannedCard.row, plan.operation !== "disable", plan);
+            setPlannedCard(null);
           }}
         />
       )}
+      {bulkPlans && (
+        <ConsequenceDialog
+          copy={BULK_DISABLE_COPY}
+          plans={labeledPlansFor(bulkPlans.actions)}
+          hasUnboundAction={bulkPlans.actions.some(item => item.plan === null)}
+          planStale={bulkPlans.stale}
+          planLoading={bulkPlans.loading}
+          planFailure={bulkPlans.failure}
+          onClose={closeBulkPlans}
+          onConfirm={async () => { await disableAll(bulkPlans); }}
+        />
+      )}
     </section>
   );
 }
diff --git a/gui/src/pages/integrations/RestoreDialog.tsx b/gui/src/pages/integrations/RestoreDialog.tsx
index 93352bf3c55..fea64673d7a 100644
--- a/gui/src/pages/integrations/RestoreDialog.tsx
+++ b/gui/src/pages/integrations/RestoreDialog.tsx
@@ -1,8 +1,22 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useT } from "../../i18n/shared";
 import { Notice } from "../../ui";
-import { describeRefusal, refusalOf } from "./refusal-copy";
-import { restoreIntegration, type IntegrationJournalRow } from "./integration-api";
+import { describeRefusal } from "./refusal-copy";
+import IntegrationPlanDetails from "./IntegrationPlanDetails";
+import {
+  bindingFor,
+  IntegrationApiError,
+  isIntegrationPreviewUnavailable,
+  previewIntegrationRestore,
+  restoreIntegration,
+  type IntegrationJournalRow,
+  type IntegrationMutationPlan,
+} from "./integration-api";
+
+interface BoundRestorePlan {
+  plan: IntegrationMutationPlan;
+  confirmDrift: boolean;
+}
 
 /**
  * Restore confirmation, including the drift second step.
@@ -38,9 +52,36 @@ export default function RestoreDialog({
   const restoreFocusRef = useRef<HTMLElement | null>(null);
   const restoreFallbackRef = useRef<HTMLElement | null>(null);
   const restoredRef = useRef(false);
-  const [drift, setDrift] = useState(false);
+  const onCloseRef = useRef(onClose);
+  const onRestoredRef = useRef(onRestored);
+  const onReconcileRef = useRef(onReconcile);
+  const tRef = useRef(t);
+  const previewAbortRef = useRef<AbortController | null>(null);
+  const previewGenerationRef = useRef(0);
+  const [boundPlan, setBoundPlan] = useState<BoundRestorePlan | null>(null);
+  const [previewPending, setPreviewPending] = useState(true);
+  const [stale, setStale] = useState(false);
   const [pending, setPending] = useState(false);
-  const [failure, setFailure] = useState<string | null>(null);
+  const [previewFailure, setPreviewFailure] = useState<string | null>(null);
+  const [mutationFailure, setMutationFailure] = useState<string | null>(null);
+  const scopedProfileId = row.clientId === "aside" ? profileId ?? row.profileId : undefined;
+  const plan = boundPlan?.plan ?? null;
+  const drift = plan?.foreignEdit === "drift";
+
+  useEffect(() => {
+    onCloseRef.current = onClose;
+    onRestoredRef.current = onRestored;
+    onReconcileRef.current = onReconcile;
+    tRef.current = t;
+  }, [onClose, onReconcile, onRestored, t]);
+
+  const dismiss = useCallback(() => {
+    if (pending) return;
+    previewGenerationRef.current += 1;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = null;
+    onCloseRef.current();
+  }, [pending]);
 
   useEffect(() => {
     const dialog = dialogRef.current;
@@ -86,33 +127,116 @@ export default function RestoreDialog({
     };
   }, []);
 
+  const loadPreview = useCallback(async () => {
+    const controller = new AbortController();
+    const generation = previewGenerationRef.current + 1;
+    previewGenerationRef.current = generation;
+    previewAbortRef.current?.abort();
+    previewAbortRef.current = controller;
+    setPreviewPending(true);
+    setPreviewFailure(null);
+    setMutationFailure(null);
+    setBoundPlan(null);
+    setStale(false);
+    try {
+      let confirmDrift = false;
+      let next = await previewIntegrationRestore(apiBase, row.opId, confirmDrift, controller.signal, scopedProfileId);
+      if (next.refusalReason === "drift_requires_confirm") {
+        confirmDrift = true;
+        next = await previewIntegrationRestore(apiBase, row.opId, confirmDrift, controller.signal, scopedProfileId);
+      }
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      setBoundPlan({ plan: next, confirmDrift });
+    } catch (error) {
+      if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+      if (isIntegrationPreviewUnavailable(error)) {
+        onReconcileRef.current?.();
+        onCloseRef.current();
+        return;
+      }
+      setPreviewFailure(tRef.current("integrations.preview.failed"));
+    } finally {
+      if (!controller.signal.aborted && generation === previewGenerationRef.current) {
+        previewAbortRef.current = null;
+        setPreviewPending(false);
+      }
+    }
+  }, [apiBase, row.opId, scopedProfileId]);
+
+  useEffect(() => {
+    const timeout = window.setTimeout(() => { void loadPreview(); }, 0);
+    return () => {
+      window.clearTimeout(timeout);
+      previewGenerationRef.current += 1;
+      previewAbortRef.current?.abort();
+      previewAbortRef.current = null;
+    };
+  }, [loadPreview]);
+
   const handleCancel = useCallback((event: React.SyntheticEvent) => {
     event.preventDefault();
-    if (!pending) onClose();
-  }, [onClose, pending]);
+    dismiss();
+  }, [dismiss]);
 
   const submit = async () => {
-    if (pending) return;
+    if (pending || previewPending || !boundPlan || !boundPlan.plan.canApply) return;
+    const attemptedConfirmDrift = boundPlan.confirmDrift;
     setPending(true);
-    setFailure(null);
+    setMutationFailure(null);
     try {
-      await restoreIntegration(apiBase, row.opId, drift, undefined, row.clientId === "aside" ? profileId ?? row.profileId : undefined);
+      await restoreIntegration(apiBase, {
+        opId: row.opId,
+        confirmDrift: attemptedConfirmDrift,
+        profileId: scopedProfileId,
+        binding: bindingFor(boundPlan.plan),
+      });
       restoredRef.current = true;
-      onRestored();
-      onClose();
+      onRestoredRef.current();
+      onCloseRef.current();
     } catch (error) {
       // Aside may have saved target intent before the writer refused. Reconcile
       // without closing the dialog or announcing a successful restore.
-      if (row.clientId === "aside") onReconcile?.();
-      if (refusalOf(error)?.reason === "drift_requires_confirm") {
-        // Not a failure: the user has not been asked yet. Ask now.
-        setDrift(true);
+      if (row.clientId === "aside") onReconcileRef.current?.();
+      if (error instanceof IntegrationApiError && error.stalePlan) {
+        let fresh = error.stalePlan;
+        let freshConfirmDrift = attemptedConfirmDrift;
         setPending(false);
+        try {
+          if (fresh.refusalReason === "drift_requires_confirm") {
+            const controller = new AbortController();
+            const generation = previewGenerationRef.current + 1;
+            previewGenerationRef.current = generation;
+            previewAbortRef.current?.abort();
+            previewAbortRef.current = controller;
+            setPreviewPending(true);
+            freshConfirmDrift = true;
+            try {
+              fresh = await previewIntegrationRestore(apiBase, row.opId, freshConfirmDrift, controller.signal, scopedProfileId);
+            } finally {
+              if (!controller.signal.aborted && generation === previewGenerationRef.current) {
+                previewAbortRef.current = null;
+                setPreviewPending(false);
+              }
+            }
+            if (controller.signal.aborted || generation !== previewGenerationRef.current) return;
+          }
+        } catch (previewError) {
+          if (previewError instanceof Error && previewError.name === "AbortError") return;
+          if (isIntegrationPreviewUnavailable(previewError)) {
+            onReconcileRef.current?.();
+            onCloseRef.current();
+            return;
+          }
+          setPreviewFailure(tRef.current("integrations.preview.failed"));
+          return;
+        }
+        setBoundPlan({ plan: fresh, confirmDrift: freshConfirmDrift });
+        setStale(true);
         return;
       }
       // Shared formatter so a residual write — compensation itself failed, the
       // file may be intermediate — is disclosed here too, not only its path.
-      setFailure(describeRefusal(t, error));
+      setMutationFailure(describeRefusal(t, error));
       setPending(false);
     }
   };
@@ -122,6 +246,7 @@ export default function RestoreDialog({
       ref={dialogRef}
       className="modal-overlay"
       aria-labelledby="integration-restore-title"
+      aria-busy={pending}
       onCancel={handleCancel}
     >
       <button
@@ -129,7 +254,7 @@ export default function RestoreDialog({
         className="modal-backdrop-dismiss"
         aria-label={t("common.close")}
         tabIndex={-1}
-        onClick={() => { if (!pending) onClose(); }}
+        onClick={dismiss}
       />
       <div className="modal-card integration-restore-dialog" role="document">
         <div className="modal-head">
@@ -140,13 +265,19 @@ export default function RestoreDialog({
         <div className="modal-desc">
           {drift ? t("integrations.restore.driftBody") : t("integrations.restore.body")}
         </div>
-        <p className="integration-path">{row.configPath}</p>
-        {failure && <Notice tone="err">{failure}</Notice>}
+        <div role="status" aria-live="polite" aria-atomic="true">
+          {previewPending && <p>{t("integrations.preview.loading")}</p>}
+          {pending && <p>{t("integrations.mutation.pending")}</p>}
+          {stale && <Notice tone="err">{t("integrations.preview.stale")}</Notice>}
+        </div>
+        <IntegrationPlanDetails plan={plan} />
+        {previewFailure && <Notice tone="err">{previewFailure}</Notice>}
+        {mutationFailure && <Notice tone="err">{mutationFailure}</Notice>}
         <div className="modal-actions">
-          <button type="button" className="btn btn-ghost" onClick={onClose} disabled={pending}>
+          <button type="button" className="btn btn-ghost" onClick={dismiss} disabled={pending}>
             {t("common.cancel")}
           </button>
-          <button type="button" className="btn btn-primary" onClick={() => void submit()} disabled={pending}>
+          <button type="button" className="btn btn-primary" onClick={() => void submit()} disabled={pending || previewPending || !plan?.canApply || Boolean(previewFailure)}>
             {pending
               ? t("integrations.restore.pending")
               : drift
diff --git a/gui/src/pages/integrations/integration-api.ts b/gui/src/pages/integrations/integration-api.ts
index ad50a781fd5..856a9b105d0 100644
--- a/gui/src/pages/integrations/integration-api.ts
+++ b/gui/src/pages/integrations/integration-api.ts
@@ -109,6 +109,50 @@ export type IntegrationRestoreResult = IntegrationMutationResult;
 /** Kept as the shared name consumed by the page surfaces. */
 export type IntegrationMutationEnvelope = IntegrationMutationResult;
 
+export type IntegrationPlanOperation = "apply" | "overwrite" | "disable" | "restore";
+export type IntegrationPlanChangeKind = "add" | "replace" | "remove" | "snapshot" | "ownership" | "journal";
+export type IntegrationPlanForeignEdit = "none" | "unowned" | "foreign-edit" | "drift";
+
+export interface IntegrationPlanChange {
+  kind: IntegrationPlanChangeKind;
+  path: string;
+}
+
+export interface IntegrationMutationPlan {
+  version: 1;
+  clientId: FileIntegrationClientId;
+  operation: IntegrationPlanOperation;
+  state: IntegrationState;
+  foreignEdit: IntegrationPlanForeignEdit;
+  changes: IntegrationPlanChange[];
+  fingerprint: string;
+  canApply: boolean;
+  willChange: boolean;
+  refusalReason?: IntegrationRefusalReason;
+  profileId?: number;
+}
+
+export interface IntegrationPlanBinding {
+  operation: IntegrationPlanOperation;
+  planFingerprint: string;
+}
+
+export interface ToggleIntegrationOptions {
+  enabled: boolean;
+  signal?: AbortSignal;
+  overwriteConflict?: boolean;
+  profileId?: number;
+  binding?: IntegrationPlanBinding;
+}
+
+export interface RestoreIntegrationOptions {
+  opId: string;
+  confirmDrift?: boolean;
+  signal?: AbortSignal;
+  profileId?: number;
+  binding: IntegrationPlanBinding;
+}
+
 export type IntegrationRefusalCode =
   | "integration_unsafe"
   | "integration_conflict"
@@ -140,6 +184,7 @@ export interface IntegrationErrorEnvelope {
   validClients?: readonly FileIntegrationClientId[];
   hint?: string;
   results?: AsideProfileOutcome[];
+  plan?: IntegrationMutationPlan;
 }
 
 export type IntegrationErrorBody = IntegrationErrorEnvelope | IntegrationRefusalEnvelope;
@@ -167,11 +212,94 @@ const INTEGRATION_STATES: ReadonlySet<string> = new Set<IntegrationState>([
   "conflict",
   "unsafe",
 ]);
+const PLAN_OPERATIONS: readonly IntegrationPlanOperation[] = ["apply", "overwrite", "disable", "restore"];
+const PLAN_CHANGE_KINDS: readonly IntegrationPlanChangeKind[] = ["add", "replace", "remove", "snapshot", "ownership", "journal"];
+const PLAN_FOREIGN_EDITS: readonly IntegrationPlanForeignEdit[] = ["none", "unowned", "foreign-edit", "drift"];
+const PLAN_KEYS = new Set(["version", "clientId", "operation", "state", "foreignEdit", "changes", "fingerprint", "canApply", "willChange", "refusalReason", "profileId"]);
+const PLAN_CHANGE_KEYS = new Set(["kind", "path"]);
+const PLAN_PSEUDO_PATHS = new Set(["$snapshot", "$ownership", "$journal"]);
+const PLAN_SCHEMA_PATHS = new Set([
+  "provider.opencodex",
+  "providers.opencodex",
+  "models.providers.opencodex",
+  "models.*",
+  "llm-pi-ai.providers.opencodex",
+  "custom_provider.opencodex",
+  "providers.[id=opencodex]",
+  "settings.providers.opencodex",
+  "catalog.providers.opencodex",
+]);
+const PLAN_CHANGE_LIMIT = 256;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+function hasOnlyKeys(value: Record<string, unknown>, allowed: ReadonlySet<string>): boolean {
+  return Object.keys(value).every(key => allowed.has(key));
+}
+
+function isSafePlanPath(path: string): boolean {
+  return PLAN_PSEUDO_PATHS.has(path) || PLAN_SCHEMA_PATHS.has(path);
+}
+
+function invalidPreviewResponse(): IntegrationApiError {
+  return new IntegrationApiError(502, { code: "invalid_integration_preview_response" });
+}
+
+export function parseIntegrationMutationPlan(value: unknown): IntegrationMutationPlan {
+  if (!isRecord(value) || !hasOnlyKeys(value, PLAN_KEYS)
+    || value.version !== 1
+    || !FILE_INTEGRATION_CLIENTS.includes(value.clientId as FileIntegrationClientId)
+    || !PLAN_OPERATIONS.includes(value.operation as IntegrationPlanOperation)
+    || !INTEGRATION_STATES.has(String(value.state))
+    || !PLAN_FOREIGN_EDITS.includes(value.foreignEdit as IntegrationPlanForeignEdit)
+    || typeof value.fingerprint !== "string" || !/^p1:(?:[0-9a-f]{32}|unbound)$/.test(value.fingerprint)
+    || typeof value.canApply !== "boolean" || typeof value.willChange !== "boolean"
+    || !Array.isArray(value.changes) || value.changes.length > PLAN_CHANGE_LIMIT
+    || (value.profileId !== undefined && (typeof value.profileId !== "number" || !Number.isSafeInteger(value.profileId) || value.profileId < 0))
+    || (value.profileId !== undefined && value.clientId !== "aside")
+    || (value.refusalReason !== undefined && !REFUSAL_REASONS.has(String(value.refusalReason)))) {
+    throw invalidPreviewResponse();
+  }
+  const changes: IntegrationPlanChange[] = [];
+  let previousOrder = -1;
+  let previousPath = "";
+  const seenByKind = new Map<IntegrationPlanChangeKind, Set<string>>();
+  for (const item of value.changes) {
+    if (!isRecord(item) || !hasOnlyKeys(item, PLAN_CHANGE_KEYS)
+      || !PLAN_CHANGE_KINDS.includes(item.kind as IntegrationPlanChangeKind)
+      || typeof item.path !== "string" || !isSafePlanPath(item.path)) throw invalidPreviewResponse();
+    const order = PLAN_CHANGE_KINDS.indexOf(item.kind as IntegrationPlanChangeKind);
+    if (order < previousOrder || (order === previousOrder && item.path <= previousPath)) throw invalidPreviewResponse();
+    const kind = item.kind as IntegrationPlanChangeKind;
+    const paths = seenByKind.get(kind) ?? new Set<string>();
+    if (paths.has(item.path)) throw invalidPreviewResponse();
+    paths.add(item.path);
+    seenByKind.set(kind, paths);
+    previousOrder = order;
+    previousPath = item.path;
+    changes.push({ kind, path: item.path });
+  }
+  if ((value.willChange && (!value.canApply || changes.length === 0))
+    || (!value.willChange && changes.length !== 0)
+    || (value.fingerprint === "p1:unbound" && value.canApply)
+    || (value.canApply === (value.refusalReason !== undefined))) throw invalidPreviewResponse();
+  return {
+    version: 1,
+    clientId: value.clientId as FileIntegrationClientId,
+    operation: value.operation as IntegrationPlanOperation,
+    state: value.state as IntegrationState,
+    foreignEdit: value.foreignEdit as IntegrationPlanForeignEdit,
+    changes,
+    fingerprint: value.fingerprint,
+    canApply: value.canApply,
+    willChange: value.willChange,
+    ...(value.refusalReason === undefined ? {} : { refusalReason: value.refusalReason as IntegrationRefusalReason }),
+    ...(value.profileId === undefined ? {} : { profileId: Number(value.profileId) }),
+  };
+}
+
 /** Writer refusals are identified by their canonical reason, never by state. */
 export function isIntegrationRefusalEnvelope(body: unknown): body is IntegrationRefusalEnvelope {
   if (!isRecord(body) || !REFUSAL_REASONS.has(String(body.reason))) return false;
@@ -186,6 +314,7 @@ export class IntegrationApiError extends Error {
   readonly refusal: IntegrationRefusalEnvelope | null;
   readonly status: number;
   readonly body: IntegrationErrorBody;
+  readonly stalePlan: IntegrationMutationPlan | null;
 
   // Parameter properties are erasable-syntax violations under the GUI's
   // stricter tsconfig, which the root typecheck does not enforce; the build
@@ -197,6 +326,7 @@ export class IntegrationApiError extends Error {
     this.status = status;
     this.body = body;
     this.refusal = refusal;
+    this.stalePlan = body.code === "integration_preview_stale" && "plan" in body && body.plan ? body.plan : null;
   }
 }
 
@@ -208,12 +338,17 @@ export function isMissingJournalEntry(error: unknown): boolean {
 }
 
 async function readErrorBody(response: Response): Promise<IntegrationErrorEnvelope> {
+  let body: unknown;
   try {
-    const body = await response.json() as unknown;
-    return isRecord(body) ? body as IntegrationErrorEnvelope : {};
+    body = await response.json() as unknown;
   } catch {
     return {};
   }
+  if (!isRecord(body)) return {};
+  if (body.code === "integration_preview_stale") {
+    return { code: body.code, plan: parseIntegrationMutationPlan(body.plan) };
+  }
+  return body as IntegrationErrorEnvelope;
 }
 
 async function readResponse<T>(response: Response): Promise<T> {
@@ -229,6 +364,14 @@ async function readResponse<T>(response: Response): Promise<T> {
 
 export { readResponse as readIntegrationResponse };
 
+export function isIntegrationPreviewUnavailable(error: unknown): boolean {
+  return error instanceof IntegrationApiError && error.body.code === "integration_preview_unavailable";
+}
+
+export function bindingFor(plan: IntegrationMutationPlan): IntegrationPlanBinding {
+  return { operation: plan.operation, planFingerprint: plan.fingerprint };
+}
+
 function profilePath(profileId: number): string {
   if (!Number.isSafeInteger(profileId) || profileId < 0) throw new IntegrationApiError(400, { code: "invalid_aside_profile" });
   return `/api/client-integrations/aside/profiles/${profileId}`;
@@ -282,26 +425,55 @@ export async function loadIntegrationJournal(
   return result;
 }
 
-export async function toggleIntegration(
+export async function previewIntegrationMutation(
   apiBase: string,
   client: FileIntegrationClientId,
-  enabled: boolean,
+  operation: Exclude<IntegrationPlanOperation, "restore">,
+  signal?: AbortSignal,
+  profileId?: number,
+) {
+  const path = profileId === undefined ? "/api/client-integrations/preview" : `${profilePath(profileId)}/preview`;
+  const requestBody = profileId === undefined ? { clientId: client, operation } : { operation };
+  const plan = parseIntegrationMutationPlan(await readResponse<unknown>(await fetch(`${apiBase}${path}`, {
+    method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(requestBody), signal,
+  })));
+  if (plan.clientId !== client || plan.operation !== operation || plan.profileId !== profileId) throw invalidPreviewResponse();
+  return plan;
+}
+
+export async function previewIntegrationRestore(
+  apiBase: string,
+  opId: string,
+  confirmDrift = false,
   signal?: AbortSignal,
-  /**
-   * Opt in to replacing a conflicted block. Deliberately last and optional: no
-   * existing call site can acquire it, and a caller has to name it.
-   */
-  overwriteConflict?: boolean,
   profileId?: number,
 ) {
-  const result = await readResponse<IntegrationToggleResult | { ok: false; message?: string; results?: unknown }>(
-    await fetch(`${apiBase}${clientPath(client, profileId)}`, {
+  const path = profileId === undefined ? "/api/client-integrations/restore/preview" : `${profilePath(profileId)}/preview`;
+  const body = profileId === undefined ? { opId, confirmDrift } : { operation: "restore", opId, confirmDrift };
+  const plan = parseIntegrationMutationPlan(await readResponse<unknown>(await fetch(`${apiBase}${path}`, {
+    method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body), signal,
+  })));
+  if (plan.operation !== "restore" || plan.profileId !== profileId) throw invalidPreviewResponse();
+  return plan;
+}
+
+export async function toggleIntegration(apiBase: string, client: FileIntegrationClientId, options: ToggleIntegrationOptions) {
+  const { enabled, signal, overwriteConflict, profileId, binding } = options;
+  const expectedOperation: IntegrationPlanOperation = enabled ? (overwriteConflict ? "overwrite" : "apply") : "disable";
+  let result: IntegrationToggleResult | { ok: false; message?: string; results?: unknown };
+  try {
+    result = await readResponse<IntegrationToggleResult | { ok: false; message?: string; results?: unknown }>(await fetch(`${apiBase}${clientPath(client, profileId)}`, {
       method: "PUT",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(overwriteConflict === true ? { enabled, overwriteConflict: true } : { enabled }),
+      body: JSON.stringify({ enabled, ...(overwriteConflict === true ? { overwriteConflict: true } : {}), ...binding }),
       signal,
-    }),
-  );
+    }));
+  } catch (error) {
+    if (error instanceof IntegrationApiError && error.stalePlan
+      && (error.stalePlan.clientId !== client || error.stalePlan.operation !== expectedOperation
+        || error.stalePlan.profileId !== profileId)) throw invalidPreviewResponse();
+    throw error;
+  }
   const outcomes = result.results === undefined ? undefined : parseAsideProfileOutcomes(result.results);
   if (client === "aside" && result.results !== undefined && (!outcomes
     || result.ok !== outcomes.every(row => row.ok))) {
@@ -317,19 +489,22 @@ export async function toggleIntegration(
 
 export async function restoreIntegration(
   apiBase: string,
-  opId: string,
-  confirmDrift = false,
-  signal?: AbortSignal,
-  profileId?: number,
+  options: RestoreIntegrationOptions,
 ) {
-  const result = await readResponse<IntegrationRestoreResult>(
-    await fetch(`${apiBase}${profileId === undefined ? "/api/client-integrations/restore" : `${profilePath(profileId)}/restore`}`, {
+  const { opId, confirmDrift = false, signal, profileId, binding } = options;
+  let result: IntegrationRestoreResult;
+  try {
+    result = await readResponse<IntegrationRestoreResult>(await fetch(`${apiBase}${profileId === undefined ? "/api/client-integrations/restore" : `${profilePath(profileId)}/restore`}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ opId, confirmDrift }),
+      body: JSON.stringify({ opId, confirmDrift, ...binding }),
       signal,
-    }),
-  );
+    }));
+  } catch (error) {
+    if (error instanceof IntegrationApiError && error.stalePlan
+      && (error.stalePlan.operation !== "restore" || error.stalePlan.profileId !== profileId)) throw invalidPreviewResponse();
+    throw error;
+  }
   if (profileId !== undefined && result.profileId !== profileId) throw new IntegrationApiError(502, { code: "invalid_aside_profile_response" });
   return result;
 }
diff --git a/gui/src/styles-integrations.css b/gui/src/styles-integrations.css
index dbd7a7ebccc..d68ee0494a6 100644
--- a/gui/src/styles-integrations.css
+++ b/gui/src/styles-integrations.css
@@ -158,6 +158,14 @@
 .integration-consequence-body { display: flex; flex-direction: column; gap: 12px; }
 .integration-consequence-body p { margin: 0; font-size: var(--text-caption); line-height: var(--leading-body); }
 .integration-consequence-body code { font-family: var(--font-code); font-size: inherit; overflow-wrap: anywhere; }
+.integration-plan { margin-top: 14px; }
+.integration-plan h4, .integration-plan h5 { margin: 0 0 8px; }
+.integration-plan-group + .integration-plan-group { margin-top: 14px; }
+.integration-plan-details { display: flex; flex-direction: column; gap: 8px; }
+.integration-plan-details p { margin: 0; }
+.integration-plan-changes { margin: 0; padding-inline-start: 20px; }
+.integration-plan-changes li { margin: 4px 0; }
+.integration-plan-changes code { font-family: var(--font-code); overflow-wrap: anywhere; }
 
 /* The Claude Code connection switch, relocated out of the sidebar. */
 .claudecode-connection-head { display: flex; align-items: center; gap: 10px; padding: 10px 0; }
diff --git a/gui/tests/aside-profiles-page.test.tsx b/gui/tests/aside-profiles-page.test.tsx
index 22c47fd582a..6cc36fd2ff2 100644
--- a/gui/tests/aside-profiles-page.test.tsx
+++ b/gui/tests/aside-profiles-page.test.tsx
@@ -85,6 +85,21 @@ beforeEach(() => {
       body: init?.body ? JSON.parse(String(init.body)) : undefined,
     };
     requests.push(request);
+    const preview = url.pathname.match(/^\/api\/client-integrations\/aside\/profiles\/(\d+)\/preview$/);
+    if (preview) {
+      const body = request.body as { operation?: string } | undefined;
+      const operation = body?.operation ?? "apply";
+      return json({
+        version: 1, clientId: "aside", profileId: Number(preview[1]), operation,
+        state: operation === "apply" ? "absent" : "current", foreignEdit: "none",
+        changes: [
+          { kind: operation === "disable" ? "remove" : "replace", path: "providers.opencodex" },
+          { kind: "snapshot", path: "$snapshot" }, { kind: "ownership", path: "$ownership" },
+          { kind: "journal", path: "$journal" },
+        ],
+        fingerprint: `p1:${String(preview[1]).padStart(32, "0")}`, canApply: true, willChange: true,
+      });
+    }
     if (request.method !== "GET") return mutationResponse(request);
     if (url.pathname === profilesPath) return listResponse();
     const scoped = url.pathname.match(/^\/api\/client-integrations\/aside\/profiles\/(\d+)(\/journal)?$/);
@@ -162,7 +177,7 @@ function listReads(): number {
 }
 
 function writes(): RequestRecord[] {
-  return requests.filter(request => request.method !== "GET");
+  return requests.filter(request => request.method !== "GET" && !request.path.endsWith("/preview"));
 }
 
 test("three profiles show desired switches, actual badges, current marker and a mixed global switch", async () => {
@@ -198,8 +213,12 @@ test("an individual toggle uses its exact profile path and body and keeps siblin
     return json(success(0));
   };
   await click("Sync Work");
+  await waitFor(() => Boolean(findButton("Disable")));
+  await click("Disable", container.querySelector("dialog[open]")!);
   await waitFor(() => button("Sync Work").getAttribute("aria-pressed") === "false");
-  expect(writes()).toEqual([{ path: `${profilesPath}/0`, method: "PUT", body: { enabled: false } }]);
+  expect(writes()).toEqual([{ path: `${profilesPath}/0`, method: "PUT", body: {
+    enabled: false, operation: "disable", planFingerprint: `p1:${"0".repeat(32)}`,
+  } }]);
   expect(button("Sync Personal").getAttribute("aria-pressed")).toBe("false");
   expect(button("Sync Profile 7").getAttribute("aria-pressed")).toBe("true");
 });
@@ -233,10 +252,14 @@ test("a refused individual update refetches saved off intent while showing the a
   };
   const before = listReads();
   await click("Sync Work");
+  await waitFor(() => Boolean(findButton("Disable")));
+  await click("Disable", container.querySelector("dialog[open]")!);
   await waitFor(() => listReads() > before && button("Sync Work").getAttribute("aria-pressed") === "false");
   expect(container.textContent).toContain("2 of 3 profiles applied");
   expect(container.textContent).toContain("Sync choice saved; file update pending.");
-  expect(writes()).toEqual([{ path: `${profilesPath}/0`, method: "PUT", body: { enabled: false } }]);
+  expect(writes()).toEqual([{ path: `${profilesPath}/0`, method: "PUT", body: {
+    enabled: false, operation: "disable", planFingerprint: `p1:${"0".repeat(32)}`,
+  } }]);
 });
 
 test("Sync now uses server-selected synchronization and preserves a profile that is off", async () => {
@@ -286,11 +309,21 @@ test("details keep state, journal and restore scoped to the selected profile, th
   expect(container.textContent).toContain("/tmp/aside-fixture/u/2/models.json");
   expect(container.textContent).not.toContain("/tmp/aside-fixture/u/0/models.json");
   await click("Undo");
-  await waitFor(() => Boolean(container.querySelector("dialog[open]")));
-  await click("Restore", container.querySelector("dialog[open]")!);
+  await waitFor(() => {
+    const dialog = container.querySelector("dialog[open]");
+    const restore = dialog ? findButton("Restore", dialog) : undefined;
+    return Boolean(restore && !restore.disabled);
+  });
+  const readyDialog = container.querySelector("dialog[open]")!;
+  await click("Restore", readyDialog);
+  const restorePosts = requests.filter(request => request.path === `${profilesPath}/2/restore` && request.method === "POST");
+  expect(restorePosts).toEqual([{ path: `${profilesPath}/2/restore`, method: "POST",
+    body: { opId: "aside-profile-2-op", confirmDrift: false, operation: "restore",
+      planFingerprint: `p1:${"2".padStart(32, "0")}` } }]);
   await waitFor(() => !container.querySelector("dialog[open]"));
   expect(writes()).toEqual([{ path: `${profilesPath}/2/restore`, method: "POST",
-    body: { opId: "aside-profile-2-op", confirmDrift: false } }]);
+    body: { opId: "aside-profile-2-op", confirmDrift: false, operation: "restore",
+      planFingerprint: `p1:${"2".padStart(32, "0")}` } }]);
   await click("All Aside profiles");
   await waitFor(() => Boolean(findButton("Sync Work")));
   expect(button("Sync Personal").getAttribute("aria-pressed")).toBe("false");
@@ -372,15 +405,25 @@ test("a failed Aside restore keeps the error dialog open but refetches persisted
       residual: true }, 500);
   };
   await click("Undo");
-  await waitFor(() => Boolean(container.querySelector("dialog[open]")));
-  await click("Restore", container.querySelector("dialog[open]")!);
+  await waitFor(() => {
+    const dialog = container.querySelector("dialog[open]");
+    const restore = dialog ? findButton("Restore", dialog) : undefined;
+    return Boolean(restore && !restore.disabled);
+  });
+  const readyDialog = container.querySelector("dialog[open]")!;
+  await click("Restore", readyDialog);
+  const restorePosts = requests.filter(request => request.path === `${profilesPath}/2/restore` && request.method === "POST");
+  expect(restorePosts).toEqual([{ path: `${profilesPath}/2/restore`, method: "POST",
+    body: { opId: "aside-profile-2-failed-restore", confirmDrift: false, operation: "restore",
+      planFingerprint: `p1:${"2".padStart(32, "0")}` } }]);
   await waitFor(() => container.querySelector("dialog[open]")?.textContent?.includes("Personal restore could not finish") === true);
   await waitFor(() => stateReads() > before && findButton("Disable")?.getAttribute("aria-pressed") === "true");
   const dialog = container.querySelector("dialog[open]")!;
   expect(dialog.textContent).toContain("Automatic recovery did not finish. Check the client configuration before retrying.");
   expect(button("Restore", dialog).disabled).toBe(false);
   expect(writes()).toEqual([{ path: `${profilesPath}/2/restore`, method: "POST",
-    body: { opId: "aside-profile-2-failed-restore", confirmDrift: false } }]);
+    body: { opId: "aside-profile-2-failed-restore", confirmDrift: false, operation: "restore",
+      planFingerprint: `p1:${"2".padStart(32, "0")}` } }]);
   await click("Cancel", dialog);
   await waitFor(() => !container.querySelector("dialog[open]"));
   expect(button("Disable").getAttribute("aria-pressed")).toBe("true");
diff --git a/gui/tests/claude-desktop-vertical.test.tsx b/gui/tests/claude-desktop-vertical.test.tsx
index 6dc43b5872a..10241ab8e5c 100644
--- a/gui/tests/claude-desktop-vertical.test.tsx
+++ b/gui/tests/claude-desktop-vertical.test.tsx
@@ -61,7 +61,7 @@ beforeEach(() => {
     configurable: true,
     value: async (url: string) => {
       const body = String(url).includes("/status")
-        ? { applied: true, appliedAt: null, stale: false, health: { lastRequestAt: null, requestCount: 0, errorCount: 0 } }
+        ? { desiredEnabled: true, applied: true, appliedAt: null, stale: false, health: { lastRequestAt: null, requestCount: 0, errorCount: 0 } }
         : payload();
       return { ok: true, status: 200, json: async () => body, text: async () => JSON.stringify(body) } as unknown as Response;
     },
@@ -205,3 +205,25 @@ test("a stored preference wins over the load-time default", async () => {
   expect(familyToggle("Opus").getAttribute("aria-expanded")).toBe("false");
   expect(familyToggle("Fable").getAttribute("aria-expanded")).toBe("true");
 });
+
+test("a malformed status payload shows the failure state instead of crashing", async () => {
+  /*
+   * The status poll used to trust any JSON: an error-shaped OK body missing
+   * health would be cached and rendered, then status.health.requestCount
+   * threw inside the page. The guard rejects it, so the resource records a
+   * cold failure and the existing failure presentation shows.
+   */
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async (url: string) => {
+      const body = String(url).includes("/status")
+        ? { error: "malformed" }
+        : payload();
+      return { ok: true, status: 200, json: async () => body, text: async () => JSON.stringify(body) } as unknown as Response;
+    },
+  });
+
+  await mount();
+
+  expect(container.textContent ?? "").toContain("Failed to load Claude Desktop profile.");
+});
diff --git a/gui/tests/codex-set-prompt-layers.test.tsx b/gui/tests/codex-set-prompt-layers.test.tsx
index 3d654b16aa0..42963d353c0 100644
--- a/gui/tests/codex-set-prompt-layers.test.tsx
+++ b/gui/tests/codex-set-prompt-layers.test.tsx
@@ -258,6 +258,26 @@ test("9. the dialog names WHY text is missing rather than omitting it silently",
   await act(async () => { root.unmount(); });
 });
 
+test("9b. an unmapped layer does not receive the base-prompt explanation", async () => {
+  // A probe that succeeded but has no confirmed tag for a layer is neither
+  // "unavailable" nor the base prompt's "not-exposed": the not-exposed copy
+  // names the base prompt and model_instructions_file, which would mislead an
+  // operator reading it for an unrelated layer.
+  stubRoutes(call => call.url.endsWith("/api/codex-prompt/text")
+    ? json({ ok: true, layers: { personality: { text: null, reason: "unmapped", bytes: 0 } } })
+    : json(snapshot()));
+  const { container, root } = await mount();
+  await act(async () => {
+    (row(container, "personality")!.querySelector("button") as HTMLButtonElement).click();
+  });
+  const dialog = document.querySelector("dialog.modal-overlay")!;
+  const notice = dialog.querySelector(".codex-set-layer-dialog__no-text")!;
+  expect(notice.textContent).toContain("no confirmed mapping");
+  expect(notice.textContent).not.toContain("base prompt");
+  expect(notice.textContent).not.toContain("model_instructions_file");
+  await act(async () => { root.unmount(); });
+});
+
 test("the prompt-text request is aborted when the panel unmounts", async () => {
   let textSignal: AbortSignal | null = null;
   globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
diff --git a/gui/tests/compaction-routing-panel.test.tsx b/gui/tests/compaction-routing-panel.test.tsx
new file mode 100644
index 00000000000..9e698c02bb6
--- /dev/null
+++ b/gui/tests/compaction-routing-panel.test.tsx
@@ -0,0 +1,154 @@
+/** @jsxImportSource react */
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act, StrictMode } from "react";
+import type { Root } from "react-dom/client";
+import { LanguageProvider } from "../src/i18n/provider";
+import CompactionRoutingPanel from "../src/components/CompactionRoutingPanel";
+
+const globals = ["document", "window", "navigator", "localStorage", "sessionStorage", "fetch", "HTMLElement", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previous: Record<string, PropertyDescriptor | undefined>;
+let win: Window;
+let root: Root | undefined;
+let container: HTMLDivElement;
+let setting: { model: string; reasoningEffort?: string; triggers?: string[] } | null;
+let failLoad: boolean;
+let failSave: boolean;
+let writes: unknown[];
+const models = [{ id: "cheap", provider: "gateway", namespaced: "gateway/cheap" }, { id: "compact", provider: "combo", namespaced: "combo/compact" }];
+
+beforeEach(() => {
+  previous = Object.fromEntries(globals.map(key => [key, Object.getOwnPropertyDescriptor(globalThis, key)]));
+  win = new Window({ url: "http://localhost/" });
+  for (const key of ["document", "window", "navigator", "localStorage", "sessionStorage", "HTMLElement"] as const) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: key === "window" ? win : win[key] });
+  }
+  Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", { configurable: true, value: true });
+  win.localStorage.setItem("ocx-lang", "en");
+  setting = null; failLoad = false; failSave = false; writes = [];
+  Object.defineProperty(globalThis, "fetch", { configurable: true, writable: true, value: async (_input: unknown, init?: RequestInit) => {
+    if (String(_input).endsWith("/api/combos")) {
+      return Response.json({ combos: [{ id: "compact", model: "combo/compact", targets: [{ provider: "gateway", model: "a" }, { provider: "openai-apikey", model: "b" }, { provider: "gateway", model: "c" }] }] });
+    }
+    if (init?.method === "PUT") {
+      const body = JSON.parse(String(init.body));
+      writes.push(body);
+      if (failSave) return Response.json({ error: "fixture failure" }, { status: 500 });
+      setting = body.compactionRouting;
+    } else if (failLoad) return Response.json({ error: "unavailable" }, { status: 503 });
+    return Response.json({ compactionRouting: setting });
+  } });
+});
+
+afterEach(async () => {
+  if (root) await act(async () => { root!.unmount(); });
+  root = undefined; win.close();
+  for (const key of globals) {
+    if (previous[key]) Object.defineProperty(globalThis, key, previous[key]!);
+    else delete (globalThis as Record<string, unknown>)[key];
+  }
+});
+
+async function flush() { await act(async () => { await new Promise(resolve => setTimeout(resolve, 10)); }); }
+async function render(base = "") {
+  if (!root) {
+    container = win.document.createElement("div") as unknown as HTMLDivElement;
+    win.document.body.appendChild(container);
+    root = (await import("react-dom/client")).createRoot(container);
+  }
+  await act(async () => { root!.render(<StrictMode><LanguageProvider><CompactionRoutingPanel apiBase={base} models={models} /></LanguageProvider></StrictMode>); });
+  await flush();
+}
+async function choose(id: string, label: string) {
+  await act(async () => { container.querySelector<HTMLButtonElement>(`#compaction-routing-${id}`)!.click(); });
+  const option = [...win.document.querySelectorAll('[role="option"]')].find(node => node.textContent === label);
+  expect(option).toBeDefined();
+  await act(async () => { (option as unknown as HTMLButtonElement).click(); });
+}
+function saveButton() { return [...container.querySelectorAll<HTMLButtonElement>('button')].find(button => button.textContent === "Save")!; }
+async function save() { await act(async () => { saveButton().click(); }); }
+
+test("saves model and optional effort, reloads, removes effort, and clears override", async () => {
+  await render();
+  expect(saveButton().disabled).toBe(true);
+  await choose("model", "gateway/cheap");
+  await choose("effort", "Low");
+  await save();
+  expect(writes).toEqual([{ compactionRouting: { model: "gateway/cheap", reasoningEffort: "low" } }]);
+  expect(container.querySelector('[role="status"]')?.textContent).toBe("Compaction settings saved.");
+  await render("/reloaded");
+  expect(container.querySelector('#compaction-routing-effort')?.textContent).toContain("Low");
+  await choose("effort", "Keep request effort");
+  await save();
+  expect(writes.at(-1)).toEqual({ compactionRouting: { model: "gateway/cheap" } });
+  await choose("model", "Use conversation model");
+  await save();
+  expect(writes.at(-1)).toEqual({ compactionRouting: null });
+  expect(container.querySelector<HTMLButtonElement>('#compaction-routing-effort')!.disabled).toBe(true);
+});
+
+test("the trigger selection round-trips and discloses automatic compaction", async () => {
+  await render();
+  await choose("model", "gateway/cheap");
+  expect(container.querySelector('#compaction-routing-triggers')?.textContent).toContain("Manual /compact only");
+  expect(container.textContent).not.toContain("Automatic compaction runs on its own");
+  await choose("triggers", "Manual and automatic");
+  await save();
+  expect(writes.at(-1)).toEqual({ compactionRouting: { model: "gateway/cheap", triggers: ["manual", "auto"] } });
+  expect(container.textContent).toContain("Automatic compaction runs on its own");
+  await render("/reloaded");
+  expect(container.querySelector('#compaction-routing-triggers')?.textContent).toContain("Manual and automatic");
+  await choose("triggers", "Automatic only");
+  await save();
+  expect(writes.at(-1)).toEqual({ compactionRouting: { model: "gateway/cheap", triggers: ["auto"] } });
+  // Manual-only is sent as an omitted `triggers`, so the default save keeps the payload the
+  // manual-only override already used.
+  await choose("triggers", "Manual /compact only");
+  await save();
+  expect(writes.at(-1)).toEqual({ compactionRouting: { model: "gateway/cheap" } });
+  await choose("model", "Use conversation model");
+  expect(container.querySelector<HTMLButtonElement>('#compaction-routing-triggers')!.disabled).toBe(true);
+});
+
+test("failed save retains the draft and allows retry", async () => {
+  await render();
+  await choose("model", "gateway/cheap");
+  failSave = true;
+  await save();
+  expect(container.querySelector('[role="alert"]')?.textContent).toContain("Could not save");
+  expect(container.querySelector('#compaction-routing-model')?.textContent).toContain("gateway/cheap");
+  expect(saveButton().disabled).toBe(false);
+  expect(setting).toBeNull();
+  failSave = false;
+  await save();
+  expect(setting).toEqual({ model: "gateway/cheap" });
+});
+
+test("failed load disables editing and retry recovers", async () => {
+  failLoad = true;
+  await render();
+  expect(container.querySelector('[role="alert"]')?.textContent).toContain("Could not load");
+  expect(container.querySelector<HTMLButtonElement>('#compaction-routing-model')!.disabled).toBe(true);
+  failLoad = false;
+  await act(async () => { [...container.querySelectorAll<HTMLButtonElement>('button')].find(button => button.textContent === "Retry")!.click(); });
+  expect(container.querySelector<HTMLButtonElement>('#compaction-routing-model')!.disabled).toBe(false);
+});
+
+test("retains a saved model missing from the current catalog", async () => {
+  setting = { model: "gateway/retired", reasoningEffort: "high" };
+  await render();
+  expect(container.querySelector('#compaction-routing-model')?.textContent).toContain("gateway/retired");
+  expect(saveButton().disabled).toBe(true);
+});
+
+test("discloses that the selected provider receives the full conversation", async () => {
+  await render();
+  expect(container.textContent).toContain("sends the entire conversation to the selected model's provider");
+  expect(container.querySelector('[role="note"]')).toBeNull();
+  await choose("model", "gateway/cheap");
+  expect(container.querySelector('[role="note"]')?.textContent).toContain("sends the full conversation contents to gateway for summarization");
+  await choose("model", "combo/compact");
+  expect(container.querySelector('[role="note"]')?.textContent).toContain("every target of combo combo/compact (gateway, openai-apikey), including failover targets");
+  await choose("model", "Use conversation model");
+  expect(container.querySelector('[role="note"]')).toBeNull();
+});
diff --git a/gui/tests/fr-localization.test.ts b/gui/tests/fr-localization.test.ts
index 689a1b8672c..5c5d8aa73d8 100644
--- a/gui/tests/fr-localization.test.ts
+++ b/gui/tests/fr-localization.test.ts
@@ -134,6 +134,7 @@ const INTENTIONAL_ENGLISH = new Set<TKey>([
   "api.clientConfig.clientCline",
   "models.reasoningEffort.minimal",
   "models.reasoningEffort.max",
+  "models.reasoningEffort.ultra",
   "pws.pacingRpmUnit",
   "claudeDesktop.family.opus",
   "claudeDesktop.family.fable",
diff --git a/gui/tests/grok-reset-coupons.test.tsx b/gui/tests/grok-reset-coupons.test.tsx
index 606c1840813..e8f10cff324 100644
--- a/gui/tests/grok-reset-coupons.test.tsx
+++ b/gui/tests/grok-reset-coupons.test.tsx
@@ -2,8 +2,9 @@
  * The Grok reset-coupon surface on xAI account rows.
  *
  * These cases exist because the dangerous paths here are the quiet ones: a
- * replayed *failure* arrives as HTTP 200, an aborted redemption may still be
- * executing upstream, and a per-row retry used to cancel every sibling read.
+ * replayed *failure* arrives as HTTP 200, a rejected redemption request may
+ * still be executing upstream, and a per-row retry used to cancel every sibling
+ * read.
  */
 import { afterEach, beforeEach, expect, test } from "bun:test";
 import { Window } from "happy-dom";
@@ -262,9 +263,9 @@ test("ledger capacity gets its own retryable message", async () => {
   expect(dialogText(host)).toContain("journal is full");
 });
 
-test("an aborted redemption stops posting, re-reads the account, and offers no retry", async () => {
+test("a transport-rejected redemption stops posting, re-reads the account, and offers no retry", async () => {
   harness.coupons.set("acct-a", [COUPON("restok_a1", 10)]);
-  harness.consumeReply = async () => { throw Object.assign(new Error("aborted"), { name: "AbortError" }); };
+  harness.consumeReply = async () => { throw new TypeError("connection reset after request dispatch"); };
   const host = await mountPanel([ACCOUNT("acct-a")]);
 
   await openDialog(host);
diff --git a/gui/tests/integration-preview-confirmations.test.tsx b/gui/tests/integration-preview-confirmations.test.tsx
new file mode 100644
index 00000000000..f03a46ef818
--- /dev/null
+++ b/gui/tests/integration-preview-confirmations.test.tsx
@@ -0,0 +1,330 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act, useState } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { LanguageProvider } from "../src/i18n/provider";
+import ConsequenceDialog from "../src/pages/integrations/ConsequenceDialog";
+import IntegrationPlanDetails from "../src/pages/integrations/IntegrationPlanDetails";
+import RestoreDialog from "../src/pages/integrations/RestoreDialog";
+import { bindingFor, IntegrationApiError, type IntegrationMutationPlan, type IntegrationPlanBinding } from "../src/pages/integrations/integration-api";
+
+const copy = {
+  titleKey: "integrations.dialog.apply.title" as const,
+  changesKey: "integrations.dialog.apply.changes" as const,
+  breakageKey: "integrations.dialog.apply.breakage" as const,
+  undoKey: "integrations.dialog.apply.undo" as const,
+  confirmKey: "integrations.dialog.apply.confirm" as const,
+};
+
+function plan(fingerprint: string, path = "providers.opencodex"): IntegrationMutationPlan {
+  return {
+    version: 1,
+    clientId: "hermes",
+    operation: "apply",
+    state: "absent",
+    foreignEdit: "none",
+    changes: [
+      { kind: "add", path },
+      { kind: "snapshot", path: "$snapshot" },
+      { kind: "ownership", path: "$ownership" },
+      { kind: "journal", path: "$journal" },
+    ],
+    fingerprint,
+    canApply: true,
+    willChange: true,
+  };
+}
+
+let windowValue: Window;
+let container: HTMLElement;
+let root: Root | null;
+const previous = new Map<string, unknown>();
+
+beforeEach(() => {
+  windowValue = new Window({ url: "http://localhost/#integrations" });
+  container = windowValue.document.createElement("div") as unknown as HTMLElement;
+  windowValue.document.body.appendChild(container as unknown as Node);
+  for (const key of ["window", "document", "navigator", "localStorage", "sessionStorage", "fetch"] as const) {
+    previous.set(key, Reflect.get(globalThis, key));
+    Object.defineProperty(globalThis, key, { configurable: true, value: Reflect.get(windowValue, key) });
+  }
+  previous.set("IS_REACT_ACT_ENVIRONMENT", Reflect.get(globalThis, "IS_REACT_ACT_ENVIRONMENT"));
+  Object.defineProperty(globalThis, "IS_REACT_ACT_ENVIRONMENT", { configurable: true, value: true });
+  root = createRoot(container);
+});
+
+async function waitFor(predicate: () => boolean): Promise<void> {
+  const deadline = Date.now() + 1500;
+  while (!predicate()) {
+    if (Date.now() >= deadline) throw new Error(`State did not settle: ${container.textContent}`);
+    await act(async () => { await new Promise<void>(resolve => windowValue.setTimeout(resolve, 0)); });
+  }
+}
+
+afterEach(async () => {
+  if (root) await act(async () => { root?.unmount(); root = null; });
+  for (const [key, value] of previous) Object.defineProperty(globalThis, key, { configurable: true, value });
+  previous.clear();
+});
+
+test("plan details render a semantic safe-path list without surrounding private values", async () => {
+  const privateCanary = "secret-model-account-value";
+  await act(async () => {
+    root?.render(<LanguageProvider><IntegrationPlanDetails plan={plan("p1:11111111111111111111111111111111")} /></LanguageProvider>);
+  });
+  const list = container.querySelector("ul.integration-plan-changes");
+  expect(list).not.toBeNull();
+  expect(list?.querySelector("code")?.textContent).toBe("providers.opencodex");
+  expect(container.textContent).not.toContain(privateCanary);
+});
+
+test("a profile no-op explains document scope and still confirms its fingerprint", async () => {
+  const noOpPlan: IntegrationMutationPlan = {
+    ...plan("p1:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
+    clientId: "aside",
+    profileId: 2,
+    operation: "disable",
+    state: "absent",
+    changes: [],
+    willChange: false,
+  };
+  let confirmed: IntegrationPlanBinding | null = null;
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <ConsequenceDialog
+          copy={{
+            titleKey: "integrations.dialog.disable.title",
+            changesKey: "integrations.dialog.disable.changes",
+            breakageKey: "integrations.dialog.disable.breakage",
+            undoKey: "integrations.dialog.disable.undo",
+            confirmKey: "integrations.dialog.disable.confirm",
+          }}
+          plan={noOpPlan}
+          onClose={() => {}}
+          onConfirm={candidate => { if (candidate) confirmed = bindingFor(candidate); }}
+        />
+      </LanguageProvider>,
+    );
+  });
+  expect(container.textContent).toContain("No changes to the managed client document are needed");
+  expect(container.textContent).toContain("The profile sync preference will still be saved");
+  expect(container.textContent).not.toContain("A backup is saved first");
+  const confirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Disable") as HTMLButtonElement;
+  await act(async () => { confirm.click(); });
+  expect(confirmed).toEqual({ operation: "disable", planFingerprint: noOpPlan.fingerprint });
+});
+
+test("a stale confirmation replaces the plan and requires a second explicit press", async () => {
+  const original = plan("p1:11111111111111111111111111111111");
+  const fresh = plan("p1:22222222222222222222222222222222", "providers.opencodex");
+  const confirmed: string[] = [];
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <ConsequenceDialog
+          copy={copy}
+          plan={original}
+          onClose={() => {}}
+          onConfirm={candidate => {
+            if (!candidate) return;
+            confirmed.push(candidate.fingerprint);
+            if (confirmed.length === 1) throw new IntegrationApiError(409, { code: "integration_preview_stale", plan: fresh });
+          }}
+        />
+      </LanguageProvider>,
+    );
+  });
+  expect(container.textContent).toContain("A backup is saved first");
+  const confirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Apply") as HTMLButtonElement;
+  await act(async () => { confirm.click(); });
+  expect(confirmed).toEqual([original.fingerprint]);
+  expect(container.textContent).toContain("Review the updated plan");
+  expect(confirmed).toHaveLength(1);
+  await act(async () => { confirm.click(); });
+  expect(confirmed).toEqual([original.fingerprint, fresh.fingerprint]);
+});
+
+test("preview loading and failure keep confirmation disabled", async () => {
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <ConsequenceDialog
+          copy={copy}
+          planLoading
+          planFailure="The change plan could not be loaded. Nothing was changed."
+          onClose={() => {}}
+          onConfirm={() => { throw new Error("unreachable"); }}
+        />
+      </LanguageProvider>,
+    );
+  });
+  const confirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Apply") as HTMLButtonElement;
+  expect(confirm.disabled).toBe(true);
+});
+
+test("a pending mutation marks and announces the busy dialog", async () => {
+  let finish: (() => void) | undefined;
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <ConsequenceDialog
+          copy={copy}
+          plan={plan("p1:44444444444444444444444444444444")}
+          onClose={() => {}}
+          onConfirm={() => new Promise<void>(resolve => { finish = resolve; })}
+        />
+      </LanguageProvider>,
+    );
+  });
+  const confirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Apply") as HTMLButtonElement;
+  await act(async () => { confirm.click(); });
+  expect(container.querySelector("dialog")?.getAttribute("aria-busy")).toBe("true");
+  expect(container.textContent).toContain("Applying the confirmed change");
+  await act(async () => { finish?.(); });
+});
+
+test("keyboard cancel closes an idle dialog and restores its trigger", async () => {
+  const trigger = windowValue.document.createElement("button") as unknown as HTMLButtonElement;
+  windowValue.document.body.insertBefore(trigger as unknown as Node, container as unknown as Node);
+  trigger.focus();
+  let closed = 0;
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <ConsequenceDialog copy={copy} plan={plan("p1:33333333333333333333333333333333")} onClose={() => { closed += 1; }} onConfirm={() => {}} />
+      </LanguageProvider>,
+    );
+  });
+  const dialog = container.querySelector("dialog")!;
+  await act(async () => { dialog.dispatchEvent(new windowValue.Event("cancel", { cancelable: true })); });
+  expect(closed).toBe(1);
+  await act(async () => { root?.unmount(); root = null; });
+  expect(windowValue.document.activeElement).toBe(trigger);
+});
+
+test("restore retains confirmDrift when stale drift becomes non-drift", async () => {
+  const requests: Array<{ url: string; body: Record<string, unknown> }> = [];
+  let mutations = 0;
+  const restorePlan = (
+    fingerprint: string,
+    foreignEdit: "none" | "drift",
+    allowed = true,
+  ): IntegrationMutationPlan => ({
+    ...plan(fingerprint),
+    operation: "restore",
+    state: "current",
+    foreignEdit,
+    changes: allowed ? [
+      { kind: "replace", path: "providers.opencodex" },
+      { kind: "snapshot", path: "$snapshot" },
+      { kind: "ownership", path: "$ownership" },
+      { kind: "journal", path: "$journal" },
+    ] : [],
+    canApply: allowed,
+    willChange: allowed,
+    ...(allowed ? {} : { refusalReason: "drift_requires_confirm" as const }),
+  });
+  const mockFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input instanceof Request ? input.url : input);
+    const body = init?.body ? JSON.parse(String(init.body)) as Record<string, unknown> : {};
+    requests.push({ url, body });
+    if (url.endsWith("/restore/preview")) {
+      return Response.json(body.confirmDrift === true
+        ? restorePlan(`p1:${"7".repeat(32)}`, "drift")
+        : restorePlan(`p1:${"6".repeat(32)}`, "drift", false));
+    }
+    mutations += 1;
+    if (mutations === 1) {
+      return Response.json({
+        code: "integration_preview_stale",
+        plan: restorePlan(`p1:${"8".repeat(32)}`, "none"),
+      }, { status: 409 });
+    }
+    return Response.json({ ok: true, clientId: "hermes", changed: true, state: "current", message: "restored" });
+  }) as typeof fetch;
+  Object.defineProperty(globalThis, "fetch", { configurable: true, value: mockFetch });
+  Object.defineProperty(windowValue, "fetch", { configurable: true, value: mockFetch });
+  let closed = 0;
+  await act(async () => {
+    root?.render(
+      <LanguageProvider>
+        <RestoreDialog
+          apiBase=""
+          row={{
+            opId: "op-drift-to-clean", clientId: "hermes", kind: "apply",
+            at: "2026-09-20T00:00:00.000Z", configPath: "/tmp/hermes.yaml",
+            snapshot: "stored", undoable: true, deletable: false,
+          }}
+          onClose={() => { closed += 1; }}
+          onRestored={() => {}}
+        />
+      </LanguageProvider>,
+    );
+  });
+  await waitFor(() => Array.from(container.querySelectorAll("button")).some(button => button.textContent?.trim() === "Back up newer edits and restore" && !button.disabled));
+  const driftConfirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Back up newer edits and restore") as HTMLButtonElement;
+  await act(async () => { driftConfirm.click(); });
+  await waitFor(() => container.textContent?.includes("Review the updated plan") === true);
+  expect(requests.filter(request => request.url.endsWith("/restore"))).toHaveLength(1);
+  expect(requests.filter(request => request.url.endsWith("/restore"))[0]?.body.confirmDrift).toBe(true);
+
+  await waitFor(() => Array.from(container.querySelectorAll("button")).some(button => button.textContent?.trim() === "Restore" && !button.disabled));
+  const cleanConfirm = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Restore") as HTMLButtonElement;
+  await act(async () => { cleanConfirm.click(); });
+  await waitFor(() => closed === 1);
+  const mutationsSent = requests.filter(request => request.url.endsWith("/restore"));
+  expect(mutationsSent).toHaveLength(2);
+  expect(mutationsSent[1]?.body).toMatchObject({
+    confirmDrift: true,
+    operation: "restore",
+    planFingerprint: `p1:${"8".repeat(32)}`,
+  });
+});
+
+test("restore preview can be cancelled and aborts a late read", async () => {
+  let previewSignal: AbortSignal | null | undefined;
+  let resolvePreview: ((response: Response) => void) | undefined;
+  const mockFetch = ((_input: RequestInfo | URL, init?: RequestInit) => {
+    previewSignal = init?.signal;
+    return new Promise<Response>(resolve => { resolvePreview = resolve; });
+  }) as typeof fetch;
+  Object.defineProperty(globalThis, "fetch", { configurable: true, value: mockFetch });
+  Object.defineProperty(windowValue, "fetch", { configurable: true, value: mockFetch });
+  let closed = 0;
+  function Harness() {
+    const [open, setOpen] = useState(true);
+    return open ? (
+      <RestoreDialog
+        apiBase=""
+        row={{
+          opId: "op-cancel-preview", clientId: "hermes", kind: "apply",
+          at: "2026-09-20T00:00:00.000Z", configPath: "/tmp/hermes.yaml",
+          snapshot: "stored", undoable: true, deletable: false,
+        }}
+        onClose={() => { closed += 1; setOpen(false); }}
+        onRestored={() => {}}
+      />
+    ) : null;
+  }
+  await act(async () => { root?.render(<LanguageProvider><Harness /></LanguageProvider>); });
+  await waitFor(() => previewSignal !== undefined && resolvePreview !== undefined);
+  expect(previewSignal?.aborted).toBe(false);
+  const cancel = Array.from(container.querySelectorAll("button")).find(button => button.textContent?.trim() === "Cancel") as HTMLButtonElement;
+  expect(cancel.disabled).toBe(false);
+  await act(async () => { cancel.click(); });
+  expect(closed).toBe(1);
+  expect(previewSignal?.aborted).toBe(true);
+  expect(container.querySelector("dialog")).toBeNull();
+
+  await act(async () => {
+    resolvePreview!(Response.json({
+      ...plan(`p1:${"9".repeat(32)}`),
+      operation: "restore",
+      state: "current",
+    }));
+    await new Promise<void>(resolve => windowValue.setTimeout(resolve, 0));
+  });
+  expect(container.querySelector("dialog")).toBeNull();
+  expect(container.textContent).not.toContain("Server change plan");
+});
diff --git a/gui/tests/integrations-api.test.ts b/gui/tests/integrations-api.test.ts
index 8a647943dfb..17599aa4998 100644
--- a/gui/tests/integrations-api.test.ts
+++ b/gui/tests/integrations-api.test.ts
@@ -9,6 +9,9 @@ import {
   loadIntegrationJournal,
   loadIntegrationState,
   loadIntegrationStates,
+  parseIntegrationMutationPlan,
+  previewIntegrationMutation,
+  previewIntegrationRestore,
   restoreIntegration,
   toggleIntegration,
   type IntegrationJournalEnvelope,
@@ -73,11 +76,31 @@ test("GET adapters preserve the server state and journal contracts", async () =>
   expect(requests.every(request => request.init?.signal === controller.signal)).toBe(true);
 });
 
-test("mutation adapters send the exact WP4 methods and bodies", async () => {
+const plan = {
+  version: 1 as const,
+  clientId: "pi" as const,
+  operation: "apply" as const,
+  state: "absent" as const,
+  foreignEdit: "none" as const,
+  changes: [
+    { kind: "add" as const, path: "providers.opencodex" },
+    { kind: "snapshot" as const, path: "$snapshot" },
+    { kind: "ownership" as const, path: "$ownership" },
+    { kind: "journal" as const, path: "$journal" },
+  ],
+  fingerprint: "p1:0123456789abcdef0123456789abcdef",
+  canApply: true,
+  willChange: true,
+};
+
+test("preview and mutation adapters send exact bound methods and bodies", async () => {
   const controller = new AbortController();
   const requests: Array<{ url: string; init?: RequestInit }> = [];
   globalThis.fetch = (async (input, init) => {
     requests.push({ url: String(input), init });
+    if (String(input).includes("/preview")) return Response.json(String(input).includes("restore")
+      ? { ...plan, operation: "restore", clientId: "pi" }
+      : plan);
     return Response.json({
       ok: true,
       clientId: "pi",
@@ -88,25 +111,71 @@ test("mutation adapters send the exact WP4 methods and bodies", async () => {
     });
   }) as typeof fetch;
 
-  await toggleIntegration("", "pi", true, controller.signal);
-  await restoreIntegration("", "op-2", true, controller.signal);
+  const applyPlan = await previewIntegrationMutation("", "pi", "apply", controller.signal);
+  const restorePlan = await previewIntegrationRestore("", "op-2", true, controller.signal);
+  await toggleIntegration("", "pi", {
+    enabled: true,
+    signal: controller.signal,
+    binding: { operation: applyPlan.operation, planFingerprint: applyPlan.fingerprint },
+  });
+  await restoreIntegration("", {
+    opId: "op-2",
+    confirmDrift: true,
+    signal: controller.signal,
+    binding: { operation: restorePlan.operation, planFingerprint: restorePlan.fingerprint },
+  });
 
-  expect(requests).toHaveLength(2);
-  expect(requests[0]).toMatchObject({ url: "/api/client-integrations/pi" });
-  expect(requests[0].init).toMatchObject({
+  expect(requests).toHaveLength(4);
+  expect(requests[0]).toMatchObject({ url: "/api/client-integrations/preview" });
+  expect(requests[0].init).toMatchObject({ method: "POST", body: JSON.stringify({ clientId: "pi", operation: "apply" }) });
+  expect(requests[1]).toMatchObject({ url: "/api/client-integrations/restore/preview" });
+  expect(requests[2]).toMatchObject({ url: "/api/client-integrations/pi" });
+  expect(requests[2].init).toMatchObject({
     method: "PUT",
-    body: JSON.stringify({ enabled: true }),
+    body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: plan.fingerprint }),
     signal: controller.signal,
   });
-  expect(new Headers(requests[0].init?.headers).get("Content-Type")).toBe("application/json");
-  expect(requests[1]).toMatchObject({ url: "/api/client-integrations/restore" });
-  expect(requests[1].init).toMatchObject({
+  expect(new Headers(requests[2].init?.headers).get("Content-Type")).toBe("application/json");
+  expect(requests[3]).toMatchObject({ url: "/api/client-integrations/restore" });
+  expect(requests[3].init).toMatchObject({
     method: "POST",
-    body: JSON.stringify({ opId: "op-2", confirmDrift: true }),
+    body: JSON.stringify({ opId: "op-2", confirmDrift: true, operation: "restore", planFingerprint: plan.fingerprint }),
     signal: controller.signal,
   });
 });
 
+test.each([
+  { ...plan, extra: "raw-value" },
+  { ...plan, operation: "refresh" },
+  { ...plan, fingerprint: "bad" },
+  { ...plan, changes: [{ kind: "add", path: "/home/private/config" }] },
+  { ...plan, changes: [{ kind: "add", path: "providers.opencodex" }, { kind: "add", path: "providers.opencodex" }] },
+  { ...plan, changes: Array.from({ length: 257 }, (_, index) => ({ kind: "add", path: `models.${index}` })) },
+])("strict preview parser rejects malformed or private data", body => {
+  expect(() => parseIntegrationMutationPlan(body)).toThrow(IntegrationApiError);
+});
+
+test("stale mutation errors expose only a newly validated plan", async () => {
+  globalThis.fetch = (async () => Response.json({
+    code: "integration_preview_stale",
+    error: "stale",
+    plan: { ...plan, fingerprint: "p1:22222222222222222222222222222222" },
+  }, { status: 409 })) as typeof fetch;
+  const error = await toggleIntegration("", "pi", {
+    enabled: true,
+    binding: { operation: "apply", planFingerprint: plan.fingerprint },
+  }).catch(cause => cause as IntegrationApiError);
+  expect(error.stalePlan?.fingerprint).toBe("p1:22222222222222222222222222222222");
+
+  globalThis.fetch = (async () => Response.json({
+    code: "integration_preview_stale", plan: { ...plan, rawValue: "private" },
+  }, { status: 409 })) as typeof fetch;
+  await expect(toggleIntegration("", "pi", {
+    enabled: true,
+    binding: { operation: "apply", planFingerprint: plan.fingerprint },
+  })).rejects.toMatchObject({ status: 502, body: { code: "invalid_integration_preview_response" } });
+});
+
 test("refusals route by reason and preserve manual recovery fields end to end", async () => {
   globalThis.fetch = (async () => Response.json({
     error: "integration mutation failed",
@@ -119,7 +188,7 @@ test("refusals route by reason and preserve manual recovery fields end to end",
     residual: true,
   }, { status: 500 })) as typeof fetch;
 
-  const error = await toggleIntegration("", "opencode", false).catch(cause => cause);
+  const error = await toggleIntegration("", "opencode", { enabled: false }).catch(cause => cause);
 
   expect(error).toBeInstanceOf(IntegrationApiError);
   expect(error).toMatchObject({
@@ -192,7 +261,7 @@ test("bulk Aside refusals retain operation-specific recovery fields", async () =
     { clientId: "aside", profileId: 2, ok: false, state: "conflict", reason: "write_failed",
       message: "write failed", snapshotPath: "/backup/profile-2", residual: true },
   ] }, { status: 207 })) as typeof fetch;
-  await expect(toggleIntegration("http://fixture", "aside", true)).rejects.toMatchObject({ body: {
+  await expect(toggleIntegration("http://fixture", "aside", { enabled: true })).rejects.toMatchObject({ body: {
     results: [{ profileId: 2, reason: "write_failed", snapshotPath: "/backup/profile-2", residual: true }],
   } });
 });
@@ -204,7 +273,7 @@ test.each([
 ])("bulk Aside rejects a contradictory aggregate result: $ok / $results", async body => {
   globalThis.fetch = (async () => Response.json(body, { status: body.ok ? 200 : 207 })) as typeof fetch;
 
-  await expect(toggleIntegration("http://fixture", "aside", true)).rejects.toMatchObject({
+  await expect(toggleIntegration("http://fixture", "aside", { enabled: true })).rejects.toMatchObject({
     status: 502,
     body: { code: "invalid_aside_profile_response" },
   });
diff --git a/gui/tests/integrations-surfaces.test.tsx b/gui/tests/integrations-surfaces.test.tsx
index 7222d371f95..5a4429d3b10 100644
--- a/gui/tests/integrations-surfaces.test.tsx
+++ b/gui/tests/integrations-surfaces.test.tsx
@@ -30,7 +30,9 @@ let previousGlobals: Record<(typeof globals)[number], unknown>;
 let testWindow: Window;
 let container: HTMLElement;
 let root: Root | null = null;
-let requests: Array<{ url: string; method: string; body: unknown }> = [];
+type RecordedRequest = { url: string; method: string; body: unknown };
+
+let requests: RecordedRequest[] = [];
 /**
  * `useDataSurface` caches by key, and the key includes `apiBase`. Reusing one
  * base across tests replayed the previous test's response, so a fixture change
@@ -53,10 +55,11 @@ type JournalRow = {
 
 let stateResponse: () => Response;
 let journalRows: JournalRow[];
-let putResponse: () => Response;
+let putResponse: (request: RecordedRequest) => Response;
 let codexRoutingResponse: () => Response;
 let codexDesiredEnabled = true;
 let deleteResponse: () => Response;
+let previewResponse: (body: Record<string, unknown>, signal?: AbortSignal | null) => Response | Promise<Response>;
 /**
  * The overview also reads Codex routing, API keys, Claude Code, Claude Desktop
  * and the Grok fence. Default answers keep every existing test's card grid
@@ -84,6 +87,27 @@ function status(overrides: Record<string, unknown> = {}) {
   };
 }
 
+function asideStatus(overrides: Record<string, unknown> = {}) {
+  return status({ clientId: "aside", configPath: "/tmp/aside/profiles.json", ...overrides });
+}
+
+function previewPlan(operation: "apply" | "overwrite" | "disable" | "restore", overrides: Record<string, unknown> = {}) {
+  return {
+    version: 1,
+    clientId: "hermes",
+    operation,
+    state: operation === "apply" ? "absent" : "current",
+    foreignEdit: "none",
+    changes: operation === "disable"
+      ? [{ kind: "remove", path: "providers.opencodex" }, { kind: "snapshot", path: "$snapshot" }, { kind: "ownership", path: "$ownership" }, { kind: "journal", path: "$journal" }]
+      : [{ kind: "replace", path: "providers.opencodex" }, { kind: "snapshot", path: "$snapshot" }, { kind: "ownership", path: "$ownership" }, { kind: "journal", path: "$journal" }],
+    fingerprint: `p1:${({ apply: "1", overwrite: "2", disable: "3", restore: "4" } as const)[operation].repeat(32)}`,
+    canApply: true,
+    willChange: true,
+    ...overrides,
+  };
+}
+
 beforeEach(() => {
   previousGlobals = Object.fromEntries(
     globals.map(key => [key, Reflect.get(globalThis, key)]),
@@ -108,16 +132,29 @@ beforeEach(() => {
   codexRoutingResponse = () => json({ routingInjected: false, status: "native", recommendedCommand: null });
   codexDesiredEnabled = true;
   deleteResponse = () => json({ ok: true, clientId: "hermes", opId: "op-old", snapshotRemoved: true });
+  previewResponse = body => {
+    const clientId = body.clientId ?? "hermes";
+    return json(previewPlan((body.operation as "apply" | "overwrite" | "disable") ?? "apply", {
+      clientId,
+      ...(clientId === "pi" ? { fingerprint: `p1:${"5".repeat(32)}` } : {}),
+    }));
+  };
   failExtraSources = false;
 
   const mockFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
     const url = String(input instanceof Request ? input.url : input);
     const method = (init?.method ?? "GET").toUpperCase();
-    requests.push({
+    const request = {
       url,
       method,
       body: init?.body ? JSON.parse(String(init.body)) : undefined,
-    });
+    };
+    requests.push(request);
+    if (url.endsWith("/api/client-integrations/restore/preview")) return json(previewPlan("restore"));
+    if (url.endsWith("/api/client-integrations/preview")) {
+      const body = init?.body ? JSON.parse(String(init.body)) as Record<string, unknown> : {};
+      return previewResponse(body, init?.signal);
+    }
     if (url.includes("/journal") && method === "DELETE") return deleteResponse();
     if (url.includes("/journal")) return json({ operations: journalRows });
     if (url.includes("/api/startup-health")) {
@@ -175,7 +212,7 @@ beforeEach(() => {
     if (url.includes("/api/grok")) {
       return failExtraSources ? json({ error: "nope" }, 500) : json({ present: false, models: [] });
     }
-    if (method === "PUT") return putResponse();
+    if (method === "PUT") return putResponse(request);
     if (url.includes("/restore")) return json({ ok: true, clientId: "hermes", changed: true, state: "current", message: "restored" });
     return stateResponse();
   }) as typeof fetch;
@@ -286,6 +323,16 @@ function toggleSwitch(): HTMLButtonElement {
   return found;
 }
 
+async function confirmDialog(label: string): Promise<void> {
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 0)); });
+  const dialog = container.querySelector("dialog[open]")!;
+  const confirm = Array.from(dialog.querySelectorAll("button")).find(
+    button => (button.textContent ?? "").trim() === label,
+  ) as HTMLButtonElement;
+  await act(async () => { confirm.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 0)); });
+}
+
 test("turning the switch off disables, even when the block is stale", async () => {
   /*
    * The defect this pins: `stale` also means our block is on disk, so the
@@ -299,9 +346,10 @@ test("turning the switch off disables, even when the block is stale", async () =
   const sw = toggleSwitch();
   expect(sw.getAttribute("aria-pressed")).toBe("true");
   await act(async () => { sw.click(); });
+  await confirmDialog("Disable");
 
   const put = requests.find(request => request.method === "PUT");
-  expect(put?.body).toEqual({ enabled: false });
+  expect(put?.body).toEqual({ enabled: false, operation: "disable", planFingerprint: previewPlan("disable").fingerprint });
 });
 
 test("updating a stale block is a separate action from the switch", async () => {
@@ -311,14 +359,58 @@ test("updating a stale block is a separate action from the switch", async () =>
   const update = buttonByText("Update");
   expect(update).toBeDefined();
   await act(async () => { update!.click(); });
-  expect(requests.find(request => request.method === "PUT")?.body).toEqual({ enabled: true });
+  await confirmDialog("Apply");
+  expect(requests.find(request => request.method === "PUT")?.body).toEqual({ enabled: true, operation: "apply", planFingerprint: previewPlan("apply").fingerprint });
 });
 
 test("an absent integration applies", async () => {
   stateResponse = () => json(status({ state: "absent" }));
   await mountClient();
   await act(async () => { toggleSwitch().click(); });
-  expect(requests.find(request => request.method === "PUT")?.body).toEqual({ enabled: true });
+  await confirmDialog("Apply");
+  expect(requests.find(request => request.method === "PUT")?.body).toEqual({ enabled: true, operation: "apply", planFingerprint: previewPlan("apply").fingerprint });
+});
+
+test("a hostile preview fails closed without leaking payload data into the page", async () => {
+  const canary = "private-preview-canary-9f31";
+  stateResponse = () => json(status({ state: "absent" }));
+  previewResponse = body => json({
+    ...previewPlan("apply", { clientId: body.clientId ?? "hermes" }),
+    rawValue: canary,
+    message: canary,
+  });
+  await mountClient();
+  await act(async () => { toggleSwitch().click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
+
+  expect(container.textContent).toContain("The change plan could not be loaded. Nothing was changed.");
+  expect(container.textContent).not.toContain(canary);
+  expect(requests.some(request => request.method === "PUT")).toBe(false);
+});
+
+test("closing a loading preview aborts it and fences a late response", async () => {
+  stateResponse = () => json(status({ state: "absent" }));
+  let previewSignal: AbortSignal | null | undefined;
+  let resolvePreview: ((response: Response) => void) | undefined;
+  previewResponse = (_body, signal) => {
+    previewSignal = signal;
+    return new Promise<Response>(resolve => { resolvePreview = resolve; });
+  };
+  await mountClient();
+  await act(async () => { toggleSwitch().click(); });
+  const dialog = container.querySelector("dialog[open]")!;
+  const close = Array.from(dialog.querySelectorAll("button")).find(button => button.textContent?.trim() === "Close") as HTMLButtonElement;
+  expect(close.disabled).toBe(false);
+  await act(async () => { close.click(); });
+  expect(previewSignal?.aborted).toBe(true);
+  expect(container.querySelector("dialog[open]")).toBeNull();
+
+  await act(async () => {
+    resolvePreview!(json(previewPlan("apply")));
+    await new Promise<void>(resolve => testWindow.setTimeout(resolve, 0));
+  });
+  expect(container.querySelector("dialog[open]")).toBeNull();
+  expect(container.textContent).not.toContain("Server change plan");
 });
 
 test("conflict locks the switch instead of guessing", async () => {
@@ -375,7 +467,7 @@ test("the overwrite button mutates nothing until the dialog is confirmed", async
   await act(async () => { confirm.click(); });
 
   const put = requests.find(request => request.method === "PUT");
-  expect(put?.body).toEqual({ enabled: true, overwriteConflict: true });
+  expect(put?.body).toEqual({ enabled: true, overwriteConflict: true, operation: "overwrite", planFingerprint: previewPlan("overwrite").fingerprint });
 });
 
 test("a foreign edit and an unowned block get different dialog copy", async () => {
@@ -533,6 +625,7 @@ test("a residual write tells the user the file may be half-written and where the
   }, 500);
   await mountClient();
   await act(async () => { toggleSwitch().click(); });
+  await confirmDialog("Disable");
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
 
   const text = container.textContent ?? "";
@@ -554,6 +647,7 @@ test("a refusal routes by reason, not by the state it happened in", async () =>
   }, 500);
   await mountClient();
   await act(async () => { toggleSwitch().click(); });
+  await confirmDialog("Disable");
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
 
   const text = container.textContent ?? "";
@@ -646,6 +740,224 @@ test("the overview does not claim nothing is installed while it is still loading
   expect(container.textContent ?? "").toContain("No installed clients were detected");
 });
 
+test("a failed first read does not claim nothing is installed either", async () => {
+  /*
+   * A failed-cold read carries no data, so it is not an answer: the error
+   * notice must stand alone, without the "nothing detected" panel, and the
+   * file clients stay as unknown rows rather than a server-side omission.
+   */
+  stateResponse = () => json({ error: "nope" }, 500);
+  await mountOverview();
+
+  const text = container.textContent ?? "";
+  expect(text).toContain("Could not load integration state.");
+  expect(text).not.toContain("No installed clients were detected");
+  expect(text).toContain("Hermes");
+});
+
+test("the aggregate Aside overview toggle stays unbound", async () => {
+  let applied = true;
+  stateResponse = () => json({ clients: [asideStatus({ state: applied ? "current" : "absent" })] });
+  previewResponse = body => body.clientId === "aside"
+    ? json({ error: "aggregate Aside previews require a profile", code: "invalid_aside_profile" }, 400)
+    : json(previewPlan("disable", { clientId: body.clientId }));
+  putResponse = request => {
+    const body = request.body as Record<string, unknown>;
+    if (body.operation !== undefined || body.planFingerprint !== undefined) {
+      return json({ error: "a confirmed plan applies to one profile", code: "invalid_aside_profile" }, 400);
+    }
+    applied = body.enabled === true;
+    return json({ ok: true, results: [{ profileId: 7, ok: true, state: applied ? "current" : "absent" }] });
+  };
+
+  await mountOverview();
+  await act(async () => { switchFor("aside")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+
+  expect(requests.filter(request => request.url.endsWith("/api/client-integrations/preview"))).toHaveLength(0);
+  const puts = requests.filter(request => request.method === "PUT" && request.url.endsWith("/api/client-integrations/aside/profiles"));
+  expect(puts).toHaveLength(1);
+  expect(puts[0]?.body).toEqual({ enabled: false });
+});
+
+test("aggregate Aside overview failures stay on the card without an unhandled rejection", async () => {
+  stateResponse = () => json({ clients: [asideStatus()] });
+  putResponse = request => {
+    const body = request.body as Record<string, unknown>;
+    if (body.operation !== undefined || body.planFingerprint !== undefined) {
+      return json({ error: "a confirmed plan applies to one profile", code: "invalid_aside_profile" }, 400);
+    }
+    return json({
+      ok: false,
+      message: "one profile failed",
+      results: [{ profileId: 7, ok: false, reason: "write_failed", message: "disk full" }],
+    }, 207);
+  };
+  let unhandled = 0;
+  testWindow.addEventListener("unhandledrejection", () => { unhandled += 1; });
+
+  await mountOverview();
+  await act(async () => { switchFor("aside")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+
+  const card = container.querySelector('[data-client="aside"]')!;
+  expect(card.querySelectorAll(".notice-err")).toHaveLength(1);
+  expect(card.textContent).toContain("disk full");
+  expect(switchFor("aside")?.disabled).toBe(false);
+  expect(unhandled).toBe(0);
+
+  await act(async () => { switchFor("aside")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+  expect(requests.filter(request => request.method === "PUT" && request.url.endsWith("/api/client-integrations/aside/profiles"))).toHaveLength(2);
+  expect(unhandled).toBe(0);
+});
+
+test("Aside-only and mixed bulk disable keep aggregate Aside unbound", async () => {
+  let clients = [asideStatus()];
+  stateResponse = () => json({ clients });
+  previewResponse = body => body.clientId === "aside"
+    ? json({ error: "aggregate Aside previews require a profile", code: "invalid_aside_profile" }, 400)
+    : json(previewPlan("disable", {
+        clientId: body.clientId,
+        fingerprint: body.clientId === "pi" ? `p1:${"5".repeat(32)}` : `p1:${"3".repeat(32)}`,
+      }));
+  putResponse = request => {
+    const body = request.body as Record<string, unknown>;
+    if (request.url.endsWith("/api/client-integrations/aside/profiles")) {
+      if (body.operation !== undefined || body.planFingerprint !== undefined) {
+        return json({ error: "a confirmed plan applies to one profile", code: "invalid_aside_profile" }, 400);
+      }
+      clients = clients.filter(client => client.clientId !== "aside");
+      return json({ ok: true, results: [{ profileId: 7, ok: true, state: "absent" }] });
+    }
+    clients = clients.filter(client => client.clientId !== "pi");
+    return json({ ok: true, clientId: "pi", changed: true, state: "absent", message: "disabled" });
+  };
+
+  await mountOverview();
+  await act(async () => { buttonByText("Disable all…")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+  expect(buttonByText("Disable all")?.disabled).toBe(false);
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+  expect(requests.filter(request => request.url.endsWith("/api/client-integrations/preview"))).toHaveLength(0);
+  expect(requests.find(request => request.method === "PUT")?.body).toEqual({ enabled: false });
+
+  if (root) {
+    const current = root;
+    await act(async () => { current.unmount(); });
+    root = null;
+  }
+  mountCount += 1;
+  apiBase = `http://ocx-test-${mountCount}.invalid`;
+  requests = [];
+  clients = [asideStatus(), status({ clientId: "pi", configPath: "/tmp/pi.json" })];
+  await mountOverview();
+  await act(async () => { buttonByText("Disable all…")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+
+  expect(requests.filter(request => request.url.endsWith("/api/client-integrations/preview")).map(request => request.body)).toEqual([
+    { clientId: "pi", operation: "disable" },
+  ]);
+  expect(requests.filter(request => request.method === "PUT").map(request => request.body)).toEqual([
+    { enabled: false },
+    { enabled: false, operation: "disable", planFingerprint: `p1:${"5".repeat(32)}` },
+  ]);
+});
+
+test("bulk confirmation is disabled when every planned target is refused", async () => {
+  stateResponse = () => json({ clients: [status()] });
+  previewResponse = body => json(previewPlan("disable", {
+    clientId: body.clientId,
+    canApply: false,
+    willChange: false,
+    changes: [],
+    refusalReason: "unsafe",
+  }));
+  await mountOverview();
+  await act(async () => { buttonByText("Disable all…")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+
+  expect(buttonByText("Disable all")?.disabled).toBe(true);
+  expect(requests.filter(request => request.method === "PUT")).toHaveLength(0);
+});
+
+test("bulk stale plans require reconfirmation without repeating completed disables", async () => {
+  const applied = new Set(["hermes", "pi", "dsh"]);
+  stateResponse = () => json({ clients: [
+    status({ clientId: "hermes", state: applied.has("hermes") ? "current" : "absent" }),
+    status({ clientId: "pi", configPath: "/tmp/pi.json", state: applied.has("pi") ? "current" : "absent" }),
+    status({ clientId: "dsh", configPath: "/tmp/dsh.yaml", state: applied.has("dsh") ? "current" : "absent" }),
+  ] });
+  previewResponse = body => json(previewPlan("disable", {
+    clientId: body.clientId,
+    fingerprint: `p1:${body.clientId === "pi" ? "5".repeat(32) : body.clientId === "dsh" ? "6".repeat(32) : "3".repeat(32)}`,
+    ...(body.clientId === "dsh" ? { canApply: false, willChange: false, changes: [], refusalReason: "unsafe" } : {}),
+  }));
+  let piAttempts = 0;
+  putResponse = request => {
+    const clientId = request.url.split("/").pop()!;
+    if (clientId === "pi" && piAttempts++ === 0) {
+      return json({
+        code: "integration_preview_stale",
+        plan: previewPlan("disable", { clientId: "pi", fingerprint: `p1:${"9".repeat(32)}` }),
+      }, 409);
+    }
+    applied.delete(clientId);
+    return json({ ok: true, clientId, changed: true, state: "absent", message: "disabled" });
+  };
+
+  await mountOverview();
+  await act(async () => { buttonByText("Disable all…")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+
+  expect(container.textContent).toContain("Review the updated plan");
+  expect(requests.filter(request => request.method === "PUT" && request.url.endsWith("/hermes"))).toHaveLength(1);
+  expect(requests.filter(request => request.method === "PUT" && request.url.endsWith("/pi"))).toHaveLength(1);
+  expect(requests.filter(request => request.method === "PUT" && request.url.endsWith("/dsh"))).toHaveLength(0);
+
+  const staleDialog = container.querySelector("dialog")!;
+  const reconfirm = Array.from(staleDialog.querySelectorAll("button")).find(
+    button => (button.textContent ?? "").trim() === "Disable all",
+  ) as HTMLButtonElement;
+  const close = Array.from(staleDialog.querySelectorAll("button")).find(
+    button => (button.textContent ?? "").trim() === "Close",
+  ) as HTMLButtonElement;
+  expect(staleDialog.getAttribute("aria-busy")).toBe("false");
+  expect(reconfirm.disabled).toBe(false);
+  expect(close.disabled).toBe(false);
+
+  await act(async () => { reconfirm.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+  const hermesPuts = requests.filter(request => request.method === "PUT" && request.url.endsWith("/hermes"));
+  const piPuts = requests.filter(request => request.method === "PUT" && request.url.endsWith("/pi"));
+  expect(hermesPuts).toHaveLength(1);
+  expect(piPuts).toHaveLength(2);
+  expect(piPuts[1]?.body).toEqual({ enabled: false, operation: "disable", planFingerprint: `p1:${"9".repeat(32)}` });
+  expect(container.querySelector("dialog")).toBeNull();
+  expect(container.textContent).toContain("dsh");
+});
+
+test("overview stale replacement does not persist a card failure", async () => {
+  stateResponse = () => json({ clients: [status()] });
+  putResponse = () => json({
+    code: "integration_preview_stale",
+    plan: previewPlan("disable", { fingerprint: `p1:${"9".repeat(32)}` }),
+  }, 409);
+  await mountOverview();
+  await act(async () => { switchFor("hermes")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+  await confirmDialog("Disable");
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+
+  expect(container.querySelector('[data-client="hermes"] .notice')).toBeNull();
+  expect(container.querySelector("dialog")?.textContent).toContain("Review the updated plan");
+});
+
 test("bulk disable confirms the result with the server before claiming success", async () => {
   /*
    * The resource layer's `refresh()` is fire-and-forget, so awaiting it proves
@@ -660,6 +972,7 @@ test("bulk disable confirms the result with the server before claiming success",
     const method = (init?.method ?? "GET").toUpperCase();
     requests.push({ url, method, body: init?.body ? JSON.parse(String(init.body)) : undefined });
     if (url.includes("/journal")) return json({ operations: [] });
+    if (url.endsWith("/api/client-integrations/preview")) return json(previewPlan("disable"));
     if (method === "PUT") {
       // The server answers OK but the block is still on disk.
       return json({ ok: true, clientId: "hermes", changed: false, state: "current", message: "ok" });
@@ -674,6 +987,8 @@ test("bulk disable confirms the result with the server before claiming success",
   expect(disableAll).toBeDefined();
   await act(async () => { disableAll!.click(); });
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
 
   const text = container.textContent ?? "";
   expect(text).not.toContain("Applied client integrations were disabled.");
@@ -693,6 +1008,7 @@ test("bulk disable does report success once the server agrees", async () => {
     const method = (init?.method ?? "GET").toUpperCase();
     requests.push({ url, method, body: init?.body ? JSON.parse(String(init.body)) : undefined });
     if (url.includes("/journal")) return json({ operations: [] });
+    if (url.endsWith("/api/client-integrations/preview")) return json(previewPlan("disable"));
     if (method === "PUT") {
       applied = false;
       return json({ ok: true, clientId: "hermes", changed: true, state: "absent", message: "ok" });
@@ -707,13 +1023,38 @@ test("bulk disable does report success once the server agrees", async () => {
   expect(disableAll).toBeDefined();
   await act(async () => { disableAll!.click(); });
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
 
   const text = container.textContent ?? "";
   expect(text).toContain("Applied client integrations were disabled.");
   expect(text).not.toContain("may be stale");
 });
 
-test("a drifted restore asks a second time instead of failing", async () => {
+test("bulk disable keeps one preview fingerprint per client", async () => {
+  stateResponse = () => json({ clients: [
+    status({ clientId: "hermes", configPath: "/tmp/hermes.yaml" }),
+    status({ clientId: "pi", configPath: "/tmp/pi.json" }),
+  ] });
+  await mountOverview();
+  await act(async () => { buttonByText("Disable all…")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 30)); });
+  await act(async () => { buttonByText("Disable all")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 40)); });
+
+  const previews = requests.filter(request => request.url.endsWith("/api/client-integrations/preview"));
+  expect(previews.map(request => request.body)).toEqual([
+    { clientId: "hermes", operation: "disable" },
+    { clientId: "pi", operation: "disable" },
+  ]);
+  const puts = requests.filter(request => request.method === "PUT");
+  expect(puts.map(request => request.body)).toEqual([
+    { enabled: false, operation: "disable", planFingerprint: previewPlan("disable").fingerprint },
+    { enabled: false, operation: "disable", planFingerprint: `p1:${"5".repeat(32)}` },
+  ]);
+});
+
+test("a drifted restore previews confirmation before its first mutation", async () => {
   /*
    * The server refuses a drifted restore unless `confirmDrift` is set. That
    * refusal is the only moment the user is told their newer edits are about to
@@ -723,17 +1064,17 @@ test("a drifted restore asks a second time instead of failing", async () => {
   const restoreFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
     const body = init?.body ? JSON.parse(String(init.body)) : undefined;
     posts.push(body);
+    if (String(input).endsWith("/restore/preview")) {
+      const confirmed = (body as { confirmDrift?: boolean })?.confirmDrift === true;
+      return json(previewPlan("restore", confirmed ? { foreignEdit: "drift", fingerprint: `p1:${"7".repeat(32)}` } : {
+        foreignEdit: "drift", canApply: false, willChange: false, changes: [], refusalReason: "drift_requires_confirm",
+        fingerprint: `p1:${"6".repeat(32)}`,
+      }));
+    }
     if ((body as { confirmDrift?: boolean })?.confirmDrift) {
       return json({ ok: true, clientId: "hermes", changed: true, state: "current", message: "restored" });
     }
-    return json({
-      error: "restore requires drift confirmation",
-      code: "integration_drift_confirmation_required",
-      clientId: "hermes",
-      state: "conflict",
-      reason: "drift_requires_confirm",
-      message: "this file changed after that operation",
-    }, 409);
+    return json({ error: "unexpected unconfirmed restore" }, 409);
   }) as typeof fetch;
   Object.defineProperty(globalThis, "fetch", { configurable: true, value: restoreFetch });
   Object.defineProperty(testWindow, "fetch", { configurable: true, value: restoreFetch });
@@ -761,18 +1102,19 @@ test("a drifted restore asks a second time instead of failing", async () => {
     );
   });
 
-  await act(async () => { buttonByText("Restore")!.click(); });
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
 
-  // First submit asked without confirmation and the dialog escalated.
+  // Both preview calls happen before the first mutation.
   expect((posts[0] as { confirmDrift?: boolean }).confirmDrift).toBe(false);
+  expect((posts[1] as { confirmDrift?: boolean }).confirmDrift).toBe(true);
   expect(container.textContent ?? "").toContain("Newer edits were detected");
 
   const confirm = buttonByText("Back up newer edits and restore");
   expect(confirm).toBeDefined();
   await act(async () => { confirm!.click(); });
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
-  expect((posts[1] as { confirmDrift?: boolean }).confirmDrift).toBe(true);
+  expect((posts[2] as { confirmDrift?: boolean }).confirmDrift).toBe(true);
+  expect((posts[2] as { planFingerprint?: string }).planFingerprint).toBe(`p1:${"7".repeat(32)}`);
 });
 
 /**
@@ -808,7 +1150,8 @@ test("a successful restore keeps focus on the stable region after refresh remove
   };
   let resolveRestore: ((response: Response) => void) | undefined;
   const restoreFetch = ((input: RequestInfo | URL) => {
-    if (String(input).includes("/restore")) {
+    if (String(input).endsWith("/restore/preview")) return Promise.resolve(json(previewPlan("restore")));
+    if (String(input).endsWith("/restore")) {
       return new Promise<Response>(resolve => { resolveRestore = resolve; });
     }
     return Promise.resolve(json({ operations: [] }));
@@ -833,6 +1176,7 @@ test("a successful restore keeps focus on the stable region after refresh remove
     );
   });
 
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
   await act(async () => { buttonByText("Restore")!.click(); });
   expect(resolveRestore).toBeDefined();
 
@@ -895,10 +1239,12 @@ test("a card toggles its own client without a trip to the sub-page", async () =>
   expect(sw!.getAttribute("aria-pressed")).toBe("true");
   await act(async () => { sw!.click(); });
   await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
+  await act(async () => { buttonByText("Disable")!.click(); });
+  await act(async () => { await new Promise<void>(resolve => testWindow.setTimeout(resolve, 20)); });
 
   const put = requests.find(request => request.method === "PUT");
   expect(put?.url).toContain("/api/client-integrations/hermes");
-  expect(put?.body).toEqual({ enabled: false });
+  expect(put?.body).toEqual({ enabled: false, operation: "disable", planFingerprint: previewPlan("disable").fingerprint });
 });
 
 test("a card cannot toggle a client whose config is in conflict", async () => {
diff --git a/package.json b/package.json
index f97ab8794e4..ed4bb03a82a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.59.0",
+  "version": "2.60.0",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",
@@ -83,6 +83,9 @@
     "@types/bun": "1.4.0",
     "typescript": "7.0.2"
   },
+  "optionalDependencies": {
+    "wreq-js": "2.3.1"
+  },
   "overrides": {
     "@hono/node-server": "2.1.0",
     "fast-uri": "^3.1.7",
diff --git a/scripts/structure-ssot.ts b/scripts/structure-ssot.ts
index ddc61e09940..fb783434f2a 100644
--- a/scripts/structure-ssot.ts
+++ b/scripts/structure-ssot.ts
@@ -35,6 +35,14 @@ export type Manifest = {
   absentPaths: { path: string; reason: string }[];
   tiers: { id: number; name: string; purpose: string }[];
   docs: { path: string; tier: number; title: string; scope: string; documents: string[] }[];
+  contracts?: {
+    version: 1;
+    entries: {
+      id: string;
+      owner: { document: string; anchor: string };
+      dependents: string[];
+    }[];
+  };
   grace: {
     undocumentedSourceAreas: { path: string; reason: string }[];
     unboundInvariants: { id: string; reason: string }[];
@@ -87,6 +95,34 @@ export function loadManifest(raw: string): { manifest: Manifest } | { error: str
       if (!isArray(doc?.documents)) problems.push("docs[" + i + "].documents must be an array");
     });
   }
+  if (m.contracts !== undefined) {
+    if (typeof m.contracts !== "object" || m.contracts === null || isArray(m.contracts)) {
+      problems.push("contracts must be an object");
+    } else {
+      const contracts = m.contracts as Partial<NonNullable<Manifest["contracts"]>>;
+      if (contracts.version !== 1) problems.push("contracts.version must be 1");
+      if (!isArray(contracts.entries)) problems.push("contracts.entries must be an array");
+      else {
+        contracts.entries.forEach((entry, i) => {
+          if (typeof entry?.id !== "string" || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(entry.id)) {
+            problems.push("contracts.entries[" + i + "].id must be a kebab-case string");
+          }
+          if (typeof entry?.owner !== "object" || entry.owner === null || isArray(entry.owner)) {
+            problems.push("contracts.entries[" + i + "].owner must be an object");
+          } else {
+            if (typeof entry.owner.document !== "string") problems.push("contracts.entries[" + i + "].owner.document must be a string");
+            if (typeof entry.owner.anchor !== "string") problems.push("contracts.entries[" + i + "].owner.anchor must be a string");
+          }
+          if (!isArray(entry?.dependents)) problems.push("contracts.entries[" + i + "].dependents must be an array");
+          else {
+            entry.dependents.forEach((dependent, j) => {
+              if (typeof dependent !== "string") problems.push("contracts.entries[" + i + "].dependents[" + j + "] must be a string");
+            });
+          }
+        });
+      }
+    }
+  }
   const grace = m.grace as Partial<Manifest["grace"]> | undefined;
   if (!grace) problems.push("grace must be an object");
   else {
@@ -210,8 +246,7 @@ export function renderIndex(manifest: Manifest): string {
   lines.push("## Which doc describes which source");
   lines.push("");
   lines.push("A source area can be described by more than one doc, because these docs are organised by topic and");
-  lines.push(BT + "src/" + BT + " is organised by module. Changing an area obliges the same change to update every doc listed");
-  lines.push("for it; see [" + BT + "AGENTS.md" + BT + "](AGENTS.md).");
+  lines.push(BT + "src/" + BT + " is organised by module. Changing an area requires review of every listed document. Edit only the documents whose local explanation changes; named cross-cutting authorities and dependents are listed below.");
   lines.push("");
   lines.push("| Source path | Described by |");
   lines.push("| --- | --- |");
@@ -232,6 +267,23 @@ export function renderIndex(manifest: Manifest): string {
     lines.push("| " + BT + row.path + BT + " | " + row.reason + " |");
   }
   lines.push("");
+  if (manifest.contracts?.entries.length) {
+    lines.push("## Cross-cutting contracts");
+    lines.push("");
+    lines.push("Source review remains defined by the source-to-doc map above. This registry names each authoritative statement and the documents that review it. Link validation proves declared topology, not behavioral correctness.");
+    lines.push("");
+    lines.push("| Contract | Authority | Review dependents |");
+    lines.push("| --- | --- | --- |");
+    for (const contract of [...manifest.contracts.entries].sort((a, b) => a.id.localeCompare(b.id))) {
+      const owner = contract.owner.document + "#" + contract.owner.anchor;
+      const dependents = [...contract.dependents]
+        .sort((a, b) => a.localeCompare(b))
+        .map((document) => "[" + BT + document + BT + "](" + document + ")")
+        .join("<br>") || "—";
+      lines.push("| " + BT + contract.id + BT + " | [" + BT + owner + BT + "](" + owner + ") | " + dependents + " |");
+    }
+    lines.push("");
+  }
   lines.push("## Decision records");
   lines.push("");
   lines.push("Superseded reasoning lives in " + BT + "decisions/" + BT + " as numbered records. A doc states the contract that holds now and");
@@ -376,7 +428,54 @@ export function runStructureChecks(repoRoot: string): string[] {
     if (isTracked(absent.path)) fail(absent.path + " is declared absent in manifest.json but is tracked; the docs describing its absence are wrong");
   }
 
-  // 4. decision records
+  // 4. cross-cutting contract authority
+  const contractIds = new Set<string>();
+  for (const contract of manifest.contracts?.entries ?? []) {
+    if (contractIds.has(contract.id)) fail("contract " + contract.id + " is declared twice");
+    contractIds.add(contract.id);
+
+    const owner = contract.owner.document;
+    const ownerAbs = join(structureDir, owner);
+    if (!declared.includes(owner)) fail("contract " + contract.id + " owner " + owner + " is not a declared structure document");
+    if (!present.includes(owner)) fail("contract " + contract.id + " owner structure/" + owner + " is missing");
+    else if (!headingAnchors(readFileSync(ownerAbs, "utf8")).has(contract.owner.anchor)) {
+      fail("contract " + contract.id + " owner structure/" + owner + " has no #" + contract.owner.anchor + " heading anchor");
+    }
+
+    const dependents = new Set<string>();
+    for (const dependent of contract.dependents) {
+      if (dependents.has(dependent)) fail("contract " + contract.id + " lists dependent " + dependent + " twice");
+      dependents.add(dependent);
+      if (dependent === owner) fail("contract " + contract.id + " lists its owner " + owner + " as a dependent");
+      if (!declared.includes(dependent)) fail("contract " + contract.id + " dependent " + dependent + " is not a declared structure document");
+      if (!present.includes(dependent)) {
+        fail("contract " + contract.id + " dependent structure/" + dependent + " is missing");
+        continue;
+      }
+      const dependentAbs = join(structureDir, dependent);
+      const body = withoutFences(readFileSync(dependentAbs, "utf8"));
+      let linked = false;
+      let hit: RegExpExecArray | null;
+      linkRe.lastIndex = 0;
+      while ((hit = linkRe.exec(body))) {
+        const separator = hit[1].indexOf("#");
+        if (separator === -1) continue;
+        const file = hit[1].slice(0, separator);
+        const fragment = hit[1].slice(separator + 1);
+        const resolved = file === "" ? dependentAbs : resolve(dirname(dependentAbs), file);
+        const target = toPosix(relative(structureDir, resolved));
+        if (target === owner && fragment === contract.owner.anchor) {
+          linked = true;
+          break;
+        }
+      }
+      if (!linked) {
+        fail("contract " + contract.id + " dependent structure/" + dependent + " does not link " + owner + "#" + contract.owner.anchor);
+      }
+    }
+  }
+
+  // 5. decision records
   const adrFiles = present.filter((p) => p.startsWith("decisions/"));
   const referenced = new Map<string, Set<string>>();
   // Ownership is the declared link form, read with fences removed. A record path mentioned in prose
@@ -417,7 +516,7 @@ export function runStructureChecks(repoRoot: string): string[] {
   }
   for (const key of referenced.keys()) if (!adrFiles.includes(key)) fail("a doc links structure/" + key + ", which does not exist");
 
-  // 5. invariant-to-test bindings
+  // 6. invariant-to-test bindings
   const overviewPath = join(structureDir, "overview.md");
   if (!existsSync(overviewPath)) {
     fail("structure/overview.md is missing; it is the invariant index, and its absence would silence every binding check");
@@ -472,7 +571,7 @@ export function runStructureChecks(repoRoot: string): string[] {
     }
   }
 
-  // 6. source-to-doc map
+  // 7. source-to-doc map
   const described = new Map<string, string[]>();
   // What a doc actually names, so a manifest claim cannot invent coverage the prose does not have.
   const namedByDoc = new Map<string, string[]>();
@@ -530,7 +629,7 @@ export function runStructureChecks(repoRoot: string): string[] {
     fail(area + " is described by no doc; add it to a doc's " + BT + "documents" + BT + " list or record it in grace.undocumentedSourceAreas with a reason");
   }
 
-  // 7. generated index parity
+  // 8. generated index parity
   const indexPath = join(structureDir, "INDEX.md");
   const expected = renderIndex(manifest);
   if (!existsSync(indexPath)) fail("structure/INDEX.md is missing; run bun run structure:index");
@@ -541,11 +640,27 @@ export function runStructureChecks(repoRoot: string): string[] {
   return failures;
 }
 
+/**
+ * Rewrite the generated index only after the manifest validates. The renderer trusts the typed
+ * shape, so a malformed manifest (for example a string where `contracts.entries` belongs) would
+ * otherwise crash the renderer with a TypeError and could write a broken index before the checker
+ * ever ran. Validation failure is an actionable schema diagnostic and leaves INDEX.md untouched.
+ */
+export function writeGeneratedIndex(repoRoot: string): { wrote: true } | { error: string } {
+  const loaded = loadManifest(readFileSync(join(repoRoot, "structure", "manifest.json"), "utf8"));
+  if ("error" in loaded) return { error: loaded.error };
+  writeFileSync(join(repoRoot, "structure", "INDEX.md"), renderIndex(loaded.manifest), "utf8");
+  return { wrote: true };
+}
+
 if (import.meta.main) {
   const repoRoot = resolve(import.meta.dir, "..");
   if (process.argv.includes("--fix")) {
-    const manifest = JSON.parse(readFileSync(join(repoRoot, "structure/manifest.json"), "utf8")) as Manifest;
-    writeFileSync(join(repoRoot, "structure/INDEX.md"), renderIndex(manifest), "utf8");
+    const fixed = writeGeneratedIndex(repoRoot);
+    if ("error" in fixed) {
+      console.error(fixed.error);
+      process.exit(1);
+    }
     console.log("wrote structure/INDEX.md");
   }
   const failures = runStructureChecks(repoRoot);
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index a9e14f2c28c..ef1c68922bb 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -171,6 +171,7 @@
     "key-attribution.test.ts": "usage",
     "provider-send-path-import.test.ts": "server",
     "socks5-fetch.test.ts": "lib",
+    "socks5-upload-lifecycle.test.ts": "lib",
     "start-args.test.ts": "cli",
     "responses-core-modules.test.ts": "responses",
     "responses-passthrough-transient-policy.test.ts": "responses",
@@ -180,6 +181,7 @@
     "chat-responses-control-integration.test.ts": "responses",
     "coding-agent-tool-result-images.test.ts": "adapters",
     "cold-spawn-warmup.test.ts": "ci-workflows",
+    "warmup-registration.test.ts": "ci-workflows",
     "hub-usage.test.ts": "server",
     "client-hub-usage.test.ts": "clients",
     "cli-usage-hub.test.ts": "cli",
@@ -210,6 +212,7 @@
     "alibaba-region-backup.test.ts": "providers",
     "alibaba-region-migration.test.ts": "providers",
     "alibaba-region-startup.test.ts": "providers",
+    "alibaba-token-plan-responses-optin.test.ts": "providers",
     "always-on-429-failover.test.ts": "routing",
     "anthropic-account-pool.test.ts": "adapters/anthropic",
     "anthropic-agentrouter-language-framing.test.ts": "adapters/anthropic",
@@ -275,6 +278,7 @@
     "azure-model-router-tool-schema.test.ts": "providers",
     "bare-echo-alias.test.ts": "responses",
     "responses-bare-echo-helper-fence.test.ts": "responses",
+    "responses-default-namespace-emit-normalize.test.ts": "responses",
     "responses-preview-main-read-fence.test.ts": "responses",
     "baseten-provider.test.ts": "providers",
     "bearer-admission-routed-provider.test.ts": "codex-integration",
@@ -373,7 +377,6 @@
     "cleanup-orphaned-workflows.test.ts": "ci-workflows",
     "clearable-deadline.test.ts": "lib",
     "cli-account-orca-import.test.ts": "cli",
-
     "cli-account-pin-drain.test.ts": "cli",
     "cli-account-pool-verbs.test.ts": "cli",
     "cli-account.test.ts": "cli",
@@ -604,6 +607,7 @@
     "context-history-ownership.test.ts": "server",
     "context-history.test.ts": "server",
     "context-window-seed-repair.test.ts": "providers",
+    "vision-classification-seed-repair.test.ts": "providers",
     "continuation-dedup.test.ts": "responses",
     "core-lab-boundary.test.ts": "lab",
     "cost-cap-unknown-evidence.test.ts": "usage",
@@ -708,6 +712,7 @@
     "docs-429-failover-claims.test.ts": "ci-workflows",
     "docs-bun-source-requirement.test.ts": "ci-workflows",
     "docs-provider-billing-claims.test.ts": "ci-workflows",
+    "docs-provider-preset-counts.test.ts": "ci-workflows",
     "docs-readme-translation-parity.test.ts": "ci-workflows",
     "docs-remote-hub-claims.test.ts": "ci-workflows",
     "doctor-codex-envkey-readiness.test.ts": "service",
@@ -773,11 +778,13 @@
     "google-signature-history-roundtrip.test.ts": "adapters/google",
     "google-structured-output.test.ts": "adapters/google",
     "google-tool-result-adjacency.test.ts": "adapters/google",
+    "google-tool-schema-contract.test.ts": "adapters/google",
     "google-tool-schema.test.ts": "adapters/google",
     "google-vertex-http.test.ts": "adapters/google",
     "google-vertex-stream.test.ts": "adapters/google",
     "google-vertex-thought-signature.test.ts": "adapters/google",
     "google-wire-compiler.test.ts": "adapters/google",
+    "google-wire-shape.test.ts": "adapters/google",
     "grok-attribution.test.ts": "providers/xai",
     "grok-config-inject.test.ts": "providers/xai",
     "grok-effort-inject.test.ts": "providers/xai",
@@ -815,6 +822,7 @@
     "integrations-merge.test.ts": "clients",
     "integrations-serialize.test.ts": "clients",
     "integrations-state.test.ts": "clients",
+    "integrations-writer-frozen-config.test.ts": "clients",
     "integrations-writer.test.ts": "clients",
     "interactive-confirm.test.ts": "cli",
     "issue-452-empty-503.test.ts": "codex-integration",
@@ -920,9 +928,12 @@
     "main-quota-provenance.test.ts": "codex-integration",
     "main-quota-window-observation.test.ts": "codex-integration",
     "management-api-logs-metrics.test.ts": "server",
+    "management-metrics-export.test.ts": "server",
     "management-client-config-route.test.ts": "server",
     "management-integration-journal-delete.test.ts": "server",
     "management-integration-routes.test.ts": "server",
+    "management-model-roster-gather-race.test.ts": "server",
+    "management-model-roster.test.ts": "server",
     "management-origin-tls.test.ts": "server",
     "management-provider-pinsless-validation.test.ts": "server",
     "management-provider-proto-override.test.ts": "server",
@@ -963,6 +974,7 @@
     "muse-spark-web-search-compat.test.ts": "providers",
     "muse-subscription-usage.test.ts": "providers",
     "muse-tool-name-alias.test.ts": "providers",
+    "mutation-plan.test.ts": "clients",
     "namespace-tool-compat.test.ts": "responses",
     "native-alias-maintainer-regressions.test.ts": "codex-integration",
     "native-claude-code-toggle.test.ts": "codex-integration",
@@ -1079,6 +1091,7 @@
     "passthrough-override.test.ts": "responses",
     "phase100-native-parity.test.ts": "e2e-style",
     "pi-path-contract.test.ts": "clients",
+    "pinned-http-content-coding.test.ts": "lib",
     "pinned-http.test.ts": "lib",
     "pinned-https-get.test.ts": "images",
     "plaintext-v2-agent-messages-server.test.ts": "server",
@@ -1157,6 +1170,8 @@
     "relay-eager.test.ts": "server",
     "release-helper.test.ts": "ci-workflows",
     "release-notes.test.ts": "ci-workflows",
+    "resolved-model-policy-consumers.test.ts": "routing",
+    "resolved-model-policy.test.ts": "providers",
     "release-version-line.test.ts": "ci-workflows",
     "remote-catalog.test.ts": "clients",
     "remote-workspace-activation.test.ts": "clients",
@@ -1205,14 +1220,19 @@
     "responses-account-label.test.ts": "responses",
     "responses-canonical-only-top-level-fields.test.ts": "responses",
     "responses-compact-handoff-admission.test.ts": "responses",
+    "responses-compaction-override.test.ts": "responses",
     "responses-compaction-routing.test.ts": "responses",
     "responses-compaction.test.ts": "responses",
     "responses-console-go-upload-retry.test.ts": "responses",
     "responses-context-overflow.test.ts": "responses",
     "responses-custom-tool-guidance.test.ts": "responses",
+    "responses-custom-tool-repair-dispatch.test.ts": "responses",
     "responses-custom-tool-repair.test.ts": "responses",
+    "responses-custom-tool-stream-consistency.test.ts": "responses",
+    "responses-freeform-wrapper-keys.test.ts": "responses",
     "responses-fetch-helpers-boundary.test.ts": "responses",
     "responses-hosted-tool-declaration.test.ts": "responses",
+    "responses-hosted-tool-min-spread.test.ts": "responses",
     "responses-field-backfill.test.ts": "responses",
     "responses-forward-dangling-call.test.ts": "responses",
     "responses-forward-incomplete-quota.test.ts": "responses",
@@ -1223,6 +1243,7 @@
     "responses-inbound-store-default.test.ts": "responses",
     "responses-item-id-repair.test.ts": "responses",
     "responses-json-events.test.ts": "responses",
+    "responses-legacy-dotted-tool-name-repair.test.ts": "responses",
     "responses-muse-tool-name-alias.test.ts": "responses",
     "responses-native-main-refresh.test.ts": "responses",
     "responses-opaque-blob-recovery.test.ts": "responses",
@@ -1338,6 +1359,9 @@
     "sponsor-presets.test.ts": "providers",
     "spend-ceiling-enforcement.test.ts": "lib",
     "spend-ledger-file-journal.test.ts": "lib",
+    "spend-ledger-lifecycle.test.ts": "server",
+    "spend-ledger-owner-startup.test.ts": "server",
+    "spend-ledger-owner.test.ts": "lib",
     "spend-reservation-ledger.test.ts": "lib",
     "sse-client-frame-bounds.test.ts": "responses",
     "sse-decoder.test.ts": "responses",
@@ -1399,6 +1423,7 @@
     "tool-choice-performance.test.ts": "adapters",
     "transient-budget-scope-source.test.ts": "lib",
     "translator-budget.test.ts": "adapters",
+    "transport-null-body.test.ts": "lib",
     "tray-proxy-deadline.test.ts": "windows",
     "tray-proxy.test.ts": "windows",
     "types-barrel-identity.test.ts": "config",
@@ -1446,6 +1471,7 @@
     "vision-anthropic.test.ts": "vision",
     "vision-backend-union.test.ts": "vision",
     "vision-cache.test.ts": "vision",
+    "vision-custom-row-precedence.test.ts": "vision",
     "vision-eligibility.test.ts": "vision",
     "vision-fail-closed.test.ts": "vision",
     "vision-reasoning-contract.test.ts": "vision",
@@ -1463,6 +1489,7 @@
     "web-search-parse.test.ts": "web-search",
     "web-search-passthrough-bridge.test.ts": "web-search",
     "web-search-progress-stream.test.ts": "web-search",
+    "web-search-retry-heartbeat.test.ts": "web-search",
     "web-search-sources.test.ts": "web-search",
     "web-search-timeout-contract.test.ts": "web-search",
     "web-search-timeout-plan.test.ts": "web-search",
@@ -1505,6 +1532,7 @@
     "yaml-fragment-source.test.ts": "config",
     "z-fulfill.test.ts": "images",
     "z-handler-activation.test.ts": "images",
+    "zai-reasoning-replay.test.ts": "providers",
     "zcode-client.test.ts": "providers",
     "zhipu-bigmodel-provider.test.ts": "providers",
     "zhipu-bigmodel-responses-quota.test.ts": "providers",
@@ -1531,7 +1559,14 @@
     "ws-steering-smoke.test.ts": "responses",
     "combo-authoritative-reset.test.ts": "codex-integration",
     "devin-stated-reset-hardening.test.ts": "providers",
-    "devin-stated-reset-retry.test.ts": "providers"
+    "devin-stated-reset-retry.test.ts": "providers",
+    "ci-structure-gate.test.ts": "ci-workflows",
+    "responses-code-mode-patch-compile.test.ts": "responses",
+    "gui-codex-usage-score-parity.test.ts": "gui",
+    "web-search-sidecar-429.test.ts": "web-search",
+    "management-google-tool-schema-policy.test.ts": "server",
+    "codex-shim-destroyed-probe.test.ts": "codex-integration",
+    "client-runtime.test.ts": "clients"
   },
   "migrated": [
     "adapters",
diff --git a/src/adapters/anthropic-image-codec.ts b/src/adapters/anthropic-image-codec.ts
index 71adc461368..c0c9ceb6c57 100644
--- a/src/adapters/anthropic-image-codec.ts
+++ b/src/adapters/anthropic-image-codec.ts
@@ -41,7 +41,9 @@ export const MAX_INPUT_BASE64_LENGTH = 64 * MiB;
  * would widen the adapter contract with no demonstrated need.
  */
 export const IMAGE_NORMALIZE_CONCURRENCY = 4;
-export const MAX_INPUT_PIXELS = 100_000_000;
+// Keep one decoded RGBA surface below 64 MiB. Native codecs may allocate additional
+// working buffers, so this is paired with process-wide admission in the normalizer.
+export const MAX_INPUT_PIXELS = 16_000_000;
 
 
 /** Formats Anthropic accepts as-is; anything else must be transcoded or dropped. */
@@ -50,6 +52,8 @@ const PASSTHROUGH_MEDIA = new Set(["image/jpeg", "image/png", "image/gif", "imag
 export interface NormalizeOptions {
   /** Shift every image's starting ladder position down (413 retry tightening; 030). */
   tierBias?: number;
+  /** Cancels queued native decode work and stops pulling more images. */
+  abortSignal?: AbortSignal;
   /** Test seam: replaces the Bun.Image encode path (audit round 1, blocker 6). */
   encode?: EncodeFn;
   /** Test seam: replaces the pass-through decode validation (C-gate round 1, blocker 1). */
@@ -275,6 +279,9 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
   const meta = await image.metadata();
   const w = typeof meta.width === "number" ? meta.width : 0;
   const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
   let pipeline = new Bun.Image(input);
   if (w > spec.maxEdge || h > spec.maxEdge) {
     const scale = spec.maxEdge / Math.max(w, h);
@@ -290,7 +297,14 @@ export const bunImageEncode: EncodeFn = async (input, spec, quality) => {
  * instead of riding pass-through to an Anthropic 400 (C-gate round 1, blocker 1).
  */
 export const bunImageValidate: ValidateFn = async input => {
-  await new Bun.Image(input).resize(1, 1).jpeg({ quality: 1 }).toBuffer();
+  const image = new Bun.Image(input);
+  const meta = await image.metadata();
+  const w = typeof meta.width === "number" ? meta.width : 0;
+  const h = typeof meta.height === "number" ? meta.height : 0;
+  if (w <= 0 || h <= 0 || w * h > MAX_INPUT_PIXELS) {
+    throw new Error("image dimensions exceed the safe decode limit");
+  }
+  await image.resize(1, 1).jpeg({ quality: 1 }).toBuffer();
 };
 
 /**
diff --git a/src/adapters/anthropic-image-normalize.ts b/src/adapters/anthropic-image-normalize.ts
index e84032cab7c..b5c4c280edc 100644
--- a/src/adapters/anthropic-image-normalize.ts
+++ b/src/adapters/anthropic-image-normalize.ts
@@ -32,6 +32,37 @@ import { recordedEmittedPosition, recordEmittedPosition } from "./anthropic-imag
 import { IMAGE_NORMALIZE_CONCURRENCY, MAX_INPUT_BASE64_LENGTH, MAX_INPUT_PIXELS } from "./anthropic-image-codec";
 import type { NormalizeOptions } from "./anthropic-image-codec";
 
+const IMAGE_DECODE_PROCESS_CONCURRENCY = IMAGE_NORMALIZE_CONCURRENCY;
+let activeImageDecodes = 0;
+const imageDecodeWaiters: Array<() => void> = [];
+
+async function enterImageDecode(signal?: AbortSignal): Promise<() => void> {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+  let transferred = false;
+  if (activeImageDecodes >= IMAGE_DECODE_PROCESS_CONCURRENCY) {
+    await new Promise<void>((resolve, reject) => {
+      const admit = (): void => {
+        transferred = true;
+        signal?.removeEventListener("abort", abort);
+        resolve();
+      };
+      const abort = (): void => {
+        const index = imageDecodeWaiters.indexOf(admit);
+        if (index >= 0) imageDecodeWaiters.splice(index, 1);
+        reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+      };
+      imageDecodeWaiters.push(admit);
+      signal?.addEventListener("abort", abort, { once: true });
+    });
+  }
+  if (!transferred) activeImageDecodes++;
+  return () => {
+    const next = imageDecodeWaiters.shift();
+    if (next) next();
+    else activeImageDecodes--;
+  };
+}
+
 const UNDECODABLE_TEXT = "[image omitted: undecodable or corrupt image data]";
 const BOMB_TEXT = "[image omitted: image too large to process safely]";
 const OVERFLOW_DROP_TEXT = "[image omitted: total image payload exceeded the provider request budget; older images were dropped]";
@@ -104,8 +135,24 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   const budget = options.budget ?? TOTAL_IMAGE_BASE64_BUDGET;
   const overflowAction = options.overflowAction ?? "none";
   const processLimit = options.processLimit ?? Number.POSITIVE_INFINITY;
+  const abortSignal = options.abortSignal;
   const n = targets.length;
 
+  const process = async (b64: string, pos: number, mediaType: string) => {
+    if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+    const leave = await enterImageDecode(abortSignal);
+    try {
+      // Re-check after admission: an abort landing between dequeue and decode-start
+      // must not begin decoding (an in-flight native decode cannot be interrupted).
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      const result = await processAt(b64, pos, mediaType, encode, validate);
+      if (abortSignal?.aborted) throw abortSignal.reason ?? new DOMException("Aborted", "AbortError");
+      return result;
+    } finally {
+      leave();
+    }
+  };
+
   // sourceB64/sourceMedia are the ORIGINAL input (encode source + cache identity);
   // size always reflects the bytes currently ON the wire for this target (the core is
   // the only mutator, so tracked size cannot drift from reality).
@@ -167,7 +214,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
       // age tier on a cold store, which is the pre-#4532 behaviour.
       const recorded = recordedEmittedPosition(b64, sourceMedia);
       const pos = Math.min((recorded ?? initialPosition(newestFirstIndex, 0)) + Math.max(0, bias), TERMINAL_POS);
-      const result = await processAt(b64, pos, sourceMedia, encode, validate);
+      const result = await process(b64, pos, sourceMedia);
       if (result.kind === "failed") {
         target.drop(UNDECODABLE_TEXT);
         if (target.retainsBytesOnDrop) {
@@ -209,7 +256,7 @@ export async function normalizeImageTargets(targets: NormalizeTarget[], options:
   while (sum > budget) {
     const entry = entries.find((e): e is Entry => e !== null && !e.done);
     if (!entry) break; // all terminal — overflowAction below decides
-    const result = await processAt(entry.sourceB64, entry.pos + 1, entry.sourceMedia, encode, validate);
+    const result = await process(entry.sourceB64, entry.pos + 1, entry.sourceMedia);
     if (result.kind === "failed") {
       entry.target.drop(UNDECODABLE_TEXT);
       if (entry.target.retainsBytesOnDrop) {
diff --git a/src/adapters/anthropic.ts b/src/adapters/anthropic.ts
index a822af32d0d..c90f8009a66 100644
--- a/src/adapters/anthropic.ts
+++ b/src/adapters/anthropic.ts
@@ -945,7 +945,10 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
       // Primary image layer: resize/re-encode to fit Anthropic limits without dropping
       // (anthropic-image-normalize.ts); the guard below remains the deterministic backstop.
       // imageTierBias > 0 = upstream-413 tightened retry (030): start every image one tier lower.
-      await normalizeAnthropicImages(messages, { tierBias: incoming?.imageTierBias ?? 0 });
+      await normalizeAnthropicImages(messages, {
+        tierBias: incoming?.imageTierBias ?? 0,
+        abortSignal: incoming?.abortSignal,
+      });
       // Anthropic rejects many-image requests (>20 images) carrying any image over
       // 2000px per side; see anthropic-image-guard.ts for the full limit policy.
       enforceAnthropicImageLimits(messages);
diff --git a/src/adapters/base.ts b/src/adapters/base.ts
index fff735ed98a..0efce92e5b7 100644
--- a/src/adapters/base.ts
+++ b/src/adapters/base.ts
@@ -31,11 +31,34 @@ export interface IncomingMeta {
    * behind it (#4546).
    */
   sendBudget?: RequestExecutionBudget;
+  /**
+   * Physical-send observations for runTurn adapters. Without the same callback carried by
+   * AdapterFetchContext, an adapter-owned replay spends the shared budget but remains absent
+   * from the request's sendCount.
+   */
+  onPhysicalSend?: (send: { ordinal: number; recovery?: AttemptRecoveryKind }) => void;
+  /**
+   * Recovery refusals for runTurn adapters. A refused replay is not a send, so this separate
+   * channel explains why recovery stopped without inflating physical-send telemetry.
+   */
+  onRecoveryWithheld?: (withheld: { reason: AttemptRecoveryWithheld }) => void;
 }
 
 export interface ProviderAdapter {
   name: string;
 
+  /**
+   * This adapter reports every physical inference send through `IncomingMeta.onPhysicalSend`,
+   * including its first.
+   *
+   * The caller normally logs the first send before handing control over, which is correct for a
+   * transport whose sends it can see. An adapter that admits its own sends through the shared
+   * budget can have that first send refused, and a send logged before admission is a send the
+   * log claims and the wire never made. Setting this moves the first send's accounting to the
+   * boundary where it is actually dispatched.
+   */
+  reportsPhysicalSends?: boolean;
+
   /**
    * Convert an already-read provider HTTP error into client-safe text. This hook must be pure and
    * return fully redacted output: callers may pass untrusted provider headers and payload text.
diff --git a/src/adapters/coding-agent/turn.ts b/src/adapters/coding-agent/turn.ts
index c1ff73fa8d5..a264ce188fa 100644
--- a/src/adapters/coding-agent/turn.ts
+++ b/src/adapters/coding-agent/turn.ts
@@ -1,4 +1,4 @@
-import { spawn as nodeSpawn, type ChildProcess, type SpawnOptions } from "node:child_process";
+import { execFileSync, spawn as nodeSpawn, type ChildProcess, type SpawnOptions } from "node:child_process";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../types";
 import { commandInvocation } from "../../lib/win-exec";
 import type { IncomingMeta } from "../base";
@@ -8,6 +8,9 @@ import { resolveCodingAgentBinary, resolveProfileByBaseUrl, type CodingAgentProv
 /** Injectable spawn for tests; production uses node:child_process. */
 export type SpawnFn = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
 
+/** Injectable Windows process-tree terminator; production uses taskkill /T /F. */
+export type KillWindowsProcessTreeFn = (pid: number) => void;
+
 /** Per-turn injectables: spawn/which seams for tests plus wall-clock ceilings for timeout, kill grace, and bounded reap. */
 export interface CodingAgentDeps {
   spawn?: SpawnFn;
@@ -20,6 +23,8 @@ export interface CodingAgentDeps {
   reapTimeoutMs?: number;
   /** Test seam for Windows command-shim invocation. */
   platform?: NodeJS.Platform;
+  /** Test seam for terminating a Windows CLI and all descendants. */
+  killWindowsProcessTree?: KillWindowsProcessTreeFn;
 }
 
 const DEFAULT_TIMEOUT_MS = 300_000;
@@ -27,6 +32,14 @@ const DEFAULT_KILL_GRACE_MS = 2_000;
 /** Bound captured stderr so an error message can never carry an unbounded (or secret) payload. */
 const MAX_STDERR_BYTES = 8 * 1024;
 
+function killWindowsProcessTree(pid: number): void {
+  const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
+  execFileSync(taskkill, ["/PID", String(pid), "/T", "/F"], {
+    stdio: "pipe",
+    windowsHide: true,
+  });
+}
+
 /** Env keys a CLI needs to run; everything else is dropped so the child env is scoped and deterministic. */
 const INHERITED_ENV_KEYS = [
   "PATH", "HOME", "USERPROFILE", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "TEMP", "TMP",
@@ -93,6 +106,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const killGraceMs = deps.killGraceMs ?? DEFAULT_KILL_GRACE_MS;
   const reapTimeoutMs = deps.reapTimeoutMs ?? (killGraceMs * 2 + 250);
+  const platform = deps.platform ?? process.platform;
 
   if (incoming.abortSignal?.aborted) {
     emit({ type: "error", message: "Coding-agent turn was aborted before start." });
@@ -140,7 +154,7 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
 
   const args = buildArgs(profile, parsed, provider);
   const env = buildEnv(profile, apiKey);
-  const invocation = commandInvocation(binary, args, deps.platform ?? process.platform, { env });
+  const invocation = commandInvocation(binary, args, platform, { env });
 
   let child: ChildProcess;
   try {
@@ -197,6 +211,12 @@ export async function runCodingAgentTurn(input: CodingAgentTurnInput): Promise<v
   const kill = (): void => {
     if (killed || child.killed) return;
     killed = true;
+    if (platform === "win32" && child.pid !== undefined) {
+      try {
+        (deps.killWindowsProcessTree ?? killWindowsProcessTree)(child.pid);
+        return;
+      } catch { /* fall back to terminating the direct child */ }
+    }
     try { child.kill("SIGTERM"); } catch { /* already gone */ }
     killTimer = setTimeout(() => {
       try { child.kill("SIGKILL"); } catch { /* already gone */ }
diff --git a/src/adapters/command-code.ts b/src/adapters/command-code.ts
index 111319236a8..35d54ebd463 100644
--- a/src/adapters/command-code.ts
+++ b/src/adapters/command-code.ts
@@ -8,7 +8,7 @@ import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./bas
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { debugDroppedFrame } from "../lib/debug";
-import { configuredReasoningEfforts } from "../reasoning-effort";
+import { configuredReasoningEfforts, modelRecordValue } from "../reasoning-effort";
 import { commandCodeReasoningEfforts, refreshCommandCodeReasoningEfforts } from "../providers/command-code-efforts";
 import { identifyRoutedModel } from "./identity";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
@@ -483,13 +483,51 @@ async function fetchCommandCode(request: AdapterRequest, ctx: AdapterFetchContex
   }
 }
 
+/**
+ * Has the operator declared their own ladders authoritative for this provider?
+ *
+ * Comparing a configured row against the shipped table cannot answer this. `providerConfigSeed`
+ * copies the whole table into every materialized preset, and both enrichment and routing keep a
+ * persisted row over the current seed, so a row written by an older release keeps its old value
+ * and starts LOOKING like an operator edit the moment the shipped table is corrected — at which
+ * point the stale row would outrank the correction and disable the rejection repair below.
+ * Provenance has to be declared rather than inferred, so it is: `providerConfigSeed` never
+ * writes this flag, which makes its presence something only a human can have caused.
+ */
+function operatorChoseCommandCodeLadder(provider: OcxProviderConfig, canonicalId: string): boolean {
+  if (provider.modelReasoningEffortsAuthoritative !== true) return false;
+  return modelRecordValue(provider.modelReasoningEfforts, canonicalId) !== undefined;
+}
+
+/**
+ * Resolve the ladder this request may draw a wire effort from.
+ *
+ * The shipped table is a default, not a ceiling the operator cannot reach past. Until this
+ * existed the adapter read `commandCodeReasoningEfforts() ?? configuredReasoningEfforts()`, so a
+ * model with a row ignored configuration outright while a model without one honoured it — and
+ * the catalog disagreed with both, because `configuredReasoningEfforts` is what advertises the
+ * picker. An operator who widened a pinned row saw the wider ladder offered in Codex and then
+ * watched the adapter strip the rung on the way out (#5096).
+ *
+ * An operator who sets `modelReasoningEffortsAuthoritative` now resolves through the same
+ * function the catalog uses, so the picker and the wire agree, and sanitization, tier healing and
+ * learned-refusal dropping apply to it. Every other provider keeps the shipped table, including a
+ * value learned by a profile refresh.
+ */
+function commandCodeEffortLadder(provider: OcxProviderConfig, canonicalId: string): readonly string[] | undefined {
+  if (operatorChoseCommandCodeLadder(provider, canonicalId)) {
+    return configuredReasoningEfforts(provider, canonicalId);
+  }
+  return commandCodeReasoningEfforts(canonicalId) ?? configuredReasoningEfforts(provider, canonicalId);
+}
+
 function supportedCommandCodeEffort(provider: OcxProviderConfig, modelId: string, requested: string | undefined): string | undefined {
   if (!requested || requested === "none") return undefined;
   // Compatibility ids (deepseek-v4-flash / glm-5.2) must resolve to their canonical
   // Command Code id before the effort lookup, or legacy requests silently lose the
   // reasoning effort because the official table is keyed by the canonical ids.
   const canonicalId = canonicalCommandCodeModelId(modelId);
-  const supported = commandCodeReasoningEfforts(canonicalId) ?? configuredReasoningEfforts(provider, canonicalId);
+  const supported = commandCodeEffortLadder(provider, canonicalId);
   if (!supported) return undefined;
   // Only remap xhigh/ultra→max for models whose official profile documents that
   // aliasing (deepseek v4, glm-5.2). Muse Spark's upstream accepts xhigh as a
@@ -501,7 +539,11 @@ function supportedCommandCodeEffort(provider: OcxProviderConfig, modelId: string
     lower === "zai-org/glm-5.2";
   if (requested === "xhigh" && !supported.includes("xhigh") && supported.includes("max")) {
     wire = "max";
-  } else if (requested === "ultra" && needsAlias && supported.includes("max")) {
+  } else if (requested === "ultra" && needsAlias && !supported.includes("ultra") && supported.includes("max")) {
+    // The xhigh branch above already refuses to alias a rung the ladder advertises; ultra has to
+    // match it. No shipped row offers ultra, so this changes nothing for the built-in table — but
+    // an authoritative operator ladder that does offer it would otherwise advertise ultra in the
+    // picker and quietly send max, which is the catalog/wire disagreement this file just fixed.
     wire = "max";
   }
   return (supported as readonly string[]).includes(wire) ? wire : undefined;
@@ -576,6 +618,11 @@ export function createCommandCodeAdapter(provider: OcxProviderConfig): ProviderA
         try { return (JSON.parse(request.body) as { params?: { model?: unknown } }).params?.model; } catch { return undefined; }
       })();
       if (typeof modelId !== "string") return response;
+      // An operator who wrote this ladder authorized the rung deliberately. Replaying the turn
+      // without it would answer at the provider default and hide a wrong configuration behind a
+      // successful-looking response, so the upstream rejection is what the caller gets. The
+      // downgrade below stays for the shipped table, where the rung was never the caller's idea.
+      if (operatorChoseCommandCodeLadder(provider, canonicalCommandCodeModelId(modelId))) return response;
       const refreshed = await refreshCommandCodeReasoningEfforts(modelId, executor);
       if (!refreshed || refreshed.includes(currentEffort)) return response;
       const retry = requestWithoutReasoningEffort(request);
diff --git a/src/adapters/cursor.ts b/src/adapters/cursor.ts
index 65f4393877b..17f9fd45fd7 100644
--- a/src/adapters/cursor.ts
+++ b/src/adapters/cursor.ts
@@ -254,6 +254,7 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
             coveredMessageCount,
             prefixDigest: cursorCoveredPrefixDigest(_parsed, coveredMessageCount),
             systemDigest: cursorInstructionDigest(_parsed),
+            toolSuspended: toolSuspendedCommit,
           });
           if (!checkpointRef) return;
           if (previousRef && previousRef !== checkpointRef) invalidateCursorCheckpoint(previousRef);
@@ -263,7 +264,8 @@ export function createCursorAdapter(provider: OcxProviderConfig, deps: CursorAda
               ...(_parsed._providerContinuation?.cursor ?? {}),
               conversationId: activeRequest.conversationId,
               // A tool-suspended checkpoint is only usable by the immediate trailing-toolResult
-              // continuation; the request-builder guard keys on checkpointUsable=false for that.
+              // continuation; the request-builder guard keys on this checkpointUsable=false and
+              // the snapshot's persisted toolSuspended flag for that.
               checkpointUsable: !toolSuspendedCommit,
               checkpointRef,
             },
diff --git a/src/adapters/cursor/checkpoint-store.ts b/src/adapters/cursor/checkpoint-store.ts
index 758430064f3..b5ddaa60ef8 100644
--- a/src/adapters/cursor/checkpoint-store.ts
+++ b/src/adapters/cursor/checkpoint-store.ts
@@ -42,6 +42,7 @@ export interface CursorCheckpointSnapshot {
   coveredMessageCount?: number;
   prefixDigest?: string;
   systemDigest?: string;
+  toolSuspended?: boolean;
 }
 
 interface CursorCheckpointStore {
@@ -229,6 +230,7 @@ export function commitCursorCheckpoint(input: {
   coveredMessageCount?: number;
   prefixDigest?: string;
   systemDigest?: string;
+  toolSuspended?: boolean;
 }): string | undefined {
   if (!input.conversationId || !input.modelId || input.checkpointBytes.byteLength === 0) return undefined;
   if (input.checkpointBytes.byteLength > CURSOR_CHECKPOINT_MAX_TOTAL_BYTES) return undefined;
@@ -258,6 +260,7 @@ export function commitCursorCheckpoint(input: {
     ...(input.coveredMessageCount !== undefined ? { coveredMessageCount: input.coveredMessageCount } : {}),
     ...(input.prefixDigest ? { prefixDigest: input.prefixDigest } : {}),
     ...(input.systemDigest ? { systemDigest: input.systemDigest } : {}),
+    ...(input.toolSuspended ? { toolSuspended: true } : {}),
   };
   const blobIds = collectCheckpointBlobIds(input.checkpointBytes);
   if (blobIds === undefined) return undefined;
diff --git a/src/adapters/cursor/discovery.ts b/src/adapters/cursor/discovery.ts
index 9224f9b3ec8..cca03619bb5 100644
--- a/src/adapters/cursor/discovery.ts
+++ b/src/adapters/cursor/discovery.ts
@@ -305,15 +305,18 @@ export function isCursorRouterModelId(modelId: string): boolean {
 export function filterCursorConfiguredModelsByLiveDiscovery<T extends { id: string }>(
   configured: readonly T[],
   liveIds: readonly string[],
+  maxModeLiveIds: readonly string[] = [],
 ): T[] {
-  return configured.filter(model =>
-    !CURSOR_KNOWN_UNCALLABLE_MODEL_IDS.has(model.id)
-    && (
-      isCursorRouterModelId(model.id)
-      // Synthetic ultra rows ride their base model's account availability.
-      || isCursorModelAvailableForAccount(cursorUltraBaseModelId(model.id) ?? model.id, liveIds)
-    ),
-  );
+  return configured.filter(model => {
+    if (CURSOR_KNOWN_UNCALLABLE_MODEL_IDS.has(model.id)) return false;
+    if (isCursorRouterModelId(model.id)) return true;
+    const ultraBase = cursorUltraBaseModelId(model.id);
+    return isCursorModelAvailableForAccount(ultraBase ?? model.id, liveIds)
+      // Successful discovery is authoritative: synthetic ultra rows additionally require the
+      // account-specific Max Mode capability. Discovery failures bypass this filter and retain
+      // the static seed under the caller's existing degraded-catalog policy.
+      && (ultraBase === undefined || isCursorModelAvailableForAccount(ultraBase, maxModeLiveIds));
+  });
 }
 
 /**
diff --git a/src/adapters/cursor/live-transport.ts b/src/adapters/cursor/live-transport.ts
index f5ad317d051..e0b6b527c42 100644
--- a/src/adapters/cursor/live-transport.ts
+++ b/src/adapters/cursor/live-transport.ts
@@ -87,7 +87,7 @@ import {
   type BackgroundShellTerminationReport,
 } from "./native-exec-shell";
 import type { CursorClientMessage, CursorRunRequest, CursorServerMessage } from "./types";
-import type { CursorTransport, CursorTransportFactoryInput } from "./transport";
+import type { CursorStreamHealthClock, CursorTransport, CursorTransportFactoryInput } from "./transport";
 import { CursorHttp1BidiConnection } from "./http1-bidi";
 import { isPinnedHttp1 } from "../../lib/upstream-http-version";
 
@@ -107,6 +107,16 @@ const CURSOR_STREAM_SILENCE_FAIL_MS = 30_000;
  * Reset on every decoded frame that is not liveness-only.
  */
 const CURSOR_STREAM_HEARTBEAT_ONLY_FAIL_MS = 90_000;
+/**
+ * The production T04 clock. The watchdog reads time and schedules its one timer through this
+ * object so a test can supply a clock it advances by hand; nothing else about the transport's
+ * timers moves with it.
+ */
+const REAL_STREAM_HEALTH_CLOCK: CursorStreamHealthClock = {
+  now: () => Date.now(),
+  setTimeout: (callback, ms) => setTimeout(callback, ms),
+  clearTimeout: timer => clearTimeout(timer),
+};
 /**
  * After `turnEnded` is decoded, the application turn is complete. A server that keeps
  * HTTP/2 open past this point cannot hold the turn hostage (senpi #1062): we close our side
@@ -494,6 +504,8 @@ class LiveCursorTransport implements CursorTransport {
   private lastInboundFrameAt = 0;
   private lastMeaningfulFrameAt = 0;
   private streamHealthFail?: (error: Error) => void;
+  /** Time source for the T04 watchdog only; the globals unless a test injects one. */
+  private readonly streamHealthClock: CursorStreamHealthClock;
   private committed = false;
   private expectedClose = false;
   /**
@@ -542,6 +554,7 @@ class LiveCursorTransport implements CursorTransport {
     // so the transport-level race test can drive it deterministically.
     this.clientToolFinalizeGraceMs = input.clientToolFinalizeGraceMs ?? CLIENT_TOOL_FINALIZE_GRACE_MS;
     this.activeClientToolFinalizeGraceMs = this.clientToolFinalizeGraceMs;
+    this.streamHealthClock = input.streamHealthClock ?? REAL_STREAM_HEALTH_CLOCK;
     // Desktop (computer-use / record-screen) executors are available even with no MCP servers.
     this.desktopDeps = desktopDepsFromConfig(input.provider.desktopExecutor);
     this.execContext = {
@@ -847,7 +860,7 @@ class LiveCursorTransport implements CursorTransport {
 
   private clearStreamHealthTimer(): void {
     if (this.streamHealthTimer) {
-      clearTimeout(this.streamHealthTimer);
+      this.streamHealthClock.clearTimeout(this.streamHealthTimer);
       this.streamHealthTimer = undefined;
     }
     this.streamHealthFail = undefined;
@@ -858,24 +871,28 @@ class LiveCursorTransport implements CursorTransport {
    * failAndClear; the timer owns nothing else. Never armed before the first decoded
    * frame (the first-frame timer covers dial + first response), and disarmed by
    * every settle / expected-close path alongside the other timers.
+   *
+   * Both clocks and the timer go through `streamHealthClock`, which is the globals in
+   * production. The `elapsedMs` diagnostic below deliberately stays on the wall clock,
+   * because `turnStartedAt` is stamped there and the pair has to subtract coherently.
    */
   private armStreamHealthTimer(fail: (error: Error) => void): void {
-    if (this.streamHealthTimer) clearTimeout(this.streamHealthTimer);
+    if (this.streamHealthTimer) this.streamHealthClock.clearTimeout(this.streamHealthTimer);
     if (this.expectedClose) return;
     this.streamHealthFail = fail;
     const silenceMs = this.input.streamSilenceFailMs ?? CURSOR_STREAM_SILENCE_FAIL_MS;
     const heartbeatOnlyMs = this.input.streamHeartbeatOnlyFailMs ?? CURSOR_STREAM_HEARTBEAT_ONLY_FAIL_MS;
-    const now = Date.now();
+    const now = this.streamHealthClock.now();
     const deadline = Math.min(
       this.lastInboundFrameAt + silenceMs,
       this.lastMeaningfulFrameAt + heartbeatOnlyMs,
     );
-    this.streamHealthTimer = setTimeout(() => {
+    this.streamHealthTimer = this.streamHealthClock.setTimeout(() => {
       this.streamHealthTimer = undefined;
       const failFn = this.streamHealthFail;
       if (!failFn || this.expectedClose) return;
-      const stalledFor = Date.now() - this.lastInboundFrameAt;
-      const meaningfulStalledFor = Date.now() - this.lastMeaningfulFrameAt;
+      const stalledFor = this.streamHealthClock.now() - this.lastInboundFrameAt;
+      const meaningfulStalledFor = this.streamHealthClock.now() - this.lastMeaningfulFrameAt;
       if (stalledFor < silenceMs && meaningfulStalledFor < heartbeatOnlyMs) {
         // A frame landed between arming and firing — re-arm for the fresh deadline.
         this.armStreamHealthTimer(failFn);
@@ -906,7 +923,7 @@ class LiveCursorTransport implements CursorTransport {
    * heartbeat-only threshold.
    */
   private noteInboundFrame(livenessOnly: boolean): void {
-    const now = Date.now();
+    const now = this.streamHealthClock.now();
     this.lastInboundFrameAt = now;
     if (!livenessOnly) this.lastMeaningfulFrameAt = now;
     if (this.streamHealthFail) this.armStreamHealthTimer(this.streamHealthFail);
@@ -1288,7 +1305,7 @@ class LiveCursorTransport implements CursorTransport {
       const decodedUpdate = decoded.message.case === "interactionUpdate" ? decoded.message.value.message?.case : undefined;
       const livenessOnly = decodedUpdate === "heartbeat" || decoded.message.case === "conversationCheckpointUpdate";
       if (!this.streamHealthFail) {
-        const now = Date.now();
+        const now = this.streamHealthClock.now();
         this.lastInboundFrameAt = now;
         this.lastMeaningfulFrameAt = now;
         this.streamHealthFail = failAndClear;
diff --git a/src/adapters/cursor/request-builder.ts b/src/adapters/cursor/request-builder.ts
index 3eb922b9689..065f971afa3 100644
--- a/src/adapters/cursor/request-builder.ts
+++ b/src/adapters/cursor/request-builder.ts
@@ -476,7 +476,13 @@ function resolveCursorCheckpoint(
   if (cursorCheckpointModelAffinityId(snapshot.modelId) !== cursorCheckpointModelAffinityId(request.modelId)) {
     return { reason: "model_changed" };
   }
-  if (parsed.context.messages.at(-1)?.role !== "toolResult" && cursorState?.checkpointUsable === false) {
+  // The continuation state only exists on the ref path; a ref-less prefix hit carries
+  // the suspension on the snapshot itself, or a non-toolResult request could resume
+  // bytes upstream serialized mid-tool-call.
+  if (
+    parsed.context.messages.at(-1)?.role !== "toolResult"
+    && (snapshot.toolSuspended === true || cursorState?.checkpointUsable === false)
+  ) {
     return { reason: "trailing_tool_result" };
   }
   const lineage = lineageMismatch(parsed, snapshot);
diff --git a/src/adapters/cursor/transport.ts b/src/adapters/cursor/transport.ts
index 79f241ca0e4..5cb3c099c8a 100644
--- a/src/adapters/cursor/transport.ts
+++ b/src/adapters/cursor/transport.ts
@@ -55,6 +55,25 @@ export interface CursorTransportFactoryInput {
    * client thread. Distinct from the per-transport native-exec/shell owner.
    */
   sessionId?: string;
+  /**
+   * Test-only clock for the T04 inbound stream-health watchdog. Production omits it and the
+   * transport uses the global timers; injecting here must not change scheduling semantics.
+   *
+   * It exists because the watchdog's contract — a meaningful frame re-arms both deadlines — can
+   * only be asserted against real timers by keeping a synthetic server delivering frames faster
+   * than the silence budget for several multiples of it. That is an assertion about how busy the
+   * machine is, and it failed in the unsharded macOS lane for exactly that reason while the
+   * watchdog was working correctly. With the clock injected, virtual time advances only where
+   * the test says it does, so no amount of runner contention can expire a deadline.
+   */
+  streamHealthClock?: CursorStreamHealthClock;
+}
+
+/** The three time primitives the T04 watchdog uses. Production binds all three to the globals. */
+export interface CursorStreamHealthClock {
+  now(): number;
+  setTimeout(callback: () => void, ms: number): ReturnType<typeof setTimeout>;
+  clearTimeout(timer: ReturnType<typeof setTimeout>): void;
 }
 
 export type CursorTransportFactory = (input: CursorTransportFactoryInput) => CursorTransport;
diff --git a/src/adapters/devin.ts b/src/adapters/devin.ts
index 0ff3b7da335..5832b2be8b7 100644
--- a/src/adapters/devin.ts
+++ b/src/adapters/devin.ts
@@ -15,6 +15,8 @@ import { getCachedCatalog, type CacheEntry } from "./devin/cloud-direct/catalog"
 import { collapseDevinModelUid } from "./devin/live-models";
 import { buildNonOpenAIToolCatalogNudgeForTools } from "./tool-catalog-nudge";
 import { DEVIN_DEFAULT_API_SERVER, resolveDevinApiServer } from "../oauth/devin";
+import { isProviderIssuedThinkingSignature } from "../responses/reasoning-envelope";
+import { SendBudgetExhaustedError } from "../lib/upstream-retry";
 
 /**
  * Combine two usage frames from one turn by keeping the larger count per field.
@@ -253,6 +255,17 @@ function textFromParts(content: string | OcxContentPart[] | undefined): string {
   return content.map((part) => (part.type === "text" ? part.text : "")).filter(Boolean).join("\n");
 }
 
+const MAX_DEVIN_REMOTE_IMAGE_URL_CHARS = 8_192;
+
+function boundedDevinRemoteImageReference(imageUrl: string): string | undefined {
+  if (imageUrl.length > MAX_DEVIN_REMOTE_IMAGE_URL_CHARS) return undefined;
+  try {
+    return new URL(imageUrl).protocol === "https:" ? imageUrl : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Convert inbound content parts to the multimodal shape the wire encoder accepts.
  *
@@ -261,9 +274,10 @@ function textFromParts(content: string | OcxContentPart[] | undefined): string {
  * text-only string and a message whose only content was an image was dropped
  * entirely, which is why a pasted screenshot killed the turn and the only
  * workaround was running OCR before sending. A data: URL carries everything
- * field #10 needs; a remote https URL cannot be inlined without a fetch, so it
- * stays as an explicit text reference rather than pretending the model can see
- * a picture it cannot. Video has no Devin field and is skipped.
+ * field #10 needs; a bounded remote https URL cannot be inlined without a fetch,
+ * so it stays as an explicit text reference rather than pretending the model can
+ * see a picture it cannot. Unsupported and oversized references become a fixed
+ * omission marker, never attacker-sized prompt text. Video has no Devin field.
  */
 function mapOcxContentToWire(content: string | OcxContentPart[] | undefined): string | ContentPart[] {
   if (typeof content === "string" || !Array.isArray(content)) return content ?? "";
@@ -274,7 +288,13 @@ function mapOcxContentToWire(content: string | OcxContentPart[] | undefined): st
     } else if (part.type === "image") {
       const m = part.imageUrl.match(/^data:([^;]+);base64,(.+)$/);
       if (m) out.push({ type: "image", mimeType: m[1]!, base64Data: m[2]! });
-      else out.push({ type: "text", text: `[image url: ${part.imageUrl}]` });
+      else {
+        const remoteReference = boundedDevinRemoteImageReference(part.imageUrl);
+        out.push({
+          type: "text",
+          text: remoteReference ? `[image url: ${remoteReference}]` : "[image omitted: unsupported or oversized URL]",
+        });
+      }
     }
   }
   return out;
@@ -310,23 +330,26 @@ function assistantText(message: OcxAssistantMessage): string {
  * clients of the same service write #11 thinking with #12 signature and #18
  * signature_type on the assistant prompt.
  *
- * The signature attests the thinking it was produced with, so a block without
- * one contributes its text and nothing else rather than borrowing a neighbour's.
+ * Field #12 attests the exact text at #11, and the wire has room for one pair.
+ * Every block that carries text is replayed, so the chain stays intact; the
+ * signature rides along only when the text being replayed IS the text it
+ * attests, which is exactly the single-block case. Several independently signed
+ * blocks send an unsigned prompt rather than pairing one block's attestation
+ * with another block's words. A signature-only block attests encrypted thinking
+ * that is not being replayed at all, so it is not one of these blocks and
+ * cannot contribute the pair.
  */
 function assistantThinking(
   message: OcxAssistantMessage,
 ): { thinking?: string; signature?: string } {
   const blocks = message.content.filter(
     (part): part is Extract<typeof part, { type: "thinking" }> => part.type === "thinking",
-  );
+  ).filter(part => Boolean(part.thinking));
   if (blocks.length === 0) return {};
-  const thinking = blocks.map(b => b.thinking).filter(Boolean).join("\n");
-  // Only one signature can ride the prompt, so take the last block that has
-  // one: that is the block the turn actually ended on.
-  const signature = blocks.filter(b => b.signature).at(-1)?.signature;
+  const signature = blocks.length === 1 ? blocks[0]!.signature : undefined;
   return {
-    ...(thinking ? { thinking } : {}),
-    ...(signature ? { signature } : {}),
+    thinking: blocks.map(part => part.thinking).join("\n"),
+    ...(isProviderIssuedThinkingSignature(signature) ? { signature } : {}),
   };
 }
 
@@ -490,6 +513,10 @@ export function createDevinAdapter(
 
   return {
     name: "devin",
+    // Every GetChatMessage send, including the first, is admitted through the shared budget and
+    // reported from the executor that dispatches it. The caller therefore leaves the first
+    // send's accounting here rather than logging it before admission can refuse it.
+    reportsPhysicalSends: true,
 
     buildRequest() {
       return {
@@ -584,6 +611,13 @@ export function createDevinAdapter(
             ...(typeof parsed.options.topP === "number" ? { topP: parsed.options.topP } : {}),
           },
           signal: incoming.abortSignal,
+        }, {
+          execution: {
+            executor: incoming.providerFetch,
+            sendBudget: incoming.sendBudget,
+            onPhysicalSend: incoming.onPhysicalSend,
+            onRecoveryWithheld: incoming.onRecoveryWithheld,
+          },
         })) {
           if (incoming.abortSignal?.aborted) {
             // Emitting nothing here left the bridge to synthesize adapter_eof.
@@ -662,6 +696,9 @@ export function createDevinAdapter(
           emit({ type: "error", message: DEVIN_CLIENT_CLOSED_MESSAGE, status: 499, retryable: false, ...(usage ? { usage } : {}) });
           return;
         }
+        // The Responses boundary already maps this local refusal to its structured 429 code.
+        // Converting it to an adapter event would make it an ordinary untyped upstream error.
+        if (error instanceof SendBudgetExhaustedError) throw error;
         const message = error instanceof CloudChatError
           ? ("Devin cloud error" + (error.code ? " " + error.code : "") + ": " + error.message)
           : error instanceof Error ? error.message : String(error);
diff --git a/src/adapters/devin/cloud-direct/chat.ts b/src/adapters/devin/cloud-direct/chat.ts
index 794c5cddf22..34547ecc193 100644
--- a/src/adapters/devin/cloud-direct/chat.ts
+++ b/src/adapters/devin/cloud-direct/chat.ts
@@ -1055,6 +1055,8 @@ export interface CloudChatRequest {
   catalog?: CacheEntry | null;
   /** Abort signal — closes the fetch stream. */
   signal?: AbortSignal;
+  /** Executor for the inference POST only; catalog and JWT RPCs retain their own transport. */
+  executor?: typeof globalThis.fetch;
 }
 
 export class CloudChatError extends Error {
@@ -1216,7 +1218,7 @@ export async function* streamChatEvents(req: CloudChatRequest): AsyncGenerator<C
 
   let resp: Response;
   try {
-    resp = await fetch(`${host}/exa.api_server_pb.ApiServerService/GetChatMessage`, {
+    resp = await (req.executor ?? globalThis.fetch)(`${host}/exa.api_server_pb.ApiServerService/GetChatMessage`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/connect+proto',
diff --git a/src/adapters/devin/cloud-direct/stated-reset-retry.ts b/src/adapters/devin/cloud-direct/stated-reset-retry.ts
index f500cd4b192..d8c87e0851d 100644
--- a/src/adapters/devin/cloud-direct/stated-reset-retry.ts
+++ b/src/adapters/devin/cloud-direct/stated-reset-retry.ts
@@ -5,7 +5,9 @@
  * is idempotent; ambiguous transport failures still propagate unchanged.
  */
 import { parseRetryAfterFromMessage } from '../../../lib/retry-delay.js';
-import { abortError, sleepWithAbort } from '../../../lib/upstream-retry.js';
+import type { AdapterFetchContext } from '../../base.js';
+import { createAdapterPhysicalSend } from '../../physical-send.js';
+import { abortError, SendBudgetExhaustedError, sleepWithAbort } from '../../../lib/upstream-retry.js';
 import { CloudChatError, streamChatEvents, type CloudChatEvent, type CloudChatRequest } from './chat.js';
 
 /** 1 initial attempt plus at most 2 replays. */
@@ -33,6 +35,11 @@ export interface StatedResetRetryOptions {
   maxReplays?: number;
   /** CUMULATIVE wait allowance, not a fresh allowance on every failure. */
   maxWaitMs?: number;
+  /** Request-wide execution authority. Absent preserves context-free callers' unlimited fetch. */
+  execution?: Pick<
+    AdapterFetchContext,
+    "executor" | "sendBudget" | "onPhysicalSend" | "onRecoveryWithheld"
+  >;
 }
 
 function replayLimit(value: number | undefined): number {
@@ -59,15 +66,34 @@ export async function* streamChatEventsWithResetRetry(
   const sleep = options?.sleep ?? sleepWithAbort;
   const maxReplays = replayLimit(options?.maxReplays);
   const maxWaitMs = waitLimit(options?.maxWaitMs);
+  const execution = options?.execution;
+  // One sender owns the whole invocation so ordinals span the initial POST and both replays.
+  // Its executor remains lazy: replay admission happens after the provider-stated wait, never
+  // while a reservation could be held for up to an hour.
+  const send = execution
+    ? createAdapterPhysicalSend({ ...execution, abortSignal: req.signal })
+    : undefined;
   let replays = 0;
   let waitedMs = 0;
+  let replaySourceError: CloudChatError | undefined;
   while (true) {
     // Check again after sleeping: cancellation can race with timer completion.
     // A pre-aborted request must not even enter a custom transport.
     if (req.signal?.aborted) throw abortError(req.signal);
     let yielded = false;
     try {
-      for await (const event of stream(req)) {
+      const recovery = replays > 0 ? "rate-limit-429" as const : undefined;
+      const attemptRequest = send
+        ? {
+            ...req,
+            executor: ((input, init) => send({
+              url: typeof input === "string" ? input : input instanceof URL ? input.href : input.url,
+              ...(recovery ? { sendClass: "auth-recovery" as const, recovery } : {}),
+              dispatch: executor => executor(input, init),
+            })) as typeof globalThis.fetch,
+          }
+        : req;
+      for await (const event of stream(attemptRequest)) {
         // Latch before yielding, so a consumer-injected error is post-output.
         yielded = true;
         yield event;
@@ -75,14 +101,24 @@ export async function* streamChatEventsWithResetRetry(
       return;
     } catch (error) {
       if (req.signal?.aborted) throw abortError(req.signal);
-      const waitSec = !yielded
+      if (!yielded && error instanceof SendBudgetExhaustedError && replaySourceError) {
+        // The provider's refusal is the real upstream answer. A local cap can withhold its
+        // recovery, but replacing the 429 would erase the status and stated reset metadata.
+        execution?.onRecoveryWithheld?.({ reason: "retry-send-budget" });
+        throw replaySourceError;
+      }
+      const retryableError = !yielded
         && error instanceof CloudChatError
         && error.status === 429
-        ? parseRetryAfterFromMessage(error.message)
+        ? error
+        : undefined;
+      const waitSec = retryableError
+        ? parseRetryAfterFromMessage(retryableError.message)
         : undefined;
       const waitMs = waitSec === undefined ? undefined : waitSec * 1000;
       if (
-        waitMs === undefined
+        retryableError === undefined
+        || waitMs === undefined
         || replays >= maxReplays
         || waitMs > maxWaitMs - waitedMs
       ) {
@@ -91,6 +127,7 @@ export async function* streamChatEventsWithResetRetry(
         throw error;
       }
       replays += 1;
+      replaySourceError = retryableError;
       // Charge the complete scheduled wait once, before sleeping. This is a
       // sleep allowance, not a wall-clock deadline on generation or timer
       // scheduling: waking a few milliseconds late must not reject an already
diff --git a/src/adapters/google-antigravity-replay.ts b/src/adapters/google-antigravity-replay.ts
index 9e3453aa590..d4ab5eb8728 100644
--- a/src/adapters/google-antigravity-replay.ts
+++ b/src/adapters/google-antigravity-replay.ts
@@ -629,7 +629,7 @@ export function antigravityUsesReplayCache(model: string): boolean {
  * neither the wire metadata nor the replay cache can supply a real one, this is the official
  * validator-bypass token.
  */
-const THOUGHT_SIGNATURE_BYPASS = "skip_thought_signature_validator";
+export const THOUGHT_SIGNATURE_BYPASS = "skip_thought_signature_validator";
 
 /**
  * True when the model speaks the Gemini wire dialect that requires a thought signature on the
diff --git a/src/adapters/google-antigravity-wire.ts b/src/adapters/google-antigravity-wire.ts
index 8411c8262eb..a40703f8377 100644
--- a/src/adapters/google-antigravity-wire.ts
+++ b/src/adapters/google-antigravity-wire.ts
@@ -77,7 +77,7 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
   //
   // Clients that send no thread header keep the text anchor and its instability; this is a scoped
   // repair, not a universal one.
-  const text = clientThreadAnchor(parsed) ?? firstUserText(parsed);
+  const text = codexThreadAnchor(parsed).preimage ?? firstUserText(parsed);
   if (!text) return `-${Math.floor(Math.random() * 9e18).toString()}`;
   const digest = createHash("sha256").update(text, "utf8").digest();
   const masked = digest.readBigUInt64BE(0) & 0x7fffffffffffffffn;
@@ -96,7 +96,10 @@ export function antigravitySessionId(parsed: OcxParsedRequest): string {
  * functionCall identity (name+args), so a shared id does not misattribute them. Instability, not
  * collision, is the failure mode this function exists to prevent.
  */
-function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
+function codexThreadAnchor(parsed: OcxParsedRequest): {
+  kind: "parent-and-own" | "parent-only" | "absent";
+  preimage?: string;
+} {
   // `_clientThreadId` carries `x-codex-parent-thread-id`, which every parallel child of one
   // parent presents identically, so anchoring on it alone collapsed concurrent children onto a
   // single upstream Cloud Code Assist session (#5033).
@@ -113,9 +116,9 @@ function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
   // survive both compaction and restart.
   const own = parsed._codexOwnThreadId?.trim();
   const parent = parsed._clientThreadId?.trim();
-  if (own && parent) return `codex-thread:${parent}\u0000${own}`;
+  if (own && parent) return { kind: "parent-and-own", preimage: `codex-thread:${parent}\u0000${own}` };
   // Parent-only clients keep the anchor they already had.
-  if (parent) return `codex-thread:${parent}`;
+  if (parent) return { kind: "parent-only", preimage: `codex-thread:${parent}` };
   // A parentless ROOT deliberately omits the parent header. `src/server/context-history.ts` says
   // so in as many words: root model requests use (session-id=root, thread-id=root) and do not
   // fabricate a parent key. It has no pair to key on, and #5054's claim that a root presents
@@ -125,7 +128,28 @@ function clientThreadAnchor(parsed: OcxParsedRequest): string | undefined {
   // preference: durable Antigravity replay state is keyed by model plus session id, and moving a
   // root's anchor on upgrade strands every signature stored under the old session — the exact
   // instability this derivation exists to avoid, introduced while fixing sharing.
-  return undefined;
+  return { kind: "absent" };
+}
+
+/**
+ * Which class of anchor {@link antigravitySessionId} derives this request's session id from.
+ *
+ * The id itself identifies a live conversation and is a Google-visible wire value, so it is not
+ * something a user can paste into a public bug report. The class is: it distinguishes the four
+ * stability regimes above — a Codex parent/child pair, a parent-only client, the content-derived
+ * text anchor that compaction can move, and the random fallback that changes every turn — while
+ * carrying no identity at all.
+ *
+ * It reads the SAME decision the id derivation reads, so the two cannot disagree about which
+ * regime a request is in. What it does not do is change how the id itself is derived: nothing
+ * about a Google-visible wire value moves because a diagnostic wants to describe it.
+ */
+export type AntigravitySessionAnchor = "parent-and-own" | "parent-only" | "text" | "none";
+
+export function antigravitySessionAnchor(parsed: OcxParsedRequest): AntigravitySessionAnchor {
+  const anchor = codexThreadAnchor(parsed);
+  if (anchor.kind !== "absent") return anchor.kind;
+  return firstUserText(parsed) ? "text" : "none";
 }
 
 /** A Gemini content part as it appears in an Antigravity request body. */
diff --git a/src/adapters/google-http.ts b/src/adapters/google-http.ts
index de21ea93fb5..bbebb36cb61 100644
--- a/src/adapters/google-http.ts
+++ b/src/adapters/google-http.ts
@@ -2,8 +2,10 @@ import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { createAdapterPhysicalSend } from "./physical-send";
 import type { SendClass } from "../lib/request-execution-budget";
 import type { AttemptRecoveryKind } from "../usage/log";
+import { debugProviderDiagnosticLazy } from "../lib/debug";
 import { isQuotaExhaustedBody, retryableGoogleStatus, safeGoogleHttpErrorMessage } from "./google-errors";
-import { repairGoogleInvalidRequestBody } from "./google-wire-compiler";
+import { repairGoogleInvalidRequestBodyWithReport } from "./google-wire-compiler";
+import type { GoogleToolSchemaPolicy, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { normalizeUpstreamHttpErrorResponse, readDisplaySafeErrorPayloadText } from "./upstream-http-error";
 import {
   abortError,
@@ -22,6 +24,8 @@ const GOOGLE_RETRY_MAX_MS = 2_000;
 export interface GoogleRetryOptions {
   /** Repair-and-replay structurally invalid 400 bodies (Vertex/Antigravity behavior). */
   repairInvalid400?: boolean;
+  toolSchemaProfile?: GoogleToolSchemaProfile;
+  toolSchemaPolicy?: GoogleToolSchemaPolicy;
 }
 
 async function normalizeFinalGoogleError(label: string, res: Response, signal?: AbortSignal): Promise<Response> {
@@ -45,6 +49,8 @@ export async function fetchGoogleWithRetry(
   opts: GoogleRetryOptions = {},
 ): Promise<Response> {
   const repairInvalid400 = opts.repairInvalid400 ?? true;
+  const toolSchemaProfile = opts.toolSchemaProfile ?? { endpointClass: "vertex" };
+  const toolSchemaPolicy = opts.toolSchemaPolicy ?? "compatible";
   const timeoutMs = ctx.timeoutMs ?? 200_000;
   const send = createAdapterPhysicalSend(ctx);
   let lastError: unknown;
@@ -77,10 +83,22 @@ export async function fetchGoogleWithRetry(
         } catch (error) {
           if (ctx.abortSignal?.aborted) throw error;
         }
-        const repairedBody = repairGoogleInvalidRequestBody(activeRequest.body, payloadText);
-        if (repairedBody !== undefined) {
+        const repair = repairGoogleInvalidRequestBodyWithReport(activeRequest.body, payloadText, toolSchemaProfile);
+        if (repair !== undefined) {
+          if (repair.toolSchemaLoss) {
+            const changedSendAllowed = toolSchemaPolicy !== "reject-lossy";
+            debugProviderDiagnosticLazy("google", "google-tool-schema-repair", () => ({
+              ...repair.toolSchemaLoss,
+              phase: "repair",
+              declarationCount: repair.toolSchemaDeclarationCount ?? 0,
+              changedSendAllowed,
+            }));
+            if (!changedSendAllowed) {
+              return ctx.returnRawErrors ? res : normalizeFinalGoogleError(label, res, ctx.abortSignal);
+            }
+          }
           compatibilityReplayUsed = true;
-          activeRequest = { ...activeRequest, body: repairedBody };
+          activeRequest = { ...activeRequest, body: repair.body };
           pendingResponse = res;
           sendClass = "repair";
           attempt--; // The changed-request replay is separate from transient retry accounting.
@@ -145,16 +163,37 @@ export async function fetchGoogleWithRetry(
  * demand" spikes, plus plain rate-limit 429s, both of which previously failed immediately
  * because the default server fetch path only retries connection resets.
  */
-export function fetchDirectGeminiWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Gemini", request, { ...ctx, returnRawErrors: true }, { repairInvalid400: false });
+export function fetchDirectGeminiWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Gemini", request, { ...ctx, returnRawErrors: true }, {
+    ...schemaPolicy,
+    repairInvalid400: false,
+  });
 }
 
 /** Vertex AI retry wrapper. */
-export function fetchVertexWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Vertex AI", request, ctx);
+export function fetchVertexWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Vertex AI", request, ctx, {
+    toolSchemaProfile: { endpointClass: "vertex" },
+    ...schemaPolicy,
+  });
 }
 
 /** Antigravity (Cloud Code Assist) retry wrapper. */
-export function fetchAntigravityWithRetry(request: AdapterRequest, ctx: AdapterFetchContext = {}): Promise<Response> {
-  return fetchGoogleWithRetry("Antigravity", request, ctx);
+export function fetchAntigravityWithRetry(
+  request: AdapterRequest,
+  ctx: AdapterFetchContext = {},
+  schemaPolicy: Pick<GoogleRetryOptions, "toolSchemaProfile" | "toolSchemaPolicy"> = {},
+): Promise<Response> {
+  return fetchGoogleWithRetry("Antigravity", request, ctx, {
+    toolSchemaProfile: { endpointClass: "cloud-code-assist" },
+    ...schemaPolicy,
+  });
 }
diff --git a/src/adapters/google-tool-schema.ts b/src/adapters/google-tool-schema.ts
index aad7d96bb4f..a28290fe602 100644
--- a/src/adapters/google-tool-schema.ts
+++ b/src/adapters/google-tool-schema.ts
@@ -8,7 +8,38 @@ const ALLOWED_TYPES = new Set(["string", "integer", "number", "boolean", "array"
 const MAX_SCHEMA_DEPTH = 24; // Google's documented nesting limit is 32; leave headroom for CCA.
 const MAX_DEREF_DEPTH = 16;
 const MAX_SCHEMA_NODES = 1_024;
+export const GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT = 255;
 const BUDGET_EXHAUSTED = Symbol("schema-budget-exhausted");
+const NUMERIC_BOUND_KEYS = ["minimum", "maximum", "exclusiveMinimum", "exclusiveMaximum"] as const;
+const SIZE_BOUND_KEYS = ["minLength", "maxLength", "minItems", "maxItems", "minProperties", "maxProperties"] as const;
+const UNSUPPORTED_CONSTRAINT_KEYS = [
+  "allOf",
+  "oneOf",
+  "not",
+  "multipleOf",
+  "pattern",
+  "$dynamicRef",
+  "$recursiveRef",
+  "additionalProperties",
+  "additionalItems",
+  "uniqueItems",
+  "contains",
+  "minContains",
+  "maxContains",
+  "dependencies",
+  "dependentRequired",
+  "dependentSchemas",
+  "patternProperties",
+  "propertyNames",
+  "unevaluatedProperties",
+  "unevaluatedItems",
+] as const;
+const CONDITIONAL_KEYS = ["if", "then", "else"] as const;
+const BOUNDED_VALUE_KEYS = new Set(["enum", "properties", "required", "items", "anyOf"]);
+const RETAINED_UNION_KEYS = ["type", "nullable", "format", "enum", "properties", "items", "required"] as const;
+// Annotation-only keywords do not change the accepted value set. The sanitizer intentionally
+// drops title, default, examples, $comment, deprecated, readOnly, writeOnly, contentEncoding,
+// contentMediaType, contentSchema, externalDocs, and example without loss.
 const MERGED_SCHEMA_KEYS = [
   "type",
   "nullable",
@@ -24,9 +55,150 @@ const MERGED_SCHEMA_KEYS = [
 
 type SanitizeResult = Schema | typeof BUDGET_EXHAUSTED;
 
+export type GoogleToolSchemaEndpointClass = "ai-studio" | "vertex" | "cloud-code-assist";
+export type GoogleToolSchemaPolicy = "compatible" | "reject-lossy";
+
+export interface GoogleToolSchemaProfile {
+  endpointClass: GoogleToolSchemaEndpointClass;
+}
+
+export type GoogleToolSchemaLossCategory =
+  | "enum-value-filtered"
+  | "enum-constraint-dropped"
+  | "const-value-filtered"
+  | "numeric-bound-dropped"
+  | "size-bound-dropped"
+  | "type-union-collapsed"
+  | "unsupported-type-widened"
+  | "nullability-overridden"
+  | "conditional-dropped"
+  | "tuple-prefix-dropped"
+  | "ref-overlay-replaced"
+  | "union-sibling-replaced"
+  | "root-object-coerced"
+  | "union-widened"
+  | "recursive-ref-widened"
+  | "dereference-limit-widened"
+  | "depth-limit-widened"
+  | "node-budget-widened"
+  | "repair-opened-schema"
+  | "unsupported-constraint-dropped"
+  | "invalid-schema-widened";
+
+export interface GoogleToolSchemaLossReport {
+  version: 1;
+  endpointClass: GoogleToolSchemaEndpointClass;
+  lossy: boolean;
+  truncated: boolean;
+  /** Bounded comparisons that exhausted their allowance; uncertainty is not proven loss. */
+  uncertainComparisons: number;
+  /** Saturating proven-loss counts only; capped/unknown structural comparisons add no category. */
+  categories: Partial<Record<GoogleToolSchemaLossCategory, number>>;
+}
+
+export interface GoogleToolSchemaSanitizeResult {
+  parameters: Record<string, unknown>;
+  lossReport: GoogleToolSchemaLossReport;
+}
+
 interface SanitizeState {
   activeRefs: Set<string>;
   remainingNodes: number;
+  budgetReported: boolean;
+  enumFilterLossOverrides: WeakMap<Schema, number>;
+  report: GoogleToolSchemaLossReport;
+}
+
+export function createGoogleToolSchemaLossReport(
+  profile: GoogleToolSchemaProfile,
+): GoogleToolSchemaLossReport {
+  return {
+    version: 1,
+    endpointClass: profile.endpointClass,
+    lossy: false,
+    truncated: false,
+    uncertainComparisons: 0,
+    categories: {},
+  };
+}
+
+function addGoogleToolSchemaUncertainty(report: GoogleToolSchemaLossReport): void {
+  if (report.uncertainComparisons >= GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT) {
+    report.truncated = true;
+    return;
+  }
+  report.uncertainComparisons++;
+}
+
+export function addGoogleToolSchemaLoss(
+  report: GoogleToolSchemaLossReport,
+  category: GoogleToolSchemaLossCategory,
+  amount = 1,
+): void {
+  if (!Number.isFinite(amount) || amount <= 0) return;
+  report.lossy = true;
+  const increment = Math.floor(amount);
+  const current = report.categories[category] ?? 0;
+  const next = current + increment;
+  if (next >= GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT) {
+    report.categories[category] = GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT;
+    if (next > GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT) report.truncated = true;
+    return;
+  }
+  report.categories[category] = next;
+}
+
+export function mergeGoogleToolSchemaLossReport(
+  target: GoogleToolSchemaLossReport,
+  source: GoogleToolSchemaLossReport,
+): void {
+  for (const [category, count] of Object.entries(source.categories)) {
+    addGoogleToolSchemaLoss(target, category as GoogleToolSchemaLossCategory, count);
+  }
+  const uncertainty = target.uncertainComparisons + source.uncertainComparisons;
+  target.uncertainComparisons = Math.min(uncertainty, GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT);
+  if (uncertainty > GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT) target.truncated = true;
+  if (source.truncated) target.truncated = true;
+}
+
+function reportBudgetExhausted(state: SanitizeState): void {
+  if (state.budgetReported) return;
+  state.budgetReported = true;
+  addGoogleToolSchemaLoss(state.report, "node-budget-widened");
+}
+
+function reportDroppedConstraints(node: Schema, state: SanitizeState): void {
+  let numericBounds = 0;
+  for (const key of NUMERIC_BOUND_KEYS) {
+    if (Object.hasOwn(node, key)) numericBounds++;
+  }
+  addGoogleToolSchemaLoss(state.report, "numeric-bound-dropped", numericBounds);
+
+  let sizeBounds = 0;
+  for (const key of SIZE_BOUND_KEYS) {
+    if (!Object.hasOwn(node, key)) continue;
+    if ((key === "minLength" || key === "minItems" || key === "minProperties") && node[key] === 0) continue;
+    sizeBounds++;
+  }
+  addGoogleToolSchemaLoss(state.report, "size-bound-dropped", sizeBounds);
+
+  let unsupported = 0;
+  for (const key of UNSUPPORTED_CONSTRAINT_KEYS) {
+    if (!Object.hasOwn(node, key)) continue;
+    if (key === "additionalProperties" && node[key] === true) continue;
+    if (key === "uniqueItems" && node[key] === false) continue;
+    unsupported++;
+  }
+  addGoogleToolSchemaLoss(state.report, "unsupported-constraint-dropped", unsupported);
+
+  let conditionals = 0;
+  for (const key of CONDITIONAL_KEYS) {
+    if (Object.hasOwn(node, key)) conditionals++;
+  }
+  addGoogleToolSchemaLoss(state.report, "conditional-dropped", conditionals);
+  if (Object.hasOwn(node, "prefixItems") && !(Array.isArray(node.prefixItems) && node.prefixItems.length === 0)) {
+    addGoogleToolSchemaLoss(state.report, "tuple-prefix-dropped");
+  }
 }
 
 function isRecord(value: unknown): value is Schema {
@@ -55,39 +227,308 @@ function collectDefs(root: unknown, defs: Map<string, unknown>): void {
   }
 }
 
-function mergeRefTarget(target: Schema, overlay: Schema): Schema {
+interface BoundedEqualityState {
+  remainingNodes: number;
+}
+
+/**
+ * Exact JSON-value comparison with the sanitizer's own depth/node ceilings.
+ * `unknown` means the cap prevented a proof; report-only mode does not count it as proven loss.
+ */
+type BoundedEquality = "equal" | "different" | "unknown";
+
+function boundedJsonEqual(
+  left: unknown,
+  right: unknown,
+  state: BoundedEqualityState = { remainingNodes: MAX_SCHEMA_NODES },
+  depth = 0,
+): BoundedEquality {
+  if (Object.is(left, right)) return "equal";
+  if (depth >= MAX_SCHEMA_DEPTH || state.remainingNodes <= 0) return "unknown";
+  state.remainingNodes--;
+
+  if (Array.isArray(left) || Array.isArray(right)) {
+    if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) return "different";
+    for (let index = 0; index < left.length; index++) {
+      if (state.remainingNodes <= 0) return "unknown";
+      state.remainingNodes--;
+      const comparison = boundedJsonEqual(left[index], right[index], state, depth + 1);
+      if (comparison !== "equal") return comparison;
+    }
+    return "equal";
+  }
+  if (!isRecord(left) || !isRecord(right)) return "different";
+
+  let leftCount = 0;
+  for (const key in left) {
+    if (!Object.hasOwn(left, key)) continue;
+    if (state.remainingNodes <= 0) return "unknown";
+    state.remainingNodes--;
+    leftCount++;
+    if (!Object.hasOwn(right, key)) return "different";
+    const comparison = boundedJsonEqual(left[key], right[key], state, depth + 1);
+    if (comparison !== "equal") return comparison;
+  }
+  let rightCount = 0;
+  for (const key in right) {
+    if (!Object.hasOwn(right, key)) continue;
+    if (state.remainingNodes <= 0) return "unknown";
+    state.remainingNodes--;
+    rightCount++;
+    if (rightCount > leftCount) return "different";
+  }
+  return leftCount === rightCount ? "equal" : "different";
+}
+
+function boundedStringSetEqual(
+  left: unknown,
+  right: unknown,
+  normalize: (value: string) => string,
+  state: BoundedEqualityState = { remainingNodes: MAX_SCHEMA_NODES },
+): BoundedEquality {
+  const leftValues = Array.isArray(left) ? left : [left];
+  const rightValues = Array.isArray(right) ? right : [right];
+  const collect = (values: unknown[]): Set<string> | undefined => {
+    const result = new Set<string>();
+    for (const value of values) {
+      if (state.remainingNodes <= 0) return undefined;
+      state.remainingNodes--;
+      if (typeof value === "string") result.add(normalize(value));
+    }
+    return result;
+  };
+  const leftSet = collect(leftValues);
+  const rightSet = collect(rightValues);
+  if (!leftSet || !rightSet) return "unknown";
+  if (leftSet.size !== rightSet.size) return "different";
+  for (const value of leftSet) {
+    if (!rightSet.has(value)) return "different";
+  }
+  return "equal";
+}
+
+function boundedJsonSetEqual(
+  left: unknown[],
+  right: unknown[],
+  state: BoundedEqualityState = { remainingNodes: MAX_SCHEMA_NODES },
+): BoundedEquality {
+  const unique = (values: unknown[]): { comparison: BoundedEquality; values: unknown[] } => {
+    const result: unknown[] = [];
+    for (const value of values) {
+      if (state.remainingNodes <= 0) return { comparison: "unknown", values: result };
+      state.remainingNodes--;
+      let duplicate = false;
+      for (const candidate of result) {
+        const comparison = boundedJsonEqual(value, candidate, state);
+        if (comparison === "unknown") return { comparison, values: result };
+        if (comparison === "equal") {
+          duplicate = true;
+          break;
+        }
+      }
+      if (!duplicate) result.push(value);
+    }
+    return { comparison: "equal", values: result };
+  };
+  const leftUnique = unique(left);
+  if (leftUnique.comparison !== "equal") return leftUnique.comparison;
+  const rightUnique = unique(right);
+  if (rightUnique.comparison !== "equal") return rightUnique.comparison;
+  if (leftUnique.values.length !== rightUnique.values.length) return "different";
+  const unmatched = [...rightUnique.values];
+  for (const value of leftUnique.values) {
+    let matched = -1;
+    for (let index = 0; index < unmatched.length; index++) {
+      const comparison = boundedJsonEqual(value, unmatched[index], state);
+      if (comparison === "unknown") return comparison;
+      if (comparison === "equal") {
+        matched = index;
+        break;
+      }
+    }
+    if (matched < 0) return "different";
+    unmatched.splice(matched, 1);
+  }
+  return "equal";
+}
+
+interface BoundedEnumOverlayAccounting {
+  comparison: BoundedEquality;
+  emittedWidensIntersection: boolean;
+  filteredIntersectionValues: number;
+}
+
+function boundedEnumOverlayAccounting(
+  target: unknown[],
+  overlay: unknown[],
+): BoundedEnumOverlayAccounting {
+  const state: BoundedEqualityState = { remainingNodes: MAX_SCHEMA_NODES };
+  const stringSet = (values: unknown[]): Set<string> | undefined => {
+    const result = new Set<string>();
+    for (const value of values) {
+      if (state.remainingNodes <= 0) return undefined;
+      state.remainingNodes--;
+      if (typeof value === "string") result.add(value);
+    }
+    return result;
+  };
+  const targetStrings = stringSet(target);
+  const emittedStrings = stringSet(overlay);
+  if (!targetStrings || !emittedStrings) {
+    return { comparison: "unknown", emittedWidensIntersection: false, filteredIntersectionValues: 0 };
+  }
+
+  let emittedWidensIntersection = false;
+  for (const value of emittedStrings) {
+    if (!targetStrings.has(value)) {
+      emittedWidensIntersection = true;
+      break;
+    }
+  }
+
+  const uniqueFiltered: unknown[] = [];
+  for (const value of overlay) {
+    if (typeof value === "string") continue;
+    if (state.remainingNodes <= 0) {
+      return { comparison: "unknown", emittedWidensIntersection: false, filteredIntersectionValues: 0 };
+    }
+    state.remainingNodes--;
+    let duplicate = false;
+    for (const candidate of uniqueFiltered) {
+      const comparison = boundedJsonEqual(value, candidate, state);
+      if (comparison === "unknown") {
+        return { comparison, emittedWidensIntersection: false, filteredIntersectionValues: 0 };
+      }
+      if (comparison === "equal") {
+        duplicate = true;
+        break;
+      }
+    }
+    if (!duplicate) uniqueFiltered.push(value);
+  }
+
+  let filteredIntersectionValues = 0;
+  for (const value of uniqueFiltered) {
+    for (const candidate of target) {
+      const comparison = boundedJsonEqual(value, candidate, state);
+      if (comparison === "unknown") {
+        return { comparison, emittedWidensIntersection: false, filteredIntersectionValues: 0 };
+      }
+      if (comparison === "equal") {
+        filteredIntersectionValues++;
+        break;
+      }
+    }
+  }
+  return { comparison: "equal", emittedWidensIntersection, filteredIntersectionValues };
+}
+
+function compareMergedValue(key: string, left: unknown, right: unknown): BoundedEquality {
+  if (key === "enum" && Array.isArray(left) && Array.isArray(right)) {
+    return boundedJsonSetEqual(left, right);
+  }
+  if (key === "required" && Array.isArray(left) && Array.isArray(right)) {
+    if (left.every(value => typeof value === "string") && right.every(value => typeof value === "string")) {
+      return boundedStringSetEqual(left, right, value => value);
+    }
+    return boundedJsonEqual(left, right);
+  }
+  if (key === "type") {
+    const leftValues = Array.isArray(left) ? left : [left];
+    const rightValues = Array.isArray(right) ? right : [right];
+    if (leftValues.every(value => typeof value === "string")
+      && rightValues.every(value => typeof value === "string")) {
+      return boundedStringSetEqual(left, right, value => value.toLowerCase());
+    }
+    return boundedJsonEqual(left, right);
+  }
+  if (BOUNDED_VALUE_KEYS.has(key)) return boundedJsonEqual(left, right);
+  return Object.is(left, right) ? "equal" : "different";
+}
+
+function mergeRefTarget(target: Schema, overlay: Schema, state: SanitizeState): Schema {
   const merged: Schema = {};
   if (Object.hasOwn(target, "$ref")) merged.$ref = target.$ref;
   for (const key of MERGED_SCHEMA_KEYS) {
-    if (Object.hasOwn(overlay, key)) merged[key] = overlay[key];
-    else if (Object.hasOwn(target, key)) merged[key] = target[key];
+    if (Object.hasOwn(overlay, key)) {
+      if (key !== "description" && Object.hasOwn(target, key)) {
+        if (key === "enum" && Array.isArray(target[key]) && Array.isArray(overlay[key])) {
+          const accounting = boundedEnumOverlayAccounting(target[key], overlay[key]);
+          if (accounting.comparison === "unknown") {
+            addGoogleToolSchemaUncertainty(state.report);
+          } else {
+            if (accounting.emittedWidensIntersection) {
+              addGoogleToolSchemaLoss(state.report, "ref-overlay-replaced");
+            }
+            addGoogleToolSchemaLoss(
+              state.report,
+              "enum-value-filtered",
+              accounting.filteredIntersectionValues,
+            );
+          }
+          // The intersection-aware accounting above owns this merged enum's filtering report.
+          state.enumFilterLossOverrides.set(merged, 0);
+        } else {
+          const comparison = compareMergedValue(key, overlay[key], target[key]);
+          if (comparison === "different") addGoogleToolSchemaLoss(state.report, "ref-overlay-replaced");
+          else if (comparison === "unknown") addGoogleToolSchemaUncertainty(state.report);
+        }
+      }
+      merged[key] = overlay[key];
+    } else if (Object.hasOwn(target, key)) merged[key] = target[key];
   }
   return merged;
 }
 
-function normalizeType(value: unknown, out: Schema, preserveNullType: boolean): void {
+function normalizeType(
+  value: unknown,
+  out: Schema,
+  preserveNullType: boolean,
+  state: SanitizeState,
+): void {
   const candidates = Array.isArray(value) ? value : [value];
   let sawNull = false;
+  const nonNullTypes = new Set<string>();
+  let unsupported = 0;
+  if (Array.isArray(value) && value.length === 0) unsupported++;
 
   for (const candidate of candidates) {
-    if (typeof candidate !== "string") continue;
+    if (typeof candidate !== "string") {
+      if (candidate !== undefined) unsupported++;
+      continue;
+    }
     const type = candidate.toLowerCase();
     if (type === "null") {
       sawNull = true;
-    } else if (out.type === undefined && ALLOWED_TYPES.has(type)) {
-      out.type = type;
+    } else if (ALLOWED_TYPES.has(type)) {
+      nonNullTypes.add(type);
+      if (out.type === undefined) out.type = type;
+    } else {
+      unsupported++;
     }
   }
 
+  addGoogleToolSchemaLoss(state.report, "unsupported-type-widened", unsupported);
+  if (nonNullTypes.size > 1) addGoogleToolSchemaLoss(state.report, "type-union-collapsed");
+
   if (!sawNull) return;
   if (out.type !== undefined) out.nullable = true;
   else if (preserveNullType) out.type = "null";
-  else out.nullable = true;
+  else {
+    out.nullable = true;
+    addGoogleToolSchemaLoss(state.report, "unsupported-type-widened");
+  }
 }
 
-function sanitizeEnum(value: unknown): string[] | undefined {
+function sanitizeEnum(value: unknown, state?: SanitizeState, filteredLossOverride?: number): string[] | undefined {
   if (!Array.isArray(value)) return undefined;
-  const values = [...new Set(value.filter((item): item is string => typeof item === "string"))];
+  const stringValues = value.filter((item): item is string => typeof item === "string");
+  if (state) addGoogleToolSchemaLoss(
+    state.report,
+    "enum-value-filtered",
+    filteredLossOverride ?? (value.length - stringValues.length),
+  );
+  const values = [...new Set(stringValues)];
   return values.length > 0 ? values : undefined;
 }
 
@@ -98,10 +539,16 @@ function normalizeAnyOf(
   refDepth: number,
   state: SanitizeState,
 ): Schema {
-  if (!Array.isArray(value) || value.length === 0) return {};
+  if (!Array.isArray(value) || value.length === 0) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
+    return {};
+  }
   const schemas: Schema[] = [];
   for (let index = 0; index < value.length; index++) {
-    if (state.remainingNodes <= 0) return {};
+    if (state.remainingNodes <= 0) {
+      reportBudgetExhausted(state);
+      return {};
+    }
     const schema = sanitizeSchema(value[index], defs, depth + 1, refDepth, true, state);
     if (schema === BUDGET_EXHAUSTED) return {};
     schemas.push(schema);
@@ -130,6 +577,7 @@ function normalizeAnyOf(
 
   // CCA's Claude bridge turns typed anyOf branches into an invalid input_schema. Widen only this
   // node when a union cannot be collapsed losslessly; parent annotations and structure survive.
+  addGoogleToolSchemaLoss(state.report, "union-widened");
   return {};
 }
 
@@ -144,7 +592,10 @@ function sanitizeProperties(
   const properties: Record<string, Schema> = Object.create(null) as Record<string, Schema>;
   for (const name in value) {
     if (!Object.hasOwn(value, name)) continue;
-    if (state.remainingNodes <= 0) break;
+    if (state.remainingNodes <= 0) {
+      reportBudgetExhausted(state);
+      break;
+    }
     // Property names form a name bag and must never be interpreted as schema keywords.
     const schema = sanitizeSchema(value[name], defs, depth + 1, refDepth, false, state);
     if (schema === BUDGET_EXHAUSTED) break;
@@ -161,78 +612,191 @@ function sanitizeSchema(
   preserveNullType: boolean,
   state: SanitizeState,
 ): SanitizeResult {
-  if (state.remainingNodes <= 0) return BUDGET_EXHAUSTED;
+  if (state.remainingNodes <= 0) {
+    reportBudgetExhausted(state);
+    return BUDGET_EXHAUSTED;
+  }
   state.remainingNodes -= 1;
-  if (depth >= MAX_SCHEMA_DEPTH || !isRecord(node)) return {};
+  if (depth >= MAX_SCHEMA_DEPTH) {
+    addGoogleToolSchemaLoss(state.report, "depth-limit-widened");
+    return {};
+  }
+  if (!isRecord(node)) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
+    return {};
+  }
+
+  reportDroppedConstraints(node, state);
 
-  if (typeof node.$ref === "string" && refDepth < MAX_DEREF_DEPTH) {
+  if (Object.hasOwn(node, "$ref") && typeof node.$ref !== "string") {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
+  } else if (typeof node.$ref === "string" && refDepth >= MAX_DEREF_DEPTH) {
+    addGoogleToolSchemaLoss(state.report, "dereference-limit-widened");
+  } else if (typeof node.$ref === "string") {
     const target = resolveRef(node.$ref, defs);
     if (isRecord(target)) {
-      if (state.activeRefs.has(node.$ref)) return {};
+      if (state.activeRefs.has(node.$ref)) {
+        addGoogleToolSchemaLoss(state.report, "recursive-ref-widened");
+        return {};
+      }
       state.activeRefs.add(node.$ref);
+      // Constraints outside the merge allowlist are discarded here and must be counted before
+      // selecting the safe view. Copied keys are deliberately excluded to avoid double counting.
+      reportDroppedConstraints(target, state);
       // Select only inputs the sanitizer can consume. Spreading an untrusted definition here would
       // enumerate and allocate every unsupported annotation before the node budget can stop work.
-      const merged = mergeRefTarget(target, node);
+      const merged = mergeRefTarget(target, node, state);
       try {
         return sanitizeSchema(merged, defs, depth, refDepth + 1, preserveNullType, state);
       } finally {
         state.activeRefs.delete(node.$ref);
       }
+    } else {
+      addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
     }
   }
 
   const out: Schema = {};
-  normalizeType(node.type, out, preserveNullType);
+  if (Object.hasOwn(node, "type") && node.type === undefined) {
+    addGoogleToolSchemaLoss(state.report, "unsupported-type-widened");
+  }
+  normalizeType(node.type, out, preserveNullType, state);
 
+  const typeIncludesNull = (Array.isArray(node.type) ? node.type : [node.type])
+    .some(candidate => typeof candidate === "string" && candidate.toLowerCase() === "null");
+  if (node.nullable === false && typeIncludesNull) {
+    addGoogleToolSchemaLoss(state.report, "nullability-overridden");
+  }
   if (typeof node.nullable === "boolean") out.nullable = node.nullable;
+  else if (Object.hasOwn(node, "nullable")) addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
   if (typeof node.description === "string") out.description = node.description;
   if (typeof node.format === "string") out.format = node.format;
+  else if (Object.hasOwn(node, "format")) addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
 
-  const enumValues = sanitizeEnum(node.enum ?? (typeof node.const === "string" ? [node.const] : undefined));
+  if (Object.hasOwn(node, "enum") && !Array.isArray(node.enum)) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
+  } else if (Array.isArray(node.enum) && node.enum.length === 0) {
+    addGoogleToolSchemaLoss(state.report, "enum-constraint-dropped");
+  }
+  if (Object.hasOwn(node, "const")) {
+    if (typeof node.const !== "string") {
+      addGoogleToolSchemaLoss(state.report, "const-value-filtered");
+    } else if (Object.hasOwn(node, "enum")) {
+      const enumValues = Array.isArray(node.enum)
+        ? [...new Set(node.enum.filter((item): item is string => typeof item === "string"))]
+        : [];
+      if (enumValues.length !== 1 || enumValues[0] !== node.const) {
+        addGoogleToolSchemaLoss(state.report, "const-value-filtered");
+      }
+    }
+  }
+  const enumValues = sanitizeEnum(
+    node.enum ?? (typeof node.const === "string" ? [node.const] : undefined),
+    state,
+    state.enumFilterLossOverrides.get(node),
+  );
   if (enumValues) out.enum = enumValues;
 
+  if (Object.hasOwn(node, "properties") && !isRecord(node.properties)) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
+  }
   const properties = sanitizeProperties(node.properties, defs, depth, refDepth, state);
   if (properties) out.properties = properties;
 
   if (properties && Array.isArray(node.required)) {
-    const required = [...new Set(node.required.filter((item): item is string => (
-      typeof item === "string" && Object.hasOwn(properties, item)
-    )))];
+    const stringRequired = node.required.filter((item): item is string => typeof item === "string");
+    const uniqueRequired = [...new Set(stringRequired)];
+    const required = uniqueRequired.filter(item => Object.hasOwn(properties, item));
+    addGoogleToolSchemaLoss(
+      state.report,
+      "unsupported-constraint-dropped",
+      uniqueRequired.length - required.length,
+    );
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened", node.required.length - stringRequired.length);
     if (required.length > 0) out.required = required;
+  } else if (!properties && Array.isArray(node.required)) {
+    const stringRequired = node.required.filter((item): item is string => typeof item === "string");
+    const required = new Set(stringRequired);
+    addGoogleToolSchemaLoss(state.report, "unsupported-constraint-dropped", required.size);
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened", node.required.length - stringRequired.length);
+  } else if (Object.hasOwn(node, "required") && !Array.isArray(node.required)) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
   }
 
-  if (state.remainingNodes <= 0) return out;
+  if (state.remainingNodes <= 0) {
+    if (Object.hasOwn(node, "items") || Object.hasOwn(node, "anyOf")) reportBudgetExhausted(state);
+    return out;
+  }
 
-  if (isRecord(node.items)) {
+  if (Array.isArray(node.items)) {
+    addGoogleToolSchemaLoss(state.report, "tuple-prefix-dropped");
+  } else if (isRecord(node.items)) {
     const items = sanitizeSchema(node.items, defs, depth + 1, refDepth, false, state);
     if (items !== BUDGET_EXHAUSTED) out.items = items;
+  } else if (Object.hasOwn(node, "items")) {
+    addGoogleToolSchemaLoss(state.report, "invalid-schema-widened");
   }
 
-  if (state.remainingNodes <= 0) return out;
-  if (node.anyOf !== undefined) {
-    Object.assign(out, normalizeAnyOf(node.anyOf, defs, depth, refDepth, state));
+  if (state.remainingNodes <= 0) {
+    if (Object.hasOwn(node, "anyOf")) reportBudgetExhausted(state);
+    return out;
+  }
+  if (Object.hasOwn(node, "anyOf")) {
+    const normalized = normalizeAnyOf(node.anyOf, defs, depth, refDepth, state);
+    for (const key of RETAINED_UNION_KEYS) {
+      if (Object.hasOwn(out, key) && Object.hasOwn(normalized, key)
+      ) {
+        const comparison = compareMergedValue(key, out[key], normalized[key]);
+        if (comparison === "different") addGoogleToolSchemaLoss(state.report, "union-sibling-replaced");
+        else if (comparison === "unknown") addGoogleToolSchemaUncertainty(state.report);
+      }
+    }
+    Object.assign(out, normalized);
   }
   return out;
 }
 
-export function sanitizeGeminiToolParameters(parameters: unknown): Record<string, unknown> {
+export function sanitizeGeminiToolParametersWithReport(
+  parameters: unknown,
+  profile: GoogleToolSchemaProfile,
+): GoogleToolSchemaSanitizeResult {
+  const report = createGoogleToolSchemaLossReport(profile);
+  if (parameters === undefined) {
+    return { parameters: { type: "object", properties: {} }, lossReport: report };
+  }
   try {
     const defs = new Map<string, unknown>();
     collectDefs(parameters, defs);
     const state: SanitizeState = {
       activeRefs: new Set(),
       remainingNodes: MAX_SCHEMA_NODES,
+      budgetReported: false,
+      enumFilterLossOverrides: new WeakMap(),
+      report,
     };
+    if (isRecord(parameters)) {
+      for (const bag of ["$defs", "definitions"] as const) {
+        if (Object.hasOwn(parameters, bag) && !isRecord(parameters[bag])) {
+          addGoogleToolSchemaLoss(report, "invalid-schema-widened");
+        }
+      }
+    }
     const sanitized = sanitizeSchema(parameters, defs, 0, 0, false, state);
     const root = sanitized === BUDGET_EXHAUSTED ? {} : sanitized;
 
     // Function arguments are always an object. Claude additionally rejects root composition and a
     // missing root type even when those forms are valid general-purpose JSON Schema.
+    if (root.type !== "object") addGoogleToolSchemaLoss(report, "root-object-coerced");
     root.type = "object";
     if (!isRecord(root.properties)) root.properties = {};
-    return root;
+    return { parameters: root, lossReport: report };
   } catch {
     // Last-resort containment: no third-party schema may break every tool in the request.
-    return { type: "object", properties: {} };
+    addGoogleToolSchemaLoss(report, "invalid-schema-widened");
+    return { parameters: { type: "object", properties: {} }, lossReport: report };
   }
 }
+
+export function sanitizeGeminiToolParameters(parameters: unknown): Record<string, unknown> {
+  return sanitizeGeminiToolParametersWithReport(parameters, { endpointClass: "ai-studio" }).parameters;
+}
diff --git a/src/adapters/google-wire-compiler.ts b/src/adapters/google-wire-compiler.ts
index 03cb6de7a34..00c00334ca4 100644
--- a/src/adapters/google-wire-compiler.ts
+++ b/src/adapters/google-wire-compiler.ts
@@ -1,11 +1,38 @@
 import { createHash } from "node:crypto";
-import { sanitizeGeminiToolParameters } from "./google-tool-schema";
+import {
+  addGoogleToolSchemaLoss,
+  createGoogleToolSchemaLossReport,
+  GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT,
+  mergeGoogleToolSchemaLossReport,
+  sanitizeGeminiToolParametersWithReport,
+  type GoogleToolSchemaLossReport,
+  type GoogleToolSchemaPolicy,
+  type GoogleToolSchemaProfile,
+} from "./google-tool-schema";
 
 type JsonObject = Record<string, unknown>;
 
 const GOOGLE_TOOL_NAME = /^[A-Za-z_][A-Za-z0-9_-]{0,63}$/;
 const GOOGLE_THINKING_LEVELS = new Set(["minimal", "low", "medium", "high"]);
 
+export class GoogleToolSchemaPolicyError extends Error {
+  readonly phase = "initial" as const;
+  readonly endpointClass: GoogleToolSchemaProfile["endpointClass"];
+  readonly categories: GoogleToolSchemaLossReport["categories"];
+  /** True when refusal is due to exhausted bounded comparison rather than proven loss. */
+  readonly indeterminate: boolean;
+
+  constructor(report: GoogleToolSchemaLossReport) {
+    const categories = { ...report.categories };
+    const indeterminate = report.uncertainComparisons > 0;
+    super(`google tool schema policy rejected ${report.lossy ? "lossy" : "indeterminate"} initial compilation (${report.endpointClass}; categories=${JSON.stringify(categories)}${indeterminate ? `; uncertainComparisons=${report.uncertainComparisons}` : ""})`);
+    this.name = "GoogleToolSchemaPolicyError";
+    this.endpointClass = report.endpointClass;
+    this.categories = categories;
+    this.indeterminate = indeterminate;
+  }
+}
+
 function isObject(value: unknown): value is JsonObject {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -94,16 +121,23 @@ function compileContents(value: unknown, toWireName: (name: string) => string):
   });
 }
 
-function compileTools(value: unknown, toWireName: (name: string) => string): unknown[] | undefined {
+function compileTools(
+  value: unknown,
+  toWireName: (name: string) => string,
+  profile: GoogleToolSchemaProfile,
+  lossReport: GoogleToolSchemaLossReport,
+): unknown[] | undefined {
   if (!Array.isArray(value)) return undefined;
   const tools = value.flatMap(rawTool => {
     if (!isObject(rawTool) || !Array.isArray(rawTool.functionDeclarations)) return [];
     const functionDeclarations = rawTool.functionDeclarations.flatMap(rawDeclaration => {
       if (!isObject(rawDeclaration) || typeof rawDeclaration.name !== "string") return [];
+      const sanitized = sanitizeGeminiToolParametersWithReport(rawDeclaration.parameters, profile);
+      mergeGoogleToolSchemaLossReport(lossReport, sanitized.lossReport);
       return [{
         name: toWireName(rawDeclaration.name),
         ...(typeof rawDeclaration.description === "string" ? { description: rawDeclaration.description } : {}),
-        parameters: sanitizeGeminiToolParameters(rawDeclaration.parameters),
+        parameters: sanitized.parameters,
       }];
     });
     return functionDeclarations.length > 0 ? [{ functionDeclarations }] : [];
@@ -180,24 +214,35 @@ function compileToolConfig(value: unknown, toWireName: (name: string) => string)
  * Final trust boundary for every Google-family request. The adapter may build a convenient
  * Gemini-shaped object; only this compiler is allowed to decide what reaches the wire.
  */
-export function compileGoogleWireBody(input: unknown): {
+export function compileGoogleWireBody(
+  input: unknown,
+  profile: GoogleToolSchemaProfile = { endpointClass: "ai-studio" },
+  policy: GoogleToolSchemaPolicy = "compatible",
+): {
   body: JsonObject;
   restoreToolName: (name: string) => string;
+  toolSchemaLossReport: GoogleToolSchemaLossReport;
 } {
   const source = isObject(input) ? input : {};
   const names = toolNameCodec(collectToolNames(source));
   const body: JsonObject = {};
+  const toolSchemaLossReport = createGoogleToolSchemaLossReport(profile);
   const contents = compileContents(source.contents, names.toWire);
   if (contents) body.contents = contents;
   if (isObject(source.systemInstruction)) body.systemInstruction = source.systemInstruction;
-  const tools = compileTools(source.tools, names.toWire);
+  const tools = compileTools(source.tools, names.toWire, profile, toolSchemaLossReport);
   if (tools) body.tools = tools;
+  // Strict mode refuses proven loss and bounded-comparison indeterminacy alike: an exhausted
+  // comparison can hide a changed constraint, so unknown is not admitted as lossless.
+  if (policy === "reject-lossy" && (toolSchemaLossReport.lossy || toolSchemaLossReport.uncertainComparisons > 0)) {
+    throw new GoogleToolSchemaPolicyError(toolSchemaLossReport);
+  }
   const generationConfig = compileGenerationConfig(source.generationConfig);
   if (generationConfig) body.generationConfig = generationConfig;
   const toolConfig = compileToolConfig(source.toolConfig, names.toWire);
   if (toolConfig) body.toolConfig = toolConfig;
   if (typeof source.sessionId === "string" && source.sessionId.length > 0) body.sessionId = source.sessionId;
-  return { body, restoreToolName: names.fromWire };
+  return { body, restoreToolName: names.fromWire, toolSchemaLossReport };
 }
 
 function functionDeclarations(root: JsonObject): JsonObject[] {
@@ -208,10 +253,35 @@ function functionDeclarations(root: JsonObject): JsonObject[] {
   });
 }
 
+/**
+ * Upstream INVALID_ARGUMENT text blaming a tool or function declaration schema.
+ *
+ * Shared with the diagnostic error classifier so the repair path and the description of why a
+ * request was rejected cannot drift into disagreeing about the same payload.
+ */
+export function isGoogleToolSchemaErrorText(errorPayload: string): boolean {
+  return /(?:input[_ ]schema|json schema|function[_ ]declarations?|x-mcp-header)/i.test(errorPayload);
+}
+
+/** Upstream INVALID_ARGUMENT text blaming the thinking configuration. */
+export function isGoogleThinkingConfigErrorText(errorPayload: string): boolean {
+  return /thinking[_ ]?(?:config|level)/i.test(errorPayload);
+}
+
+export interface GoogleInvalidRequestRepair {
+  body: string;
+  toolSchemaLoss?: GoogleToolSchemaLossReport;
+  toolSchemaDeclarationCount?: number;
+}
+
 /** Build a changed request for one known-safe replay of an INVALID_ARGUMENT response. */
-export function repairGoogleInvalidRequestBody(body: string, errorPayload: string): string | undefined {
-  const schemaError = /(?:input[_ ]schema|json schema|function[_ ]declarations?|x-mcp-header)/i.test(errorPayload);
-  const thinkingError = /thinking[_ ]?(?:config|level)/i.test(errorPayload);
+export function repairGoogleInvalidRequestBodyWithReport(
+  body: string,
+  errorPayload: string,
+  profile: GoogleToolSchemaProfile = { endpointClass: "ai-studio" },
+): GoogleInvalidRequestRepair | undefined {
+  const schemaError = isGoogleToolSchemaErrorText(errorPayload);
+  const thinkingError = isGoogleThinkingConfigErrorText(errorPayload);
   if (!schemaError && !thinkingError) return undefined;
   let parsed: unknown;
   try {
@@ -222,6 +292,8 @@ export function repairGoogleInvalidRequestBody(body: string, errorPayload: strin
   if (!isObject(parsed)) return undefined;
   const root = isObject(parsed.request) ? parsed.request : parsed;
   let changed = false;
+  let toolSchemaLoss: GoogleToolSchemaLossReport | undefined;
+  let toolSchemaDeclarationCount: number | undefined;
 
   if (thinkingError && isObject(root.generationConfig) && "thinkingConfig" in root.generationConfig) {
     delete root.generationConfig.thinkingConfig;
@@ -237,6 +309,9 @@ export function repairGoogleInvalidRequestBody(body: string, errorPayload: strin
       const index = indexed === undefined ? -1 : Number.parseInt(indexed, 10);
       const rejected = declarations[index];
       const targets = rejected ? [rejected] : declarations;
+      toolSchemaLoss = createGoogleToolSchemaLossReport(profile);
+      addGoogleToolSchemaLoss(toolSchemaLoss, "repair-opened-schema", targets.length);
+      toolSchemaDeclarationCount = Math.min(targets.length, GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT);
       for (const declaration of targets) {
         declaration.parameters = { type: "object", properties: {} };
         delete declaration.parametersJsonSchema;
@@ -244,5 +319,13 @@ export function repairGoogleInvalidRequestBody(body: string, errorPayload: strin
       changed = true;
     }
   }
-  return changed ? JSON.stringify(parsed) : undefined;
+  return changed ? {
+    body: JSON.stringify(parsed),
+    ...(toolSchemaLoss ? { toolSchemaLoss, toolSchemaDeclarationCount } : {}),
+  } : undefined;
+}
+
+/** Compatibility facade for callers that need only the changed body. */
+export function repairGoogleInvalidRequestBody(body: string, errorPayload: string): string | undefined {
+  return repairGoogleInvalidRequestBodyWithReport(body, errorPayload)?.body;
 }
diff --git a/src/adapters/google-wire-shape.ts b/src/adapters/google-wire-shape.ts
new file mode 100644
index 00000000000..47dfcbabce2
--- /dev/null
+++ b/src/adapters/google-wire-shape.ts
@@ -0,0 +1,461 @@
+import { MAX_DEBUG_LINE_BYTES } from "../lib/debug-log-buffer";
+import { THOUGHT_SIGNATURE_BYPASS } from "./google-antigravity-replay";
+import type { AntigravitySessionAnchor } from "./google-antigravity-wire";
+import { isGoogleThinkingConfigErrorText, isGoogleToolSchemaErrorText } from "./google-wire-compiler";
+
+/**
+ * Content-free structural projection of a compiled Google-family wire request (#5008).
+ *
+ * Why this exists. The report behind #5008 is an intermittent HTTP 400 on the FIRST upstream
+ * send of a long, tool-heavy Antigravity session: "Please ensure that function call turn comes
+ * immediately after a user turn or after a function response turn." The reporter's own static
+ * matrix (A-F on the issue) exercised every adjacency hazard the translator can produce and all
+ * of them returned 200, so the failing wire cannot be reconstructed from the repro shapes. What
+ * is missing is a description of the request that actually failed, and the only description a
+ * user can attach to a public bug report is one that carries no conversation in it.
+ *
+ * This module is that description. It reads the request object AFTER compileGoogleWireBody and
+ * after Antigravity replay/signature adjustment — the exact object the envelope carries — and
+ * returns counts, positions, kinds and booleans.
+ *
+ * What it never retains, by construction rather than by redaction: prompt or system text, tool
+ * arguments, tool results, tool or function names, original or wire tool-call ids, thought
+ * signature text or any hash of it, inline file bytes, project or account identifiers, the
+ * request id, the Cloud Code Assist session id, the Codex thread or session ids, and the first
+ * user message. Tool-call identity survives only as a request-internal ordinal assigned in
+ * first-appearance order, which is enough to show pairing structure and is meaningless outside
+ * the single request that produced it.
+ *
+ * Totals are computed over the whole request; per-turn detail is cut at
+ * GOOGLE_WIRE_SHAPE_TURN_CEILING and the summary is marked truncated. A 440-message session
+ * therefore still reports its true turn and call counts.
+ *
+ * This is a projection, not a validator. It does not decide whether a request is acceptable to
+ * the upstream, and nothing in the request path consults its output.
+ *
+ * What it costs. With provider debug off the projection never runs: the call site passes a
+ * builder to debugProviderDiagnosticLazy, which returns before invoking it. With provider debug
+ * ON it runs synchronously on the dispatch path, before the request is sent, and it walks every
+ * turn, every part and every call id, then serializes, redacts and writes one line. The cost is
+ * linear in history length, which is largest for exactly the long sessions this exists to
+ * describe. That is the price of observing the real outbound body rather than a reconstruction,
+ * and an operator who turns provider debug on for a 440-message session is paying it on every
+ * turn.
+ */
+
+/** Per-turn detail beyond this many turns is dropped; totals are unaffected. */
+export const GOOGLE_WIRE_SHAPE_TURN_CEILING = 64;
+
+/** Per-turn ordinal lists are cut here; the turn's own counts are unaffected. */
+export const GOOGLE_WIRE_SHAPE_ORDINAL_CEILING = 16;
+
+/** Longest error text inspected by classifyGoogleWireUpstreamError. */
+const UPSTREAM_ERROR_SCAN_LIMIT = 2048;
+
+/**
+ * Serialized ceiling for one summary, held at half the debug buffer's per-line cap so the event
+ * prefix and any redaction copy still fit under it.
+ *
+ * The item ceilings above are not sufficient on their own: 64 retained turns carrying 16 ordinals
+ * each serialize past the buffer's limit, and the buffer truncates at a byte boundary. That
+ * leaves a consumer with JSON it cannot parse whose retained prefix still says truncated is
+ * false — a cut that hides itself. Trimming here instead keeps the line parseable and keeps the
+ * flag honest.
+ */
+export const GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES = Math.floor(MAX_DEBUG_LINE_BYTES / 2);
+
+export type GoogleWireTurnRole = "user" | "model" | "other";
+
+export type GoogleWirePartKind =
+  | "text"
+  | "thought"
+  | "functionCall"
+  | "functionResponse"
+  | "inlineData"
+  | "other";
+
+/**
+ * Ordering classes transcribed from the upstream error text, not inferred from it.
+ *
+ * The message names one relationship — a function-call turn must follow a user turn or a
+ * function-response turn — so call-turn-opens-request and call-turn-after-model-turn are the two
+ * ways a well-formed request can contradict it, call-turn-after-unknown-turn covers a predecessor
+ * that is neither, and response-turn-without-call-turn is its converse.
+ * request-ends-with-model-turn is a different upstream 400 that messagesToGeminiFormat already
+ * guards with its "(continue)" nudge; it is projected so a defeated guard is visible rather than
+ * silent.
+ *
+ * A flag is not a verdict. The reporter's case A produces call-turn-after-model-turn and
+ * returned 200, which is itself worth being able to observe in a real failing request.
+ */
+export type GoogleWireOrderingViolation =
+  | "call-turn-opens-request"
+  | "call-turn-after-model-turn"
+  | "call-turn-after-unknown-turn"
+  | "response-turn-without-call-turn"
+  | "request-ends-with-model-turn";
+
+/** Bounded classes for an upstream rejection. The error text itself is never retained. */
+export type GoogleWireUpstreamErrorClass =
+  | "turn-adjacency"
+  | "thought-signature"
+  | "tool-schema"
+  | "thinking-config"
+  | "other";
+
+export interface GoogleWireTurnShape {
+  /** Position in contents. */
+  index: number;
+  role: GoogleWireTurnRole;
+  /** Number of parts in this turn. */
+  parts: number;
+  /** Distinct part kinds, in first-appearance order. */
+  kinds: GoogleWirePartKind[];
+  /** Request-internal ordinals of the function calls in this turn. */
+  calls: number[];
+  /** Request-internal ordinals of the function responses in this turn. */
+  responses: number[];
+  /** Function calls carrying any thought signature. */
+  signedCalls: number;
+  /** Of those, the ones carrying only the validator-bypass sentinel. */
+  sentinelCalls: number;
+  violation?: GoogleWireOrderingViolation;
+}
+
+/** Facts the caller knows and the wire body does not carry. */
+export interface GoogleWireShapeFacts {
+  /** Which anchor class produced the Antigravity session id. Never the id itself. */
+  sessionAnchor?: AntigravitySessionAnchor;
+  /**
+   * Function calls the translator signed from client history or the durable replay store,
+   * counted before the Antigravity session cache runs.
+   */
+  historySignedCalls?: number;
+  /** A durable replay scope was attached to this request. Its completeness is NOT asserted. */
+  replayScopeBound?: boolean;
+  /** The real physical send this body belongs to, 1 for the first send. */
+  sendOrdinal?: number;
+  /** Bounded class of the upstream rejection, when this body was rejected. */
+  errorClass?: GoogleWireUpstreamErrorClass;
+}
+
+export type GoogleWireShapeSummary = {
+  version: 1;
+  /** Per-turn detail was cut by a ceiling. Totals below remain exact. */
+  truncated: boolean;
+  turns: number;
+  roles: Record<GoogleWireTurnRole, number>;
+  functionCalls: number;
+  functionResponses: number;
+  /** Distinct tool-call ids seen anywhere in the request. */
+  distinctCallIds: number;
+  /** Function calls that carried no id at all. */
+  callsWithoutId: number;
+  /** Function responses that carried no id at all. */
+  responsesWithoutId: number;
+  /** Call ordinals no response answers. */
+  unansweredCalls: number;
+  /** Response ordinals no call introduced. */
+  unmatchedResponses: number;
+  toolDeclarations: number;
+  hasSystemInstruction: boolean;
+  hasSessionId: boolean;
+  sessionAnchor: AntigravitySessionAnchor | "unknown";
+  signature: {
+    /** At least one function call reaches the wire with a signature. */
+    present: boolean;
+    /** Every signed call carries only the validator-bypass sentinel. */
+    sentinelOnly: boolean;
+    signedCalls: number;
+    sentinelCalls: number;
+    /** Signed at translation time, from client history or the durable replay store. */
+    historySignedCalls: number;
+    /**
+     * The remainder the Antigravity session cache supplied, clamped at zero. The cache never
+     * overwrites an existing signature, so the three counts partition the signed calls.
+     */
+    sessionCacheSignedCalls: number;
+    /**
+     * A durable replay scope was attached. Whether it was COMPLETE enough to key a lookup is
+     * decided inside lookupReplayThoughtSignature and is deliberately not claimed here.
+     */
+    replayScopeBound: boolean;
+  };
+  orderingViolations: number;
+  firstOrderingViolation: { index: number; kind: GoogleWireOrderingViolation } | null;
+  /** Present only when the caller supplied send facts. */
+  send: { ordinal: number; errorClass: GoogleWireUpstreamErrorClass | null } | null;
+  turnShapes: GoogleWireTurnShape[];
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function turnRole(content: Record<string, unknown>): GoogleWireTurnRole {
+  const role = content.role;
+  return role === "user" || role === "model" ? role : "other";
+}
+
+function partKind(part: Record<string, unknown>): GoogleWirePartKind {
+  if (part.thought === true) return "thought";
+  if (isRecord(part.functionCall)) return "functionCall";
+  if (isRecord(part.functionResponse)) return "functionResponse";
+  if (isRecord(part.inline_data) || isRecord(part.inlineData)) return "inlineData";
+  if (typeof part.text === "string") return "text";
+  return "other";
+}
+
+/**
+ * A function call or response id, read only to be replaced by an ordinal. The value never
+ * leaves this function.
+ */
+function callIdOf(call: Record<string, unknown>): string | undefined {
+  const id = call.id;
+  return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+
+function signatureOf(part: Record<string, unknown>): string | undefined {
+  const camel = part.thoughtSignature;
+  if (typeof camel === "string" && camel.length > 0) return camel;
+  const snake = part.thought_signature;
+  if (typeof snake === "string" && snake.length > 0) return snake;
+  return undefined;
+}
+
+/** Request-internal renumbering: first appearance wins, and the mapping dies with the call. */
+function ordinalAllocator(): (rawId: string) => number {
+  const ordinals = new Map<string, number>();
+  return rawId => {
+    const existing = ordinals.get(rawId);
+    if (existing !== undefined) return existing;
+    const next = ordinals.size + 1;
+    ordinals.set(rawId, next);
+    return next;
+  };
+}
+
+function countToolDeclarations(tools: unknown): number {
+  if (!Array.isArray(tools)) return 0;
+  let total = 0;
+  for (const tool of tools) {
+    if (!isRecord(tool) || !Array.isArray(tool.functionDeclarations)) continue;
+    total += tool.functionDeclarations.length;
+  }
+  return total;
+}
+
+interface TurnFacts {
+  role: GoogleWireTurnRole;
+  hasFunctionCall: boolean;
+  hasFunctionResponse: boolean;
+}
+
+/**
+ * The first ordering class this turn contradicts, judged against the turn before it.
+ *
+ * "Function response turn" is read as a user turn carrying at least one functionResponse, which
+ * is the shape messagesToGeminiFormat emits for a tool-result batch. A plain user turn satisfies
+ * the rule on its own, so a call turn after either one is unflagged.
+ */
+function violationFor(turn: TurnFacts, previous: TurnFacts | undefined, isLast: boolean): GoogleWireOrderingViolation | undefined {
+  if (turn.role === "model" && turn.hasFunctionCall) {
+    if (!previous) return "call-turn-opens-request";
+    if (previous.role === "model") return "call-turn-after-model-turn";
+    if (previous.role !== "user") return "call-turn-after-unknown-turn";
+  }
+  if (turn.role === "user" && turn.hasFunctionResponse) {
+    if (!previous || previous.role !== "model" || !previous.hasFunctionCall) {
+      return "response-turn-without-call-turn";
+    }
+  }
+  if (isLast && turn.role === "model") return "request-ends-with-model-turn";
+  return undefined;
+}
+
+function serializedBytes(summary: GoogleWireShapeSummary): number {
+  return new TextEncoder().encode(JSON.stringify(summary)).length;
+}
+
+/**
+ * Drop per-turn detail from the tail until the summary serializes under its byte budget.
+ *
+ * Trimming from the tail rather than the head is deliberate: the opening turns of a request are
+ * where a first-send ordering violation lives, and they are what a reader needs most.
+ */
+function fitToSerializedBudget(summary: GoogleWireShapeSummary): GoogleWireShapeSummary {
+  if (serializedBytes(summary) <= GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES) return summary;
+  let kept = summary.turnShapes.length;
+  let fitted: GoogleWireShapeSummary = { ...summary, truncated: true, turnShapes: summary.turnShapes };
+  while (kept > 0 && serializedBytes(fitted) > GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES) {
+    kept -= 1;
+    fitted = { ...summary, truncated: true, turnShapes: summary.turnShapes.slice(0, kept) };
+  }
+  return fitted;
+}
+
+/**
+ * Project the structure of a compiled Google wire request body.
+ *
+ * Pure and non-mutating: every field is read, nothing is written back, and the returned object
+ * shares no reference with the input.
+ */
+export function summarizeGoogleWireShape(
+  body: unknown,
+  facts: GoogleWireShapeFacts = {},
+): GoogleWireShapeSummary {
+  const root = isRecord(body) ? body : {};
+  const contents: unknown[] = Array.isArray(root.contents) ? root.contents : [];
+  const ordinalFor = ordinalAllocator();
+  const historySignedCalls = Math.max(0, facts.historySignedCalls ?? 0);
+
+  const roles: Record<GoogleWireTurnRole, number> = { user: 0, model: 0, other: 0 };
+  const callOrdinals = new Set<number>();
+  const responseOrdinals = new Set<number>();
+  const turnShapes: GoogleWireTurnShape[] = [];
+
+  let functionCalls = 0;
+  let functionResponses = 0;
+  let callsWithoutId = 0;
+  let responsesWithoutId = 0;
+  let signedCalls = 0;
+  let sentinelCalls = 0;
+  let orderingViolations = 0;
+  let truncated = false;
+  let firstOrderingViolation: GoogleWireShapeSummary["firstOrderingViolation"] = null;
+  let previous: TurnFacts | undefined;
+
+  for (let index = 0; index < contents.length; index++) {
+    const rawContent: unknown = contents[index];
+    const content = isRecord(rawContent) ? rawContent : {};
+    const role = turnRole(content);
+    roles[role] += 1;
+    const parts: unknown[] = Array.isArray(content.parts) ? content.parts : [];
+    const kinds: GoogleWirePartKind[] = [];
+    const calls: number[] = [];
+    const responses: number[] = [];
+    let turnSignedCalls = 0;
+    let turnSentinelCalls = 0;
+
+    for (const rawPart of parts) {
+      const part = isRecord(rawPart) ? rawPart : {};
+      const kind = partKind(part);
+      if (!kinds.includes(kind)) kinds.push(kind);
+      if (kind === "functionCall") {
+        functionCalls += 1;
+        const id = callIdOf(part.functionCall as Record<string, unknown>);
+        if (id === undefined) {
+          callsWithoutId += 1;
+        } else {
+          const ordinal = ordinalFor(id);
+          callOrdinals.add(ordinal);
+          if (calls.length < GOOGLE_WIRE_SHAPE_ORDINAL_CEILING) calls.push(ordinal);
+          else truncated = true;
+        }
+        const signature = signatureOf(part);
+        if (signature !== undefined) {
+          turnSignedCalls += 1;
+          if (signature === THOUGHT_SIGNATURE_BYPASS) turnSentinelCalls += 1;
+        }
+      } else if (kind === "functionResponse") {
+        functionResponses += 1;
+        const id = callIdOf(part.functionResponse as Record<string, unknown>);
+        if (id === undefined) {
+          responsesWithoutId += 1;
+        } else {
+          const ordinal = ordinalFor(id);
+          responseOrdinals.add(ordinal);
+          if (responses.length < GOOGLE_WIRE_SHAPE_ORDINAL_CEILING) responses.push(ordinal);
+          else truncated = true;
+        }
+      }
+    }
+
+    signedCalls += turnSignedCalls;
+    sentinelCalls += turnSentinelCalls;
+    const current: TurnFacts = {
+      role,
+      hasFunctionCall: kinds.includes("functionCall"),
+      hasFunctionResponse: kinds.includes("functionResponse"),
+    };
+    const violation = violationFor(current, previous, index === contents.length - 1);
+    if (violation) {
+      orderingViolations += 1;
+      if (!firstOrderingViolation) firstOrderingViolation = { index, kind: violation };
+    }
+    if (turnShapes.length < GOOGLE_WIRE_SHAPE_TURN_CEILING) {
+      turnShapes.push({
+        index,
+        role,
+        parts: parts.length,
+        kinds,
+        calls,
+        responses,
+        signedCalls: turnSignedCalls,
+        sentinelCalls: turnSentinelCalls,
+        ...(violation ? { violation } : {}),
+      });
+    } else {
+      truncated = true;
+    }
+    previous = current;
+  }
+
+  let unansweredCalls = 0;
+  for (const ordinal of callOrdinals) if (!responseOrdinals.has(ordinal)) unansweredCalls += 1;
+  let unmatchedResponses = 0;
+  for (const ordinal of responseOrdinals) if (!callOrdinals.has(ordinal)) unmatchedResponses += 1;
+
+  return fitToSerializedBudget({
+    version: 1,
+    truncated,
+    turns: contents.length,
+    roles,
+    functionCalls,
+    functionResponses,
+    distinctCallIds: new Set([...callOrdinals, ...responseOrdinals]).size,
+    callsWithoutId,
+    responsesWithoutId,
+    unansweredCalls,
+    unmatchedResponses,
+    toolDeclarations: countToolDeclarations(root.tools),
+    hasSystemInstruction: isRecord(root.systemInstruction),
+    hasSessionId: typeof root.sessionId === "string" && root.sessionId.length > 0,
+    sessionAnchor: facts.sessionAnchor ?? "unknown",
+    signature: {
+      present: signedCalls > 0,
+      sentinelOnly: signedCalls > 0 && signedCalls === sentinelCalls,
+      signedCalls,
+      sentinelCalls,
+      historySignedCalls,
+      sessionCacheSignedCalls: Math.max(0, signedCalls - sentinelCalls - historySignedCalls),
+      replayScopeBound: facts.replayScopeBound === true,
+    },
+    orderingViolations,
+    firstOrderingViolation,
+    send: facts.sendOrdinal === undefined
+      ? null
+      : { ordinal: facts.sendOrdinal, errorClass: facts.errorClass ?? null },
+    turnShapes,
+  });
+}
+
+/**
+ * Classify an upstream rejection into one of a fixed set of classes.
+ *
+ * Bounded in both directions: at most UPSTREAM_ERROR_SCAN_LIMIT characters are inspected, and
+ * only the class is returned, so no upstream text reaches a caller through this function.
+ */
+export function classifyGoogleWireUpstreamError(message: unknown): GoogleWireUpstreamErrorClass {
+  if (typeof message !== "string" || message.length === 0) return "other";
+  const scanned = message.slice(0, UPSTREAM_ERROR_SCAN_LIMIT);
+  if (/function\s+call\s+turn|function\s+response\s+turn|model\s+turn\s+are\s+not\s+supported|assistant\s+message\s+prefill/i.test(scanned)) {
+    return "turn-adjacency";
+  }
+  if (/thought[_\s-]?signature|TYPE_BYTES/i.test(scanned)) return "thought-signature";
+  // Shared with the wire compiler's repair path so a payload cannot be repaired as one class
+  // and described as another.
+  if (isGoogleToolSchemaErrorText(scanned)) return "tool-schema";
+  if (isGoogleThinkingConfigErrorText(scanned)) return "thinking-config";
+  return "other";
+}
diff --git a/src/adapters/google.ts b/src/adapters/google.ts
index 685cd2177cd..1e8631ae645 100644
--- a/src/adapters/google.ts
+++ b/src/adapters/google.ts
@@ -1,5 +1,5 @@
 import type { AdapterFetchContext, AdapterRequest, ProviderAdapter } from "./base";
-import { debugDroppedFrame } from "../lib/debug";
+import { debugDroppedFrame, debugProviderDiagnosticLazy } from "../lib/debug";
 import { createToolCallIdAllocator } from "./tool-call-id";
 import { createImageBudget, materializeInlineImage, MAX_ENCODED_BYTES_PER_IMAGE, artifactHttpUrl } from "../images/artifacts";
 import type {
@@ -20,8 +20,10 @@ import { getVertexAccessToken } from "../lib/gcp-adc";
 import { fetchAntigravityWithRetry, fetchVertexWithRetry } from "./google-http";
 import { safeAntigravityHttpErrorMessage, safeVertexHttpErrorMessage } from "./google-errors";
 import { isVertexTruncatedTurn, vertexTruncationErrorMessage } from "./google-truncation";
-import { ANTIGRAVITY_REQUEST_UA, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { ANTIGRAVITY_REQUEST_UA, antigravitySessionAnchor, antigravitySessionId, isLikelyRealThoughtSignature, sanitizeAntigravityClaudeSignatures } from "./google-antigravity-wire";
+import { summarizeGoogleWireShape } from "./google-wire-shape";
 import { compileGoogleWireBody } from "./google-wire-compiler";
+import type { GoogleToolSchemaLossReport, GoogleToolSchemaProfile } from "./google-tool-schema";
 import { identifyRoutedModel } from "./identity";
 import {
   antigravityUsesReplayCache,
@@ -737,6 +739,14 @@ function invalidGoogleShapeEvent(
 }
 
 export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  const toolSchemaPolicy = provider.googleToolSchemaPolicy ?? "compatible";
+  const toolSchemaProfile = {
+    endpointClass: provider.googleMode ?? "ai-studio",
+  } satisfies GoogleToolSchemaProfile;
+  const reportToolSchemaLoss = (report: GoogleToolSchemaLossReport): void => {
+    if (!report.lossy && report.uncertainComparisons === 0) return;
+    debugProviderDiagnosticLazy("google", "google-tool-schema-loss", () => ({ ...report }));
+  };
   // Per-request closure: resolveAdapter builds a fresh adapter per request (server.ts), so buildRequest
   // can stash the CCA model/session for parseStream's reasoning-replay observation.
   let antigravityModel: string | undefined;
@@ -799,7 +809,11 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
     ...(provider.googleMode === "vertex" || provider.googleMode === "cloud-code-assist"
       ? {
           fetchResponse: (request: AdapterRequest, ctx?: AdapterFetchContext): Promise<Response> =>
-            (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(request, ctx),
+            (provider.googleMode === "cloud-code-assist" ? fetchAntigravityWithRetry : fetchVertexWithRetry)(
+              request,
+              ctx,
+              { toolSchemaProfile, toolSchemaPolicy },
+            ),
           formatErrorBody: (status: number, _headers: Headers, payloadText: string): string =>
             (provider.googleMode === "cloud-code-assist" ? safeAntigravityHttpErrorMessage : safeVertexHttpErrorMessage)(status, payloadText),
         }
@@ -970,7 +984,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           const fcc = (existing.functionCallingConfig ?? {}) as Record<string, unknown>;
           draftRequest.toolConfig = { ...existing, functionCallingConfig: { ...fcc, mode: "VALIDATED" } };
         }
-        const compiled = compileGoogleWireBody(draftRequest);
+        const compiled = compileGoogleWireBody(draftRequest, toolSchemaProfile, toolSchemaPolicy);
+        reportToolSchemaLoss(compiled.toolSchemaLossReport);
         const request = compiled.body;
         restoreGoogleToolName = compiled.restoreToolName;
         // Compile names before replay: signatures are keyed by the exact provider-visible name.
@@ -989,6 +1004,20 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
           // Vertex and AI Studio share one decision. A second check here would append a
           // duplicate nudge whenever signature sanitization reshapes the tail afterwards.
         }
+        // Opt-in structural description of the request that is about to leave (#5008).
+        //
+        // Passed as a BUILDER, not a value: the lazy form gates before invoking it, so a session
+        // with provider debug off never pays the walk, and it evaluates the projection inside its
+        // own try/catch, so a throw in here cannot turn a built request into a rejected one. The
+        // projection only reads `request`, so the bytes below are the same either way.
+        debugProviderDiagnosticLazy("google", "antigravity-wire-shape", () => summarizeGoogleWireShape(request, {
+          sessionAnchor: antigravitySessionAnchor(parsed),
+          // Signed at translation time, from client history or the durable store. The
+          // Antigravity session cache signs afterwards, inside applyAntigravityReplay, and the
+          // projection attributes that remainder to the cache rather than to this count.
+          historySignedCalls: replayedCallIds.length,
+          replayScopeBound: parsed._reasoningReplayScope !== undefined,
+        }));
         const envelope = {
           model: wireModelId,
           // The envelope's `userAgent` field is a protocol constant ("antigravity"), distinct from
@@ -1006,7 +1035,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       }
 
       if (provider.googleMode === "vertex") {
-        const compiled = compileGoogleWireBody(body);
+        const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
+        reportToolSchemaLoss(compiled.toolSchemaLossReport);
         restoreGoogleToolName = compiled.restoreToolName;
         const vertexProject = provider.project || process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || "api-key";
         const vertexLocation = provider.location || process.env.GOOGLE_CLOUD_LOCATION || "global";
@@ -1052,7 +1082,8 @@ export function createGoogleAdapter(provider: OcxProviderConfig): ProviderAdapte
       if (!apiKey) throw new Error("google (AI Studio) requires a non-empty API key");
       headers["x-goog-api-key"] = apiKey;
 
-      const compiled = compileGoogleWireBody(body);
+      const compiled = compileGoogleWireBody(body, toolSchemaProfile, toolSchemaPolicy);
+      reportToolSchemaLoss(compiled.toolSchemaLossReport);
       restoreGoogleToolName = compiled.restoreToolName;
       return { url, method: "POST", headers, body: JSON.stringify(compiled.body) };
     },
diff --git a/src/adapters/openai-chat-images.ts b/src/adapters/openai-chat-images.ts
index 0aabecaa8b8..9fe644e2261 100644
--- a/src/adapters/openai-chat-images.ts
+++ b/src/adapters/openai-chat-images.ts
@@ -13,7 +13,9 @@ import {
 export const OPENAI_CHAT_IMAGE_BASE64_BUDGET = 3_670_016; // 3.5MiB
 
 export interface NormalizeOpenAIChatImagesOptions
-  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {}
+  extends Pick<NormalizeOptions, "encode" | "tierBias" | "validate"> {
+  abortSignal?: AbortSignal;
+}
 
 /** Whether `value` is a plain object, so message and part shapes can be walked safely. */
 function isRecord(value: unknown): value is Record<string, unknown> {
diff --git a/src/adapters/openai-chat.ts b/src/adapters/openai-chat.ts
index 7c5c2c66b61..633c693c7ff 100644
--- a/src/adapters/openai-chat.ts
+++ b/src/adapters/openai-chat.ts
@@ -297,7 +297,11 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         };
       };
       if (hasShrinkableOpenAIChatImages(messages)) {
-        return normalizeOpenAIChatImages(messages, { tierBias: incoming?.imageTierBias }).then(finish, finish);
+        const imageOptions = { tierBias: incoming?.imageTierBias, abortSignal: incoming?.abortSignal };
+        return normalizeOpenAIChatImages(messages, imageOptions).then(finish, error => {
+          if (incoming?.abortSignal?.aborted) throw error;
+          return finish();
+        });
       }
       return finish();
     },
diff --git a/src/adapters/openai-responses/image-gen.ts b/src/adapters/openai-responses/image-gen.ts
index 4b29c66ad77..4ceef1ca899 100644
--- a/src/adapters/openai-responses/image-gen.ts
+++ b/src/adapters/openai-responses/image-gen.ts
@@ -101,14 +101,17 @@ export function preferConfiguredHostedTools(
   }
 
   let input = body.input;
-  const strippedAdditionalToolsIndices = new Set<number>();
+  // Indices arrive in increasing order, so the first stripped container is already
+  // the minimum — tracking it directly avoids spreading an attacker-sized Set into
+  // Math.min's argument list.
+  let firstStrippedAdditionalToolsIndex: number | undefined;
   if (Array.isArray(body.input)) {
     let nestedChanged = false;
     const mappedInput = body.input.map((item, index) => {
       if (!isPlainObject(item) || item.type !== "additional_tools" || !Array.isArray(item.tools)) return item;
       const nestedTools = stripGroup(item.tools);
       if (nestedTools === item.tools) return item;
-      strippedAdditionalToolsIndices.add(index);
+      firstStrippedAdditionalToolsIndex ??= index;
       nestedChanged = true;
       return { ...item, tools: nestedTools };
     });
@@ -127,17 +130,16 @@ export function preferConfiguredHostedTools(
     || (Array.isArray(input) && input.some(item => isPlainObject(item)
       && item.type === "additional_tools"
       && hasHostedImageGenTool(item.tools)));
-  if ((strippedTopLevelImageGenTool || strippedAdditionalToolsIndices.size > 0) && !hasHostedImageGenDeclaration) {
+  if ((strippedTopLevelImageGenTool || firstStrippedAdditionalToolsIndex !== undefined) && !hasHostedImageGenDeclaration) {
     if (strippedTopLevelImageGenTool && Array.isArray(tools)) {
       tools = [...tools, { type: HOSTED_IMAGE_GENERATION_TOOL }];
-    } else if (strippedAdditionalToolsIndices.size > 0 && Array.isArray(input)) {
+    } else if (firstStrippedAdditionalToolsIndex !== undefined && Array.isArray(input)) {
       // Restore into the FIRST stripped container only. Tool declarations are
       // request-scoped, not container-scoped — the containers are separate carriers for
       // one tool set, so a single hosted declaration covers the request. An earlier
       // revision restored into every stripped container and put `image_generation` on
       // the wire twice; review caught it.
-      const firstStripped = Math.min(...strippedAdditionalToolsIndices);
-      input = input.map((item, index) => index === firstStripped
+      input = input.map((item, index) => index === firstStrippedAdditionalToolsIndex
         && isPlainObject(item)
         && Array.isArray(item.tools)
         ? { ...item, tools: [...item.tools, { type: HOSTED_IMAGE_GENERATION_TOOL }] }
diff --git a/src/adapters/openai-responses/passthrough.ts b/src/adapters/openai-responses/passthrough.ts
index 1184ac6a1c7..83ce6e1517b 100644
--- a/src/adapters/openai-responses/passthrough.ts
+++ b/src/adapters/openai-responses/passthrough.ts
@@ -18,6 +18,7 @@ import type { TranslatorBudget } from "../../lib/translator-budget";
 import { rewriteRoutedCustomToolsForUpstream } from "../../responses/custom-tool-compat";
 import { rewriteRoutedToolSearchForUpstream } from "../../responses/tool-search-compat";
 import { rewriteRoutedNamespaceToolsForUpstream } from "../../responses/namespace-tool-compat";
+import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { preparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
 import { isMetaAiResponsesDestination, rewriteMuseToolNamesForUpstream } from "../../responses/muse-tool-name-alias";
 import { openaiResponsesUrl } from "../openai-responses-url";
@@ -31,7 +32,7 @@ import {
 import {
   createAdapterTierMetadata,
 } from "../../providers/fastwire";
-import { mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
+import { dropResponsesReasoningInputItems, mapRoutedResponsesReasoningEffort, normalizeConfiguredReasoningSummaryDelivery, sanitizeReasoningInputContent, stripDisabledReasoningSummaries, stripDisabledVerbosity, stripUnsupportedReasoningSummaryDelivery } from "./reasoning";
 import { scrubOcxCompactionItems, stripCanonicalOnlyToolFields, stripCanonicalOnlyTopLevelFields, stripInternalChatMessageMetadataPassthrough, stripInvalidItemIds, stripItemIdsWhenUnstored } from "./request-strips";
 import { stripCanonicalForwardPromptCacheOptions, stripDeprecatedPromptCacheRetention } from "./prompt-cache";
 import { isPlainObject } from "./internal";
@@ -295,6 +296,9 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       if (forward || stateless || pairedToolResults) {
         outBody = repairOrphanedInputItems(outBody, unexpandedMiss, synthesizeMissingCallOutputs);
       }
+      if (provider.dropResponsesReasoningItems === true) {
+        outBody = dropResponsesReasoningInputItems(outBody);
+      }
       if (adjacentToolResults) {
         outBody = normalizeResponsesToolResultAdjacency(outBody);
       }
@@ -335,6 +339,12 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       // every turn, and a strict parser rejects the whole request over the missing key —
       // `queries` for DeepSeek (#930), `query` for Console Go (#3071).
       outBody = backfillWebSearchQueries(outBody);
+      // #5095: a conversation that already contains a `default.`-prefixed call name is refused by
+      // the upstream `^[a-zA-Z0-9_-]+$` name pattern on every later turn that replays it, so the
+      // task cannot be compacted or continued at all. Repair the replayed item here, before the
+      // canonical-destination split below, because the reported failure was a side chat on a plain
+      // OpenAI model inheriting history a routed provider had damaged.
+      outBody = repairLegacyDottedToolCallNames(outBody);
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         outBody = stripInternalChatMessageMetadataPassthrough(outBody);
         // The same class of private field, one level up, but keyed on the DESTINATION rather than
@@ -397,14 +407,16 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
         // Last, so promoted namespace children are also cleared of Codex-private fields.
         outBody = stripCanonicalOnlyToolFields(outBody, provider.supportsOpenAiWebSearchToolFields === false);
       }
-      if (!forward) outBody = normalizeOpenCodeGoAdditionalTools(outBody, url);
+      if (!forward) {
+        outBody = normalizeOpenCodeGoAdditionalTools(outBody, url, parsed._replayPrefixLen);
+      }
       // Same predicate as the routedCompaction gate in handleResponses(): an authMode check would
       // let a noncanonical custom forward provider skip this rewrite while the server still routes
       // it as a summarizer turn (#422). The compaction body build removes the tool surface and must
       // therefore be the last routed transform that may depend on those declarations. Structural
       // sanitizers below can still run after it.
       outBody = normalizeResponsesCodeMode(outBody, parsed, provider);
-      if (parsed._compactionRequest === true && !isCanonicalOpenAiForwardProvider(provider)) {
+      if (parsed._compactionRequest === true && (!isCanonicalOpenAiForwardProvider(provider) || parsed._portableCompaction === true)) {
         outBody = buildRoutedCompactionBody(outBody);
       }
       // Run after routed compaction so nested input_image parts are replaced before a malformed
diff --git a/src/adapters/openai-responses/reasoning.ts b/src/adapters/openai-responses/reasoning.ts
index 52f4cf2d408..ae585b4c45b 100644
--- a/src/adapters/openai-responses/reasoning.ts
+++ b/src/adapters/openai-responses/reasoning.ts
@@ -4,6 +4,13 @@ import { OCX_REASONING_PREFIX } from "../../responses/reasoning-envelope";
 import { configuredReasoningEfforts, mapReasoningEffort, modelRecordValue } from "../../reasoning-effort";
 import { isPlainObject } from "./internal";
 
+/** Drop only replayed Responses reasoning items; all other continuation input stays untouched. */
+export function dropResponsesReasoningInputItems(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  const input = body.input.filter(item => !isPlainObject(item) || item.type !== "reasoning");
+  return input.length === body.input.length ? body : { ...body, input };
+}
+
 /**
  * Sanitize reasoning input by field policy, not by preserving each item's shape. Retaining a
  * native `encrypted_content` guarantees only that blob value: `status` is always removed;
diff --git a/src/adapters/opencode-go-additional-tools.ts b/src/adapters/opencode-go-additional-tools.ts
index 35e3aaa3e49..7e3609c134e 100644
--- a/src/adapters/opencode-go-additional-tools.ts
+++ b/src/adapters/opencode-go-additional-tools.ts
@@ -3,7 +3,11 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 /** Console Go accepts public tools but rejects the private additional_tools input wrapper. */
-export function normalizeOpenCodeGoAdditionalTools(body: unknown, responseUrl: string): unknown {
+export function normalizeOpenCodeGoAdditionalTools(
+  body: unknown,
+  responseUrl: string,
+  replayPrefixLength = 0,
+): unknown {
   let destination: URL;
   try {
     destination = new URL(responseUrl);
@@ -20,10 +24,16 @@ export function normalizeOpenCodeGoAdditionalTools(body: unknown, responseUrl: s
 
   const input: unknown[] = [];
   const promoted: unknown[] = [];
+  const currentTurnStart = Number.isFinite(replayPrefixLength)
+    ? Math.min(body.input.length, Math.max(0, Math.trunc(replayPrefixLength)))
+    : 0;
   let changed = false;
-  for (const item of body.input) {
+  for (const [index, item] of body.input.entries()) {
     if (isRecord(item) && item.type === "additional_tools" && Array.isArray(item.tools)) {
       changed = true;
+      // Replayed wrappers are conversation history, not authority for the current request.
+      // Go cannot accept the wrapper itself, so remove it without promoting its catalog.
+      if (index < currentTurnStart) continue;
       // Custom/search/namespace lowering already owns identity and deduplication. This pass
       // only moves declarations, including hosted tools that intentionally have no name.
       for (const tool of item.tools) promoted.push(tool);
diff --git a/src/bridge/sse.ts b/src/bridge/sse.ts
index 66d15f58fce..0466963eb57 100644
--- a/src/bridge/sse.ts
+++ b/src/bridge/sse.ts
@@ -17,11 +17,10 @@ import {
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
 import {
-  freeformFallbackKeys,
   mayBecomePatchEnvelope,
   repairFreeformToolInput,
-  unwrapFreeformToolInput,
 } from "../responses/apply-patch-envelope";
+import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { encodeCompactionSummary } from "../responses/compaction";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
 import { isTruncatedStopReason, truncationReasonFor } from "../responses/truncated-stop-reason";
@@ -153,153 +152,6 @@ export function bridgeToResponsesSSE(
       ? compileCodeModeHelperInput(args, helper, codeModeHelperName ?? toolName)
       : repairFreeformToolInput(args, toolName, namespace);
   };
-  // Best-effort unwrap of a PARTIAL freeform arg buffer for live input streaming
-  // (`response.custom_tool_call_input.delta` — codex-rs uses it for UI preview only;
-  // the completed custom_tool_call item stays authoritative). Compact `{"input":"...`
-  // buffers get their string value progressively unescaped; anything else streams raw.
-  const JSON_WHITESPACE = new Set([" ", "\t", "\n", "\r"]);
-  type WrapperOpening =
-    | { state: "none" }
-    | { state: "prefix" }
-    | { state: "open"; valueStart: number };
-  /**
-   * Where the string value of `{"<key>":"` begins, tolerating the insignificant whitespace
-   * `JSON.parse` accepts.
-   *
-   * The earlier form of this compared the buffer against the compact literal `{"key":"`, so a
-   * wrapper written with spaces or newlines matched no prefix at all, streamed as raw JSON
-   * deltas and then completed as the unwrapped body. That is the same delta/completion
-   * disagreement #5047 closed for compact wrappers, reached through a different spelling:
-   * `unwrapFreeformToolInput` reads the completed text with `JSON.parse`, which does not care
-   * how the object is laid out, so neither can the streaming side.
-   */
-  const wrapperOpening = (args: string, key: string): WrapperOpening => {
-    let index = 0;
-    for (const token of ["{", `"${key}"`, ":", '"']) {
-      while (index < args.length && JSON_WHITESPACE.has(args[index]!)) index++;
-      if (index >= args.length) return { state: "prefix" };
-      for (const expected of token) {
-        if (index >= args.length) return { state: "prefix" };
-        if (args[index] !== expected) return { state: "none" };
-        index++;
-      }
-    }
-    return { state: "open", valueStart: index };
-  };
-  /**
-   * Whether a body could still grow into one complete outer Markdown fence.
-   *
-   * `stripMarkdownCodeFence` removes such a fence at completion for exactly the two tools that
-   * own the grammar, so a fenced body's streamed bytes and its completed input disagree unless
-   * the stream holds. A buffer that does not open with a fence can never acquire one, so
-   * ordinary bodies are unaffected; a buffer that does keeps its preview suppressed for the
-   * whole call, because a closing fence can still be followed by more text that withdraws it.
-   */
-  const mayBecomeFencedBody = (text: string, toolName: string): boolean => {
-    if (toolName !== "exec" && toolName !== "apply_patch") return false;
-    const head = text.trimStart();
-    if (head === "") return true;
-    return head.startsWith("```") || "```".startsWith(head);
-  };
-  /** The two-character escapes JSON defines, and nothing else. */
-  const JSON_ESCAPES = new Map<string, string>([
-    ['"', '"'], ["\\", "\\"], ["/", "/"],
-    ["b", "\b"], ["f", "\f"], ["n", "\n"], ["r", "\r"], ["t", "\t"],
-  ]);
-  const LOW_SURROGATE_ESCAPE = /^\\u[dD][c-fC-F][0-9a-fA-F]{2}$/;
-  /**
-   * The decoded prefix of a JSON string body, stopping at the first byte it cannot resolve.
-   *
-   * Every stop is a hold rather than a guess, because `JSON.parse` decides the completed value
-   * and anything invented here would be retracted. Three of them are not obvious:
-   *
-   * An escape JSON does not define makes the whole wrapper unparseable no matter what arrives
-   * next, so completion falls back to the raw text. Returning `null` for that case stops the
-   * preview rather than continuing to decode a value the completed item will never carry.
-   * `\\b` and `\\f` are defined, and were previously decoded to the letters b and f.
-   *
-   * A lone high surrogate is not a character. Emitting one alone puts an unpaired code unit in a
-   * delta the client has to decode by itself, so the pair is emitted together or not at all.
-   */
-  const decodeJsonStringPrefix = (body: string): string | null => {
-    let out = "";
-    for (let i = 0; i < body.length; i++) {
-      const c = body[i];
-      if (c === '"') break; // unescaped closing quote: value complete
-      if (c !== "\\") { out += c; continue; }
-      const n = body[i + 1];
-      if (n === undefined) break; // escape split across chunks: wait for more
-      if (n === "u") {
-        const hex = body.slice(i + 2, i + 6);
-        if (hex.length < 4) break; // split across chunks: wait for more
-        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return null; // never parses
-        const code = parseInt(hex, 16);
-        if (code >= 0xd800 && code <= 0xdbff) {
-          const low = body.slice(i + 6, i + 12);
-          if (!LOW_SURROGATE_ESCAPE.test(low)) break;
-          out += String.fromCharCode(code, parseInt(low.slice(2), 16));
-          i += 11;
-          continue;
-        }
-        out += String.fromCharCode(code);
-        i += 5;
-        continue;
-      }
-      const escaped = JSON_ESCAPES.get(n);
-      if (escaped === undefined) return null; // never parses
-      out += escaped;
-      i += 1;
-    }
-    return out;
-  };
-  /**
-   * The value to stream so far, or `null` to HOLD because nothing can be decided yet.
-   *
-   * `input` is decidable from its prefix: `unwrapFreeformToolInput` returns it whenever the
-   * key is present, whatever else the object carries, so its value can be unescaped
-   * progressively and never retracted.
-   *
-   * One case escapes that claim and is accepted rather than fixed: a duplicate `input` key.
-   * `JSON.parse` keeps the last one, so `{"input":"a","input":"b"}` streams a and completes with
-   * b. Closing it means holding every canonical wrapper until its object parses, which is the
-   * progressive streaming this path exists to provide. The completed item stays authoritative,
-   * and no model emits a duplicate key in practice.
-   *
-   * A wrapper that turns invalid AFTER streaming has committed has the same shape and the same
-   * answer. `{"input":"a` followed by `\\qb"}` has already published a when the undefined escape
-   * arrives, and completion returns the raw text because nothing parses. The preview stops
-   * there: no rewind, and no decoded text the completed item does not contain. Bounding the
-   * damage is what is available without giving up progressive streaming, and the args are
-   * unusable in that case whichever representation wins.
-   *
-   * A fallback key is not. It only unwraps when it is the SINGLE string field, and a second
-   * key can still arrive — so a value emitted early would have to be taken back. That is the
-   * rewind this holds instead: stream nothing until the object closes, then publish the one
-   * repaired body. The routed passthrough in `responses-custom-tool-repair.ts` already holds
-   * any object prefix for the same reason (#5047).
-   */
-  const freeformPartialInput = (args: string, toolName: string): string | null => {
-    const openings = ["input", ...freeformFallbackKeys(toolName)]
-      .map(key => ({ key, opening: wrapperOpening(args, key) }));
-    const canonical = openings[0]!.opening;
-    if (canonical.state === "open") {
-      const decoded = decodeJsonStringPrefix(args.slice(canonical.valueStart));
-      if (decoded === null) return null;
-      return mayBecomeFencedBody(decoded, toolName) ? null : decoded;
-    }
-    if (openings.some(entry => entry.opening.state === "open")) {
-      // Committed to a fallback wrapper. Undecidable until the object is complete.
-      try {
-        JSON.parse(args);
-      } catch {
-        return null;
-      }
-      return unwrapFreeformToolInput(args, toolName);
-    }
-    // Still an ambiguous prefix of some wrapper: which wrapper, if any, is not known yet.
-    if (openings.some(entry => entry.opening.state === "prefix")) return null;
-    return mayBecomeFencedBody(args, toolName) ? null : args;
-  };
   // tool_search_call carries arguments as a JSON object ({query, limit}); parse the model's arg string.
   const parseArgsObj = (args: string): Record<string, unknown> => {
     try { const o = JSON.parse(args); return o && typeof o === "object" ? o : {}; } catch { return {}; }
@@ -1199,7 +1051,7 @@ export function bridgeToResponsesSSE(
                   });
                 }
                 if (currentToolCall.freeform && !currentToolCall.codeModeHelperName) {
-                  // `freeformPartialInput` holds while the buffer is still an ambiguous prefix
+                  // `progressiveFreeformInput` holds while the buffer is still an ambiguous prefix
                   // of a JSON wrapper; otherwise stream only the unwrapped input suffix, never
                   // rewinding on a mode flip.
                   //
@@ -1209,7 +1061,7 @@ export function bridgeToResponsesSSE(
                   // is the same disagreement in the other direction.
                   const ownsFreeformGrammar = currentToolCall.namespace === undefined
                     || currentToolCall.namespace === "functions";
-                  const full = freeformPartialInput(
+                  const full = progressiveFreeformInput(
                     currentToolCall.args,
                     ownsFreeformGrammar ? currentToolCall.name : "",
                   );
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 0dde3a22b51..1f683dd857d 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -403,16 +403,16 @@ export async function cmdAutoSwitch(args: string[], deps: AccountDeps): Promise<
     // shared kernel, and absent is a server that does not speak this field at all. Collapsing
     // false into absent would render the live feature as an unknown capability.
     const inert = typeof settings.inert === "boolean" ? settings.inert : null;
-    // A stored threshold only steers selection once the pool consumes it, which is exactly
-    // what `inert: false` reports.
-    const enabled = inert === false && storedThreshold !== null;
+    // A positive stored threshold only steers selection once the pool consumes it, which is
+    // exactly what `inert: false` reports. Zero remains the explicit disabled value.
+    const enabled = inert === false && storedThreshold !== null && storedThreshold > 0;
     if (wantsJson) {
       console.log(JSON.stringify({ provider: name, autoSwitchThreshold: storedThreshold, enabled, poolEnabled, inert }, null, 2));
     } else {
       const value = storedThreshold === null ? "unset" : `${storedThreshold}%`;
       const state = inert === false ? (enabled ? "on" : "off") : inert === true ? "inactive" : "unavailable";
       const why = inert === false
-        ? (enabled ? "applied by this pool" : "no threshold stored")
+        ? (enabled ? "applied by this pool" : storedThreshold === 0 ? "usage-based switching disabled" : "no threshold stored")
         : inert === true ? "not applied by this pool" : "threshold support is unknown";
       console.log(`auto-switch: ${state} (stored threshold ${value}; ${why})`);
     }
diff --git a/src/cli/dispatch.ts b/src/cli/dispatch.ts
index d152d673f52..029336f66c9 100644
--- a/src/cli/dispatch.ts
+++ b/src/cli/dispatch.ts
@@ -945,9 +945,9 @@ export type StartOwnerDecision = "refuse" | "service-stay-out" | "sibling";
  *
  * The #3106 guard exists so a bare `start` cannot shadow a healthy configured-port
  * proxy with an ephemeral-port copy. An interactive `--port X` naming a DIFFERENT
- * port than the live proxy's is an explicit sibling request, not that shadow — and
- * refusing it also broke every spawned-launcher test on a machine running a real
- * proxy, because the probe reaches the machine-global port across sandbox homes.
+ * port than the live proxy's is an explicit sibling request, not that shadow. The
+ * state-directory spend-ledger lease makes the final same-home refusal; keeping this
+ * decision allows isolated homes on one machine to remain independent.
  * The service wrapper always passes the configured port and keeps its exact
  * stay-out-of-the-way semantics: it never takes the sibling path.
  */
diff --git a/src/cli/doctor.ts b/src/cli/doctor.ts
index dc90ece81aa..fc3b5347f72 100644
--- a/src/cli/doctor.ts
+++ b/src/cli/doctor.ts
@@ -1505,8 +1505,16 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   // cannot break a legitimately green pipeline.
 
   console.log("\nCodex agent role files");
-  const tomlFallbackRoles = scanCodexAgentRolesWithTomlModelFallback(resolveCodexHomeDirImpl());
-  if (tomlFallbackRoles.length === 0) {
+  let roleScanError: unknown;
+  const tomlFallbackRoles = scanCodexAgentRolesWithTomlModelFallback(
+    resolveCodexHomeDirImpl(),
+    cause => {
+      roleScanError = cause;
+    },
+  );
+  if (roleScanError) {
+    console.log(`  [WARN] unable to scan $CODEX_HOME/agents/*.toml: ${String(roleScanError)}`);
+  } else if (tomlFallbackRoles.length === 0) {
     console.log("  ok     no per-role model_fallback fields in $CODEX_HOME/agents/*.toml");
   } else {
     console.log(`  [WARN] ${tomlFallbackRoles.length} agent role file${tomlFallbackRoles.length === 1 ? "" : "s"} contain${tomlFallbackRoles.length === 1 ? "s" : ""} \`model_fallback\`: ${tomlFallbackRoles.join(", ")}`);
@@ -1514,13 +1522,24 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   }
   // opencodex does not write these files; the Codex desktop external-agent import does, and it
   // drops the model pin on the way in. Observe-only: doctor never repairs or removes them.
-  const unpinnedDerivedRoles = scanOpencodexDerivedCodexAgentRolesWithoutModelPin(resolveCodexHomeDirImpl());
-  if (unpinnedDerivedRoles.length === 0) {
-    console.log("  ok     every opencodex-derived role file in $CODEX_HOME/agents/*.toml pins a model");
-  } else {
-    console.log(`  [WARN] ${unpinnedDerivedRoles.length} opencodex-derived role file${unpinnedDerivedRoles.length === 1 ? "" : "s"} without a \`model\` pin: ${unpinnedDerivedRoles.map(role => `${role}.toml`).join(", ")}`);
-    console.log("        Codex runs these roles on the parent model, so a spawn records one role and another model. The `ocx-route` directive in the file cannot pin them: it is honoured only on the Claude Code `/v1/messages` path and is inert on `/v1/responses`.");
-    console.log("        Add `model = \"<id>\"` to each file, or remove them. They usually come from the Codex desktop external-agent import of ~/.claude/agents/ocx-*.md; set `[desktop] external-agent-import-sync-item-types` with `SUBAGENTS = false` to stop it recreating them.");
+  // Both role scans share the same directory listing, so a failure above already reported the
+  // cause; skip the second scan rather than warn twice or print a false "ok".
+  if (!roleScanError) {
+    const unpinnedDerivedRoles = scanOpencodexDerivedCodexAgentRolesWithoutModelPin(
+      resolveCodexHomeDirImpl(),
+      cause => {
+        roleScanError = cause;
+      },
+    );
+    if (roleScanError) {
+      console.log(`  [WARN] unable to scan $CODEX_HOME/agents/*.toml: ${String(roleScanError)}`);
+    } else if (unpinnedDerivedRoles.length === 0) {
+      console.log("  ok     every opencodex-derived role file in $CODEX_HOME/agents/*.toml pins a model");
+    } else {
+      console.log(`  [WARN] ${unpinnedDerivedRoles.length} opencodex-derived role file${unpinnedDerivedRoles.length === 1 ? "" : "s"} without a \`model\` pin: ${unpinnedDerivedRoles.map(role => `${role}.toml`).join(", ")}`);
+      console.log("        Codex runs these roles on the parent model, so a spawn records one role and another model. The `ocx-route` directive in the file cannot pin them: it is honoured only on the Claude Code `/v1/messages` path and is inert on `/v1/responses`.");
+      console.log("        Add `model = \"<id>\"` to each file, or remove them. They usually come from the Codex desktop external-agent import of ~/.claude/agents/ocx-*.md; set `[desktop] external-agent-import-sync-item-types` with `SUBAGENTS = false` to stop it recreating them.");
+    }
   }
 
   const dual = collectWslDualInstall();
diff --git a/src/cli/hub.ts b/src/cli/hub.ts
index e3edcedc23b..dcb55073426 100644
--- a/src/cli/hub.ts
+++ b/src/cli/hub.ts
@@ -228,8 +228,9 @@ export function hubInviteCommand(
   managementUrl: string,
   clients: OcxConnectedClientId[],
 ): string {
-  const clientsFlag = clients.length > 0 ? ` --clients ${clients.join(",")}` : "";
-  return `echo '${code}' | ocx connect ${dataUrl} --management-url ${managementUrl}${clientsFlag} --pairing-code-stdin`;
+  const shellQuote = (value: string): string => `'${value.replaceAll("'", `'"'"'`)}'`;
+  const clientsFlag = clients.length > 0 ? ` --clients ${shellQuote(clients.join(","))}` : "";
+  return `echo ${shellQuote(code)} | ocx connect ${shellQuote(dataUrl)} --management-url ${shellQuote(managementUrl)}${clientsFlag} --pairing-code-stdin`;
 }
 
 async function runInvite(args: string[], deps: HubCommandDeps): Promise<number> {
diff --git a/src/cli/index.ts b/src/cli/index.ts
index fb68ae09f2d..00d89469fd3 100755
--- a/src/cli/index.ts
+++ b/src/cli/index.ts
@@ -78,6 +78,7 @@ import {
 } from "./tray-proxy";
 import { requestBoundSystemRestart } from "./system-restart-client";
 import { installCrashGuards } from "../lib/crash-guard";
+import { SpendLedgerOwnerError } from "../lib/spend-ledger-owner";
 import { redactUrlForLog } from "../lib/redact";
 import { dispatchCommand, decideBusyPreferredPort, decideStartWithLiveOwner } from "./dispatch";
 import { AuxiliaryListenerBindError, findAvailablePort, isAddrInUse, PortUnavailableError, shouldPersistSelectedPort, waitForPortAvailable } from "../server/ports";
@@ -418,8 +419,8 @@ async function handleStart(options: { block?: boolean } = {}) {
     // to bake the service (observed: a probe on 10198 left the service pinned there).
     siblingStart = true;
     console.warn(
-      `Proxy already running on port ${owner.live.port}; starting a second instance on requested port ${requestedPort}. `
-      + `The new instance takes over this home's pid/runtime records and Codex config while it runs.`,
+      `Proxy already running on port ${owner.live.port}; requested a second instance on port ${requestedPort}. `
+      + `Startup continues only for an independent OPENCODEX_HOME; one state directory has one spend-ledger writer.`,
     );
   }
 
@@ -463,6 +464,10 @@ async function handleStart(options: { block?: boolean } = {}) {
       scheduleCatalogPrewarm();
       break;
     } catch (err) {
+      if (err instanceof SpendLedgerOwnerError) {
+        console.error(`❌ ${err.message}`);
+        process.exit(1);
+      }
       if (err instanceof AuxiliaryListenerBindError || !isAddrInUse(err) || attempt >= 2) throw err;
       if (requestedPort !== undefined) {
         console.log(`⚠️  Port ${port} was taken while starting; waiting to retry the same port...`);
diff --git a/src/cli/opencode.ts b/src/cli/opencode.ts
index 2c49bd2d8df..0f1a562738d 100644
--- a/src/cli/opencode.ts
+++ b/src/cli/opencode.ts
@@ -41,7 +41,7 @@ import type {
 } from "../clients/config-export";
 import { filterCatalogVisibleModels, visibleNativeSlugs } from "../codex/catalog";
 import { commandInvocation } from "../lib/win-exec";
-import { configuredAdminToken } from "../lib/admin-secrets";
+import { configuredAdminToken, opencodeCatalogToken } from "../lib/admin-secrets";
 import { localManagementOrigin } from "../lib/local-destinations";
 import { directLocalHttpFetch } from "../server/direct-local-http";
 import { loadServiceTokenFromFile, serviceApiTokenFilePath } from "../lib/service-secrets";
@@ -684,7 +684,7 @@ export async function cmdOpencode(args: string[]): Promise<number> {
   try {
     const managementToken = configuredAdminToken();
     if (!managementToken) throw new Error("No local admin token is available; check the running proxy's home.");
-    proxyModels = await fetchOpencodeProxyModels(live, managementToken, {
+    proxyModels = await fetchOpencodeProxyModels(live, opencodeCatalogToken(managementToken), {
       managementOrigin: localManagementOrigin({ ...startupConfig, hostname: live.hostname }, live.port),
     });
   } catch (error) {
diff --git a/src/cli/provider.ts b/src/cli/provider.ts
index 958989a94fc..83ea1027a75 100644
--- a/src/cli/provider.ts
+++ b/src/cli/provider.ts
@@ -139,7 +139,7 @@ function handleList(args: string[]): void {
 // provider add
 // ---------------------------------------------------------------------------
 
-const ADD_USAGE = "Usage: ocx provider add <name> [--adapter <adapter>] [--base-url <url>] [--api-key <key>] [--api-key-transport <x-api-key|bearer>] [--default-model <model>] [--model <id> --text-only] [--allow-private-network] [--set-default] [--force] [--json] [--sync]";
+const ADD_USAGE = "Usage: ocx provider add <name> [--adapter <adapter>] [--base-url <url>] [--api-key <key>] [--api-key-transport <x-api-key|bearer>] [--default-model <model>] [--model <id> --text-only] [--google-tool-schema-policy <compatible|reject-lossy>] [--allow-private-network] [--set-default] [--force] [--json] [--sync]";
 
 async function handleAdd(args: string[]): Promise<void> {
   const name = args[0];
@@ -164,6 +164,7 @@ async function handleAdd(args: string[]): Promise<void> {
   const adapter = consumeFlagValue(restArgs, "--adapter");
   const baseUrl = consumeFlagValue(restArgs, "--base-url");
   const defaultModel = consumeFlagValue(restArgs, "--default-model");
+  const googleToolSchemaPolicy = consumeFlagValue(restArgs, "--google-tool-schema-policy");
   const textOnly = consumeFlag(restArgs, "--text-only");
   const capabilityModel = consumeFlagValue(restArgs, "--model");
   rejectUnknownArgs(restArgs, ADD_USAGE);
@@ -228,6 +229,17 @@ async function handleAdd(args: string[]): Promise<void> {
     }
     provConfig.apiKeyTransport = apiKeyTransport;
   }
+  if (googleToolSchemaPolicy !== undefined) {
+    if (googleToolSchemaPolicy !== "compatible" && googleToolSchemaPolicy !== "reject-lossy") {
+      console.error('Error: --google-tool-schema-policy must be "compatible" or "reject-lossy".');
+      process.exit(1);
+    }
+    if (provConfig.adapter !== "google") {
+      console.error("Error: --google-tool-schema-policy requires the google adapter.");
+      process.exit(1);
+    }
+    provConfig.googleToolSchemaPolicy = googleToolSchemaPolicy;
+  }
 
   const existingProvider = config.providers[name];
   if (existingProvider?.modelCapabilities !== undefined && provConfig.modelCapabilities === undefined) {
diff --git a/src/client/machine-api.ts b/src/client/machine-api.ts
index 9788e74fe60..593c3bf8df9 100644
--- a/src/client/machine-api.ts
+++ b/src/client/machine-api.ts
@@ -23,7 +23,7 @@ export interface MachineStatusV1 {
 export interface MachineApiDeps {
   sync: typeof syncConnectedClient;
   disconnect: typeof disconnectClient;
-  scheduleStandaloneRecycle: () => void;
+  scheduleStandaloneRecycle: (disconnectedTokenFingerprint: string) => void;
   hubReachability?: () => HubReachability;
   setHubReachability?: (value: HubReachability) => void;
 }
@@ -130,7 +130,7 @@ export async function handleMachineApi(
     }
     try {
       const result = await deps.disconnect(input.keepCatalog === undefined ? {} : { keepCatalog: input.keepCatalog });
-      deps.scheduleStandaloneRecycle();
+      deps.scheduleStandaloneRecycle(state.tokenFingerprint);
       return Response.json({ success: true, ...result }, { status: 202 });
     } catch (error) {
       return Response.json({ success: false, error: error instanceof Error ? error.message : "disconnect failed" }, { status: 409 });
diff --git a/src/client/machine-listener.ts b/src/client/machine-listener.ts
index d4b66881be8..f0dd56b7656 100644
--- a/src/client/machine-listener.ts
+++ b/src/client/machine-listener.ts
@@ -75,8 +75,8 @@ export function startMachineListener(
   const machineApiDeps: MachineApiDeps = {
     sync: deps.machineApi?.sync ?? syncConnectedClient,
     disconnect: deps.machineApi?.disconnect ?? disconnectClient,
-    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (() => {
-      void import("./runtime").then(module => module.scheduleStandaloneRecycle());
+    scheduleStandaloneRecycle: deps.machineApi?.scheduleStandaloneRecycle ?? (tokenFingerprint => {
+      void import("./runtime").then(module => module.scheduleStandaloneRecycle(tokenFingerprint));
     }),
     hubReachability: deps.machineApi?.hubReachability ?? (() => hubReachability),
     setHubReachability: deps.machineApi?.setHubReachability ?? (value => { hubReachability = value; }),
diff --git a/src/client/runtime.ts b/src/client/runtime.ts
index f8eb85920a8..bef2691d594 100644
--- a/src/client/runtime.ts
+++ b/src/client/runtime.ts
@@ -4,6 +4,7 @@ import { loadConfig } from "../config";
 import { removePid, removeRuntimePort, writePid, writeRuntimePort } from "../config/process-state";
 import { installCrashGuards } from "../lib/crash-guard";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
+import { loadServiceTokenFromFile, serviceApiTokenFingerprint } from "../lib/service-secrets";
 import { findAvailablePort } from "../server/ports";
 import { startMachineListener } from "./machine-listener";
 import { readClientConnectionState } from "./state";
@@ -17,7 +18,30 @@ function cleanup(): void {
   removeRuntimePort(process.pid);
 }
 
-export function scheduleStandaloneRecycle(): void {
+export function standaloneRecycleEnv(
+  env: NodeJS.ProcessEnv,
+  disconnectedTokenFingerprint: string,
+): NodeJS.ProcessEnv {
+  const childEnv = { ...env };
+  const admissionToken = childEnv.OPENCODEX_API_AUTH_TOKEN?.trim();
+  if (admissionToken && serviceApiTokenFingerprint(admissionToken) !== disconnectedTokenFingerprint) {
+    // A surviving env token shadows OCX_API_TOKEN_FILE entirely, so nothing below can
+    // reintroduce the disconnected token.
+    return childEnv;
+  }
+  if (admissionToken) delete childEnv.OPENCODEX_API_AUTH_TOKEN;
+  // The respawned `ocx start` loads OCX_API_TOKEN_FILE into OPENCODEX_API_AUTH_TOKEN when the
+  // env token is absent, so vet the file by content: drop the pointer when it is unreadable or
+  // holds the disconnected token, keep it when it holds a different operator credential.
+  if (!childEnv.OCX_API_TOKEN_FILE?.trim()) return childEnv;
+  const fileToken = loadServiceTokenFromFile(childEnv);
+  if (fileToken === null || serviceApiTokenFingerprint(fileToken) === disconnectedTokenFingerprint) {
+    delete childEnv.OCX_API_TOKEN_FILE;
+  }
+  return childEnv;
+}
+
+export function scheduleStandaloneRecycle(disconnectedTokenFingerprint: string): void {
   if (recycleScheduled) return;
   recycleScheduled = true;
   const timer = setTimeout(() => {
@@ -46,7 +70,7 @@ export function scheduleStandaloneRecycle(): void {
         detached: true,
         stdio: "ignore",
         windowsHide: true,
-        env: { ...process.env },
+        env: standaloneRecycleEnv(process.env, disconnectedTokenFingerprint),
       });
       child.unref();
     }
diff --git a/src/codex/account-store.ts b/src/codex/account-store.ts
index 4d681ecf2f4..8a019d77005 100644
--- a/src/codex/account-store.ts
+++ b/src/codex/account-store.ts
@@ -370,6 +370,23 @@ export function isCodexAccountGenerationLive(id: string, generation: number): bo
   return !!record?.credential && record.deletedAt == null && record.generation === generation;
 }
 
+/**
+ * The same verdict as {@link isCodexAccountGenerationLive}, over ONE store load.
+ *
+ * `readCodexAccountRecord` is `loadCodexAccountRecordStore()[id]`, so asking it per row
+ * reloads, reparses and renormalizes the whole file per row — the exact shape
+ * {@link loadCodexAccountRecordSnapshot} was added to avoid. The denial reader resolves
+ * several accounts in one synchronous pass on the request path, so it opens one checker and
+ * closes over the snapshot instead.
+ */
+export function beginCodexAccountGenerationLiveCheck(): (id: string, generation: number) => boolean {
+  const snapshot = loadCodexAccountRecordSnapshot();
+  return (id, generation) => {
+    const record = snapshot[id];
+    return !!record?.credential && record.deletedAt == null && record.generation === generation;
+  };
+}
+
 export function saveCodexAccountCredentialIfGeneration(
   id: string,
   generation: number,
@@ -596,6 +613,41 @@ function withCredentialMutationLockSync<T>(fn: () => T): T {
 }
 
 type CodexTokenResult = { accessToken: string; chatgptAccountId: string; generation: number };
+type CodexRefreshGenerationHandoff = (accountId: string, fromGeneration: number, toGeneration: number) => void;
+// var (hoisted, initialized to undefined) rather than const: a registrar reached
+// through an import cycle can register while this module body is still evaluating,
+// and the lazily created Set must be reachable rather than in the temporal dead zone.
+var refreshGenerationHandoffs: Set<CodexRefreshGenerationHandoff> | undefined;
+function refreshHandoffs(): Set<CodexRefreshGenerationHandoff> {
+  return refreshGenerationHandoffs ??= new Set();
+}
+
+/** Register process-local state that must follow a credential refresh generation. */
+export function registerCodexRefreshGenerationHandoff(handoff: CodexRefreshGenerationHandoff): () => void {
+  const set = refreshHandoffs();
+  set.add(handoff);
+  return () => set.delete(handoff);
+}
+
+/**
+ * Invoke every registered handoff for one committed `fromGeneration` to `toGeneration` move.
+ *
+ * Each listener runs independently and a throw is contained: by the time handoffs run the
+ * rotated credential is already persisted, so a failing listener must not reject the shared
+ * refresh promise (surviving waiters would see a refresh failure that never happened), must
+ * not starve the remaining listeners, and must not block plan reconciliation. The warning
+ * carries no account id or token material — the same scrub refresh error messages get.
+ */
+function dispatchRefreshGenerationHandoffs(accountId: string, fromGeneration: number, toGeneration: number): void {
+  for (const handoff of refreshHandoffs()) {
+    try {
+      handoff(accountId, fromGeneration, toGeneration);
+    } catch (error) {
+      console.warn("[codex-auth] a refresh generation handoff listener failed", error);
+    }
+  }
+}
+
 type CodexRefreshResult = CodexTokenResult & {
   credential?: CodexAccountCredentials;
   /**
@@ -1377,6 +1429,19 @@ async function resolveCodexToken(
    * committed result, for every waiter, including none.
    */
   const refreshPromise = fetchPromise.then(async (result): Promise<CodexRefreshResult> => {
+    // Generation-dependent completion belongs to the flight, not to its initiating
+    // request. The owner may stop waiting after a disconnect while this detached work
+    // still commits G+1; advance process-local affinities before any waiter observes
+    // the result (and even when there are no surviving waiters).
+    if (result.selfRefreshed) {
+      dispatchRefreshGenerationHandoffs(id, result.generation - 1, result.generation);
+      // A propagated alias committed at its OWN generation, so its affinities sit at
+      // alias.generation - 1: without this handoff they fail the exact-generation
+      // liveness check on the very next request that reads them.
+      for (const alias of result.propagatedAliases ?? []) {
+        dispatchRefreshGenerationHandoffs(alias.id, alias.generation - 1, alias.generation);
+      }
+    }
     await notePlanFromRefreshedAccessToken(id, result.accessToken, result.generation);
     // One settlement path for the whole flight: the refreshing account, then any dormant alias that
     // adopted the same rotated JWT. An alias holds the identical access token, so a changed
diff --git a/src/codex/auth-api/account-list.ts b/src/codex/auth-api/account-list.ts
index faa8eeefc08..b19e487264a 100644
--- a/src/codex/auth-api/account-list.ts
+++ b/src/codex/auth-api/account-list.ts
@@ -82,9 +82,9 @@ export function mainQuotaWithCarriedResetCredits(
 /**
  * Why an account needs the operator. `missing_credential`, `refresh_failed`, and
  * `quota_unauthorized` are the three causes this surface tells apart on its own. `unauthorized`
- * and `forbidden` exist because the shared health projection may return them; today
- * `projectCodexAccountHealth` only ever produces `refresh_failed`, so accepting the full union
- * keeps this field correct if that projection widens rather than silently dropping a reason.
+ * and `forbidden` come from the shared health projection: `projectCodexAccountHealth` maps a
+ * stored verification failure's `http_status:401`/`http_status:403` to them, so the union has
+ * to accept every reason the projection can emit rather than silently dropping one.
  */
 export type CodexAccountReauthReason =
   | "missing_credential"
@@ -105,18 +105,26 @@ export function poolAccountDto(
   const plan = codexPlanValue(account.plan);
   const quota = quotaForPlan(quotaResult.quota, plan);
   const runtimeReauth = isAccountNeedsReauth(account.id);
+  const rawReauthReason: CodexAccountReauthReason | undefined = !hasCredential
+    ? "missing_credential"
+    : quotaResult.reauthReason;
   const needsReauth = !hasCredential || quotaResult.needsReauth || runtimeReauth;
-  const health = projectCodexAccountHealth({ accountId: account.id, needsReauth });
+  // An in-memory reauth mark carries no cause of its own, so it must not name one: passing
+  // a caller reason here would outrank the stored verdict's http_status inside the
+  // projection and hide unauthorized/forbidden until the mark is gone. With no caller
+  // reason the projection falls back to the persisted cause, then to refresh_failed.
+  const healthReason = rawReauthReason === "quota_unauthorized" || rawReauthReason === "missing_credential"
+    ? "unauthorized"
+    : rawReauthReason;
+  const health = projectCodexAccountHealth({
+    accountId: account.id,
+    needsReauth,
+    reauthReason: needsReauth ? healthReason : undefined,
+  });
   // `needsReauth` is an OR of three independent causes plus a persisted verdict resolved inside the
   // health projection. Emitting only the boolean is what left #4212's reporter guessing which
   // account took their model away and why, so name the cause they actually have to act on.
-  const reauthReason: CodexAccountReauthReason | undefined = !hasCredential
-    ? "missing_credential"
-    : runtimeReauth
-      ? "refresh_failed"
-      : quotaResult.needsReauth
-        ? "quota_unauthorized"
-        : health.status === "reauth_required" ? health.reason : undefined;
+  const reauthReason: CodexAccountReauthReason | undefined = rawReauthReason ?? (health.status === "reauth_required" ? health.reason : undefined);
   return {
     id: account.id,
     email: projectEmail(account.email, maskEmails) ?? account.email,
diff --git a/src/codex/auth-api/pool-quota-probe.ts b/src/codex/auth-api/pool-quota-probe.ts
index 84f8519af1e..538f6023240 100644
--- a/src/codex/auth-api/pool-quota-probe.ts
+++ b/src/codex/auth-api/pool-quota-probe.ts
@@ -1,4 +1,4 @@
-import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, forceRefreshCodexPoolToken, markCodexAccountValidated, markCodexAccountValidationFailed, readCodexAccountRecord, CodexCredentialGenerationConflictError, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError, TokenRefreshError } from "../account-store";
+import { capturePoolQuotaWriter, getValidCodexToken, isCodexAccountGenerationLive, forceRefreshCodexPoolToken, markCodexAccountValidated, markCodexAccountValidationFailed, readCodexAccountRecord, isTerminalCodexPoolRefreshFailure, CodexCredentialGenerationConflictError, CodexCredentialRefreshLockTimeoutError, CodexCredentialRefreshBusyError, CodexCredentialRefreshStaleError, TokenRefreshError } from "../account-store";
 import type { PoolQuotaWriter } from "../quota-types";
 import { isValidWhamHistoryObservation, getAccountQuota, isCompleteCodexQuotaRecoverySnapshot, parseUsageQuota, setAccountQuotaFromParsed } from "../quota";
 import type { StoredAccountQuota, WhamUsageResponse } from "../quota";
@@ -46,6 +46,8 @@ export interface PoolQuotaResult {
   resetRefreshLineage?: ManualResetRefreshLineage;
   quota: StoredAccountQuota | null;
   needsReauth: boolean;
+  /** Failure source observed while obtaining the quota, when reauthentication is required. */
+  reauthReason?: "refresh_failed" | "quota_unauthorized";
   /** Credential generation whose cache or network result this DTO state belongs to. */
   credentialGeneration?: number;
   /** Present only when this call freshly parsed a WHAM usage response. */
@@ -178,7 +180,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // the credential it condemned, so a late terminal response arriving after the operator
     // re-authenticated would quarantine the replacement.
     markAccountNeedsReauth(accountId, captureConfigGeneration(), rejectedGeneration);
-    return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+    return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: rejectedGeneration };
   }
 
   const claim = claimQuotaRecovery(accountId, rejectedGeneration);
@@ -186,7 +188,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // A lineage fenced by a TERMINAL refresh failure stays terminal. Without this, the
     // budget being used would make the next bare 401 report a dead credential as healthy.
     if (quotaRecoveryTerminalFor(accountId, rejectedGeneration)) {
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: rejectedGeneration };
     }
     // Otherwise: this lineage spent its attempt, another caller is mid-refresh, or a
     // transient failure is backing off. Report transient and let the next poll try —
@@ -225,8 +227,15 @@ export async function recoverPoolQuotaFrom401(ctx: {
     // A refresh that failed terminally is the one case where the credential really is gone.
     // Everything else is unknown, and unknown is not proof.
     if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
+      // Persist the same verdict the token guardian writes: the in-memory mark dies with
+      // this process, and only the stored terminal failure keeps a cached listing from
+      // calling the dead grant healthy after a restart.
+      markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
+        expectedGeneration: rejectedGeneration,
+        terminal: true,
+      });
       markAccountNeedsReauth(accountId, captureConfigGeneration(), rejectedGeneration);
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: rejectedGeneration };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: rejectedGeneration };
     }
     return { quota: existing ?? null, needsReauth: false, credentialGeneration: rejectedGeneration };
   }
@@ -258,7 +267,7 @@ export async function recoverPoolQuotaFrom401(ctx: {
       // let the next poll call a dead credential healthy. The evidence is about the
       // REFRESHED credential, which is what the replay used.
       markAccountNeedsReauth(accountId, writerGeneration, refreshed.generation);
-      return { quota: existing ?? null, needsReauth: true, credentialGeneration: refreshed.generation };
+      return { quota: existing ?? null, needsReauth: true, reauthReason: "quota_unauthorized", credentialGeneration: refreshed.generation };
     }
     return { quota: existing ?? null, needsReauth: false, credentialGeneration: refreshed.generation };
   }
@@ -399,9 +408,23 @@ export async function fetchFreshPoolAccountQuota(
         quotaProbeSkipped: true,
       }, quotaProbeEvidence);
     }
-    if (e instanceof TokenRefreshError) {
+    // Terminal means the grant itself is dead or missing; an `unknown` refresh failure (a
+    // token-endpoint 5xx, a transport blip) may clear, so it reports transient like the
+    // 401-recovery path instead of quarantining a healthy account (#2887). A revoked or
+    // expired grant is also written to the record as a terminal validation failure, the same
+    // verdict the token guardian persists: the in-memory mark dies with this process, and
+    // the stored verdict is what keeps a cached listing from calling the dead grant healthy
+    // after a restart.
+    if (isTerminalCodexPoolRefreshFailure(e)) {
+      if (e instanceof TokenRefreshError && isTerminalRefreshError(e)) {
+        markCodexAccountValidationFailed(accountId, `refresh_${e.reason}`, {
+          expectedGeneration: requestCredentialGeneration,
+          terminal: true,
+        });
+      }
+      markAccountNeedsReauth(accountId, captureConfigGeneration(), requestCredentialGeneration);
       return withQuotaProbeEvidence(
-        { quota: existing ?? null, needsReauth: true, credentialGeneration: requestCredentialGeneration },
+        { quota: existing ?? null, needsReauth: true, reauthReason: "refresh_failed", credentialGeneration: requestCredentialGeneration },
         quotaProbeEvidence,
       );
     }
diff --git a/src/codex/catalog/gather-capture.ts b/src/codex/catalog/gather-capture.ts
index 318fac9bd39..656a3b4d3b4 100644
--- a/src/codex/catalog/gather-capture.ts
+++ b/src/codex/catalog/gather-capture.ts
@@ -100,8 +100,9 @@ import type {
   CatalogSourceEvidence,
   CatalogTrustedOpenAiApiPolicySnapshot,
 } from "../convergence-types";
-import { applyRegistryCapabilitySeedFill, modelCapabilities, modelInputModalities } from "./model-hints";
+import { modelCapabilities, modelInputModalities } from "./model-hints";
 import { configuredComboTargetModelsByProvider } from "./combo-member";
+import { resolveModelPolicy } from "../../providers/resolved-model-policy";
 
 /** Concurrent gatherRoutedModels callers with the same catalog identity share one live discovery.
  *  Keyed by gatherFlightKey so a different config cannot join or evict the wrong flight. */
@@ -344,8 +345,26 @@ export function captureProviderGather(
 ): CapturedProviderGather {
   const enriched = detachedClone(withCanonicalOpenAiForwardAuthDefault(name, configured));
   enrichProviderFromRegistry(name, enriched);
-  applyRegistryCapabilitySeedFill(name, enriched);
   const registryTransportMatch = providerMatchesRegistryTransport(name, enriched);
+  const registryEntry = registryTransportMatch ? getProviderRegistryEntry(name) : undefined;
+  const staticProvider = resolveModelPolicy({
+    providerName: name,
+    modelId: enriched.defaultModel ?? "__catalog_capture__",
+    provider: enriched,
+    registryEntry,
+    transportMatchedRegistry: registryTransportMatch,
+    ...(enriched.authMode ? { effectiveAuth: { authMode: enriched.authMode } } : {}),
+  }).provider;
+  for (const key of [
+    "modelContextWindows", "modelInputModalities", "modelMaxInputTokens", "modelMaxOutputTokens",
+    "modelReasoningEfforts", "modelSupportsReasoningSummaries",
+    "modelSupportsVerbosity", "modelSupportsServiceTier",
+  ] as const) {
+    if (staticProvider[key] !== undefined) enriched[key] = detachedClone(staticProvider[key]) as never;
+  }
+  // A present modelDefaultReasoningEfforts object is a whole-map catalog authority, including
+  // explicit {}. enrichProviderFromRegistry already preserves/fills that contract; replacing it
+  // with the resolver's per-key registry fill would turn "no configured default" into a seed default.
   const provider = recursivelyFreeze(enriched);
   const fastPolicyAuthority = captureFastPolicyAuthority(
     name,
diff --git a/src/codex/catalog/model-hints.ts b/src/codex/catalog/model-hints.ts
index 4d58bace599..8fd19f0054f 100644
--- a/src/codex/catalog/model-hints.ts
+++ b/src/codex/catalog/model-hints.ts
@@ -90,6 +90,7 @@ import type { CatalogModel } from "./parsing";
 import { disabledNativeSlugs, hasComboTargets, hasNativeOpenAiCapabilityMetadata, NATIVE_GPT56_MAX_INPUT_TOKENS, nativeContextLimits, nativeOpenAiCapabilityDisplayName, nativeDefaultReasoningEffort, nativeInputModalities, nativeOpenAiAutoCompactTokenLimit, nativeOpenAiContextWindow, nativeOpenAiMaxInputTokens, nativeOpenAiMaxOutputTokens, nativeOpenAiSlugs, nativeParallelToolCalls, nativeReasoningEfforts } from "./metadata";
 import { deriveComboCatalogModel, normalizedOpenAiApiSignature, openAiApiCollisionWarnings, replaceLastComboCatalogOmissions, warnUncataloguedComboOnce } from "./aggregation";
 import type { ComboCatalogOmission } from "./aggregation";
+import { clampObservedModelLimits, resolveModelPolicy } from "../../providers/resolved-model-policy";
 import type { CatalogGatherProviderAuthEvidence } from "./filesystem-evidence";
 import type {
   CatalogAdmissionSnapshot,
@@ -246,22 +247,6 @@ export function configuredReasoningSummarySupport(prov: OcxProviderConfig | unde
   return modelRecordValue(prov.modelReasoningSummaryDelivery, id) !== undefined ? true : undefined;
 }
 
-function configuredVerbositySupport(name: string, prov: OcxProviderConfig | undefined, id: string): boolean | undefined {
-  const explicit = prov ? modelRecordValue(prov.modelSupportsVerbosity, id) : undefined;
-  if (explicit !== undefined) return explicit;
-  if (!prov) return undefined;
-  void name;
-  // Provider-wide fallback for ids the per-model map does not enumerate — a live-discovered
-  // model would otherwise re-advertise a control the upstream accepts and ignores.
-  //
-  // Read from the PROVIDER CONFIG, never from PROVIDER_REGISTRY. A gather flight captures its
-  // registry authority up front and forbids any later registry read, so consulting the registry
-  // here made a custom-destination flight fall back to "configured" instead of serving its own
-  // discovery result (tests/codex-integration/codex-gather-authority.test.ts). `applyVerbosityDefaults` in
-  // providers/derive.ts materializes the registry default into the config at seed/enrich time.
-  return prov.supportsVerbosity;
-}
-
 export function applyProviderConfigHints(
   name: string,
   prov: OcxProviderConfig,
@@ -270,6 +255,15 @@ export function applyProviderConfigHints(
   metadataModelIdCaseFold?: boolean,
   effectiveAlias?: string | null,
 ): CatalogModel {
+  const staticPolicy = resolveModelPolicy({
+    providerName: name,
+    modelId: model.id,
+    provider: prov,
+    transportMatchedRegistry: false,
+    modelCapabilities: prov.modelCapabilities?.[model.id],
+    ...(prov.authMode ? { effectiveAuth: { authMode: prov.authMode } } : {}),
+    ...(effectiveAlias !== undefined ? { effectiveAlias } : {}),
+  });
   const displayName = configuredModelDisplayName(prov, model.id);
   // The alias decision is resolved once at flight admission (captureProviderGather) and threaded
   // through as `effectiveAlias`. Re-deriving it here would read PROVIDER_REGISTRY after admission,
@@ -279,11 +273,15 @@ export function applyProviderConfigHints(
   const providerAlias = typeof effectiveAlias === "string" || effectiveAlias === null
     ? effectiveAlias
     : model.providerAlias;
-  const configuredCap = configuredContextWindow(prov, model.id);
-  const configuredMaxInput = configuredMaxInputTokens(prov, model.id);
+  const configuredCap = staticPolicy.model.contextWindow ?? configuredContextWindow(prov, model.id);
+  const configuredMaxInput = staticPolicy.model.maxInputTokens;
   const maxOutputTokens = routedMaxOutputTokens(name, prov, model, model.id, metadataModelIdCaseFold);
   const configuredAutoCompact = configuredAutoCompactTokenLimit(prov, model.id);
-  let inputModalities = configuredInputModalities(prov, model.id);
+  // The resolver owns exact capability precedence and legacy exact/colon-family/case-fold fallback.
+  // Removing an exact capability row therefore returns this projection to legacy-map inference.
+  let inputModalities = staticPolicy.model.inputModalities
+    ? [...staticPolicy.model.inputModalities]
+    : undefined;
   // The shared vision-sidecar consumer predicate keeps catalog advertisement and request-time
   // planning aligned. The catalog must still advertise image input — the Codex app
   // gates attachments client-side on input_modalities, and a text-only entry would block images
@@ -297,10 +295,12 @@ export function applyProviderConfigHints(
   }
   const reasoningEfforts = configuredReasoningEfforts(prov, model.id);
   const suppressSyntheticMax = modelRecordValue(prov.modelSuppressSyntheticMax, model.id) === true;
-  const defaultReasoningEffort = modelRecordValue(prov.modelDefaultReasoningEfforts, model.id) ?? model.defaultReasoningEffort;
-  const supportsReasoningSummaries = configuredReasoningSummarySupport(prov, model.id);
-  const supportsVerbosity = configuredVerbositySupport(name, prov, model.id);
+  const defaultReasoningEffort = staticPolicy.model.defaultReasoningEffort ?? model.defaultReasoningEffort;
+  const supportsReasoningSummaries = staticPolicy.model.supportsReasoningSummaries;
+  const supportsVerbosity = staticPolicy.model.supportsVerbosity;
   const fastPolicy = fastPolicyForModel(prov, model.id, name);
+  // Frozen gather providers retain the captured Fast authority. That late/captured eligibility
+  // owns catalog publication, including an explicit provider-level false.
   const supportsServiceTier = serviceTierSupportFromPolicy(fastPolicy);
   const {
     supportsServiceTier: _staleServiceTier,
@@ -313,9 +313,12 @@ export function applyProviderConfigHints(
   const discoveredWindow = typeof model.contextWindow === "number" && model.contextWindow > 0
     ? model.contextWindow
     : undefined;
-  const hintedWindow = discoveredWindow !== undefined
-    ? (configuredCap !== undefined ? Math.min(discoveredWindow, configuredCap) : discoveredWindow)
-    : (configuredCap ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined));
+  const projectedLimits = clampObservedModelLimits(staticPolicy.model, {
+    ...(discoveredWindow !== undefined ? { contextWindow: discoveredWindow } : {}),
+    ...(typeof model.maxInputTokens === "number" && model.maxInputTokens > 0 ? { maxInputTokens: model.maxInputTokens } : {}),
+  });
+  const hintedWindow = projectedLimits.contextWindow
+    ?? (providerCap !== undefined ? resolveUnknownRoutedContextWindow(providerCap) : undefined);
   const hinted = {
     ...modelWithoutServiceTier,
     ...(displayName !== undefined ? { displayName } : {}),
@@ -326,9 +329,7 @@ export function applyProviderConfigHints(
     ...(suppressSyntheticMax ? { suppressSyntheticMax: true } : {}),
     ...(configuredMaxInput !== undefined
       ? {
-        maxInputTokens: typeof model.maxInputTokens === "number" && model.maxInputTokens > 0
-          ? Math.min(model.maxInputTokens, configuredMaxInput)
-          : configuredMaxInput,
+        maxInputTokens: projectedLimits.maxInputTokens ?? configuredMaxInput,
       }
       : {}),
     ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
diff --git a/src/codex/catalog/parsing.ts b/src/codex/catalog/parsing.ts
index fd9a4db1784..d802284aeef 100644
--- a/src/codex/catalog/parsing.ts
+++ b/src/codex/catalog/parsing.ts
@@ -803,6 +803,13 @@ export function normalizeRoutedCatalogEntry(
   delete entry.multi_agent_reasoning_effort;
   delete entry.use_responses_lite;
   delete entry.supports_websockets;
+  // Routed rows cloned from native templates must not inherit OpenAI-only experimental context
+  // delivery. Codex reads the flag as "this model accepts experimental context history" and drives
+  // its context-management cadence from it, so a third-party provider that never negotiated it gets
+  // a compact-after-every-step loop instead (observed on a routed DeepSeek row: 1,600+ compactions
+  // in a single thread). Nothing re-applies the field from provider metadata during this step, so
+  // the row leaves this normalization without it.
+  delete entry.supports_experimental_context;
   /*
    * Tier metadata is stripped from routed rows because a row cloned from a native template
    * would otherwise hand a third-party provider OpenAI's tiers.
diff --git a/src/codex/catalog/provider-models.ts b/src/codex/catalog/provider-models.ts
index ced0cb939ed..d2641eba78d 100644
--- a/src/codex/catalog/provider-models.ts
+++ b/src/codex/catalog/provider-models.ts
@@ -11,6 +11,7 @@ import {
   clearModelCache,
   clearProviderDiscoveryStatus,
   captureModelCacheGeneration,
+  observeModelCacheRevision,
   DEFAULT_MODEL_CACHE_TTL_MS,
   getFreshCached,
   getStaleCached,
@@ -108,6 +109,14 @@ import { captureProviderGather, materializeCapturedHeaders } from "./gather-capt
 export interface ProviderModelsResult {
   readonly models: CatalogModel[];
   readonly outcome: CatalogGatherProviderModelOutcome;
+  /**
+   * The provider's cache content revision as it stood when these rows were chosen.
+   *
+   * Sampled here rather than by the caller because only this point is synchronous with the
+   * choice. A caller reading it after its own await can observe a revision another flight
+   * published in between, and would then record these rows under that flight's identity.
+   */
+  readonly contentRevision: string;
 }
 export const refreshingModelsAuthResolver: ModelsAuthResolver = { kind: "refreshing" };
 
@@ -145,7 +154,11 @@ export async function fetchProviderModelsWithAuth(
   const observed = (
     models: CatalogModel[],
     state: CatalogGatherProviderModelOutcome["state"],
-  ): ProviderModelsResult => ({ models, outcome: { provider: name, state } });
+  ): ProviderModelsResult => ({
+    models,
+    outcome: { provider: name, state },
+    contentRevision: observeModelCacheRevision(name),
+  });
   // Capture before any credential refresh or outbound await. OAuth account changes clear this
   // generation, so a request started with the former account cannot later publish its result.
   const cacheGeneration = captureModelCacheGeneration(name);
@@ -372,7 +385,11 @@ export async function fetchProviderModelsWithAuth(
       ...(cursorFetch ? { fetch: cursorFetch } : {}),
     });
     if (liveResult.ok) {
-      const available = filterCursorConfiguredModelsByLiveDiscovery(configured, liveResult.models);
+      const available = filterCursorConfiguredModelsByLiveDiscovery(
+        configured,
+        liveResult.models,
+        liveResult.maxModeModels ?? [],
+      );
       const result = available.length > 0 ? available : configured;
       // Cache the discovery-filtered roster without combo retention so a later
       // gather can re-apply the current capture's retain set on read.
diff --git a/src/codex/catalog/retained-sync.ts b/src/codex/catalog/retained-sync.ts
index 7f49c0ea13c..66e15186f29 100644
--- a/src/codex/catalog/retained-sync.ts
+++ b/src/codex/catalog/retained-sync.ts
@@ -59,10 +59,12 @@ import {
   type CatalogWritePermit,
 } from "../catalog-write-serialization";
 import {
+  preparedBytesDifferFromDisk,
   publishHashedCodexCatalogBackup,
   publishLegacyCodexCatalogBackup,
   replaceActiveCodexCatalog,
   replaceCodexModelsCache,
+  type PreparedCatalogFileWrite,
 } from "../internal/catalog-writer";
 import { visibleCodexAccountSelectors } from "./account-models";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_OPENAI_MODELS, NATIVE_RESERVE_MODEL } from "./native-models";
@@ -234,24 +236,6 @@ function revalidateRetainedCatalogSync(
   };
 }
 
-/**
- * Exact bytes currently on disk at `path`, or null when unreadable/absent.
- *
- * Deliberately a Buffer rather than a decoded string: `readFileSync(path, "utf8")`
- * substitutes U+FFFD for every invalid byte, so a file holding a raw 0x80 decodes
- * equal to prepared content holding a legitimately encoded U+FFFD. Comparing the
- * decoded strings would then classify a malformed catalog as identical, skip the
- * atomic repair write, and leave the corruption on disk while reporting
- * `catalogWritten: false`.
- */
-function currentCatalogFileContent(path: string): Buffer | null {
-  try {
-    return readFileSync(path);
-  } catch {
-    return null;
-  }
-}
-
 function pristineCatalogBytes(read: RetainedCatalogSyncRead): string | null {
   if (read.onDiskCatalog && !catalogHasRoutedEntries(read.onDiskCatalog)) {
     try {
@@ -558,15 +542,12 @@ function writeRetainedCatalogSync({
   // nothing about the catalog changed. Skipping the no-op write keeps both the mtime
   // and `catalogWritten` honest; `added` still reports the routed rows the catalog
   // carries, because they are on disk either way.
-  const onDiskBytes = currentCatalogFileContent(catalogPath);
-  if (onDiskBytes !== null && onDiskBytes.equals(Buffer.from(content, "utf8"))) {
+  const preparedCatalog: PreparedCatalogFileWrite = { path: catalogPath, content };
+  if (!preparedBytesDifferFromDisk(preparedCatalog)) {
     return { added, path: catalogPath, catalogWritten: false, comboOmissions };
   }
 
-  replaceActiveCodexCatalog(permit, owningCodexHome, {
-    path: catalogPath,
-    content,
-  });
+  replaceActiveCodexCatalog(permit, owningCodexHome, preparedCatalog);
   return {
     added,
     path: catalogPath,
@@ -713,10 +694,25 @@ export function invalidateCodexModelsCacheWithPermit(
       client_version: "0.0.0",
       models: [...models, ...observedAccountModels],
     };
-    replaceCodexModelsCache(permit, owningCodexHome, {
+    const preparedCache: PreparedCatalogFileWrite = {
       path: cachePath,
       content: `${JSON.stringify(wrapper, null, 2)}\n`,
-    });
+    };
+    // The same no-op rule the active catalog already applies (#1459), for the same
+    // reason and at the second writer that has to obey it.
+    //
+    // This function is what `refreshCodexModelCatalog` reports as `cacheSynced`, and
+    // `handleStart` ORs that into the stale-app-server warning. Rewriting identical
+    // bytes bumped this file's mtime and returned `true`, so on a start where the
+    // catalog reproduced byte-identically — the settled case — the warning still
+    // claimed "Disk catalog/cache were updated" and told the operator their Codex
+    // model list might be stale, when nothing on disk had changed and Codex held the
+    // same model set the file already described. Returning `false` here makes
+    // `cacheSynced` mean what its name and its consumers already assume, and what
+    // `pullRemoteCatalog` and the early returns in `refreshCodexModelCatalog`
+    // already assert: a write happened.
+    if (!preparedBytesDifferFromDisk(preparedCache)) return false;
+    replaceCodexModelsCache(permit, owningCodexHome, preparedCache);
     return true;
   } catch {
     return false;
diff --git a/src/codex/catalog/routed-gather.ts b/src/codex/catalog/routed-gather.ts
index c610ab45d41..24ef744dc56 100644
--- a/src/codex/catalog/routed-gather.ts
+++ b/src/codex/catalog/routed-gather.ts
@@ -113,6 +113,15 @@ export interface GatherRoutedModelsOptions {
   providerModelOutcomes?: CatalogGatherProviderModelOutcome[];
   /** Internal convergence sink for the immutable policy that produced the returned rows. */
   discoveryPolicySnapshots?: CatalogProviderDiscoveryPolicySnapshot[];
+  /**
+   * Each provider's cache content revision as of the moment its rows were chosen.
+   *
+   * A caller that derives something from these rows and wants to know later whether the rows are
+   * still current must use this, not a revision sampled after the gather returns: another flight
+   * can publish between the choice and the sample, and the derived value would then carry that
+   * flight's identity while holding these rows.
+   */
+  providerContentRevisions?: Map<string, string>;
 }
 
 interface GatherFlightResult {
@@ -121,6 +130,7 @@ interface GatherFlightResult {
   providerAuthOutcomes: readonly CatalogGatherProviderAuthOutcome[];
   providerModelOutcomes: readonly CatalogGatherProviderModelOutcome[];
   discoveryPolicySnapshots: readonly CatalogProviderDiscoveryPolicySnapshot[];
+  providerContentRevisions: ReadonlyMap<string, string>;
 }
 interface GatherInflightEntry {
   readonly discoveryPolicyIdentity: string;
@@ -256,6 +266,7 @@ async function gatherRoutedModelsWithAuth(
     providerAuthOutcomes,
     providerModelOutcomes,
     discoveryPolicySnapshots,
+    providerContentRevisions,
   } = await entry.promise;
   if (options?.comboOmissions) {
     options.comboOmissions.length = 0;
@@ -269,6 +280,12 @@ async function gatherRoutedModelsWithAuth(
     options.providerModelOutcomes.length = 0;
     options.providerModelOutcomes.push(...providerModelOutcomes);
   }
+  if (options?.providerContentRevisions) {
+    options.providerContentRevisions.clear();
+    for (const [provider, revision] of providerContentRevisions) {
+      options.providerContentRevisions.set(provider, revision);
+    }
+  }
   if (options?.discoveryPolicySnapshots) {
     options.discoveryPolicySnapshots.length = 0;
     options.discoveryPolicySnapshots.push(...discoveryPolicySnapshots);
@@ -763,6 +780,8 @@ async function gatherRoutedModelsUncached(
     providerAuthOutcomes: localProviderAuthOutcomes,
     providerModelOutcomes,
     discoveryPolicySnapshots: capture.discoveryPolicySnapshots,
+    // Stamped by each provider at the moment it chose its rows, not sampled here.
+    providerContentRevisions: new Map(providerResults.map(result => [result.outcome.provider, result.contentRevision])),
   };
 }
 
diff --git a/src/codex/context-compat.ts b/src/codex/context-compat.ts
index e78a456163b..85d0c988bf9 100644
--- a/src/codex/context-compat.ts
+++ b/src/codex/context-compat.ts
@@ -7,14 +7,17 @@ export const CONTEXT_BACKEND_PREFIX = "/backend-api/codex";
 
 /** The single definition of the opt-in, shared by injection and the runtime gate. */
 export function contextExperimentalEnabled(configContent: string): boolean {
-  let parsed: { features?: { context_management?: { experimental_mode?: boolean } } };
+  let parsed: { features?: { context_management?: boolean | { experimental_mode?: boolean } } };
   try {
     parsed = Bun.TOML.parse(configContent) as typeof parsed;
   } catch {
     // Injection tolerates incomplete user config; malformed TOML is not an opt-in.
     return false;
   }
-  return parsed.features?.context_management?.experimental_mode === true;
+  // Codex FeatureToml accepts either a boolean or the experimental_mode table.
+  // Keep strict true checks: malformed values must not activate a credentialed relay.
+  const setting = parsed.features?.context_management;
+  return setting === true || (typeof setting === "object" && setting?.experimental_mode === true);
 }
 
 let activation: { key: string; active: boolean } | undefined;
diff --git a/src/codex/desired-state.ts b/src/codex/desired-state.ts
index 8f34c65585a..a2cc3a96b7d 100644
--- a/src/codex/desired-state.ts
+++ b/src/codex/desired-state.ts
@@ -260,7 +260,10 @@ export async function syncCodexOnStartIfEnabled(
   // The `.catch` is deliberate and stays: a failure to APPLY must not stop the
   // proxy from coming up. A failed sync simply reports no writes. The readiness
   // gate observes the real outcome so /readyz reflects the sync state exactly as
-  // the PR contract defines (ready only on ok=true with no warning).
+  // the contract defines: ready on ok=true once the sync has settled. A nonempty
+  // `warning` is a local-Codex-artifact degradation the sync chose to continue
+  // past, and #5181 is what it cost to treat it as terminal — a healthy
+  // multi-provider proxy reported itself permanently unready.
   const outcome = readinessGate
     ? await runStartupReadinessSync(readinessGate, async () => (await sync(port)) ?? null)
     : await sync(port).catch(() => undefined);
diff --git a/src/codex/history-job.ts b/src/codex/history-job.ts
index cfbabb5b62a..134550f478c 100644
--- a/src/codex/history-job.ts
+++ b/src/codex/history-job.ts
@@ -23,7 +23,7 @@ import type {
   CodexHistoryWorkerOperation,
   HistoryWorkerResult,
 } from "./history-worker";
-import { currentHistoryDbBusyTimeoutMs, historyBackupPathFor } from "./history-provider";
+import { currentHistoryDbBusyTimeoutMs, resolveExistingHistoryBackupPath } from "./history-provider";
 import type { CodexHistoryFailureReason, CodexHistoryVerifiedNoopProof } from "./history-provider";
 import { getCodexHome, resolveCodexStateDbPath } from "./paths";
 
@@ -32,7 +32,7 @@ import { getCodexHome, resolveCodexStateDbPath } from "./paths";
  *
  * The SQLite root can differ from CODEX_HOME and both environment/config inputs
  * can change between invocations. The parent resolves one exact target and hands
- * those canonical paths to the Worker rather than asking the Worker to infer a
+ * those resolved paths to the Worker rather than asking the Worker to infer a
  * possibly different environment.
  */
 export function resolveCodexHistoryJobTarget(): {
@@ -45,10 +45,10 @@ export function resolveCodexHistoryJobTarget(): {
   return {
     canonicalCodexHome: home,
     canonicalStateDbPath: stateDb,
-    // Derived by the provider's own rule rather than guessed: the manifest lives
-    // in the config directory under a hash of the state database, so a
-    // hand-built path would address a different file entirely.
-    canonicalBackupPath: historyBackupPathFor(stateDb),
+    // Resolve through the provider's canonical-first compatibility rule. Passing
+    // only the newly normalized name would hide a pre-#4442 Windows manifest from
+    // the Worker and make an upgrade look like an empty backup.
+    canonicalBackupPath: resolveExistingHistoryBackupPath(stateDb),
   };
 }
 
diff --git a/src/codex/history-provider.ts b/src/codex/history-provider.ts
index 1bfc36433e0..15a7e3b8344 100644
--- a/src/codex/history-provider.ts
+++ b/src/codex/history-provider.ts
@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
-import { zstdDecompressSync } from "node:zlib";
+import { parseSessionMetaLine, type ParsedSessionMeta } from "./history-rollout-read";
+export { MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES, readThreadFieldsFromRollout, type RolloutThreadFields } from "./history-rollout-read";
 import { Database } from "bun:sqlite";
 import { resolveCodexStateDbPath } from "./paths";
 import { openCodexStateForPreflight } from "./history-state-open";
@@ -16,13 +17,6 @@ import {
   type CodexHistoryBackupManifest,
 } from "./history-manifest";
 
-/**
- * Cap for decompressing a lone `.jsonl.zst` rollout during quarantine restore.
- * Bounds peak memory while reconstructing thread rows; never write the decoded
- * JSONL to disk.
- */
-export const MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES = 64 * 1024 * 1024;
-
 /**
  * The manifest that shadows one state database.
  *
@@ -441,18 +435,32 @@ export function preflightCodexHistoryInjection(
     const paginatedColumn = columns.some(column => column.name === "history_mode");
     if (paginatedColumn && restoreEntries.length > 0) return HISTORY_RELABEL_STANDS_DOWN;
     for (const entry of restoreEntries) assertLegacyHistoryWritable(entry.rolloutPath);
-    const rows = db.query<{ rollout_path: string; history_mode: string | null }, []>(`
-      SELECT rollout_path, ${paginatedColumn ? "history_mode" : "NULL AS history_mode"}
+    const rows = db.query<{ rollout_path: string; history_mode: string | null; model_provider: string }, []>(`
+      SELECT rollout_path, ${paginatedColumn ? "history_mode" : "NULL AS history_mode"}, model_provider
       FROM threads
       WHERE ${providerTableMode
         ? resumeHistory ? "model_provider IN ('openai', 'opencodex')" : "0"
         : "model_provider = 'opencodex'"}
     `).all();
+    // No ORDER BY: a paginated opencodex row can precede a paginated openai one, so the
+    // verdict waits for the full scan instead of standing down on the first paginated row.
+    let foundPaginatedRow = false;
+    let foundPaginatedOpenaiRow = false;
     for (const row of rows) {
-      if (paginatedColumn || row.history_mode === "paginated") return HISTORY_RELABEL_STANDS_DOWN;
+      if (paginatedColumn || row.history_mode === "paginated") {
+        foundPaginatedRow = true;
+        // A provider-table transition removes the root openai_base_url, and a row already
+        // paginated cannot be relabeled: standing it down would route the openai-tagged
+        // thread to Codex's built-in OpenAI endpoint. A still-legacy row only stands down.
+        if (providerTableMode && row.history_mode === "paginated" && row.model_provider === "openai") {
+          foundPaginatedOpenaiRow = true;
+        }
+        continue;
+      }
       assertLegacyHistoryWritable(row.rollout_path);
     }
-    return null;
+    if (foundPaginatedOpenaiRow) return "history_paginated_openai_requires_native_writer";
+    return foundPaginatedRow ? HISTORY_RELABEL_STANDS_DOWN : null;
   } catch (error) {
     return error instanceof CodexHistoryIntegrityError
       ? error.message
@@ -1021,24 +1029,6 @@ function assertRestoreReadback(
   }
 }
 
-interface ParsedSessionMeta {
-  record: { type?: unknown; timestamp?: unknown; payload: { model_provider?: unknown; source?: unknown } & Record<string, unknown> };
-}
-
-/** Parse one JSONL line into a `session_meta` record, or null if it isn't one. */
-function parseSessionMetaLine(line: string): ParsedSessionMeta | null {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object") return null;
-  const record = parsed as ParsedSessionMeta["record"];
-  if (record.type !== "session_meta" || !record.payload || typeof record.payload !== "object") return null;
-  return { record };
-}
-
 /**
  * Find the LAST `session_meta` line in a rollout, mirroring the app's last-writer-wins fold
  * (codex-rs `apply_session_meta_from_item`). We base our patch on the most recent metadata so we
@@ -1107,142 +1097,6 @@ function compensateConcurrentSessionMetaAppend(
   }
 }
 
-/**
- * Fields needed to re-insert a production-shaped `threads` row from a rollout JSONL when a
- * Phase-2 quarantine predates full `satellite-backup.json` thread snapshots.
- *
- * Uses the same last-writer-wins `session_meta` fold as {@link readLatestSessionMeta}, plus the
- * first user-message preview (codex-rs `list.rs` / `EventMsg::UserMessage` path).
- */
-export interface RolloutThreadFields {
-  id: string;
-  modelProvider: string;
-  source: string;
-  firstUserMessage: string;
-  hasUserEvent: number;
-  cwd?: string;
-  historyMode?: string;
-  cliVersion?: string;
-}
-
-function textFromContentParts(content: unknown): string | null {
-  if (typeof content === "string" && content.trim()) return content.trim();
-  if (!Array.isArray(content)) return null;
-  const parts: string[] = [];
-  for (const part of content) {
-    if (!part || typeof part !== "object") continue;
-    const p = part as Record<string, unknown>;
-    if (typeof p.text === "string" && p.text.trim()) parts.push(p.text.trim());
-    else if (typeof p.input_text === "string" && p.input_text.trim()) parts.push(p.input_text.trim());
-  }
-  const joined = parts.join("\n").trim();
-  return joined || null;
-}
-
-/** Extract the first user-message preview from a rollout line, or null. */
-function extractUserMessagePreview(line: string): string | null {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(line);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object") return null;
-  const record = parsed as { type?: unknown; payload?: unknown };
-  const payload = record.payload;
-  if (!payload || typeof payload !== "object") return null;
-  const p = payload as Record<string, unknown>;
-
-  if (record.type === "event_msg") {
-    // codex-rs EventMsg::UserMessage — payload.type is "user_message" (or omitted in fixtures).
-    if (p.type === "user_message" || typeof p.message === "string") {
-      if (typeof p.message === "string" && p.message.trim()) return p.message.trim();
-      const fromContent = textFromContentParts(p.content);
-      if (fromContent) return fromContent;
-    }
-    return null;
-  }
-
-  if (record.type === "response_item") {
-    if (p.type === "message" && p.role === "user") {
-      return textFromContentParts(p.content);
-    }
-  }
-  return null;
-}
-
-/**
- * Reconstruct thread identity + listing fields from a staged/restored rollout JSONL.
- * Returns null when the file is missing or has no parseable `session_meta`.
- *
- * Accepts plain `.jsonl` or a lone `.jsonl.zst` (legacy Phase-2 quarantine). Compressed
- * rollouts are decompressed in memory with {@link MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES};
- * no decompressed copy is written to disk.
- */
-export function readThreadFieldsFromRollout(path: string): RolloutThreadFields | null {
-  if (!path || !existsSync(path)) return null;
-  let raw: string;
-  try {
-    raw = path.endsWith(".zst")
-      ? decompressRolloutZstUtf8(path)
-      : readFileSync(path, "utf8");
-  } catch {
-    return null;
-  }
-  return parseThreadFieldsFromRolloutText(raw);
-}
-
-function decompressRolloutZstUtf8(
-  path: string,
-  maxBytes: number = MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES,
-): string {
-  const compressed = readFileSync(path);
-  const decoded = zstdDecompressSync(compressed as Uint8Array<ArrayBuffer>, {
-    maxOutputLength: maxBytes,
-  });
-  if (decoded.byteLength > maxBytes) {
-    throw new Error("rollout_zst_too_large");
-  }
-  return new TextDecoder().decode(decoded);
-}
-
-function parseThreadFieldsFromRolloutText(raw: string): RolloutThreadFields | null {
-  const lines = raw.split("\n");
-  let latest: ParsedSessionMeta | null = null;
-  let firstUserMessage = "";
-  for (const line of lines) {
-    if (!line) continue;
-    if (line.includes("\"session_meta\"")) {
-      const meta = parseSessionMetaLine(line);
-      if (meta) latest = meta;
-    }
-    if (!firstUserMessage) {
-      const preview = extractUserMessagePreview(line);
-      if (preview) firstUserMessage = preview;
-    }
-  }
-  if (!latest) return null;
-  const payload = latest.record.payload;
-  const id = typeof payload.id === "string" ? payload.id : "";
-  if (!id) return null;
-  const modelProvider = typeof payload.model_provider === "string" && payload.model_provider
-    ? payload.model_provider
-    : "openai";
-  const source = typeof payload.source === "string" && payload.source
-    ? payload.source
-    : "cli";
-  return {
-    id,
-    modelProvider,
-    source,
-    firstUserMessage,
-    hasUserEvent: firstUserMessage.trim() ? 1 : 0,
-    ...(typeof payload.cwd === "string" ? { cwd: payload.cwd } : {}),
-    ...(typeof payload.history_mode === "string" ? { historyMode: payload.history_mode } : {}),
-    ...(typeof payload.cli_version === "string" ? { cliVersion: payload.cli_version } : {}),
-  };
-}
-
 /**
  * Make a thread's rollout reflect a provider/source change by APPENDING a new `session_meta` line,
  * rather than rewriting line 1. The appended line clones the latest metadata payload (so no field
diff --git a/src/codex/history-rollout-read.ts b/src/codex/history-rollout-read.ts
new file mode 100644
index 00000000000..3dacd4ab0eb
--- /dev/null
+++ b/src/codex/history-rollout-read.ts
@@ -0,0 +1,174 @@
+import { existsSync, readFileSync } from "node:fs";
+import { zstdDecompressSync } from "node:zlib";
+
+/**
+ * Reading side of Codex rollout JSONL files: the `session_meta` fold and the thread fields a
+ * quarantine restore reconstructs from a rollout.
+ *
+ * Split out of `history-provider.ts` when that file crossed the repository file-size ratchet at
+ * 2009 lines. The cut follows a real seam rather than a line count: everything here reads a
+ * rollout file and returns plain data, while the module it left keeps the database and manifest
+ * writes. Nothing here opens a database or touches a backup manifest.
+ *
+ * `history-provider.ts` re-exports the public names, so existing importers are unaffected.
+ */
+/**
+ * Cap for decompressing a lone `.jsonl.zst` rollout during quarantine restore.
+ * Bounds peak memory while reconstructing thread rows; never write the decoded
+ * JSONL to disk.
+ */
+export const MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES = 64 * 1024 * 1024;
+
+export interface ParsedSessionMeta {
+  record: { type?: unknown; timestamp?: unknown; payload: { model_provider?: unknown; source?: unknown } & Record<string, unknown> };
+}
+
+/** Parse one JSONL line into a `session_meta` record, or null if it isn't one. */
+export function parseSessionMetaLine(line: string): ParsedSessionMeta | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as ParsedSessionMeta["record"];
+  if (record.type !== "session_meta" || !record.payload || typeof record.payload !== "object") return null;
+  return { record };
+}
+
+/**
+ * Fields needed to re-insert a production-shaped `threads` row from a rollout JSONL when a
+ * Phase-2 quarantine predates full `satellite-backup.json` thread snapshots.
+ *
+ * Uses the same last-writer-wins `session_meta` fold as {@link readLatestSessionMeta}, plus the
+ * first user-message preview (codex-rs `list.rs` / `EventMsg::UserMessage` path).
+ */
+export interface RolloutThreadFields {
+  id: string;
+  modelProvider: string;
+  source: string;
+  firstUserMessage: string;
+  hasUserEvent: number;
+  cwd?: string;
+  historyMode?: string;
+  cliVersion?: string;
+}
+
+function textFromContentParts(content: unknown): string | null {
+  if (typeof content === "string" && content.trim()) return content.trim();
+  if (!Array.isArray(content)) return null;
+  const parts: string[] = [];
+  for (const part of content) {
+    if (!part || typeof part !== "object") continue;
+    const p = part as Record<string, unknown>;
+    if (typeof p.text === "string" && p.text.trim()) parts.push(p.text.trim());
+    else if (typeof p.input_text === "string" && p.input_text.trim()) parts.push(p.input_text.trim());
+  }
+  const joined = parts.join("\n").trim();
+  return joined || null;
+}
+
+/** Extract the first user-message preview from a rollout line, or null. */
+function extractUserMessagePreview(line: string): string | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as { type?: unknown; payload?: unknown };
+  const payload = record.payload;
+  if (!payload || typeof payload !== "object") return null;
+  const p = payload as Record<string, unknown>;
+
+  if (record.type === "event_msg") {
+    // codex-rs EventMsg::UserMessage — payload.type is "user_message" (or omitted in fixtures).
+    if (p.type === "user_message" || typeof p.message === "string") {
+      if (typeof p.message === "string" && p.message.trim()) return p.message.trim();
+      const fromContent = textFromContentParts(p.content);
+      if (fromContent) return fromContent;
+    }
+    return null;
+  }
+
+  if (record.type === "response_item") {
+    if (p.type === "message" && p.role === "user") {
+      return textFromContentParts(p.content);
+    }
+  }
+  return null;
+}
+
+/**
+ * Reconstruct thread identity + listing fields from a staged/restored rollout JSONL.
+ * Returns null when the file is missing or has no parseable `session_meta`.
+ *
+ * Accepts plain `.jsonl` or a lone `.jsonl.zst` (legacy Phase-2 quarantine). Compressed
+ * rollouts are decompressed in memory with {@link MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES};
+ * no decompressed copy is written to disk.
+ */
+export function readThreadFieldsFromRollout(path: string): RolloutThreadFields | null {
+  if (!path || !existsSync(path)) return null;
+  let raw: string;
+  try {
+    raw = path.endsWith(".zst")
+      ? decompressRolloutZstUtf8(path)
+      : readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+  return parseThreadFieldsFromRolloutText(raw);
+}
+
+function decompressRolloutZstUtf8(
+  path: string,
+  maxBytes: number = MAX_ROLLOUT_ZST_DECOMPRESSED_BYTES,
+): string {
+  const compressed = readFileSync(path);
+  const decoded = zstdDecompressSync(compressed as Uint8Array<ArrayBuffer>, {
+    maxOutputLength: maxBytes,
+  });
+  if (decoded.byteLength > maxBytes) {
+    throw new Error("rollout_zst_too_large");
+  }
+  return new TextDecoder().decode(decoded);
+}
+
+function parseThreadFieldsFromRolloutText(raw: string): RolloutThreadFields | null {
+  const lines = raw.split("\n");
+  let latest: ParsedSessionMeta | null = null;
+  let firstUserMessage = "";
+  for (const line of lines) {
+    if (!line) continue;
+    if (line.includes("\"session_meta\"")) {
+      const meta = parseSessionMetaLine(line);
+      if (meta) latest = meta;
+    }
+    if (!firstUserMessage) {
+      const preview = extractUserMessagePreview(line);
+      if (preview) firstUserMessage = preview;
+    }
+  }
+  if (!latest) return null;
+  const payload = latest.record.payload;
+  const id = typeof payload.id === "string" ? payload.id : "";
+  if (!id) return null;
+  const modelProvider = typeof payload.model_provider === "string" && payload.model_provider
+    ? payload.model_provider
+    : "openai";
+  const source = typeof payload.source === "string" && payload.source
+    ? payload.source
+    : "cli";
+  return {
+    id,
+    modelProvider,
+    source,
+    firstUserMessage,
+    hasUserEvent: firstUserMessage.trim() ? 1 : 0,
+    ...(typeof payload.cwd === "string" ? { cwd: payload.cwd } : {}),
+    ...(typeof payload.history_mode === "string" ? { historyMode: payload.history_mode } : {}),
+    ...(typeof payload.cli_version === "string" ? { cliVersion: payload.cli_version } : {}),
+  };
+}
diff --git a/src/codex/internal/catalog-writer.ts b/src/codex/internal/catalog-writer.ts
index 0d9bee79ef0..08a89b55da4 100644
--- a/src/codex/internal/catalog-writer.ts
+++ b/src/codex/internal/catalog-writer.ts
@@ -1,4 +1,4 @@
-import { chmodSync, linkSync, mkdirSync, truncateSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, linkSync, mkdirSync, readFileSync, truncateSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 
 import {
@@ -37,6 +37,38 @@ export interface CatalogBackupWriteIO {
 
 let backupTempSequence = 0;
 
+/**
+ * Do the prepared bytes differ from what is already on disk at `prepared.path`?
+ *
+ * The single no-op rule for both files the catalog layer owns — the active catalog
+ * and Codex's models cache — so the two writers cannot drift apart. Every
+ * mtime-keyed reader has to treat a rewrite as a change: the app-server staleness
+ * classifier (#857) compares a file's mtime against each running Codex's start
+ * time, so rewriting identical bytes marks every already-running Codex as stale
+ * even though nothing changed. #1459 established this rule for the catalog; the
+ * cache is the second writer that has to apply it, because
+ * `refreshCodexModelCatalog` reports `cacheSynced` straight into the startup
+ * warning in `handleStart`.
+ *
+ * Deliberately a Buffer rather than a decoded string: `readFileSync(path, "utf8")`
+ * substitutes U+FFFD for every invalid byte, so a file holding a raw 0x80 decodes
+ * equal to prepared content holding a legitimately encoded U+FFFD. Comparing
+ * decoded strings would then classify a malformed file as identical, skip the
+ * atomic repair write, and leave the corruption on disk.
+ *
+ * An unreadable or absent file reports "differs", so the caller performs the real
+ * write; that also converges a file that does not exist yet.
+ */
+export function preparedBytesDifferFromDisk(prepared: PreparedCatalogFileWrite): boolean {
+  let onDisk: Buffer;
+  try {
+    onDisk = readFileSync(prepared.path);
+  } catch {
+    return true;
+  }
+  return !onDisk.equals(Buffer.from(prepared.content, "utf8"));
+}
+
 function isMissingPathError(error: unknown): boolean {
   return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
 }
diff --git a/src/codex/model-cache.ts b/src/codex/model-cache.ts
index fe790715fed..c69d15abc9e 100644
--- a/src/codex/model-cache.ts
+++ b/src/codex/model-cache.ts
@@ -71,6 +71,8 @@ function deleteCachedProvider(provider: string): number {
   cache.delete(provider);
   cacheBytes = Math.max(0, cacheBytes - entry.sizeBytes);
   if (oldestCachedProvider === provider) recomputeOldestCachedProvider();
+  // A removal changes this provider's content as surely as a publication does.
+  bumpProviderCacheRevision(provider);
   return entry.sizeBytes;
 }
 
@@ -177,6 +179,34 @@ export function isModelCacheGenerationCurrent(provider: string, generation: stri
   return generation === captureModelCacheGeneration(provider);
 }
 
+/**
+ * How many times this provider's cached content has actually changed.
+ *
+ * Deliberately separate from the generation. A generation revokes an in-flight discovery's right
+ * to publish, so it advances on an authority clear and must not be repurposed: moving it on a
+ * successful publication would cancel writes that are still legitimate. This counts accepted
+ * publications and removals instead, which is what a reader holding a derived roster needs to
+ * know, and it advances on exactly the event a generation does not: a discovery that succeeded
+ * and changed the rows.
+ *
+ * Reading is passive. An unseen provider reads as `0` rather than seeding an entry, so observing
+ * one cannot alter what a later capture or publication sees.
+ */
+const providerCacheRevisions = new Map<string, number>();
+let globalContentRevision = 0;
+
+function bumpProviderCacheRevision(provider: string): void {
+  providerCacheRevisions.set(provider, (providerCacheRevisions.get(provider) ?? 0) + 1);
+}
+
+export function observeModelCacheRevision(provider: string): string {
+  // The global term covers a clear that empties the map wholesale, which per-provider counters
+  // cannot express: without it, wiping every entry and republishing identical-looking rows would
+  // read as unchanged. It also survives pruning, so a retired provider cannot come back with a
+  // counter that matches a roster built before it left.
+  return `${globalContentRevision}:${providerCacheRevisions.get(provider) ?? 0}`;
+}
+
 /**
  * Store a live result unless the cache was cleared while that asynchronous discovery was running.
  * The optional generation keeps existing direct cache writers unchanged while discovery callers can
@@ -200,6 +230,8 @@ export function setCached(
     oldestCachedAt = now;
   }
   enforceAppOwnedMemoryBudget();
+  // Published and accepted, so anything derived from this provider's rows is now out of date.
+  bumpProviderCacheRevision(provider);
   return true;
 }
 
@@ -220,6 +252,11 @@ export function clearModelCache(
   } else {
     if (revokesInFlightDiscovery) globalCacheGeneration += 1;
     cache.clear();
+    // A wholesale clear changes every provider's content at once, and clearing the map means no
+    // per-provider counter can record it. Advancing the global term retires every derived roster
+    // and lets the per-provider entries be dropped without an ABA on the way back.
+    globalContentRevision += 1;
+    providerCacheRevisions.clear();
     cacheBytes = 0;
     oldestCachedProvider = undefined;
     oldestCachedAt = null;
@@ -237,6 +274,7 @@ export function reconcileModelCacheProviders(
   const removedProviders = new Set<string>();
   const trackedProviders = new Set([
     ...providerCacheGenerations.keys(),
+    ...providerCacheRevisions.keys(),
     ...failureAt.keys(),
     ...discoveryStatus.keys(),
     ...liveModelCounts.keys(),
@@ -247,6 +285,10 @@ export function reconcileModelCacheProviders(
     if (validProviders.has(provider)) continue;
     if (!revokedRemovedProviderAuthority) {
       globalCacheGeneration += 1;
+      // Advanced BEFORE any revision entry is dropped, so a provider that comes back cannot
+      // present the counter a roster was built against. Without this the delete below is an ABA:
+      // the entry returns at zero and an old stamp matches again.
+      globalContentRevision += 1;
       revokedRemovedProviderAuthority = true;
     }
     providerCacheGenerations.set(provider, (providerCacheGenerations.get(provider) ?? 0) + 1);
@@ -255,6 +297,11 @@ export function reconcileModelCacheProviders(
     failureAt.delete(provider);
     discoveryStatus.delete(provider);
     liveModelCounts.delete(provider);
+    // AFTER the cache deletion, which bumps this provider's revision and would otherwise recreate
+    // the entry we just removed. Dropped rather than left behind: a provider the configuration no
+    // longer has must not keep an entry alive for the life of the process merely because nothing
+    // cleared the whole cache. The global epoch advanced above, so the removal is not an ABA.
+    providerCacheRevisions.delete(provider);
     removedProviders.add(provider);
   }
   lastReconciledGeneration = generation;
diff --git a/src/codex/model-entitlements.ts b/src/codex/model-entitlements.ts
index 39ed12a7b3a..c9e1c8c8e0e 100644
--- a/src/codex/model-entitlements.ts
+++ b/src/codex/model-entitlements.ts
@@ -2,7 +2,11 @@ import { createHash } from "node:crypto";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import type { CodexAccountCredentialRecord, OcxConfig } from "../types";
 import { isSelectableCodexPoolAccount } from "./account-id";
-import { getValidCodexToken, loadCodexAccountRecordSnapshot } from "./account-store";
+import {
+  beginCodexAccountGenerationLiveCheck,
+  getValidCodexToken,
+  loadCodexAccountRecordSnapshot,
+} from "./account-store";
 import {
   getMainAccountToken,
   getValidMainAccountToken,
@@ -22,6 +26,7 @@ import {
   forgetObservedCodexModelDenialsForAccount,
   observedDeniedCodexAccountIdsForModel,
   recordObservedCodexModelDenial,
+  setObservedDenialGenerationCheck,
   resetObservedCodexModelDenialsForTests,
 } from "./observed-model-denials";
 
@@ -1297,13 +1302,14 @@ export function cachedDeniedCodexAccountIdsForModel(
   // absent an ongoing catalog sync the loop above contributes nothing at all. An upstream
   // refusal does not expire on that schedule and is not a snapshot of a pending answer: it is
   // the account's own Codex surface naming this model and declining it (#4906).
-  for (const accountId of observedDeniedCodexAccountIdsForModel(modelId, now) ?? []) {
-    // Under the caller's read fence, like the roster loop above. Nothing here reads account
-    // storage, but an excluded account must stay UNKNOWN rather than denied so a profile switch
-    // or a request-owned credential produces the same selection it does today.
-    if (options.excludeAccountIds?.has(accountId)) continue;
-    denied.add(accountId);
-  }
+  // The caller's read fence is passed IN rather than applied to the result, so an excluded
+  // account is skipped before the credential-generation validation reads account storage
+  // (#4952). An excluded account must stay UNKNOWN rather than denied, so a profile switch or
+  // a request-owned credential produces the same selection it does today.
+  const observedDenied = observedDeniedCodexAccountIdsForModel(modelId, now, {
+    ...(options.excludeAccountIds ? { excludeAccountIds: options.excludeAccountIds } : {}),
+  });
+  for (const accountId of observedDenied ?? []) denied.add(accountId);
   // One account holds one entry per client version, and upstream filters the roster by that
   // version. So the same account can legitimately carry a granted entry under a current client
   // and a denied one under an older client that predates the model. Positive evidence is
@@ -1330,23 +1336,36 @@ export function cachedDeniedCodexAccountIdsForModel(
  * admissible here: 400 covers every malformed request too, and remembering one of those as an
  * entitlement fact would steer routing away from a perfectly capable account.
  */
+// Denial evidence is credential-scoped (#4952). The store stays a leaf module, so the
+// liveness predicate is injected here, where the account store is already a dependency.
+setObservedDenialGenerationCheck(beginCodexAccountGenerationLiveCheck);
+
 export function recordCodexModelDenialEvidence(
   accountId: string | null | undefined,
   modelId: string | undefined,
+  generation: number | null | undefined,
   now = Date.now(),
 ): void {
   if (!accountId || !modelId) return;
   if (!ENTITLEMENT_PREFERRED_NATIVE_OPENAI_MODELS.has(modelId)) return;
-  recordObservedCodexModelDenial(accountId, modelId, now);
+  // A caller that cannot name a credential generation records ACCOUNT-scoped evidence rather
+  // than none. The one production context in that position is `main-pool`, whose credential
+  // lives in `auth.json` and has no pool generation; discarding its refusals would revert
+  // #4906 for the stored main login (#4952). Request-owned `main` never reaches here — its
+  // `accountId` is null and the guard above returns.
+  recordObservedCodexModelDenial(accountId, modelId, typeof generation === "number" ? generation : undefined, now);
 }
 
 /** Drop the refusal evidence for a pair the account has just served successfully. */
 export function clearCodexModelDenialEvidence(
   accountId: string | null | undefined,
   modelId: string | undefined,
+  generation: number | null | undefined,
 ): void {
   if (!accountId || !modelId) return;
-  clearObservedCodexModelDenial(accountId, modelId);
+  // Mirror of the write: an account-scoped success clears account-scoped evidence. It cannot
+  // clear a credential-scoped entry that names a newer generation, and vice versa (#4952).
+  clearObservedCodexModelDenial(accountId, modelId, typeof generation === "number" ? generation : undefined);
 }
 
 /** Synchronous projection for management/catalog readers after a discovery pass. */
diff --git a/src/codex/observed-model-denials.ts b/src/codex/observed-model-denials.ts
index 97b0297a88b..e8a0c9ec32f 100644
--- a/src/codex/observed-model-denials.ts
+++ b/src/codex/observed-model-denials.ts
@@ -48,8 +48,55 @@ const OBSERVED_DENIAL_TTL_MS = 6 * 60 * 60_000;
 /** Bounded like the roster cache: pool size times flagship count, with room to spare. */
 const OBSERVED_DENIAL_MAX_ENTRIES = 512;
 
-/** `accountId\u0000modelId` -> expiry. Insertion order is the eviction order. */
-const observedDenials = new Map<string, number>();
+/**
+ * One entry of refusal evidence.
+ *
+ * `generation` is the credential generation the refusal was observed under (#4952). Evidence
+ * is about a CREDENTIAL, not an account id: reauthenticating the same internal account can
+ * swap the subscription underneath it, so a refusal from the previous credential says nothing
+ * about the replacement. Carrying the generation lets a reader ignore superseded evidence and
+ * lets a late reply from an older generation be refused rather than applied.
+ *
+ * It is OPTIONAL because not every account that can be refused has one. A `main-pool` context
+ * — the stored main login taking part in rotation — carries a real `accountId` and a
+ * `writerGeneration`, but no pool credential generation, because its credential lives in
+ * `auth.json` rather than the pool store. Dropping its evidence would have silently reverted
+ * #4906 for that account: the pool would re-send the same model to the login that just refused
+ * it, on every request, forever. An entry without a generation is account-scoped, and the
+ * generation fences below simply do not apply to it. This is the same rule the quota writer
+ * already uses in `core-codex-account.ts`, where an absent credential generation skips the
+ * liveness check instead of discarding the write.
+ */
+interface ObservedDenial {
+  expiresAt: number;
+  generation?: number;
+}
+
+/** `accountId\u0000modelId` -> entry. Insertion order is the eviction order. */
+const observedDenials = new Map<string, ObservedDenial>();
+
+/** Whether `generation` is still the account's live credential. */
+type GenerationLiveCheck = (accountId: string, generation: number) => boolean;
+
+/**
+ * Opens one liveness check.
+ *
+ * A FACTORY rather than a bare predicate because the production implementation reads the
+ * credential store, and a lookup can ask about several accounts. Loading once per lookup and
+ * closing over that snapshot is the shape `loadCodexAccountRecordSnapshot` exists for; a bare
+ * predicate would reload and reparse the whole store per row, on the request path.
+ *
+ * Injected rather than imported at module scope so this stays a leaf module: `account-store`
+ * reads the credential file, and a unit test of this map should not have to stand one up.
+ */
+type GenerationLiveCheckFactory = () => GenerationLiveCheck;
+
+let beginGenerationLiveCheck: GenerationLiveCheckFactory = () => () => true;
+
+/** Wire the liveness predicate. Called once at startup; tests substitute their own. */
+export function setObservedDenialGenerationCheck(begin: GenerationLiveCheckFactory): void {
+  beginGenerationLiveCheck = begin;
+}
 
 function denialKey(accountId: string, modelId: string): string {
   return `${accountId}\u0000${modelId}`;
@@ -72,12 +119,24 @@ function modelIdOfDenialKey(key: string): string {
 export function recordObservedCodexModelDenial(
   accountId: string,
   modelId: string,
+  generation: number | undefined,
   now = Date.now(),
 ): void {
+  // A refusal dispatched under generation G can arrive after G+1 has been saved. Reject it
+  // BEFORE touching the map at all, not merely when this key already holds newer evidence:
+  // with no entry for this key the stale row would otherwise be inserted, and at the entry
+  // bound it would evict a valid row that nothing can restore (#4952).
+  if (generation !== undefined && !beginGenerationLiveCheck()(accountId, generation)) return;
   const key = denialKey(accountId, modelId);
+  const existing = observedDenials.get(key);
+  // Second fence, for the window where the replacement credential has been dispatched but the
+  // store read above still answers live. Both sides must name a generation to be comparable;
+  // an account-scoped entry is not older or newer than a credential-scoped one.
+  if (existing !== undefined && existing.generation !== undefined && generation !== undefined
+    && existing.generation > generation) return;
   // Delete before set so the refreshed entry moves to the back of the eviction order.
   observedDenials.delete(key);
-  observedDenials.set(key, now + OBSERVED_DENIAL_TTL_MS);
+  observedDenials.set(key, { expiresAt: now + OBSERVED_DENIAL_TTL_MS, generation });
   while (observedDenials.size > OBSERVED_DENIAL_MAX_ENTRIES) {
     const oldest = observedDenials.keys().next();
     if (oldest.done) break;
@@ -91,8 +150,20 @@ export function recordObservedCodexModelDenial(
  * A success is newer and stronger evidence than the refusal that preceded it: whatever the
  * entitlement was when upstream refused, it is not that now.
  */
-export function clearObservedCodexModelDenial(accountId: string, modelId: string): void {
-  observedDenials.delete(denialKey(accountId, modelId));
+export function clearObservedCodexModelDenial(
+  accountId: string,
+  modelId: string,
+  generation: number | undefined,
+): void {
+  const key = denialKey(accountId, modelId);
+  const existing = observedDenials.get(key);
+  if (!existing) return;
+  // The mirror of the write fence: a success dispatched under G arriving after G+1 was
+  // refused must not clear the replacement's evidence (#4952). Equal generations clear,
+  // because that is the ordinary "this account just served this model" case.
+  if (existing.generation !== undefined && generation !== undefined
+    && existing.generation > generation) return;
+  observedDenials.delete(key);
 }
 
 /**
@@ -119,19 +190,41 @@ export function forgetObservedCodexModelDenialsForAccount(accountId: string | nu
 export function observedDeniedCodexAccountIdsForModel(
   modelId: string | undefined,
   now = Date.now(),
+  options: { excludeAccountIds?: ReadonlySet<string> } = {},
 ): ReadonlySet<string> | undefined {
   if (!modelId) return undefined;
   const denied = new Set<string>();
-  for (const [key, expiresAt] of [...observedDenials]) {
-    if (expiresAt <= now) {
+  // Opened lazily and at most once: a lookup that matches no credential-scoped row must not
+  // read the credential store at all.
+  let isLive: GenerationLiveCheck | undefined;
+  for (const [key, entry] of [...observedDenials]) {
+    if (entry.expiresAt <= now) {
       observedDenials.delete(key);
       continue;
     }
-    if (modelIdOfDenialKey(key) === modelId) denied.add(accountIdOfDenialKey(key));
+    // Model and the caller's exclusion fence FIRST. The issue asks for identity validation
+    // after the exclusion read, and an excluded account — a draining profile switch, or a
+    // request-owned credential — must produce no credential-store read on its behalf.
+    if (modelIdOfDenialKey(key) !== modelId) continue;
+    const accountId = accountIdOfDenialKey(key);
+    if (options.excludeAccountIds?.has(accountId)) continue;
+    if (entry.generation !== undefined) {
+      isLive ??= beginGenerationLiveCheck();
+      // Superseded evidence stops denying the replacement. It is SKIPPED, not deleted: the
+      // predicate cannot tell "this account reauthenticated" from "the credential store could
+      // not be read", and deleting on the second would throw away valid evidence that a
+      // transient read failure was never entitled to touch. Skipping already delivers the
+      // routing outcome the issue asks for, on every read, without depending on the
+      // conditional account-wide forget that cannot run when no roster was ever cached.
+      // Superseded rows still leave by TTL, by eviction, and by the account-wide forget.
+      if (!isLive(accountId, entry.generation)) continue;
+    }
+    denied.add(accountId);
   }
   return denied.size > 0 ? denied : undefined;
 }
 
 export function resetObservedCodexModelDenialsForTests(): void {
   observedDenials.clear();
+  beginGenerationLiveCheck = () => () => true;
 }
diff --git a/src/codex/prompt-text-probe.ts b/src/codex/prompt-text-probe.ts
index 8af11f00f5e..444b7bb763f 100644
--- a/src/codex/prompt-text-probe.ts
+++ b/src/codex/prompt-text-probe.ts
@@ -75,7 +75,7 @@ const UNMAPPED_LAYER_IDS = [
   // The Rust source names a <git_attribution> marker pair, but a world-state section is
   // DIFF-rendered: it emits nothing on a turn where its state has not changed. Live
   // `codex debug prompt-input` (codex-cli 0.145.0, 32978 bytes) showed no such block and
-  // no attribution text. Listing the id here reports "not exposed" honestly instead of
+  // no attribution text. Listing the id here reports "unmapped" honestly instead of
   // claiming a tag this extractor has never actually matched - the same mistake the
   // header above records for permissions.
   "git-attribution",
@@ -85,7 +85,7 @@ export interface LayerText {
   /** Rendered text, when this layer produced a section on the probed turn. */
   text: string | null;
   /** Why the text is absent, when it is. */
-  reason: "ok" | "empty-source" | "not-rendered" | "not-exposed" | "unavailable";
+  reason: "ok" | "empty-source" | "not-rendered" | "not-exposed" | "unmapped" | "unavailable";
   bytes: number;
   /**
    * `expanded` is text Codex sends as written. `template` is a catalog
@@ -103,7 +103,7 @@ export interface LayerText {
 
 /**
  * Why the base prompt is or is not readable, at the granularity a reader can act
- * on. `LayerText.reason` has five coarse values and cannot express any of this,
+ * on. `LayerText.reason` has six coarse values and cannot express any of this,
  * which is why the detailed answer travels on its own record.
  */
 export type BasePromptReason =
@@ -374,7 +374,7 @@ function readBasePrompt(codexHome: string): BasePromptText {
 /**
  * Project the base prompt onto the legacy `base-instructions` layer slot.
  *
- * The slot is lossy by construction - five coarse reasons, no renderer that reads
+ * The slot is lossy by construction - six coarse reasons, no renderer that reads
  * `representation` - so it carries only what it can carry honestly: published text
  * when the source is text Codex sends, and otherwise no text at all. A template is
  * deliberately NOT `ok` here, because the dialog labels every `ok` layer "Text
@@ -944,9 +944,12 @@ export async function probePromptText(
 
   // Layers whose rendered tag we have not confirmed against live output. Leaving
   // them absent made the GUI fall through to "unavailable", which claims the probe
-  // failed when it succeeded. Saying we have no mapping is the smaller claim.
+  // failed when it succeeded. Keep this distinct from the base prompt's
+  // "not-exposed", which is confirmed to travel outside the printable message
+  // list - reusing it showed a base-prompt-specific explanation for unrelated
+  // layers.
   for (const id of UNMAPPED_LAYER_IDS) {
-    layers[id] ??= { text: null, reason: "not-exposed", bytes: 0 };
+    layers[id] ??= { text: null, reason: "unmapped", bytes: 0 };
   }
   return { ok: true, codexHome, layers, base, ...(reportedRuntime ? { runtime: reportedRuntime } : {}) };
 }
diff --git a/src/codex/routing.ts b/src/codex/routing.ts
index 0aebeaae229..a6c06eed431 100644
--- a/src/codex/routing.ts
+++ b/src/codex/routing.ts
@@ -1,5 +1,6 @@
 import { saveConfigPreservingClaudeCode } from "../config";
-import { isCodexAccountGenerationLive } from "./account-store";
+import { isCodexAccountGenerationLive, registerCodexRefreshGenerationHandoff } from "./account-store";
+import { handOffThreadAffinityGeneration } from "./routing/thread-affinity";
 import { codexAccountLogLabel } from "./account-label";
 import { isCodexAccountPaused } from "./account-pause";
 import { clearCodexAccountPin, pinnedCodexAccountId } from "./account-priority";
@@ -205,6 +206,11 @@ export {
 } from "./routing/active-account";
 export { codexAccountPinDrainReason } from "./routing/pin-drain";
 export type { CodexPinDrainReason } from "./routing/pin-drain";
+
+// A shared refresh can outlive the request that opened it. Register the affinity
+// handoff with the flight so a detached G -> G+1 commit cannot strand bindings at G.
+registerCodexRefreshGenerationHandoff(handOffThreadAffinityGeneration);
+
 function hasConfiguredPoolAccount(
   config: OcxConfig,
   accountId: string,
diff --git a/src/codex/shim.ts b/src/codex/shim.ts
index 6eebf8d61f5..2fa48ab88e8 100644
--- a/src/codex/shim.ts
+++ b/src/codex/shim.ts
@@ -241,7 +241,7 @@ function backupPathFor(path: string): string {
  */
 function destroyedShimMessage(file: ShimFileState): string {
   const wrapper = existsSync(file.wrapperPath)
-    ? isShim(file.wrapperPath) ? "present but unusable" : "present but not an opencodex shim"
+    ? stableShimPathProbe(file.wrapperPath)?.prefix.includes(SHIM_MARKER) ? "present but unusable" : "present but not an opencodex shim"
     : "missing";
   const backup = existsSync(file.backupPath) ? "present" : "missing";
   const base = `Codex autostart shim not restored: wrapper ${wrapper} at ${file.wrapperPath}; original backup ${backup} at ${file.backupPath}.`;
diff --git a/src/codex/subagent-model-fallback.ts b/src/codex/subagent-model-fallback.ts
index ef9903b4ad9..42d289c7e00 100644
--- a/src/codex/subagent-model-fallback.ts
+++ b/src/codex/subagent-model-fallback.ts
@@ -905,8 +905,16 @@ export function hasCodexAgentModelFallbackField(role: string, codexHome = CODEX_
 }
 
 /** Roles whose TOML still carries `model_fallback`, including empty arrays. */
-export function scanCodexAgentRolesWithTomlModelFallback(codexHome = CODEX_HOME): string[] {
-  return listCodexAgentRoles(codexHome).filter(role => hasCodexAgentModelFallbackField(role, codexHome));
+export function scanCodexAgentRolesWithTomlModelFallback(
+  codexHome = CODEX_HOME,
+  onListError?: (cause: unknown) => void,
+): string[] {
+  try {
+    return listCodexAgentRoles(codexHome).filter(role => hasCodexAgentModelFallbackField(role, codexHome));
+  } catch (cause) {
+    onListError?.(cause);
+    return [];
+  }
 }
 
 const TOML_MODEL_KEY = /^\s*(?:model|"model"|'model')\s*=/;
@@ -984,9 +992,19 @@ const OPENCODEX_DERIVED_ROLE_MARKERS = ["generated-by: opencodex", "ocx-route:"]
  * authorizes writing to, repairing, or removing these files, and the marker-based ownership rules
  * that govern the files opencodex does write are unchanged.
  */
-export function scanOpencodexDerivedCodexAgentRolesWithoutModelPin(codexHome = CODEX_HOME): string[] {
+export function scanOpencodexDerivedCodexAgentRolesWithoutModelPin(
+  codexHome = CODEX_HOME,
+  onListError?: (cause: unknown) => void,
+): string[] {
   const findings: string[] = [];
-  for (const role of listCodexAgentRoles(codexHome)) {
+  let roles: string[];
+  try {
+    roles = listCodexAgentRoles(codexHome);
+  } catch (cause) {
+    onListError?.(cause);
+    return [];
+  }
+  for (const role of roles) {
     let content: string;
     try {
       content = readFileSync(join(codexHome, "agents", `${role}.toml`), "utf8");
diff --git a/src/combos/failover.ts b/src/combos/failover.ts
index da9ccdca375..3b0434e244d 100644
--- a/src/combos/failover.ts
+++ b/src/combos/failover.ts
@@ -399,6 +399,9 @@ function isRequestLocalTargetIncompatibility(status: number, message: string, co
     if (errorCode === "unsupported_value"
       && (e.param === "reasoning.effort" || e.param === "reasoning_effort")
       && e.message.startsWith("Unsupported value:") && e.message.includes("not supported")) return true;
+    if (e.code === null
+      && e.param === "reasoning_effort"
+      && /^Function tools with reasoning_effort are not supported for gpt-6-astra(?:-\d{4}-\d{2}-\d{2})? in \/v1\/chat\/completions\. To use function tools, use \/v1\/responses or set reasoning_effort to 'none'\.$/.test(e.message)) return true;
     return e.param === "input"
       && (errorCode === "" || errorCode === "invalid_request_error")
       && /^Model '[^']{1,256}' does not support image inputs\./.test(e.message);
diff --git a/src/config.ts b/src/config.ts
index 510501c5079..9788f252144 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -170,7 +170,7 @@ import {
   sanitizeModelCostsForLoad,
   sanitizeCapabilityDeclarationsForLoad,
   warnInheritedFastWireConflicts,
-  warnDegradedStreamMode,
+  warnDegradedTopLevelOptIns,
   warnDegradedHostname,
   warnDegradedListeners,
   warnDegradedApiKeys,
@@ -227,7 +227,7 @@ export function loadConfig(): OcxConfig {
     if (result.success) {
       const config = normalizeApiKeyIds(result.data as OcxConfig);
       warnInheritedFastWireConflicts(configPath, config);
-      warnDegradedStreamMode(parsed, config);
+      warnDegradedTopLevelOptIns(parsed, config);
       warnDegradedHostname(parsed, config);
       warnDegradedListeners(parsed, config);
       warnDegradedApiKeys(parsed, config);
diff --git a/src/config/admitted-identity.ts b/src/config/admitted-identity.ts
new file mode 100644
index 00000000000..eaca3be7cc9
--- /dev/null
+++ b/src/config/admitted-identity.ts
@@ -0,0 +1,222 @@
+import { readConfigAdmissionSnapshot } from "./diagnostics";
+import { getConfigPath } from "./paths";
+import { canonicalPlainData, copyPlainData, isPlainObject, ownDataKeys } from "../lib/plain-data";
+import type { OcxConfig } from "../types";
+
+/**
+ * A configuration a roster may be built from, detached from the object the caller holds.
+ *
+ * The detachment is the point. A gather suspends, and while it is suspended a management route can
+ * edit the resident configuration in place; gathering from one state and projecting from another
+ * would produce rows that belong to neither. Every authoritative pass uses this copy from
+ * beginning to end, so what the resident object does in the meantime becomes a question about
+ * whether the result may be retained rather than a question about what the result is.
+ *
+ * What this deliberately does NOT do is require the resident configuration to equal the file on
+ * disk. The proxy routes by the configuration it is holding, so that is the configuration a
+ * preview and the mutation it authorizes must both describe. A file the operator has edited and
+ * the process has not adopted is a supported state rather than a fault: live reconciliation
+ * (src/config/live-reconcile.ts) merges persisted state while deliberately retaining live changes
+ * and the active listener binding, and can persist a binding the resident object does not have.
+ * Demanding equality would make preview permanently unavailable on exactly those configurations
+ * while proving nothing about the rows, which come from the resident object either way.
+ */
+export interface ExportConfigAdmission {
+  readonly config: OcxConfig;
+}
+
+/**
+ * What was true when an admission was captured, kept here rather than on the admission object.
+ *
+ * None of it is data a consumer has any business reading: the file term is a digest of the
+ * operator's configuration file and the canonical form contains their credentials. Holding it in a
+ * module WeakMap means an admission can be passed around, and even serialized by a careless
+ * caller, without carrying any of it.
+ */
+interface AdmissionEvidence {
+  readonly path: string;
+  readonly file: string;
+  readonly data: string;
+  readonly executors: ReadonlyMap<string, unknown>;
+}
+
+const evidence = new WeakMap<ExportConfigAdmission, AdmissionEvidence>();
+
+/**
+ * Detach the configuration a roster is about to be built from, and record what it was.
+ *
+ * Two things are recorded because two things can move independently. The resident configuration is
+ * what the rows are derived from, so its complete structure is captured: structurally rather than
+ * as a list of the fields that seemed to matter, because such a list is only as complete as
+ * whoever last thought about it and this one had already missed export-affecting configuration.
+ * The configuration file is recorded beside it, so a roster does not outlive an operator editing
+ * the configuration under a process that has not adopted it yet.
+ *
+ * Null when the file cannot be read, when it is there but the loader would have had to salvage it,
+ * and when the configuration object cannot be copied as plain data. Every caller fails closed on
+ * it: refusing a preview costs an ordinary load, and serving one that describes a configuration
+ * nobody has costs a file the operator did not ask for.
+ */
+export function captureExportConfigAdmission(live: OcxConfig): ExportConfigAdmission | null {
+  const path = getConfigPath();
+  const file = admittedFileTerm();
+  if (file === null) return null;
+  const resident = detachConfig(live);
+  if (resident === null) return null;
+  const config = withExecutors(resident);
+  if (config === null) return null;
+  const admission: ExportConfigAdmission = { config };
+  evidence.set(admission, { path, file, data: canonicalPlainData(resident.data), executors: resident.executors });
+  return admission;
+}
+
+/**
+ * Whether an admission still describes the configuration in hand and the file it was taken beside.
+ *
+ * Three things are checked because three things can move: the file can be rewritten, the resident
+ * object can be edited in place, and a consumer of the detached copy can mutate what it was given.
+ * The last matters as much as the others, because a pass that edited its own input and then
+ * published would be retaining a roster under a state that no longer describes even that input.
+ *
+ * Passive: it reads the configuration file and nothing else. No credential is resolved, no
+ * provider is contacted, no path is hardened and nothing is written.
+ */
+export function isExportConfigAdmissionCurrent(admission: ExportConfigAdmission, live: OcxConfig): boolean {
+  const captured = evidence.get(admission);
+  if (captured === undefined) return false;
+  // A different configuration home is a different question, not a stale answer to this one.
+  if (getConfigPath() !== captured.path) return false;
+  const file = admittedFileTerm();
+  if (file === null || file !== captured.file) return false;
+  const resident = detachConfig(live);
+  if (resident === null || canonicalPlainData(resident.data) !== captured.data) return false;
+  if (!sameExecutors(resident.executors, captured.executors)) return false;
+  const working = detachConfig(admission.config);
+  return working !== null
+    && canonicalPlainData(working.data) === captured.data
+    && sameExecutors(working.executors, captured.executors);
+}
+
+/**
+ * A plain-data copy of a configuration for a consumer that must not observe later edits, or null.
+ *
+ * The integration writer is the case this exists for. It freezes every other resolution seam
+ * before its first await and then held the configuration by reference, so a plan checked under one
+ * configuration could be written from another: the check and the document it authorized were
+ * reading the same object at two different moments. One copy taken before the await gives both of
+ * them the same configuration.
+ *
+ * Null rather than the caller's object when the copy cannot be made. Handing back the reference
+ * would have been a copy in name only, and the caller would have gone on to describe it as the
+ * configuration it checked.
+ */
+export function detachedConfigSnapshot(config: OcxConfig): OcxConfig | null {
+  const detached = detachConfig(config);
+  return detached === null ? null : withExecutors(detached);
+}
+
+/**
+ * The configuration file as an opaque term: its exact bytes, or the distinguished absence of one.
+ *
+ * This is a byte observation and nothing more. It says the operator's configuration file has not
+ * been rewritten since a roster was built; it is not a claim about whether the configuration the
+ * process is holding agrees with that file.
+ *
+ * Null for a file that cannot be read, because then a later read cannot tell whether it changed.
+ * Null too for one that is there and does not load cleanly, which is the existing contract for a
+ * derived roster rather than an inference about the resident configuration. Before this, a digest
+ * was accepted ahead of any look at what the parse produced.
+ *
+ * Absence is a configuration rather than the lack of one. No file means defaults, which is an
+ * ordinary fresh install and the ordinary state in CI.
+ */
+function admittedFileTerm(): string | null {
+  const snapshot = readConfigAdmissionSnapshot();
+  const { source, error } = snapshot.diagnostics;
+  if (snapshot.kind === "read") return source === "file" && error === null ? snapshot.contentSha256 : null;
+  return source === "default" && error === null ? "absent" : null;
+}
+
+interface DetachedConfig {
+  readonly data: Record<string, unknown>;
+  readonly executors: ReadonlyMap<string, unknown>;
+}
+
+/**
+ * A configuration as plain data, with the transport executors kept out of it.
+ *
+ * The copier refuses everything JSON could not have produced, so the one thing that needs handling
+ * here is a provider's fetch executor: a caller owns it and the gather uses it instead of the
+ * global transport. It is held by reference for the detached copy and compared by reference
+ * afterwards, so replacing it invalidates the binding while it is never serialized.
+ */
+function detachConfig(live: OcxConfig): DetachedConfig | null {
+  const executors = new Map<string, unknown>();
+  const root = live as unknown;
+  if (!isPlainObject(root)) return null;
+  const data: Record<string, unknown> = {};
+  for (const key of ownDataKeys(root)) {
+    if (key === null) return null;
+    const value = root[key];
+    if (value === undefined) continue;
+    if (key !== "providers") {
+      const copied = copyPlainData(value);
+      if (!copied.ok) return null;
+      data[key] = copied.value;
+      continue;
+    }
+    if (!isPlainObject(value)) return null;
+    const providers: Record<string, unknown> = {};
+    for (const name of ownDataKeys(value)) {
+      if (name === null) return null;
+      const provider = value[name];
+      if (provider === undefined) continue;
+      if (!isPlainObject(provider)) return null;
+      const copiedProvider: Record<string, unknown> = {};
+      for (const field of ownDataKeys(provider)) {
+        if (field === null) return null;
+        const fieldValue = provider[field];
+        if (fieldValue === undefined) continue;
+        // The executor exception applies to an executor. A provider entry keeps unknown
+        // configuration keys, so a fetch value that is not a function is something an operator
+        // wrote into the file, and it is copied and compared as the data it is. Discovery reads it
+        // the same way: the outbound transport takes its built-in path unless the value is
+        // callable.
+        if (field === "fetch" && typeof fieldValue === "function") {
+          executors.set(name, fieldValue);
+          continue;
+        }
+        const copied = copyPlainData(fieldValue);
+        if (!copied.ok) return null;
+        copiedProvider[field] = copied.value;
+      }
+      providers[name] = copiedProvider;
+    }
+    data[key] = providers;
+  }
+  return { data, executors };
+}
+
+/** The copy a consumer runs against, with the executors put back by reference. */
+function withExecutors(detached: DetachedConfig): OcxConfig | null {
+  // A second copy, so what is compared later is never the object handed to a consumer.
+  const copied = copyPlainData(detached.data);
+  if (!copied.ok) return null;
+  const config = copied.value;
+  const providers = config.providers;
+  if (isPlainObject(providers)) {
+    for (const [name, executor] of detached.executors) {
+      const provider = providers[name];
+      if (isPlainObject(provider)) provider.fetch = executor;
+    }
+  }
+  return config as unknown as OcxConfig;
+}
+
+function sameExecutors(left: ReadonlyMap<string, unknown>, right: ReadonlyMap<string, unknown>): boolean {
+  if (left.size !== right.size) return false;
+  for (const [name, executor] of left) {
+    if (!right.has(name) || right.get(name) !== executor) return false;
+  }
+  return true;
+}
diff --git a/src/config/diagnostics.ts b/src/config/diagnostics.ts
index b3904dfb0ad..a3893b98af9 100644
--- a/src/config/diagnostics.ts
+++ b/src/config/diagnostics.ts
@@ -60,6 +60,7 @@ import {
   remoteGuiConfigSchema,
   runtimeRoleSchema,
   spendSchema,
+  compactionRoutingSchema,
 } from "./schema/leaf-validators";
 
 export type ConfigDiagnostics = {
@@ -561,7 +562,26 @@ function managementIngressConfigError(value: unknown): string | null {
   return null;
 }
 
+/** Load degrades malformed metrics export config to off; live writes reject the same shape. */
+export function metricsExportConfigError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw || !Object.hasOwn(raw, "metricsExport") || raw.metricsExport === undefined) return null;
+  const metricsExport = rawConfigRecord(raw.metricsExport);
+  if (!metricsExport) return "schema_invalid: metricsExport: must be an object or omitted";
+  if (Object.keys(metricsExport).some(key => key !== "enabled")) {
+    return "schema_invalid: metricsExport: contains an unsupported field";
+  }
+  if (metricsExport.enabled !== undefined && typeof metricsExport.enabled !== "boolean") {
+    return "schema_invalid: metricsExport.enabled: must be a boolean";
+  }
+  return null;
+}
+
 export function validateConfigCandidate(value: unknown): { ok: true; config: OcxConfig } | { ok: false; error: string } {
+  const compactionRouting = rawConfigRecord(value)?.compactionRouting;
+  if (compactionRouting !== undefined && !compactionRoutingSchema.safeParse(compactionRouting).success) {
+    return { ok: false, error: "schema_invalid: compactionRouting: requires a nonblank model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" };
+  }
   const boundaryError = configReasoningPinsConfigError(value)
     ?? blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
@@ -586,7 +606,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
     ?? clientConnectionConfigError(value)
     ?? clientRolePairError(value)
     ?? loopbackListenerPortError(value)
-    ?? managementIngressConfigError(value);
+    ?? managementIngressConfigError(value)
+    ?? metricsExportConfigError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) {
diff --git a/src/config/feature-flags.ts b/src/config/feature-flags.ts
index 01d60adbf2b..df418ece637 100644
--- a/src/config/feature-flags.ts
+++ b/src/config/feature-flags.ts
@@ -12,6 +12,11 @@ export function ultraFastTierEnabled(config: Pick<OcxConfig, "ultraFastTier">):
   return config.ultraFastTier === true;
 }
 
+/** Default-off aggregate request metrics; activation is fixed for one server process lifetime. */
+export function metricsExportEnabled(config: Pick<OcxConfig, "metricsExport">): boolean {
+  return config.metricsExport?.enabled === true;
+}
+
 /**
  * Default cadence for the opt-in catalog auto-refresh (issue #3630): one converge pass
  * per hour. Each pass spends a live /models call against every enabled provider, and
diff --git a/src/config/load-degrade.ts b/src/config/load-degrade.ts
index 0f482cf8df1..1787ad109a6 100644
--- a/src/config/load-degrade.ts
+++ b/src/config/load-degrade.ts
@@ -101,6 +101,24 @@ export function warnDegradedStreamMode(rawParsed: unknown, validated: OcxConfig)
   }
 }
 
+export function warnDegradedCompactionRouting(rawParsed: unknown, validated: OcxConfig): void {
+  if (!rawParsed || typeof rawParsed !== "object") return;
+  const raw = (rawParsed as Record<string, unknown>).compactionRouting;
+  if (raw !== undefined && validated.compactionRouting === undefined) {
+    console.warn("⚠️  config.json compactionRouting is invalid (expected { model, reasoningEffort?, triggers? } with a nonblank model, a declared effort, and triggers drawn without repetition from \"manual\" and \"auto\") — compaction keeps the conversation model");
+  }
+}
+
+/**
+ * Top-level opt-in blocks whose hand-edited form degrades to "off" instead of failing the whole
+ * schema. Grouped behind one entry point because `src/config.ts` sits at its file-size cap, and
+ * the ratchet only ever moves down: a per-block call there costs a line the file does not have.
+ */
+export function warnDegradedTopLevelOptIns(rawParsed: unknown, validated: OcxConfig): void {
+  warnDegradedStreamMode(rawParsed, validated);
+  warnDegradedCompactionRouting(rawParsed, validated);
+}
+
 /**
  * Load-time degradation for `retryOn429` (loadConfig only): one hand-edited invalid optional
  * field (e.g. `attempts: 0` or a string) must not trip the whole provider schema and hide every
diff --git a/src/config/proxy-env.ts b/src/config/proxy-env.ts
index aa53350ef81..adbfe5f6176 100644
--- a/src/config/proxy-env.ts
+++ b/src/config/proxy-env.ts
@@ -143,8 +143,14 @@ export function applyProxyEnvWith(
     } else {
       const found = readWindowsSystemProxy(auto.reader, auto.platform);
       if (found.kind === "proxy") {
-        console.log(`[opencodex] proxy "auto": using Windows system proxy ${describeProxyForLog(found.url)}`);
-        proxy = found.url;
+        const origins = [
+          found.httpUrl && `HTTP ${describeProxyForLog(found.httpUrl)}`,
+          found.httpsUrl && `HTTPS ${describeProxyForLog(found.httpsUrl)}`,
+        ].filter(Boolean).join(", ");
+        console.log(`[opencodex] proxy "auto": using Windows system proxy ${origins}`);
+        if (found.httpUrl) process.env.HTTP_PROXY = found.httpUrl;
+        if (found.httpsUrl) process.env.HTTPS_PROXY = found.httpsUrl;
+        proxy = undefined;
       } else {
         const reason = found.kind === "unsupported"
           ? "only Windows system proxy discovery is supported; using direct egress on this OS"
diff --git a/src/config/schema/compaction-triggers.ts b/src/config/schema/compaction-triggers.ts
new file mode 100644
index 00000000000..cac2911ce71
--- /dev/null
+++ b/src/config/schema/compaction-triggers.ts
@@ -0,0 +1,11 @@
+/**
+ * The `compaction.trigger` values Codex labels a compaction turn with (`CompactionTrigger`
+ * in codex-rs: a manual `/compact` versus automatic compaction). `compactionRouting.triggers`
+ * selects which of them an override applies to.
+ *
+ * This is its own leaf module and imports nothing on purpose. The request path reads it from
+ * `src/server/responses/compaction-routing.ts`; importing `leaf-validators.ts` there instead
+ * closes a cycle with `config-schema.ts` that survives typecheck and then fails at run time
+ * with "Cannot access 'runtimeRoleSchema' before initialization".
+ */
+export const COMPACTION_TRIGGERS = ["manual", "auto"] as const;
diff --git a/src/config/schema/config-schema.ts b/src/config/schema/config-schema.ts
index 94844bf4ec0..18a45a68412 100644
--- a/src/config/schema/config-schema.ts
+++ b/src/config/schema/config-schema.ts
@@ -21,6 +21,7 @@ import {
   CODEX_ACCOUNT_NAMESPACE_ACCOUNT_ID_COLLISION_ERROR,
   codexAccountNamespacesSchema,
   modelPinnedEffortsSchema,
+  compactionRoutingSchema,
   modelPreferHostedToolsConfigError,
   providerModelCostsConfigError,
   providerRelativeSendPathConfigError,
@@ -73,6 +74,8 @@ export const configSchema = z.object({
   // A malformed privacy block must never be read as "unmask": .catch(undefined) drops it and
   // emailMaskingEnabled then falls back to masked, which is also what an absent block means.
   privacy: z.object({ maskEmails: z.boolean().optional() }).strict().optional().catch(undefined),
+  // Malformed hand edits disable this opt-in exporter. Live writes reject them in diagnostics.ts.
+  metricsExport: z.object({ enabled: z.boolean().optional() }).strict().optional().catch(undefined),
   // A malformed present client block must remain diagnosable from raw config and
   // fail closed through src/client/state.ts; unrelated provider state still loads.
   client: clientConnectionSchema.optional().catch(undefined),
@@ -125,6 +128,7 @@ export const configSchema = z.object({
   ]).optional().catch(undefined),
   providers: z.record(z.string(), providerConfigSchema),
   modelPinnedEfforts: modelPinnedEffortsSchema.optional(),
+  compactionRouting: compactionRoutingSchema.optional().catch(undefined),
   defaultProvider: z.string().min(1).default("openai"),
   defaultModelAliases: z.boolean().optional(),
   // Malformed hand edits disable this opt-in projection without rejecting providers.
diff --git a/src/config/schema/leaf-validators.ts b/src/config/schema/leaf-validators.ts
index 6dc1b35aa0d..f3160644b08 100644
--- a/src/config/schema/leaf-validators.ts
+++ b/src/config/schema/leaf-validators.ts
@@ -38,12 +38,21 @@ import {
   isHostedToolUnsupportedForModel,
 } from "../../responses/hosted-tool-policy";
 import { getConfigDir } from "../paths";
+import { COMPACTION_TRIGGERS } from "./compaction-triggers";
 
 /** One definition of "usable secret", shared by the schema and the warnings. */
 export function isUsableApiKeySecret(value: unknown): value is string {
   return typeof value === "string" && value.length > 0 && value === value.trim();
 }
 
+export const compactionRoutingSchema = z.object({
+  model: z.string().trim().min(1),
+  reasoningEffort: z.string().refine(value => pinnedReasoningEffortConfigError(value) === null).optional(),
+  triggers: z.array(z.enum(COMPACTION_TRIGGERS)).nonempty()
+    .refine(values => new Set(values).size === values.length, "triggers must not repeat a value")
+    .optional(),
+}).strict();
+
 /**
  * Bounds for the opt-in same-target 429 wait-and-retry policy. Single source of truth
  * shared by the config schema, the load-time sanitizer, and the management write
@@ -254,6 +263,8 @@ export const providerConfigSchema = z.object({
   modelSupportsServiceTier: z.record(z.string().min(1), z.boolean()).optional(),
   modelSuppressSyntheticMax: z.record(z.string().min(1), z.boolean()).optional(),
   preserveResponsesReasoningContent: z.boolean().optional(),
+  dropResponsesReasoningItems: z.boolean().optional(),
+  modelReasoningEffortsAuthoritative: z.boolean().optional(),
   decodesNativeCompactionBlobs: z.boolean().optional(),
   allowEncryptedV2AgentTasks: z.boolean().optional(),
   allowPrivateNetwork: z.boolean().optional(),
@@ -268,6 +279,7 @@ export const providerConfigSchema = z.object({
   // canonical ChatGPT backend WS selection is independent of this flag.
   upstreamWebsocket: z.boolean().optional(),
   directGeminiWireRenames: z.boolean().optional(),
+  googleToolSchemaPolicy: z.enum(["compatible", "reject-lossy"]).optional(),
   noStructuredOutputModels: z.array(z.string().min(1))
     .transform(normalizeNonBlankStringArray)
     .optional(),
diff --git a/src/grok/reset-coupons.ts b/src/grok/reset-coupons.ts
index b35afd286a6..90e9229a9c2 100644
--- a/src/grok/reset-coupons.ts
+++ b/src/grok/reset-coupons.ts
@@ -52,27 +52,48 @@ export function encodeVarint(value: number | bigint): Uint8Array {
   return new Uint8Array(bytes);
 }
 
+const MAX_PROTOBUF_VARINT_BYTES = 10;
+
 /**
  * Decodes a protobuf varint from bytes at offset.
  */
 export function decodeVarint(bytes: Uint8Array, offset: number): { value: number; bytesRead: number } {
+  if (!Number.isInteger(offset) || offset < 0 || offset >= bytes.length) {
+    throw new Error("Invalid protobuf varint offset");
+  }
+
   let result = 0;
-  let shift = 0;
   let count = 0;
 
   while (offset + count < bytes.length) {
+    // Protobuf caps a varint at the ten bytes a 64-bit value needs. The safe-integer guard
+    // below cannot stand in for this bound, because a continuation byte carrying no payload
+    // bits contributes a part of zero, which IS a safe integer: without an explicit length
+    // limit an arbitrarily long run of 0x80 followed by 0x00 decoded as a valid zero, and an
+    // overlong zero length can normalize a malformed body into an empty coupon list.
+    if (count >= MAX_PROTOBUF_VARINT_BYTES) {
+      throw new Error("Overlong protobuf varint");
+    }
     const b = bytes[offset + count];
-    count++;
-    result |= (b & 0x7f) << shift;
-    if ((b & 0x80) === 0) break;
-    shift += 7;
-    if (shift > 35) {
-      // For timestamps seconds, JS safe integers suffice.
-      break;
+    const part = (b & 0x7f) * (2 ** (7 * count));
+    if (!Number.isSafeInteger(part) || result > Number.MAX_SAFE_INTEGER - part) {
+      throw new Error("Protobuf varint exceeds JavaScript safe integer range");
     }
+    result += part;
+    count++;
+    if ((b & 0x80) === 0) return { value: result, bytesRead: count };
   }
 
-  return { value: result, bytesRead: count };
+  throw new Error("Truncated protobuf varint");
+}
+
+function decodeLength(bytes: Uint8Array, offset: number): { start: number; end: number } {
+  const { value: length, bytesRead } = decodeVarint(bytes, offset);
+  const start = offset + bytesRead;
+  if (!Number.isSafeInteger(length) || length < 0 || length > bytes.length - start) {
+    throw new Error("Invalid protobuf length-delimited field");
+  }
+  return { start, end: start + length };
 }
 
 /**
@@ -109,8 +130,8 @@ function decodeTimestamp(bytes: Uint8Array): number {
       offset += bytesRead;
       if (fieldNum === 1) seconds = value;
     } else if (wireType === 2) {
-      const { value: len, bytesRead } = decodeVarint(bytes, offset);
-      offset += bytesRead + len;
+      const { end } = decodeLength(bytes, offset);
+      offset = end;
     } else {
       break;
     }
@@ -135,10 +156,9 @@ function decodeConsumerResetToken(bytes: Uint8Array): GrokResetCoupon | null {
     const wireType = tag & 0x7;
 
     if (wireType === 2) {
-      const { value: len, bytesRead: lenRead } = decodeVarint(bytes, offset);
-      offset += lenRead;
-      const sub = bytes.subarray(offset, offset + len);
-      offset += len;
+      const { start, end } = decodeLength(bytes, offset);
+      const sub = bytes.subarray(start, end);
+      offset = end;
 
       if (fieldNum === 10) {
         tokenId = new TextDecoder("utf-8").decode(sub);
@@ -178,10 +198,9 @@ export function decodeGetRemainingResetsResponse(payload: Uint8Array): GrokReset
     const wireType = tag & 0x7;
 
     if (wireType === 2) {
-      const { value: len, bytesRead: lenRead } = decodeVarint(payload, offset);
-      offset += lenRead;
-      const sub = payload.subarray(offset, offset + len);
-      offset += len;
+      const { start, end } = decodeLength(payload, offset);
+      const sub = payload.subarray(start, end);
+      offset = end;
 
       if (fieldNum === 10) {
         const token = decodeConsumerResetToken(sub);
diff --git a/src/images/loop.ts b/src/images/loop.ts
index 193bbef45f9..c09a07336b5 100644
--- a/src/images/loop.ts
+++ b/src/images/loop.ts
@@ -321,10 +321,15 @@ export interface ImageBridgeDeps {
    * 429 states the window's reset epoch even when it omits Retry-After -- and a rotation that
    * cannot see it cools the drained account for the short default instead of until the window
    * actually reopens. Optional so existing callers keep compiling.
+   *
+   * `retryParsed` is the exact iteration-local request the retry will be built from. The loop
+   * sends a shallow copy of the outer parsed request, so a rotation that rebinds only the outer
+   * object never reaches the wire. Optional so existing callers keep compiling.
    */
   on429?: (
     retryAfterHeader: string | null,
     responseHeaders?: Headers,
+    retryParsed?: OcxParsedRequest,
   ) => ProviderAdapter | null | Promise<ProviderAdapter | null>;
   /** Opt-in same-target 429 policy (key-auth providers). When present, 429 replays on the SAME key before on429 rotation. */
   retryOn429Policy?: Required<RateLimitRetryPolicy> | null;
@@ -660,7 +665,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       }
       // 429 key-failover parity with web-search / normal routed path.
       while (prepared.response.status === 429 && deps.on429) {
-        const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers);
+        const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers, iterParsed);
         if (!rotated) break;
         try { void prepared.response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
         adapter = rotated;
diff --git a/src/integrations/aside-profile-context.ts b/src/integrations/aside-profile-context.ts
index d0bd9536cb8..65ee091c06f 100644
--- a/src/integrations/aside-profile-context.ts
+++ b/src/integrations/aside-profile-context.ts
@@ -2,6 +2,8 @@ import { lstatSync, readdirSync, realpathSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { ClientPathError, type ExportModel } from "../clients/config-export";
 import { assertAsideProfileBoundary, guardAsideProfileIO, listAsideProfiles, type AsideProfile } from "../clients/aside-profiles";
+import { detachedConfigSnapshot } from "../config/admitted-identity";
+import { copyPlainData } from "../lib/plain-data";
 import type { OcxConfig } from "../types";
 import { type IntegrationIO } from "./config-io";
 import type { JournalEntry } from "./journal";
@@ -46,6 +48,17 @@ export interface AsideProfileContext {
   defaultEnabled: boolean;
   models: () => Promise<readonly ExportModel[]>;
   scopes: Map<number, AsideProfileScope>;
+  /**
+   * The configuration every profile write in this action is built from, copied when the context
+   * was created.
+   *
+   * An Aside mutation checks its confirmation, then awaits the preference write, and only then
+   * builds each profile's write input. The preference write edits the live configuration itself,
+   * so reading it again afterwards guaranteed the document was serialized from a configuration
+   * the check never saw. This copy is taken before the check and carried through every write, so
+   * the two describe the same thing.
+   */
+  boundConfig: OcxConfig;
 }
 
 function storeUnsafe(): never {
@@ -142,10 +155,28 @@ export function createAsideProfileContext(input: AsideProfilesInput): AsideProfi
     ? matched?.id ?? null
     : profiles.find(profile => profile.configPath === newest?.configPath)?.id ?? null;
   let loaded: Promise<readonly ExportModel[]> | undefined;
+  const boundConfig = detachedConfigSnapshot(input.config);
+  if (boundConfig === null) {
+    throw new AsideProfileError("aside_profiles_unavailable", 409, "The proxy configuration could not be captured for this change");
+  }
   return {
     input: { ...input, env: { ...(input.env ?? process.env) } }, profiles, rootStore, legacyProfileId, scopes: new Map(),
     defaultEnabled: input.config.asideProfileSync?.allProfiles ?? Boolean(matched),
-    models: () => loaded ??= Promise.resolve().then(() => typeof input.models === "function" ? input.models() : input.models),
+    /*
+     * Resolved once and copied, so every profile in one action writes the same roster and a
+     * caller editing the model objects it passed cannot change what a checked plan described.
+     * The copy is taken here rather than at each write because the check reads it too.
+     */
+    models: () => loaded ??= Promise.resolve()
+      .then(() => typeof input.models === "function" ? input.models() : input.models)
+      .then(rows => {
+        const copied = copyPlainData([...rows]);
+        if (!copied.ok) {
+          throw new AsideProfileError("aside_profiles_unavailable", 409, "The model roster could not be captured for this change");
+        }
+        return copied.value;
+      }),
+    boundConfig,
   };
 }
 
@@ -160,7 +191,10 @@ export function selectAsideProfiles(ctx: AsideProfileContext, profileId?: number
 }
 
 export function asideProfileEnabled(ctx: AsideProfileContext, id: number): boolean {
-  return ctx.input.config.asideProfileSync?.profiles?.[String(id)] ?? ctx.defaultEnabled;
+  // The bound copy, like every other policy read in this context: the preference write inside an
+  // action edits the live configuration, and a decision taken afterwards would be answering from
+  // a policy the action itself installed.
+  return ctx.boundConfig.asideProfileSync?.profiles?.[String(id)] ?? ctx.defaultEnabled;
 }
 
 export function asideProfileScope(ctx: AsideProfileContext, profile: AsideProfile): AsideProfileScope {
@@ -207,7 +241,7 @@ export async function asideWriteInput(ctx: AsideProfileContext, scope: AsideProf
   const models = await ctx.models();
   scope.assertBoundary();
   return {
-    clientId: "aside", config: ctx.input.config, models, port: ctx.input.port,
+    clientId: "aside", config: ctx.boundConfig, models, port: ctx.input.port,
     env: ctx.input.env, home: ctx.input.home, store: scope.store, io: scope.io,
     resolvedPaths: { configPath: scope.profile.configPath, detectDir: scope.profile.detectDir },
   };
diff --git a/src/integrations/aside-profile-journal.ts b/src/integrations/aside-profile-journal.ts
index 0fd7f471834..2d22588a646 100644
--- a/src/integrations/aside-profile-journal.ts
+++ b/src/integrations/aside-profile-journal.ts
@@ -167,10 +167,32 @@ function importOperation(row: AsideOperation, scope: AsideProfileScope): void {
 
 export function restoreAsideProfile(
   input: AsideProfilesInput,
-  request: { opId: string; profileId?: number; confirmDrift?: boolean },
+  request: {
+    opId: string;
+    profileId?: number;
+    confirmDrift?: boolean;
+    /**
+     * The row a caller already selected. Aside can hold more than one valid copy, so resolving
+     * again here could act on a different one than the plan the operator confirmed described.
+     */
+    selectedOperation?: AsideOperation;
+  },
+  options?: {
+    revalidate?: (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>;
+    /**
+     * Checked after the preference write, once before the selected history is copied into this
+     * profile's store and once more immediately before the restore itself.
+     *
+     * The preference write and that copy both sit between the first check and the restore they
+     * authorize, and Aside takes no writer lock. The snapshot checks below still hold, but they
+     * say nothing about the target file, which can be edited in either window; without this, a
+     * confirmation about the earlier file still overwrote the later one.
+     */
+    revalidateBeforeWrite?: (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>;
+  },
 ): Promise<AsideProfileWriteOutcome> {
   return runAsideProfileAction<AsideProfileWriteOutcome>(input, request.profileId, `restore:${request.opId}:${Boolean(request.confirmDrift)}`, async ctx => {
-    const row = requiredOperation(ctx, request.opId, request.profileId);
+    const row = request.selectedOperation ?? requiredOperation(ctx, request.opId, request.profileId);
     const profile = selectAsideProfiles(ctx, row.profileId)[0]!;
     const scope = asideProfileScope(ctx, profile);
     assertAsideSnapshotEntry(row.entry);
@@ -188,6 +210,16 @@ export function restoreAsideProfile(
       return { clientId: "aside", profileId: profile.id, ok: false, reason: "drift_requires_confirm", state: "conflict", message: "This profile changed after that operation; confirm to replace it" };
     }
     const restoredText = snapshot.kind === "stored" ? snapshot.text : null;
+    /*
+     * Checked before the preference write and before importOperation, which captures a snapshot
+     * and appends a journal row. Both happen ahead of the coordinated restore, so a confirmation
+     * checked under the writer lock would already have rewritten the user's preference and their
+     * history by the time it was consulted.
+     */
+    // The input this restore will actually write from, so the check cannot be answering about a
+    // view it rebuilt from the live configuration while the write uses this one.
+    const stale = await options?.revalidate?.(bound);
+    if (stale) return stale;
     await persistAsidePolicy(ctx, { profileId: profile.id, enabled: snapshotWasOwned(row.entry, restoredText, bound) });
     try {
       scope.assertBoundary();
@@ -197,8 +229,41 @@ export function restoreAsideProfile(
         || (currentSnapshot.kind === "stored" && currentSnapshot.text !== restoredText)) {
         throw new AsideProfileError("aside_operation_changed", 409, "Aside operation or snapshot changed while saving preferences");
       }
+      /*
+       * Looked at twice, because the two moments answer different questions and neither covers
+       * the other.
+       *
+       * Here, before the import, so that a confirmation already stale by this point is refused
+       * without copying anything: the import writes the selected row and its snapshot into this
+       * profile's own store, and a refusal from inside the coordinated restore returns before the
+       * restore transaction begins, so nothing would compensate that copy.
+       */
+      const beforeImport = await options?.revalidateBeforeWrite?.(bound);
+      if (beforeImport) return beforeImport;
       importOperation(row, scope);
-      return { ...await restoreIntegrationCoordinated({ ...bound, opId: request.opId, confirmDrift: request.confirmDrift }, { lockSeams: input.lockSeams }), profileId: profile.id };
+      return {
+        ...await restoreIntegrationCoordinated(
+          { ...bound, opId: request.opId, confirmDrift: request.confirmDrift },
+          {
+            lockSeams: input.lockSeams,
+            /*
+             * And again inside the coordinated restore, immediately before it runs. The import
+             * sits between the two, and Aside takes no writer lock, so that path still awaits
+             * before the restore begins: a target edited after the copy would otherwise be
+             * rewritten by a confirmation that never described it.
+             *
+             * A refusal here leaves the copied history and the saved preference in place. That is
+             * deliberate: the copy is this operation's own history rather than a change to the
+             * operator's file, and unwinding it would need a transaction across two stores and a
+             * configuration write for no gain the operator can see.
+             */
+            ...(options?.revalidateBeforeWrite
+              ? { revalidate: (frozen: IntegrationWriteInput) => options.revalidateBeforeWrite!(frozen) }
+              : {}),
+          },
+        ),
+        profileId: profile.id,
+      };
     } catch (error) { return asideProfileFailure(profile.id, error); }
   });
 }
diff --git a/src/integrations/aside-profiles.ts b/src/integrations/aside-profiles.ts
index 94514f253a8..2d5e2a8e9df 100644
--- a/src/integrations/aside-profiles.ts
+++ b/src/integrations/aside-profiles.ts
@@ -2,20 +2,65 @@ import type { AsideProfile } from "../clients/aside-profiles";
 import { asideHomeDir } from "../clients/config-export";
 import { join } from "node:path";
 import type { OwnedIntegrationRefreshOutcome } from "./owned-refresh";
+import type { JournalEntry } from "./journal";
+import type { IntegrationStateStore } from "./store";
 import { readIntegrationState, type IntegrationState, type IntegrationStatus } from "./state";
 import {
   applyIntegrationCoordinated, disableIntegrationCoordinated,
   overwriteIntegrationCoordinated, refreshIntegrationCoordinated,
+  type IntegrationWriteInput,
 } from "./writer";
 import {
   asideProfileEnabled, asideProfileFailure, asideProfileScope, asideWriteInput,
   asideRootStore, createAsideProfileContext, persistAsidePolicy, runAsideProfileAction, selectAsideProfiles,
   type AsideProfileContext, type AsideProfilesInput, type AsideProfileWriteOutcome,
 } from "./aside-profile-context";
+import { AsideProfileError as AsideProfileErrorClass } from "./aside-profile-context";
+import {
+  previewIntegration,
+  type IntegrationMutationPlan,
+  type IntegrationPlanOperation,
+} from "./mutation-plan";
 
 export { AsideProfileError } from "./aside-profile-context";
 export type { AsideProfilesInput, AsideProfileWriteOutcome } from "./aside-profile-context";
 
+/**
+ * Plan one profile's change without performing it.
+ *
+ * A profile is the unit here because a fingerprint can only honestly describe one independently
+ * changing file. The scope this builds is the same scope the mutation will use — that profile's
+ * store, IO and resolved path pair — so the plan describes the thing that would actually happen
+ * rather than an approximation of it.
+ *
+ * The roster comes from whatever the caller injected, so a preview inherits the caller's no-gather
+ * guarantee instead of reaching for a second source of models.
+ */
+export async function previewAsideProfile(
+  input: AsideProfilesInput,
+  request: {
+    profileId: number;
+    operation: IntegrationPlanOperation;
+    opId?: string;
+    confirmDrift?: boolean;
+    /** The row and store the route already selected; re-resolving could pick a different copy. */
+    resolved?: { entry: JournalEntry; store: IntegrationStateStore };
+  },
+): Promise<IntegrationMutationPlan> {
+  const ctx = createAsideProfileContext(input);
+  const profile = selectAsideProfiles(ctx, request.profileId)[0];
+  if (!profile) throw new AsideProfileErrorClass("aside_profile_not_found", 404, "That Aside profile is not available");
+  const scope = asideProfileScope(ctx, profile);
+  const bound = await asideWriteInput(ctx, scope);
+  return previewIntegration(bound, {
+    operation: request.operation,
+    profileId: request.profileId,
+    ...(request.opId === undefined ? {} : { opId: request.opId }),
+    ...(request.confirmDrift === undefined ? {} : { confirmDrift: request.confirmDrift }),
+    ...(request.resolved === undefined ? {} : { resolved: request.resolved }),
+  });
+}
+
 export interface AsideProfileState extends IntegrationStatus {
   profileId: number;
   name?: string;
@@ -104,6 +149,18 @@ export async function getAsideProfileState(input: AsideProfilesInput, id: number
 export function mutateAsideProfiles(
   input: AsideProfilesInput,
   change: { enabled: boolean; profileId?: number; overwriteConflict?: boolean },
+  options?: {
+    revalidate?: (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>;
+    /**
+     * Checked again immediately before the client document is written.
+     *
+     * Aside takes no writer lock, and the preference write sits between the first check and the
+     * write it authorizes. Nothing stops the target file from being edited in that window, and the
+     * writer's own comparison reads the file as it is now, so a confirmation about the earlier
+     * file would otherwise still overwrite the later one.
+     */
+    revalidateBeforeWrite?: (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>;
+  },
 ): Promise<AsideProfileMutationResult> {
   return runAsideProfileAction<AsideProfileMutationResult>(input, change.profileId, `${change.enabled ? "enable" : "disable"}:${Boolean(change.overwriteConflict)}`, async (ctx, profiles) => {
     const refused = new Map<number, AsideProfileWriteOutcome>();
@@ -111,6 +168,66 @@ export function mutateAsideProfiles(
       try { asideProfileScope(ctx, profile); }
       catch (error) { refused.set(profile.id, asideProfileFailure(profile.id, error)); }
     }
+    /*
+     * The input each profile will be written from, prepared before the check and handed to it.
+     *
+     * A check that built its own view from the live configuration was answering about a different
+     * input than the one that would be written: the context copies the configuration when it is
+     * created, so live could be edited to something else and then back again while this action was
+     * in flight, and a check reading live would agree with a plan this write never described.
+     *
+     * Only a checked change prepares early. Preparing resolves the roster, and an unchecked change
+     * whose preference write fails must not have done any model work by then, which is a contract
+     * of its own. There is nothing to bring forward when there is no check to read it.
+     */
+    const prepared = new Map<number, IntegrationWriteInput>();
+    if (options?.revalidate) {
+      /*
+       * Refused before anything is prepared. Preparing resolves the roster, and a supported loader
+       * reaches providers and can finalize an initial model selection, so a confirmation this
+       * cannot check at all must not cause that work first. A confirmation describes one profile,
+       * and HTTP refuses one that names none; guessing which prepared input a bindingless
+       * confirmation meant would invent the thing the check exists to verify.
+       */
+      if (change.profileId === undefined) {
+        throw new AsideProfileErrorClass("invalid_aside_profile", 400, "a confirmed change applies to one profile");
+      }
+      for (const profile of profiles) {
+        if (refused.has(profile.id)) continue;
+        try { prepared.set(profile.id, await asideWriteInput(ctx, asideProfileScope(ctx, profile))); }
+        catch (error) { refused.set(profile.id, asideProfileFailure(profile.id, error)); }
+      }
+    }
+    /*
+     * A confirmation is checked HERE, not under the writer lock.
+     *
+     * The await below persists the user's Aside preference before any writer runs, so a check
+     * that waited for the lock would fire after the thing it was meant to prevent. Profile and
+     * path selection is frozen by this point, which is everything the check needs.
+     */
+    if (options?.revalidate) {
+      const guarded = change.profileId === undefined ? undefined : prepared.get(change.profileId);
+      // Nothing prepared is nothing to check and nothing to write; refusing keeps a binding from
+      // being dropped on the way to a write that would then be unchecked.
+      const stale: AsideProfileWriteOutcome | null = guarded === undefined
+        ? refused.get(change.profileId ?? -1) ?? {
+          ok: false, reason: "unsafe", state: "conflict", clientId: "aside",
+          message: "that profile cannot be prepared for this change",
+          profileId: change.profileId ?? profiles[0]?.id ?? 0,
+        }
+        : await options.revalidate(guarded);
+      if (stale) {
+        return {
+          ok: false,
+          clientId: "aside",
+          changed: false,
+          state: "conflict",
+          message: "that confirmation no longer describes this profile",
+          results: [stale],
+          result: stale,
+        };
+      }
+    }
     // This await precedes model loading, writer preflight, snapshots and all client writes.
     await persistAsidePolicy(ctx, change);
     const results: AsideProfileWriteOutcome[] = [];
@@ -118,11 +235,19 @@ export function mutateAsideProfiles(
       const refusal = refused.get(profile.id);
       if (refusal) { results.push(refusal); continue; }
       try {
-        const scope = asideProfileScope(ctx, profile);
-        const bound = await asideWriteInput(ctx, scope);
+        // The prepared input when a check read one, so the write is the thing that was checked.
+        const bound = prepared.get(profile.id) ?? await asideWriteInput(ctx, asideProfileScope(ctx, profile));
         const operation = !change.enabled ? disableIntegrationCoordinated
           : change.overwriteConflict ? overwriteIntegrationCoordinated : applyIntegrationCoordinated;
-        results.push({ ...await operation(bound, { lockSeams: input.lockSeams }), profileId: profile.id });
+        results.push({
+          ...await operation(bound, {
+            lockSeams: input.lockSeams,
+            ...(options?.revalidateBeforeWrite
+              ? { revalidate: (frozen: IntegrationWriteInput) => options.revalidateBeforeWrite!(frozen) }
+              : {}),
+          }),
+          profileId: profile.id,
+        });
       } catch (error) { results.push(asideProfileFailure(profile.id, error)); }
     }
     const ok = results.every(result => result.ok);
diff --git a/src/integrations/mutation-plan.ts b/src/integrations/mutation-plan.ts
new file mode 100644
index 00000000000..20cc91c9f6a
--- /dev/null
+++ b/src/integrations/mutation-plan.ts
@@ -0,0 +1,815 @@
+/**
+ * Value-free planning for integration mutations.
+ *
+ * An operator confirming "apply", "overwrite", "disable" or "undo" is agreeing to consequences
+ * nobody has shown them. This module computes those consequences as bounded managed schema paths
+ * and closed change kinds, and binds them to a fingerprint over every input the decision rested
+ * on, so a confirmation can be refused when the state it described has moved.
+ *
+ * Two rules give the output its safety. Nothing here is a value: paths are structural, and a
+ * segment that is not representable in the managed grammar is dropped rather than echoed, because
+ * an ownership record on disk accepts arbitrary strings and is not a validation authority. And
+ * nothing here writes: this module owns no IO, takes no lock, and must never import the writer.
+ * The dependency direction is state/ownership/merge into here, and here into the writer and the
+ * preview route.
+ */
+import { createHash } from "node:crypto";
+import { canonicalContribution, fingerprint, type OwnershipRecord } from "./ownership";
+import { ClientPathError, EXPORT_CLIENTS, type ExportModel, type ManagedContribution } from "../clients/config-export";
+import { OPENCODE_PROVIDER_ID } from "../clients/config-export/constants";
+import { createClineIO, ClineTransactionError } from "./cline-io";
+import { parseClineDocument } from "./cline-document";
+import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { INTEGRATION_CLIENTS, isLoopbackOnly, resolveIntegrationPaths, type IntegrationClientId } from "./registry";
+import { shouldInjectApiAuthHeader } from "../codex/inject";
+import { classifyIntegration, exportContextOf, readPath, type IntegrationState, type StateReason } from "./state";
+import { createIntegrationStateStore, type IntegrationStateStore } from "./store";
+import type { OcxConfig } from "../types";
+import { matchesOperationResult, type JournalEntry } from "./journal";
+
+/**
+ * Why a mutation refused. Declared here rather than in the writer so the planner can report a
+ * refusal without depending on the module that performs writes; the writer re-exports it, so this
+ * is a move rather than a second vocabulary.
+ */
+export type RefusalReason =
+  | "not_installed"
+  | "conflict"
+  | "unsafe"
+  | "non_loopback"
+  | "drift_requires_confirm"
+  | "snapshot_expired"
+  | "write_failed";
+
+export type IntegrationPlanOperation = "apply" | "overwrite" | "disable" | "restore";
+export type IntegrationPlanChangeKind = "add" | "replace" | "remove" | "snapshot" | "ownership" | "journal";
+export type IntegrationPlanForeignEdit = "none" | "unowned" | "foreign-edit" | "drift";
+
+/**
+ * Effects that are not places in the client's document. They carry no disk location and no value,
+ * so an operator learns that history will be written without learning where it lives.
+ */
+export const PLAN_SNAPSHOT_PATH = "$snapshot";
+export const PLAN_OWNERSHIP_PATH = "$ownership";
+export const PLAN_JOURNAL_PATH = "$journal";
+
+/**
+ * Upper bound on reported changes. Above the largest contribution any registered client builds and
+ * well below a response worth truncating, so the cap is a guard rather than a routine limit.
+ */
+export const PLAN_CHANGE_LIMIT = 256;
+
+export interface IntegrationPlanChange {
+  readonly kind: IntegrationPlanChangeKind;
+  readonly path: string;
+}
+
+export interface IntegrationMutationPlan {
+  readonly version: 1;
+  readonly clientId: IntegrationClientId;
+  readonly operation: IntegrationPlanOperation;
+  readonly state: IntegrationState;
+  readonly foreignEdit: IntegrationPlanForeignEdit;
+  readonly changes: readonly IntegrationPlanChange[];
+  readonly fingerprint: string;
+  readonly canApply: boolean;
+  /**
+   * Whether confirming would write at all.
+   *
+   * An apply against an already-current file and a disable against an absent one both succeed
+   * while writing nothing, so reporting a snapshot and a journal row for them would describe
+   * consequences that never happen.
+   */
+  readonly willChange: boolean;
+  readonly refusalReason?: RefusalReason;
+  readonly profileId?: number;
+}
+
+/** A position whose observed value is never published, only its presence. */
+export const DYNAMIC_SEGMENT = "*";
+
+/**
+ * Where each client's managed fragments live, declared rather than inferred.
+ *
+ * A general "looks like a plain key" rule is not good enough, and Kimi is the proof: it writes one
+ * fragment per model at `models.<alias>`, so an alphanumeric allowlist would publish a user's
+ * model identifier verbatim. The same rule would accept any plain path sitting in an ownership
+ * record, and a record on disk is not a validation authority.
+ *
+ * So a path is published only when it matches one of these templates exactly. Static segments must
+ * match literally, a DYNAMIC_SEGMENT position accepts any observed segment, and the string that
+ * leaves this module is the TEMPLATE rather than the observed path. That is what makes publishing
+ * a value structurally impossible instead of merely unlikely.
+ *
+ * The satisfies clause makes a new client a type error here, so nobody can add one whose managed
+ * paths silently have no declaration.
+ */
+const CLIENT_MANAGED_PATHS = {
+  opencode: [["provider", OPENCODE_PROVIDER_ID], ["providers", OPENCODE_PROVIDER_ID]],
+  pi: [["providers", OPENCODE_PROVIDER_ID]],
+  omp: [["providers", OPENCODE_PROVIDER_ID]],
+  hermes: [["providers", OPENCODE_PROVIDER_ID]],
+  openclaw: [["models", "providers", OPENCODE_PROVIDER_ID]],
+  kimi: [["providers", OPENCODE_PROVIDER_ID], ["models", DYNAMIC_SEGMENT]],
+  gajae: [["providers", OPENCODE_PROVIDER_ID]],
+  dsh: [["llm-pi-ai", "providers", OPENCODE_PROVIDER_ID]],
+  mcode: [["custom_provider", OPENCODE_PROVIDER_ID]],
+  zcode: [["provider", OPENCODE_PROVIDER_ID]],
+  prime: [["providers", OPENCODE_PROVIDER_ID]],
+  aside: [["providers", OPENCODE_PROVIDER_ID]],
+  raycast: [["providers", `[id=${OPENCODE_PROVIDER_ID}]`]],
+  omo: [["providers", OPENCODE_PROVIDER_ID]],
+  cline: [
+    ["settings", "providers", OPENCODE_PROVIDER_ID],
+    ["catalog", "providers", OPENCODE_PROVIDER_ID],
+  ],
+} satisfies Record<IntegrationClientId, readonly (readonly string[])[]>;
+
+/** Not a configuration surface. Exported so a parity case can compare it against the shipped clients. */
+export const MANAGED_PATH_TEMPLATES: Readonly<Record<IntegrationClientId, readonly (readonly string[])[]>> = CLIENT_MANAGED_PATHS;
+
+function matchesTemplate(template: readonly string[], path: readonly string[]): boolean {
+  if (template.length !== path.length) return false;
+  return template.every((segment, index) => {
+    const observed = path[index];
+    if (observed === undefined || observed.length === 0) return false;
+    return segment === DYNAMIC_SEGMENT || segment === observed;
+  });
+}
+
+/**
+ * The managed schema path this change touches, or null when the path is outside the client's
+ * declared grammar.
+ *
+ * Null is not an error to work around. A path nobody declared is either a record written by a
+ * different version or something arbitrary, and neither is safe to name, so the caller reports the
+ * fixed ownership pseudo-path or a refusal instead of inventing a description.
+ */
+export function canonicalSchemaPath(clientId: IntegrationClientId, path: readonly string[]): string | null {
+  if (path.length === 0) return null;
+  for (const template of CLIENT_MANAGED_PATHS[clientId]) {
+    if (matchesTemplate(template, path)) return template.join(".");
+  }
+  return null;
+}
+
+const KIND_ORDER: readonly IntegrationPlanChangeKind[] = ["add", "replace", "remove", "snapshot", "ownership", "journal"];
+
+/**
+ * Deterministic, deduplicated and capped. Deterministic because the fingerprint is taken over this
+ * projection, so an unstable order would stale a plan that did not change.
+ */
+export function orderPlanChanges(changes: readonly IntegrationPlanChange[]): readonly IntegrationPlanChange[] {
+  const seen = new Set<string>();
+  const unique: IntegrationPlanChange[] = [];
+  for (const change of changes) {
+    const key = `${change.kind}\u0000${change.path}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(change);
+  }
+  unique.sort((left, right) => {
+    const byKind = KIND_ORDER.indexOf(left.kind) - KIND_ORDER.indexOf(right.kind);
+    if (byKind !== 0) return byKind;
+    return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+  });
+  return Object.freeze(unique.slice(0, PLAN_CHANGE_LIMIT));
+}
+
+/**
+ * Every input the plan's authority rests on.
+ *
+ * `models` is here because the desired contribution is derived from it, so a model roster that
+ * changed between preview and commit changes what would be written. `snapshot` carries a digest of
+ * the bytes a restore would actually publish rather than only the operation id, because the id
+ * names the row and the bytes are what lands in the user's file.
+ */
+export interface PlanFingerprintInput {
+  readonly operation: IntegrationPlanOperation;
+  readonly clientId: IntegrationClientId;
+  readonly profileId?: number;
+  readonly configPath: string;
+  readonly detectDir: string;
+  /**
+   * What the detect directory actually was when observed, not merely where it is.
+   *
+   * Binding only the path leaves a confirmation valid across an uninstall: the contribution is
+   * unchanged, so every other component matches, while the answer to "is this client installed"
+   * has flipped. The observed kind is the input the not_installed refusal is derived from.
+   */
+  readonly installKind: string;
+  /**
+   * Whether admission policy blocks this integration, which is the non_loopback refusal's input.
+   *
+   * Config eligibility can change without touching the file, the record or the contribution, so a
+   * plan that did not bind it could be confirmed after the proxy stopped being a legal target.
+   */
+  readonly admissionBlocked: boolean;
+  /** Exact current bytes, or null when the target is missing. Missing and empty are not equal. */
+  readonly before: string | null;
+  readonly contribution: ManagedContribution | null;
+  readonly record: OwnershipRecord | null;
+  readonly models: readonly ExportModel[];
+  readonly restore?: {
+    readonly opId: string;
+    readonly entry: JournalEntry;
+    readonly snapshotKind: string;
+    /** Digest of the snapshot's exact text, or null when it holds none. */
+    readonly snapshotText: string | null;
+    readonly confirmDrift: boolean;
+    /**
+     * Whether the target has changed since the operation being undone, which is the
+     * drift_requires_confirm predicate. Passed in rather than recomputed so the plan and the
+     * mutation read drift from the same comparison.
+     */
+    readonly driftsFromResult: boolean;
+  };
+}
+
+const PLAN_FINGERPRINT_VERSION = "p1";
+
+function digest(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+
+/**
+ * An opaque optimistic-concurrency token, not authorization.
+ *
+ * Longer than the 16-hex ownership fingerprint because this one is supplied by a caller and
+ * compared for equality, so accidental collision matters more than it does for a stored digest.
+ * The version prefix means a future input set invalidates old tokens instead of silently
+ * comparing two different meanings.
+ */
+export function planFingerprint(input: PlanFingerprintInput): string {
+  const restore = input.restore;
+  const components = [
+    PLAN_FINGERPRINT_VERSION,
+    input.operation,
+    input.clientId,
+    input.profileId === undefined ? null : input.profileId,
+    input.configPath,
+    input.detectDir,
+    input.installKind,
+    input.admissionBlocked,
+    input.before === null ? "\u0000absent" : fingerprint(input.before),
+    input.contribution === null ? null : fingerprint(canonicalContribution(input.contribution)),
+    input.record === null ? null : fingerprint(JSON.stringify(input.record)),
+    fingerprint(JSON.stringify(input.models)),
+    restore === undefined ? null : [
+      restore.opId,
+      fingerprint(JSON.stringify(restore.entry)),
+      restore.snapshotKind,
+      restore.snapshotText === null ? "\u0000none" : fingerprint(restore.snapshotText),
+      restore.confirmDrift,
+      restore.driftsFromResult,
+    ],
+  ];
+  return `${PLAN_FINGERPRINT_VERSION}:${digest(JSON.stringify(components))}`;
+}
+
+/** The observation facts a plan is derived from, beside the fingerprint inputs. */
+export interface PlanInput extends PlanFingerprintInput {
+  readonly classified: { readonly state: IntegrationState; readonly reason?: StateReason };
+  /**
+   * The parsed target document. Whether a managed place is occupied is a fact about the file, not
+   * about our record: an overwrite of a key somebody else wrote replaces a value even though no
+   * record of ours mentions it.
+   */
+  readonly parsed: unknown;
+}
+
+type PlanOutcome =
+  | { readonly kind: "refuse"; readonly reason: RefusalReason }
+  | { readonly kind: "noop" }
+  | { readonly kind: "change" };
+
+const CHANGE: PlanOutcome = { kind: "change" };
+const NOOP: PlanOutcome = { kind: "noop" };
+const deny = (reason: RefusalReason): PlanOutcome => ({ kind: "refuse", reason });
+
+function foreignEditOf(input: PlanInput): IntegrationPlanForeignEdit {
+  if (input.restore?.driftsFromResult) return "drift";
+  if (input.classified.reason === "unowned-key") return "unowned";
+  if (input.classified.reason === "foreign-edit") return "foreign-edit";
+  return "none";
+}
+
+/**
+ * Why this operation would refuse, in the writer's own order.
+ *
+ * The order is not cosmetic. An uninstalled client is reported as not installed rather than as
+ * whatever its leftover file happens to classify as, and an unreadable or unparseable file is
+ * reported before either, because that is the sequence the writer itself refuses in. A plan that
+ * named a different reason than the mutation would name is worse than no plan.
+ */
+function applyOutcome(input: PlanInput): PlanOutcome {
+  if (input.installKind !== "dir") return deny("not_installed");
+  if (input.admissionBlocked) return deny("non_loopback");
+  // Overwrite exists precisely to proceed through a conflict the operator has been shown.
+  if (input.classified.state === "conflict" && input.operation !== "overwrite") return deny("conflict");
+  if (input.classified.state === "unsafe") return deny("unsafe");
+  if (input.classified.state === "current") return NOOP;
+  return CHANGE;
+}
+
+/**
+ * Disable answers a different question, so it asks different ones.
+ *
+ * It never checks installation or admission: removing what we wrote from a file that still exists
+ * is meaningful whether or not the client is installed now, and it emits nothing that admission
+ * policy could object to. An absent block is a success that writes nothing rather than a refusal.
+ */
+function disableOutcome(input: PlanInput): PlanOutcome {
+  if (input.classified.state === "absent") return NOOP;
+  if (input.classified.state === "conflict") return deny("conflict");
+  if (input.classified.state === "unsafe") return deny("unsafe");
+  return CHANGE;
+}
+
+function restoreOutcome(input: PlanInput): PlanOutcome {
+  if (input.restore === undefined) return deny("unsafe");
+  if (input.restore.snapshotKind === "expired") return deny("snapshot_expired");
+  if (input.restore.driftsFromResult && !input.restore.confirmDrift) return deny("drift_requires_confirm");
+  return CHANGE;
+}
+
+/**
+ * What this operation would do, decided the way the operation itself decides it.
+ *
+ * Applying one global sequence to all four was wrong: it reported disable as refused on an
+ * uninstalled client the writer would have accepted, and it ranked the classifier's unsafe ahead
+ * of a conflict that apply reports first. A plan is only useful if it reaches the same verdict,
+ * for the same reason, as the mutation it describes.
+ */
+function outcomeOf(input: PlanInput): PlanOutcome {
+  if (input.operation === "restore") return restoreOutcome(input);
+  if (input.operation === "disable") return disableOutcome(input);
+  return applyOutcome(input);
+}
+
+
+/**
+ * The managed places this operation would touch, plus the history it would write.
+ *
+ * A path that does not canonicalize is omitted rather than guessed at. For a shipped client that
+ * cannot happen, and the parity case proves it; what it does cover is a record written by another
+ * version, where declining to describe a path is the honest answer and the fixed ownership entry
+ * still tells the operator that ownership changes.
+ */
+function changesOf(input: PlanInput): readonly IntegrationPlanChange[] {
+  const changes: IntegrationPlanChange[] = [];
+  if (input.operation === "apply" || input.operation === "overwrite") {
+    for (const fragment of input.contribution?.fragments ?? []) {
+      const path = canonicalSchemaPath(input.clientId, fragment.path);
+      if (path === null) continue;
+      // Occupied is a fact about the document. Deciding from our own record instead would call an
+      // overwrite of somebody else's key an addition, which is the one case overwrite exists for.
+      const occupied = readPath(input.parsed, fragment.path) !== undefined;
+      changes.push({ kind: occupied ? "replace" : "add", path });
+    }
+  }
+  if (input.operation === "disable") {
+    for (const owned of input.record?.fragmentPaths ?? []) {
+      const path = canonicalSchemaPath(input.clientId, owned);
+      if (path === null) continue;
+      changes.push({ kind: "remove", path });
+    }
+  }
+  if (input.operation === "restore") {
+    /*
+     * An undo replaces the whole document, so what it changes is the difference between the
+     * places that are ours now and the places the row recorded as ours before that operation ran.
+     *
+     * Reading only the prior record got both common undos wrong. Undoing an initial apply has no
+     * prior record, so the plan described a change to nothing at all while the undo removed the
+     * managed block. Undoing a disable has a prior record and an empty document, so the plan said
+     * it would replace paths the file does not currently have.
+     *
+     * Provenance is still restored rather than re-derived: the prior record is what says which
+     * places are ours afterwards. The document only answers whether each of them is there now.
+     */
+    const prior = new Map<string, readonly string[]>();
+    for (const fragment of input.restore?.entry.priorRecord?.fragmentPaths ?? []) {
+      const path = canonicalSchemaPath(input.clientId, fragment);
+      if (path !== null) prior.set(path, fragment);
+    }
+    /*
+     * A document we could not read says nothing about whether a place is there, and restore does
+     * not need it read: eligibility is a question about bytes. Where it cannot be read, each place
+     * is reported as a replacement, which is what this list said before any of it was derived.
+     */
+    const documentKnown = input.parsed !== PARSE_FAILED;
+    for (const [path, fragment] of prior) {
+      const absent = documentKnown && readPath(input.parsed, fragment) === undefined;
+      changes.push({ kind: absent ? "add" : "replace", path });
+    }
+    for (const fragment of input.record?.fragmentPaths ?? []) {
+      const path = canonicalSchemaPath(input.clientId, fragment);
+      if (path === null || prior.has(path)) continue;
+      changes.push({ kind: "remove", path });
+    }
+  }
+  changes.push({ kind: "snapshot", path: PLAN_SNAPSHOT_PATH });
+  changes.push({ kind: "ownership", path: PLAN_OWNERSHIP_PATH });
+  changes.push({ kind: "journal", path: PLAN_JOURNAL_PATH });
+  return orderPlanChanges(changes);
+}
+
+/**
+ * The whole plan, value-free.
+ *
+ * A refused plan is still worth returning: knowing that undo is blocked because the backup expired
+ * is the answer an operator needs, and it carries no more detail than an allowed one.
+ */
+export function buildMutationPlan(input: PlanInput): IntegrationMutationPlan {
+  const outcome = outcomeOf(input);
+  return Object.freeze({
+    version: 1 as const,
+    clientId: input.clientId,
+    operation: input.operation,
+    state: input.classified.state,
+    foreignEdit: foreignEditOf(input),
+    // Only a plan that would actually write describes places to write.
+    changes: outcome.kind === "change" ? changesOf(input) : Object.freeze([]),
+    fingerprint: planFingerprint(input),
+    canApply: outcome.kind !== "refuse",
+    willChange: outcome.kind === "change",
+    ...(outcome.kind === "refuse" ? { refusalReason: outcome.reason } : {}),
+    ...(input.profileId === undefined ? {} : { profileId: input.profileId }),
+  });
+}
+
+/**
+ * The token a plan carries when observation itself refused.
+ *
+ * Such a plan never read the state it would have bound, so there is nothing to bind. It is safe
+ * for every one of them to share this value because `canApply` is false, and a mutation may only
+ * be bound to a plan that could apply.
+ */
+export const PLAN_UNBOUND_FINGERPRINT = `${PLAN_FINGERPRINT_VERSION}:unbound`;
+
+function unboundPlan(
+  clientId: IntegrationClientId,
+  operation: IntegrationPlanOperation,
+  failure: IntegrationObservationFailure,
+  profileId?: number,
+): IntegrationMutationPlan {
+  return Object.freeze({
+    version: 1 as const,
+    clientId,
+    operation,
+    state: failure.state,
+    foreignEdit: "none" as const,
+    changes: Object.freeze([]),
+    fingerprint: PLAN_UNBOUND_FINGERPRINT,
+    canApply: false,
+    willChange: false,
+    refusalReason: failure.reason,
+    ...(profileId === undefined ? {} : { profileId }),
+  });
+}
+
+/**
+ * Restore reads a different specification, so it gets its own observation.
+ *
+ * The writer's undo path never parses and never classifies: it compares the resolved config path
+ * against the one the journal row was recorded for, reads the snapshot, and reads the target's
+ * BYTES. Routing a preview through the general observation therefore refused an undo of a file
+ * that was readable but unparseable, which is the state that most needs restoring, and accepted a
+ * row recorded against a previous home, which is the single case path equality exists to refuse.
+ */
+export function observeRestore(
+  input: IntegrationWriteInput,
+  opId: string,
+  effects: ObservationEffects,
+  /**
+   * The row a caller already selected, with the store it came from.
+   *
+   * Aside can hold more than one valid copy of the same operation, so re-resolving here could
+   * legitimately pick a different row than the mutation will. The plan would then describe an
+   * operation the confirmation was never about. A caller that has resolved one passes it in, and
+   * neither side resolves again.
+   */
+  selectedOperation?: { entry: JournalEntry; store: IntegrationStateStore },
+) {
+  const store = selectedOperation?.store ?? input.store ?? createIntegrationStateStore();
+  let io = input.io ?? defaultIntegrationIO(store);
+  const clientId = input.clientId;
+  let resolved: { configPath: string; detectDir: string };
+  try {
+    resolved = input.resolvedPaths ?? resolveIntegrationPaths(clientId, input.env, input.home);
+  } catch (error) {
+    if (!(error instanceof ClientPathError)) throw error;
+    return { failed: observationFailure("unsafe", "unsafe", error.message) } as const;
+  }
+  // Coordinated restore refuses this before it looks at the row at all: an undo will not create
+  // the client's home, so a writer-lock client without one has nothing to restore into.
+  if (INTEGRATION_CLIENTS[clientId].writerLock && io.statKind(resolved.detectDir) !== "dir") {
+    return {
+      failed: observationFailure("unsafe", "unsafe", "the client home is missing; restore will not create it"),
+    } as const;
+  }
+  const entry = selectedOperation?.entry ?? store.findOperation(opId);
+  if (!entry || entry.clientId !== clientId) {
+    return { failed: observationFailure("unsafe", "unsafe", "that operation cannot be undone") } as const;
+  }
+  const configPath = entry.configPath;
+  // An undo acts on the path the operation was journaled against. A row recorded for one home must
+  // never be allowed to rewrite a file in another.
+  if (resolved.configPath !== configPath) {
+    return {
+      failed: observationFailure("conflict", "conflict", "that operation was recorded for a different location"),
+    } as const;
+  }
+  if (clientId === "cline") {
+    try { io = createClineIO(io, configPath, store, effects.recover); }
+    catch (error) {
+      if (!(error instanceof ClineTransactionError)) throw error;
+      return { failed: { ...observationFailure("unsafe", "unsafe", error.message, error.snapshotPath), residual: true } } as const;
+    }
+  }
+  const snapshot = store.readSnapshot(entry);
+  /*
+   * Expiry is decided before the target is read, exactly as the writer decides it. Reading first
+   * let an expired backup over an unreadable file report the file as the problem, when the answer
+   * the operator needs is that the backup is gone.
+   */
+  if (snapshot.kind === "expired") {
+    return { failed: observationFailure("snapshot_expired", "absent", "that backup has expired") } as const;
+  }
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return { failed: observationFailure("unsafe", "unsafe", "the target cannot be read safely") } as const;
+  }
+  const before = target.before;
+  return {
+    failed: undefined,
+    clientId,
+    configPath,
+    detectDir: resolved.detectDir,
+    installKind: io.statKind(resolved.detectDir),
+    entry,
+    snapshotKind: snapshot.kind,
+    snapshotText: snapshot.kind === "stored" ? snapshot.text : null,
+    before,
+    // Bytes only. Parsing here is exactly what must not happen.
+    driftsFromResult: !matchesOperationResult(entry, before),
+  } as const;
+}
+
+export interface PreviewRequest {
+  readonly operation: IntegrationPlanOperation;
+  /** Required for restore; names the journalled operation being undone. */
+  readonly opId?: string;
+  readonly confirmDrift?: boolean;
+  readonly profileId?: number;
+  /** A row and store the caller already selected, so neither side resolves it twice. */
+  readonly resolved?: { entry: JournalEntry; store: IntegrationStateStore };
+}
+
+/**
+ * Plan an operation without performing it.
+ *
+ * Observation runs with both write-capable effects off, so this path prunes nothing, recovers
+ * nothing, takes no lock and enters no mutation flight. Everything it reads is a read: the target
+ * file, the ownership records, and for restore the journal row and its snapshot.
+ */
+export function previewIntegration(input: IntegrationWriteInput, request: PreviewRequest): IntegrationMutationPlan {
+  // Restore never reaches the general observation, because the writer's undo path never parses
+  // or classifies and a preview that did would answer a different question.
+  if (request.operation === "restore") return previewRestore(input, request);
+  const observed = observeIntegration(input, { maintenance: false, recover: false });
+  if (observed.failed) return unboundPlan(input.clientId, request.operation, observed.failed, request.profileId);
+
+  const shared = {
+    operation: request.operation,
+    clientId: observed.clientId,
+    configPath: observed.configPath,
+    detectDir: observed.detectDir,
+    installKind: observed.io.statKind(observed.detectDir),
+    // Loopback-only clients cannot carry the admission header a non-loopback bind requires.
+    admissionBlocked: isLoopbackOnly(observed.clientId) && shouldInjectApiAuthHeader(input.config),
+    before: observed.before,
+    contribution: observed.contribution,
+    record: observed.record,
+    models: input.models,
+    classified: observed.classified,
+    parsed: observed.parsed,
+    ...(request.profileId === undefined ? {} : { profileId: request.profileId }),
+  };
+
+  return buildMutationPlan(shared);
+}
+
+/**
+ * Which places are ours in the file this undo would rewrite, read the same way the general
+ * observation reads them.
+ *
+ * Read from the store bound to the target being rewritten, never from the store a historical row
+ * was selected out of. Aside keeps a copy of an operation in the root store while the profile's
+ * own store holds the ownership for its file, so asking the selected row's store would have
+ * described the wrong file's ownership. The selected store stays what it is for: the row and its
+ * snapshot. A record written for another location grants nothing here either, which is the same
+ * rule the writer applies.
+ */
+function currentRecordFor(
+  input: IntegrationWriteInput,
+  clientId: IntegrationClientId,
+  configPath: string,
+): OwnershipRecord | null {
+  const store = input.store ?? createIntegrationStateStore();
+  const stored = store.readRecords()[clientId] ?? null;
+  return stored && stored.clientId === clientId && stored.configPath === configPath ? stored : null;
+}
+
+/**
+ * Plan an undo the way the writer performs one.
+ *
+ * State is derived from bytes alone: a missing target is absent, a target that no longer matches
+ * the row's recorded result is a conflict, and anything else is current. Admission is not asked
+ * about, because restore emits nothing an admission policy could object to and the writer does not
+ * ask either.
+ */
+function previewRestore(input: IntegrationWriteInput, request: PreviewRequest): IntegrationMutationPlan {
+  const refusal = (message: string): IntegrationMutationPlan =>
+    unboundPlan(input.clientId, "restore", { reason: "unsafe", state: "unsafe", message }, request.profileId);
+  if (request.opId === undefined) return refusal("that operation cannot be undone");
+
+  const observed = observeRestore(
+    input,
+    request.opId,
+    { maintenance: false, recover: false },
+    request.resolved,
+  );
+  if (observed.failed) return unboundPlan(input.clientId, "restore", observed.failed, request.profileId);
+
+  /*
+   * Drift decides first. A row that recorded a file and now finds none has drifted, and calling
+   * that absent would report a missing file as an ordinary undo while the writer refuses it
+   * pending confirmation. Absent is only honest when the recorded result was absence too.
+   */
+  const state: IntegrationState = observed.driftsFromResult
+    ? "conflict"
+    : observed.before === null ? "absent" : "current";
+
+  return buildMutationPlan({
+    operation: "restore",
+    clientId: observed.clientId,
+    configPath: observed.configPath,
+    detectDir: observed.detectDir,
+    installKind: observed.installKind,
+    admissionBlocked: false,
+    before: observed.before,
+    contribution: null,
+    // Descriptive, never decisive. The record says which places are ours now and the document
+    // says which of them the file holds, so the change list can distinguish a place this undo
+    // adds back from one it replaces and one it takes away. Neither is allowed to refuse: an
+    // unreadable document is reported as PARSE_FAILED and leaves every place a replacement, and
+    // restore eligibility stays the byte comparison it was.
+    record: currentRecordFor(input, observed.clientId, observed.configPath),
+    models: input.models,
+    classified: { state },
+    parsed: observed.before === null
+      ? {}
+      : observed.clientId === "cline"
+        ? parseClineDocument(observed.before)
+        : parseConfig(observed.before, EXPORT_CLIENTS[observed.clientId].format),
+    restore: {
+      opId: observed.entry.opId,
+      entry: observed.entry,
+      snapshotKind: observed.snapshotKind,
+      snapshotText: observed.snapshotText,
+      confirmDrift: request.confirmDrift === true,
+      driftsFromResult: observed.driftsFromResult,
+    },
+    ...(request.profileId === undefined ? {} : { profileId: request.profileId }),
+  });
+}
+
+/**
+ * What a mutation is asked to do. Declared here because the observation below consumes it and the
+ * planner must not depend on the writer; the writer re-exports it, so callers are unaffected.
+ */
+export interface IntegrationWriteInput {
+  clientId: IntegrationClientId;
+  models: readonly ExportModel[];
+  config: OcxConfig;
+  port: number;
+  env?: NodeJS.ProcessEnv;
+  home?: string;
+  store?: IntegrationStateStore;
+  io?: IntegrationIO;
+  /** Frozen once by the async coordinator; synchronous callers may omit it. */
+  resolvedPaths?: { configPath: string; detectDir: string };
+}
+
+/** A refusal in the planner's own vocabulary, so observation does not depend on the writer's result type. */
+export interface IntegrationObservationFailure {
+  readonly reason: RefusalReason;
+  readonly state: IntegrationState;
+  readonly message: string;
+  readonly snapshotPath?: string;
+  /** A Cline transaction left residue that only a mutation may clear. */
+  readonly residual?: boolean;
+}
+
+function observationFailure(
+  reason: RefusalReason,
+  state: IntegrationState,
+  message: string,
+  snapshotPath?: string,
+): IntegrationObservationFailure {
+  return { reason, state, message, ...(snapshotPath ? { snapshotPath } : {}) };
+}
+
+/**
+ * What preview and mutation are allowed to touch while looking.
+ *
+ * Both are false for a preview and both are true for a mutation, and neither defaults, because the
+ * difference is the whole safety argument. `maintenance` runs pending snapshot pruning, which
+ * writes; `recover` lets the Cline adapter repair a pending transaction, which also writes. A
+ * preview that quietly inherited either would be a mutation wearing a read's name.
+ */
+export interface ObservationEffects {
+  readonly maintenance: boolean;
+  readonly recover: boolean;
+}
+
+/**
+ * Detect, gate, read, parse and classify, once, for both preview and mutation.
+ *
+ * Extracted from the writer so a plan and the mutation it authorizes rest on the same
+ * classification rather than two independent reads that can disagree. The ordering of refusals is
+ * load-bearing and is preserved exactly as the writer had it.
+ */
+export function observeIntegration(input: IntegrationWriteInput, effects: ObservationEffects) {
+  const store = input.store ?? createIntegrationStateStore();
+  let io = input.io ?? defaultIntegrationIO(store);
+  const clientId = input.clientId;
+  const spec = INTEGRATION_CLIENTS[clientId];
+  const exportSpec = EXPORT_CLIENTS[clientId];
+  /*
+   * Resolution itself can refuse: a relative OPENCLAW_* selector is rejected
+   * because we cannot know the gateway's working directory. That is a refusal
+   * about the user's configuration, not an internal fault, so it must not
+   * escape as an exception — the collection route would answer 500 for the
+   * whole Integrations page because one client is misconfigured.
+   */
+  let configPath: string;
+  let detectDir: string;
+  try {
+    /*
+     * Resolve the PAIR, never one half.
+     *
+     * The coordinated path hands us a frozen pair, but applyIntegration,
+     * refreshIntegration and disableIntegration are public and may be called
+     * without one. Resolving configPath here and detectDir separately later let
+     * an Aside account switch land between the two, so a direct apply could
+     * verify account 1 was installed and then write account 0's catalog.
+     */
+    const resolved = input.resolvedPaths ?? resolveIntegrationPaths(clientId, input.env, input.home);
+    configPath = resolved.configPath;
+    detectDir = resolved.detectDir;
+    if (clientId === "cline") io = createClineIO(io, configPath, store, effects.recover);
+  } catch (error) {
+    if (error instanceof ClineTransactionError) {
+      return { failed: { ...observationFailure("unsafe", "unsafe", error.message, error.snapshotPath), residual: true } } as const;
+    }
+    if (!(error instanceof ClientPathError)) throw error;
+    return { failed: observationFailure("unsafe", "unsafe", error.message) } as const;
+  }
+  // Pruning writes, so only a mutation may perform it. Preview reports the state it finds.
+  if (effects.maintenance) store.retryPendingPrunes();
+
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return {
+      failed: observationFailure("unsafe", "unsafe",
+        target.why === "read-failed"
+          ? `${configPath} exists but could not be read`
+          : `${configPath} is not a regular file`),
+    } as const;
+  }
+  const before = target.before;
+  const parsed = clientId === "cline" ? parseClineDocument(before) : parseConfig(before, exportSpec.format);
+  if (parsed === PARSE_FAILED) {
+    return { failed: observationFailure("unsafe", "unsafe",
+      `${configPath} could not be parsed, or holds something opencodex cannot rewrite without changing it (a non-finite number, a large integer or a tiny one a rewrite would round, -0, a duplicate member, or nesting deeper than 1000 levels)`) } as const;
+  }
+  const contribution = exportSpec.buildContribution(exportContextOf(input));
+  // A record proves ownership of the file it was written FOR. Matching only by
+  // client id let a record for one home authorize a write to another whose
+  // bytes happened to hash the same — which deleted a config we never touched.
+  const stored = store.readRecords()[clientId] ?? null;
+  const record = stored && stored.clientId === clientId && stored.configPath === configPath
+    ? stored
+    : null;
+  // `configPath`/`clientId` are load-bearing, not decoration: a record proves
+  // ownership of ONE file, and the writer mutates whatever path resolves NOW.
+  // Without them a record written for another home directory would grant
+  // ownership here and disable would delete fragments it never wrote.
+  const classified = classifyIntegration({
+    fileText: before, fileIsRegular: true, parsed, record, contribution, configPath, clientId,
+  });
+  return { failed: undefined, store, io, clientId, spec, exportSpec, configPath, detectDir, before, parsed, contribution, record, classified } as const;
+}
diff --git a/src/integrations/writer.ts b/src/integrations/writer.ts
index 0bac4da13a7..fa783c37057 100644
--- a/src/integrations/writer.ts
+++ b/src/integrations/writer.ts
@@ -11,12 +11,14 @@
  */
 import { homedir } from "node:os";
 import { createClineIO, ClineTransactionError } from "./cline-io";
-import { parseClineDocument, serializeClineDocument, preserveClineSelection } from "./cline-document";
+import { serializeClineDocument, preserveClineSelection } from "./cline-document";
 import { dirname } from "node:path";
 import { EXPORT_CLIENTS, type ExportModel, type ManagedContribution } from "../clients/config-export";
 import { shouldInjectApiAuthHeader } from "../codex/inject";
+import { detachedConfigSnapshot } from "../config/admitted-identity";
+import { copyPlainData } from "../lib/plain-data";
 import type { OcxConfig } from "../types";
-import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { defaultIntegrationIO, loadTarget, type IntegrationIO } from "./config-io";
 import {
   fingerprint,
   canonicalContribution,
@@ -31,11 +33,12 @@ import {
 } from "./ownership-policy";
 import { AmbiguousSelectorError, createdContainerPaths, mergeContribution, removeFragments } from "./merge";
 import { INTEGRATION_CLIENTS, isLoopbackOnly, resolveIntegrationPaths, type IntegrationClientId } from "./registry";
-import { classifyIntegration, exportContextOf } from "./state";
+import { exportContextOf } from "./state";
 import type { IntegrationState } from "./state";
 import { serializeDocument, UnserializableValueError } from "./serialize";
 import { ClientPathError } from "../clients/config-export";
 import { matchesOperationResult, newOpId, type JournalEntry } from "./journal";
+import { observeIntegration, type IntegrationWriteInput, type RefusalReason } from "./mutation-plan";
 import { createIntegrationStateStore, type IntegrationStateStore } from "./store";
 import {
   patchYamlFragmentSource,
@@ -62,14 +65,12 @@ function yamlRefusalReason(
 }
 import { withIntegrationWriterLock, type IntegrationWriterLockSeams } from "./writer-lock";
 
-export type RefusalReason =
-  | "not_installed"
-  | "conflict"
-  | "unsafe"
-  | "non_loopback"
-  | "drift_requires_confirm"
-  | "snapshot_expired"
-  | "write_failed";
+/**
+ * Owned by the planner so a plan can report a refusal without depending on the writer, and
+ * re-exported here because this module was its original home and every caller imports it from
+ * the writer.
+ */
+export type { IntegrationWriteInput, RefusalReason };
 
 export interface WriteOk {
   ok: true;
@@ -94,19 +95,6 @@ export interface WriteRefused {
 
 export type WriteOutcome = WriteOk | WriteRefused;
 
-export interface IntegrationWriteInput {
-  clientId: IntegrationClientId;
-  models: readonly ExportModel[];
-  config: OcxConfig;
-  port: number;
-  env?: NodeJS.ProcessEnv;
-  home?: string;
-  store?: IntegrationStateStore;
-  io?: IntegrationIO;
-  /** Frozen once by the async coordinator; synchronous callers may omit it. */
-  resolvedPaths?: { configPath: string; detectDir: string };
-}
-
 export interface IntegrationRestoreInput extends IntegrationWriteInput {
   opId: string;
   confirmDrift?: boolean;
@@ -227,76 +215,20 @@ function sourcePreservingFragmentValue(
   return fragment?.value;
 }
 
-/** Shared preflight: detect, gate, read, parse and classify. */
+/**
+ * Mutation's view of the shared observation.
+ *
+ * The read, parse and classify live in the planner so a preview and the mutation it authorizes
+ * cannot disagree. Mutation keeps the effects a preview must not have: pending-prune maintenance
+ * and Cline transaction recovery both write. Translating the planner's refusal into WriteRefused
+ * here keeps the planner free of any dependency on this module's result type.
+ */
 function preflight(input: IntegrationWriteInput) {
-  const store = input.store ?? createIntegrationStateStore();
-  let io = input.io ?? defaultIntegrationIO(store);
-  const clientId = input.clientId;
-  const spec = INTEGRATION_CLIENTS[clientId];
-  const exportSpec = EXPORT_CLIENTS[clientId];
-  /*
-   * Resolution itself can refuse: a relative OPENCLAW_* selector is rejected
-   * because we cannot know the gateway's working directory. That is a refusal
-   * about the user's configuration, not an internal fault, so it must not
-   * escape as an exception — the collection route would answer 500 for the
-   * whole Integrations page because one client is misconfigured.
-   */
-  let configPath: string;
-  let detectDir: string;
-  try {
-    /*
-     * Resolve the PAIR, never one half.
-     *
-     * The coordinated path hands us a frozen pair, but applyIntegration,
-     * refreshIntegration and disableIntegration are public and may be called
-     * without one. Resolving configPath here and detectDir separately later let
-     * an Aside account switch land between the two, so a direct apply could
-     * verify account 1 was installed and then write account 0's catalog.
-     */
-    const resolved = input.resolvedPaths ?? resolveIntegrationPaths(clientId, input.env, input.home);
-    configPath = resolved.configPath;
-    detectDir = resolved.detectDir;
-    if (clientId === "cline") io = createClineIO(io, configPath, store, true);
-  } catch (error) {
-    if (error instanceof ClineTransactionError) {
-      return { failed: { ...refuse(clientId, "unsafe", "unsafe", error.message, error.snapshotPath), residual: true } } as const;
-    }
-    if (!(error instanceof ClientPathError)) throw error;
-    return { failed: refuse(clientId, "unsafe", "unsafe", error.message) } as const;
-  }
-  store.retryPendingPrunes();
-
-  const target = loadTarget(io, configPath);
-  if (!target.ok) {
-    return {
-      failed: refuse(clientId, "unsafe", "unsafe",
-        target.why === "read-failed"
-          ? `${configPath} exists but could not be read`
-          : `${configPath} is not a regular file`),
-    } as const;
-  }
-  const before = target.before;
-  const parsed = clientId === "cline" ? parseClineDocument(before) : parseConfig(before, exportSpec.format);
-  if (parsed === PARSE_FAILED) {
-    return { failed: refuse(clientId, "unsafe", "unsafe",
-      `${configPath} could not be parsed, or holds something opencodex cannot rewrite without changing it (a non-finite number, a large integer or a tiny one a rewrite would round, -0, a duplicate member, or nesting deeper than 1000 levels)`) } as const;
-  }
-  const contribution = exportSpec.buildContribution(exportContextOf(input));
-  // A record proves ownership of the file it was written FOR. Matching only by
-  // client id let a record for one home authorize a write to another whose
-  // bytes happened to hash the same — which deleted a config we never touched.
-  const stored = store.readRecords()[clientId] ?? null;
-  const record = stored && stored.clientId === clientId && stored.configPath === configPath
-    ? stored
-    : null;
-  // `configPath`/`clientId` are load-bearing, not decoration: a record proves
-  // ownership of ONE file, and the writer mutates whatever path resolves NOW.
-  // Without them a record written for another home directory would grant
-  // ownership here and disable would delete fragments it never wrote.
-  const classified = classifyIntegration({
-    fileText: before, fileIsRegular: true, parsed, record, contribution, configPath, clientId,
-  });
-  return { failed: undefined, store, io, clientId, spec, exportSpec, configPath, detectDir, before, parsed, contribution, record, classified } as const;
+  const observed = observeIntegration(input, { maintenance: true, recover: true });
+  if (!observed.failed) return observed;
+  const { reason, state, message, snapshotPath, residual } = observed.failed;
+  const refused = refuse(input.clientId, reason, state, message, snapshotPath);
+  return { failed: residual ? { ...refused, residual: true } : refused } as const;
 }
 
 /**
@@ -748,6 +680,15 @@ export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome
 
 export interface CoordinatedIntegrationOptions {
   lockSeams?: IntegrationWriterLockSeams;
+  /**
+   * Checked after the input is frozen and the writer lock is held, before any side effect.
+   *
+   * A confirmation is a statement about state the operator was shown. Checking it out here, where
+   * the lock already excludes cooperating writers, is what makes it a decision about the same
+   * state the mutation is about to change rather than about state from a moment earlier. A
+   * non-null result refuses without writing anything.
+   */
+  revalidate?: (frozen: IntegrationWriteInput) => Promise<WriteOutcome | null>;
 }
 
 /** Freeze all mutable resolution seams before the first lock await. */
@@ -759,6 +700,16 @@ type FrozenIntegrationInput = IntegrationWriteInput & {
   resolvedPaths: { configPath: string; detectDir: string };
 };
 
+/**
+ * An input this write cannot hold still.
+ *
+ * A coordinated write checks a plan and then writes a document from the same input, with an await
+ * in between. Anything it cannot copy would have to be read from the caller's object twice, and
+ * the second read is not the one that was checked. Refusing is bounded and says so; carrying the
+ * reference and calling it a frozen input would not be.
+ */
+class UncopyableIntegrationInputError extends Error {}
+
 function freezeIntegrationInput(input: IntegrationWriteInput): FrozenIntegrationInput {
   const env = { ...(input.env ?? process.env) };
   const home = input.home ?? homedir();
@@ -773,7 +724,23 @@ function freezeIntegrationInput(input: IntegrationWriteInput): FrozenIntegration
   const resolvedPaths = input.resolvedPaths
     ? { ...input.resolvedPaths }
     : resolveIntegrationPaths(input.clientId, env, home);
-  return { ...input, env, home, store, io, resolvedPaths };
+  /*
+   * The configuration and the roster are seams like the others, and they were the two still held
+   * by reference. A coordinated write plans from this input, awaits the writer lock and a
+   * revalidation, and only then serializes the document from it. A management route editing the
+   * live configuration, or a caller editing the model objects it passed in, would have been
+   * checked in one state and written from another, which is the substitution the fingerprint
+   * exists to prevent. Copying both here gives the plan and the document one input.
+   */
+  const config = detachedConfigSnapshot(input.config);
+  if (config === null) {
+    throw new UncopyableIntegrationInputError("the proxy configuration could not be captured for this write");
+  }
+  const models = copyPlainData(input.models);
+  if (!models.ok) {
+    throw new UncopyableIntegrationInputError("the model roster could not be captured for this write");
+  }
+  return { ...input, config, models: models.value, env, home, store, io, resolvedPaths };
 }
 
 function tryFreezeIntegrationInput(input: IntegrationWriteInput):
@@ -782,6 +749,9 @@ function tryFreezeIntegrationInput(input: IntegrationWriteInput):
   try {
     return { ok: true, value: freezeIntegrationInput(input) };
   } catch (error) {
+    if (error instanceof UncopyableIntegrationInputError) {
+      return { ok: false, refusal: refuse(input.clientId, "unsafe", "unsafe", error.message) };
+    }
     if (!(error instanceof ClientPathError)) throw error;
     return {
       ok: false,
@@ -799,15 +769,22 @@ async function coordinatedWrite(
   if (!prepared.ok) return prepared.refusal;
   const frozen = prepared.value;
   const spec = INTEGRATION_CLIENTS[frozen.clientId];
-  if (!spec.writerLock) return operation(frozen);
+  if (!spec.writerLock) {
+    const refused = await options?.revalidate?.(frozen);
+    return refused ?? operation(frozen);
+  }
 
   // An absent client home is not created merely to acquire a sibling lock.
   if (frozen.io.statKind(frozen.resolvedPaths.detectDir) !== "dir") {
-    return operation(frozen);
+    const refused = await options?.revalidate?.(frozen);
+    return refused ?? operation(frozen);
   }
   return withIntegrationWriterLock(
     frozen.resolvedPaths.configPath,
-    async () => operation(frozen),
+    async () => {
+      const refused = await options?.revalidate?.(frozen);
+      return refused ?? operation(frozen);
+    },
     options?.lockSeams,
     spec.writerLock.suffix,
   );
@@ -849,7 +826,11 @@ export async function restoreIntegrationCoordinated(
   if (!prepared.ok) return prepared.refusal;
   const frozen = prepared.value;
   const spec = INTEGRATION_CLIENTS[frozen.clientId];
-  if (!spec.writerLock) return restoreIntegration({ ...frozen, opId: input.opId, confirmDrift: input.confirmDrift });
+  const run = () => restoreIntegration({ ...frozen, opId: input.opId, confirmDrift: input.confirmDrift });
+  if (!spec.writerLock) {
+    const refused = await options?.revalidate?.(frozen);
+    return refused ?? run();
+  }
   if (frozen.io.statKind(frozen.resolvedPaths.detectDir) !== "dir") {
     return refuse(
       frozen.clientId,
@@ -860,7 +841,12 @@ export async function restoreIntegrationCoordinated(
   }
   return withIntegrationWriterLock(
     frozen.resolvedPaths.configPath,
-    async () => restoreIntegration({ ...frozen, opId: input.opId, confirmDrift: input.confirmDrift }),
+    async () => {
+      // An undo is bound like any other confirmation, and this is the only place where that check
+      // happens with the lock held and before the snapshot, the write and the journal row.
+      const refused = await options?.revalidate?.(frozen);
+      return refused ?? run();
+    },
     options?.lockSeams,
     spec.writerLock.suffix,
   );
diff --git a/src/lab/live/transport.ts b/src/lab/live/transport.ts
index f1dac8e2116..359a4b7c118 100644
--- a/src/lab/live/transport.ts
+++ b/src/lab/live/transport.ts
@@ -104,6 +104,10 @@ export function classifyTransportError(error: unknown): { classification: Failur
     case "network_blocked": return { classification: "network_failure", secondaryCode: code };
     case "region_blocked": return { classification: "region_blocked", secondaryCode: code };
     case "provider_transient": return { classification: "provider_transient", secondaryCode: code };
+    // A response this transport cannot read is an upstream protocol failure. It is deterministic
+    // rather than transient, and attributing it to the harness would blame the runner for what
+    // the peer sent.
+    case "unreadable_response": return { classification: "protocol_failure", secondaryCode: code };
     case "connect_timeout": case "first_byte_timeout": case "total_timeout":
       return { classification: "timeout", secondaryCode: code };
     case "inactivity_timeout":
diff --git a/src/lab/live/types.ts b/src/lab/live/types.ts
index 8a30cfc799e..70408b4394e 100644
--- a/src/lab/live/types.ts
+++ b/src/lab/live/types.ts
@@ -89,6 +89,11 @@ export type TransportErrorCode =
   | "output_byte_limit"
   | "output_token_limit"
   | "tool_call_limit"
+  // The peer answered, and the answer cannot be read: a content coding this transport cannot
+  // undo, or coded bytes that did not decode. Neither is a timeout, a budget, or a fault of
+  // the harness, so none of those codes describes it and every one of them would send an
+  // operator looking in the wrong place.
+  | "unreadable_response"
   | "artifact_byte_limit"
   | "memory_limit"
   | "child_process_limit"
diff --git a/src/lab/subject/behavior-fingerprint.ts b/src/lab/subject/behavior-fingerprint.ts
index 831577c8dce..e50564e6f28 100644
--- a/src/lab/subject/behavior-fingerprint.ts
+++ b/src/lab/subject/behavior-fingerprint.ts
@@ -9,7 +9,7 @@ const CLOSED_KEYS = new Set([
   "limits.contextWindow", "limits.maxInputTokens", "limits.maxOutputTokens",
   "modalities.input",
   "sampling.omitTemperature", "sampling.omitTopP", "sampling.omitPenalties",
-  "reasoning.supported", "reasoning.efforts", "reasoning.defaultEffort", "reasoning.effortMap", "reasoning.wireFormat",
+  "reasoning.supported", "reasoning.efforts", "reasoning.effortsAuthoritative", "reasoning.defaultEffort", "reasoning.effortMap", "reasoning.wireFormat",
   "reasoning.summaryMode", "reasoning.replayMode", "reasoning.splitMode", "reasoning.toggleMode", "reasoning.budgetMode",
   "tools.choiceRestrictions", "tools.parallel", "tools.hostedPreference", "tools.customFreeform", "tools.builtinNameEscaping",
   "cache.forwarding", "cache.retention", "anthropic.eofPolicy", "openai-chat.eofPolicy",
diff --git a/src/lib/admin-secrets.ts b/src/lib/admin-secrets.ts
index 04fe85c4236..b3e46ba457a 100644
--- a/src/lib/admin-secrets.ts
+++ b/src/lib/admin-secrets.ts
@@ -1,4 +1,4 @@
-import { timingSafeEqual } from "node:crypto";
+import { createHmac, timingSafeEqual } from "node:crypto";
 import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
@@ -27,6 +27,14 @@ export function configuredAdminToken(configDir = getConfigDir(), env: NodeJS.Pro
 
 export const ADMIN_TOKEN_PREFIX = "ocx_admin_";
 
+/**
+ * Derive the bearer used by the OpenCode launcher for its one management read.
+ * A listener that captures this value cannot recover or replay the administrator token.
+ */
+export function opencodeCatalogToken(adminToken: string): string {
+  return `ocx_catalog_${createHmac("sha256", adminToken).update("opencode:/api/models:v1").digest("base64url")}`;
+}
+
 function secretTextEquals(left: string, right: string): boolean {
   const a = Buffer.from(left);
   const b = Buffer.from(right);
diff --git a/src/lib/debug-log-buffer.ts b/src/lib/debug-log-buffer.ts
index 17e0fc84bb0..df355ec2a93 100644
--- a/src/lib/debug-log-buffer.ts
+++ b/src/lib/debug-log-buffer.ts
@@ -9,7 +9,12 @@ export interface DebugLogEntry {
 
 const MAX_LINES = 2_000;
 const MAX_DEBUG_SUBSCRIBERS = 64;
-const MAX_DEBUG_LINE_BYTES = 16 * 1024;
+/**
+ * Per-line retention cap. Exported because a producer of a long structured line has to budget
+ * BELOW it: this buffer truncates at a byte boundary, so a JSON line cut here stops being
+ * parseable while its retained prefix still reads as complete.
+ */
+export const MAX_DEBUG_LINE_BYTES = 16 * 1024;
 const buffer: DebugLogEntry[] = [];
 interface DebugSubscriberRegistration { lease: AdmissionLease }
 const listeners = new Map<(entry: DebugLogEntry) => void, DebugSubscriberRegistration>();
diff --git a/src/lib/debug.ts b/src/lib/debug.ts
index 5d4b54b050f..938e5737ea7 100644
--- a/src/lib/debug.ts
+++ b/src/lib/debug.ts
@@ -29,3 +29,26 @@ export function debugProviderDiagnostic(adapter: string, event: string, details:
     /* diagnostics must never affect request handling */
   }
 }
+
+/**
+ * The same diagnostic for details that are expensive to compute or read live request state.
+ *
+ * The eager form takes an already-built object, so the build runs in ARGUMENT position: outside
+ * this module's gate, and outside its try/catch. For a projection that walks a whole request
+ * that is wrong twice over — it pays the walk while debug is off, and a throw inside it reaches
+ * the caller, which for an adapter means a built request becomes a rejected one and a send that
+ * would have happened does not. Pass the builder instead: it runs only when debug is on, and a
+ * throw inside it is swallowed exactly like a throw in the emit.
+ */
+export function debugProviderDiagnosticLazy(
+  adapter: string,
+  event: string,
+  details: () => Record<string, unknown>,
+): void {
+  if (!isDebugEnabled()) return;
+  try {
+    emitDebugLine(`[ocx:${adapter}:${event}] ${JSON.stringify(redactSecrets(details()))}`);
+  } catch {
+    /* diagnostics must never affect request handling */
+  }
+}
diff --git a/src/lib/errors.ts b/src/lib/errors.ts
index 669e81b21f9..18b27d34827 100644
--- a/src/lib/errors.ts
+++ b/src/lib/errors.ts
@@ -74,6 +74,75 @@ export function isCyberPolicyMessage(text: string): boolean {
   return false;
 }
 
+/**
+ * Refusal codes Codex ends a turn on.
+ *
+ * Its Responses parser classifies a `response.failed` terminal by `error.code`
+ * alone (codex-rs/codex-api/src/sse/responses.rs:423-462). These four become a
+ * fatal `ApiError` the client reports instead of reconnecting. A code outside
+ * this set is never read as a refusal: `server_is_overloaded` and `slow_down`
+ * take the overload arm, `rate_limit_exceeded` takes the rate-limit arm, and
+ * everything else falls through to `ApiError::Retryable` and is reconnected up
+ * to `stream_max_retries`.
+ *
+ * Deliberately scoped to content refusals. `insufficient_quota` and
+ * `context_length_exceeded` are terminal for Codex too, but they are separate
+ * failure families this proxy already classifies through its own quota and
+ * context paths, and pulling them in here would change their retry behavior
+ * with no evidence asking for it.
+ */
+const TERMINAL_REFUSAL_CODES = new Set<string>([
+  CYBER_POLICY_ERROR_CODE,
+  "misalignment_policy_violation",
+  "invalid_prompt",
+  "bio_policy",
+]);
+
+/** True when an upstream error code is a refusal the client must not retry. */
+export function isTerminalRefusalCode(code: string | null | undefined): boolean {
+  return typeof code === "string" && TERMINAL_REFUSAL_CODES.has(code);
+}
+
+/** Stand-in copy for a refusal the upstream sent without a message of its own. */
+export const TERMINAL_REFUSAL_FALLBACK_MESSAGE = "The upstream refused this request.";
+
+/** Readable copy for a refusal code, used when the upstream carried no message. */
+export function terminalRefusalFallbackMessage(code: string): string {
+  return code === CYBER_POLICY_ERROR_CODE
+    ? CYBER_POLICY_FALLBACK_MESSAGE
+    : TERMINAL_REFUSAL_FALLBACK_MESSAGE;
+}
+
+/**
+ * Name the refusal code behind upstream safety copy when the structured code
+ * was not carried on the wire.
+ *
+ * Same discipline as {@link isCyberPolicyMessage}: whole distinctive phrases
+ * only. A loose match here is the mirror-image defect — it would end a turn
+ * that a genuine transient failure would have retried successfully — so a
+ * message that merely mentions safety or blocking does not qualify. Callers
+ * must consult this only when the upstream carried no structured code at all,
+ * so that a transport failure quoting a refusal in its diagnostic text cannot
+ * be promoted past the verdict the upstream actually gave.
+ *
+ * Copy provenance: "limited access to this content for safety reasons" is the
+ * prefix Codex itself matches (tui/src/chatwidget/turn_runtime.rs:8-15) and
+ * pairs with `invalid_prompt` in its parser fixture (sse/responses.rs:1358-1366),
+ * which also pairs "flagged for possible biological risk" with `bio_policy`.
+ * "blocked by our safety systems" is the copy reported in #5176; pairing it
+ * with `invalid_prompt` is an inference from the two verified pairings above,
+ * not something the upstream source states.
+ */
+export function safetyRefusalCodeFromMessage(text: string): string | undefined {
+  const lower = String(text ?? "").toLowerCase();
+  if (lower.includes("flagged for possible biological risk")) return "bio_policy";
+  if (
+    lower.includes("blocked by our safety systems")
+    || lower.includes("limited access to this content for safety reasons")
+  ) return "invalid_prompt";
+  return undefined;
+}
+
 function isSubscriptionGateMessage(text: string): boolean {
   return (
     text.includes("requires a subscription") ||
@@ -187,6 +256,16 @@ export function isClientClosedMessage(text: string): boolean {
   );
 }
 
+/**
+ * Ambiguous-reset refusal wording owned by this proxy (src/lib/upstream-retry.ts):
+ * the upstream connection closed before any response arrived, so the request may
+ * already have been processed and automatic replay was stopped. Matched narrowly
+ * so a provider-sent message is never relabeled by it.
+ */
+export function isUpstreamResetReplayRefusedMessage(text: string): boolean {
+  return text.toLowerCase().includes("connection closed before a response was received");
+}
+
 export function classifyError(status: number, type: string, message: string): OcxErrorPayload {
   const text = message.toLowerCase();
   if (type === "previous_response_not_found") {
diff --git a/src/lib/http-response-semantics.ts b/src/lib/http-response-semantics.ts
new file mode 100644
index 00000000000..ac56325c506
--- /dev/null
+++ b/src/lib/http-response-semantics.ts
@@ -0,0 +1,57 @@
+/**
+ * Response rules both raw outbound transports have to apply themselves.
+ *
+ * `fetch` applies them below the Response constructor. `src/lib/pinned-http.ts` and
+ * `src/lib/socks5-fetch.ts` assemble a Response from a socket instead, so each one answers the
+ * same questions on its own — and a rule written twice is a rule that drifts. It already had:
+ * the SOCKS helper excluded 204 and the pinned helper excluded nothing, so the same no-content
+ * upstream answer behaved differently depending on which transport carried the request.
+ */
+
+/**
+ * Statuses the Fetch specification defines as null-body.
+ *
+ * `new Response(body, { status })` throws a TypeError for a non-null body on any of these, so a
+ * transport that attaches its stream unconditionally converts a valid no-content answer into a
+ * construction failure. There are no body bytes to wait for either, so a transport that streams
+ * one of these holds the caller until the peer closes a connection it is entitled to keep alive.
+ *
+ * 101 and 103 are null-body statuses too, but neither is a final Response status these helpers
+ * support. 103 and every other informational head is consumed while looking for the final one,
+ * and 101 hands the connection to a protocol neither helper speaks, which is outside what they
+ * construct a Response for at all. The three below are the statuses these transports actually
+ * have to answer for.
+ *
+ * https://fetch.spec.whatwg.org/#null-body-status
+ */
+export function isNullBodyStatus(status: number): boolean {
+  return status === 204 || status === 205 || status === 304;
+}
+
+/** What a transport must do with the coding a response declares. */
+export type ContentCoding =
+  | { kind: "identity" }
+  | { kind: "decodable"; format: "gzip" | "deflate" }
+  | { kind: "unsupported"; coding: string };
+
+/**
+ * Classify the `content-encoding` a raw transport received.
+ *
+ * `fetch` undoes a content-coding below the Response constructor. A transport that assembles a
+ * body from a socket hands the coded bytes to whatever reads them instead: `response.json()`
+ * throws a SyntaxError on the gzip magic number and an SSE reader sees noise rather than frames.
+ * Only `gzip` and `deflate` can be undone with `DecompressionStream`, so anything else is
+ * reported as unsupported and each transport refuses it under its own error type rather than
+ * surfacing bytes no caller can parse.
+ *
+ * This reads the coding the response actually carries and nothing else. A caller whose
+ * `accept-encoding` names a coding this code cannot undo is not the problem; what the peer
+ * chose to send is.
+ */
+export function classifyContentCoding(headers: Headers): ContentCoding {
+  const coding = (headers.get("content-encoding") ?? "").trim().toLowerCase();
+  if (coding === "" || coding === "identity") return { kind: "identity" };
+  if (coding === "gzip" || coding === "x-gzip") return { kind: "decodable", format: "gzip" };
+  if (coding === "deflate") return { kind: "decodable", format: "deflate" };
+  return { kind: "unsupported", coding };
+}
diff --git a/src/lib/lab-live-pinned-sender.ts b/src/lib/lab-live-pinned-sender.ts
index 0c336511bdd..7961369c785 100644
--- a/src/lib/lab-live-pinned-sender.ts
+++ b/src/lib/lab-live-pinned-sender.ts
@@ -1,10 +1,32 @@
-import { PinnedHttpError, pinnedHttpGet, pinnedHttpPost } from "./pinned-http";
+import { PinnedHttpError, pinnedHttpGet, pinnedHttpPost, type PinnedHttpErrorCode } from "./pinned-http";
 import { TransportError } from "../lab/live/transport";
-import type { LabCredentialLeaseV1, LabPinnedSender } from "../lab/live/types";
+import type { LabCredentialLeaseV1, LabPinnedSender, TransportErrorCode } from "../lab/live/types";
 
 /** Only response metadata required by current live assertions crosses into Lab. */
 const LAB_RESPONSE_HEADER_ALLOWLIST = ["content-type"] as const;
 
+/**
+ * Every pinned-transport failure code, mapped to the Lab transport taxonomy or to nothing.
+ *
+ * A switch over the codes that existed when it was written silently let later ones fall through
+ * to a raw rethrow. That is not the same as leaving them unclassified: Lab's executor turns an
+ * unrecognized error into `harness_failure` / `execution_error`, so a response the peer coded
+ * in a format this transport cannot undo was reported as a fault of the runner. Both unreadable
+ * answers therefore carry `unreadable_response`, which Lab classifies as a protocol failure.
+ * A total map keeps a future code from acquiring that misattribution by default.
+ */
+const LAB_TRANSPORT_FAILURES = {
+  connect_timeout: { code: "connect_timeout", message: "pinned provider connection timed out" },
+  first_byte_timeout: { code: "first_byte_timeout", message: "pinned provider first byte timed out" },
+  inactivity_timeout: { code: "inactivity_timeout", message: "pinned provider response stalled" },
+  output_byte_limit: { code: "output_byte_limit", message: "pinned provider response exceeded byte budget" },
+  content_decode_failed: { code: "unreadable_response", message: "pinned provider response did not decode" },
+  unsupported_content_encoding: {
+    code: "unreadable_response",
+    message: "pinned provider used a content-encoding this transport cannot decode",
+  },
+} satisfies Record<PinnedHttpErrorCode, { code: TransportErrorCode; message: string }>;
+
 /**
  * Trusted credential/transport owner. Secret headers exist only in this non-Lab module and are
  * consumed directly by the pinned HTTP primitive; they are never returned to Lab code.
@@ -33,16 +55,8 @@ export function createLabAuthorizedPinnedSender(
       body = await response.text();
     } catch (error) {
       if (error instanceof PinnedHttpError) {
-        switch (error.code) {
-          case "connect_timeout":
-            throw new TransportError("connect_timeout", "pinned provider connection timed out");
-          case "first_byte_timeout":
-            throw new TransportError("first_byte_timeout", "pinned provider first byte timed out");
-          case "inactivity_timeout":
-            throw new TransportError("inactivity_timeout", "pinned provider response stalled");
-          case "output_byte_limit":
-            throw new TransportError("output_byte_limit", "pinned provider response exceeded byte budget");
-        }
+        const mapped = LAB_TRANSPORT_FAILURES[error.code];
+        throw new TransportError(mapped.code, mapped.message);
       }
       throw error;
     }
diff --git a/src/lib/pinned-http.ts b/src/lib/pinned-http.ts
index b2b04c07054..6527dfd7d49 100644
--- a/src/lib/pinned-http.ts
+++ b/src/lib/pinned-http.ts
@@ -1,5 +1,6 @@
 import http, { type ClientRequest, type IncomingMessage, type RequestOptions } from "node:http";
 import https from "node:https";
+import { classifyContentCoding, isNullBodyStatus } from "./http-response-semantics";
 
 export type PinnedAddress = { address: string; family: number };
 
@@ -7,7 +8,9 @@ export type PinnedHttpErrorCode =
   | "connect_timeout"
   | "first_byte_timeout"
   | "inactivity_timeout"
-  | "output_byte_limit";
+  | "output_byte_limit"
+  | "unsupported_content_encoding"
+  | "content_decode_failed";
 
 export class PinnedHttpError extends Error {
   override readonly name = "PinnedHttpError";
@@ -32,6 +35,99 @@ export interface PinnedHttpRequestOptions {
 /** @deprecated Use {@link PinnedHttpRequestOptions}. */
 export type PinnedHttpGetOptions = PinnedHttpRequestOptions;
 
+/**
+ * Undo the content-coding this transport has to undo itself, under the caller's byte ceiling.
+ *
+ * `maxBytes` keeps its existing meaning for the bytes that arrive on the socket, and gains the
+ * same meaning for the bytes the caller ends up reading. Bounding only the coded side would let
+ * a small compressed response expand past a ceiling the caller set precisely so it would not
+ * have to hold an unbounded body in memory.
+ *
+ * A completed body is not torn down here. The response already ended, so there is nothing to
+ * release, and destroying it would take a connection the agent is entitled to reuse. That
+ * matches the identity path, which also only closes. Teardown belongs to the paths that end a
+ * response early: a decode failure, an exceeded ceiling, and a caller that cancels.
+ *
+ * Only a decoder failure is renamed. A mid-body reset, a stalled response and an exceeded
+ * socket-byte ceiling all reach this pipeline as "the stream failed", and calling any of them a
+ * decode failure would tell the caller the peer sent unreadable bytes when the truth is that the
+ * connection died. The source failure is recorded as it passes so the original error survives;
+ * what is left after that is the decompressor's own, and that one is named because the caller's
+ * alternative is a bare TypeError from a stream it never constructed.
+ */
+function decodedBody(
+  source: ReadableStream<Uint8Array>,
+  format: "gzip" | "deflate",
+  maxBytes: number | undefined,
+  context: string,
+  release: () => void,
+): ReadableStream<Uint8Array> {
+  // Interposed purely to attribute failures. Once bytes enter the decompressor, a transport
+  // error and a corrupt trailer are indistinguishable from the far side of the pipe.
+  let sourceFailure: { error: unknown } | undefined;
+  const sourceReader = source.getReader();
+  const attributed = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const next = await sourceReader.read();
+        if (next.done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(next.value);
+      } catch (error) {
+        sourceFailure = { error };
+        controller.error(error);
+      }
+    },
+    cancel(reason) {
+      return sourceReader.cancel(reason);
+    },
+  });
+  // `DecompressionStream` declares its writable side as `WritableStream<BufferSource>`, and
+  // TypeScript measures `WritableStream` as invariant in its chunk type, so the pair is not
+  // assignable to `ReadableWritablePair<Uint8Array, Uint8Array>` even though every chunk this
+  // body produces is a valid `BufferSource`. The conversion states that relationship and
+  // nothing else; it does not widen what is actually written.
+  const decompressor = new DecompressionStream(format) as unknown as ReadableWritablePair<Uint8Array, Uint8Array>;
+  const reader = attributed.pipeThrough(decompressor).getReader();
+  let decoded = 0;
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const next = await reader.read();
+        if (next.done) {
+          controller.close();
+          return;
+        }
+        decoded += next.value.byteLength;
+        if (maxBytes !== undefined && decoded > maxBytes) {
+          throw new PinnedHttpError("output_byte_limit", `${context} exceeds ${maxBytes} byte cap`);
+        }
+        controller.enqueue(next.value);
+      } catch (error) {
+        // A failure the socket stream raised is the caller's answer, whatever shape it has.
+        // Only what the decompressor itself rejected is renamed.
+        const named = sourceFailure !== undefined
+          ? sourceFailure.error
+          : error instanceof PinnedHttpError
+            ? error
+            : new PinnedHttpError("content_decode_failed", `${context} could not decode its ${format} body`);
+        // Cancelling the decoded reader propagates back through the decompressor to the socket
+        // stream's own `cancel`, which destroys the request; `release` covers the case where
+        // that propagation is already finished.
+        await reader.cancel(named).catch(() => { /* already torn down */ });
+        controller.error(named);
+        release();
+      }
+    },
+    async cancel(reason) {
+      await reader.cancel(reason).catch(() => { /* already torn down */ });
+      release();
+    },
+  });
+}
+
 function pinnedHttpRequest(
   url: string,
   pinned: PinnedAddress,
@@ -55,6 +151,10 @@ function pinnedHttpRequest(
   const maxBytes = options?.maxBytes;
   const headers = new Headers(options?.headers);
   headers.set("host", parsed.host);
+  // This transport assembles the response itself, so a coding it did not ask for becomes its own
+  // problem to undo. Ask for none by default and leave an explicit caller choice alone, which is
+  // the same rule `src/lib/socks5-fetch.ts` applies to the other raw route.
+  if (!headers.has("accept-encoding")) headers.set("accept-encoding", "identity");
   if (body !== undefined && !headers.has("content-length")) {
     headers.set("content-length", String(Buffer.byteLength(body)));
   }
@@ -150,6 +250,39 @@ function pinnedHttpRequest(
         return;
       }
 
+      // A success status can still be null-body. `new Response(stream, { status: 204 })` throws a
+      // TypeError, so attaching the body below would turn a correct no-content answer into a
+      // construction failure raised inside this event handler rather than a resolved response.
+      // Nothing is coming on the socket either, so streaming one of these would hold the caller
+      // until the peer closed a connection it is entitled to keep alive. The headers still
+      // describe the representation the peer would have sent and are preserved as they arrived.
+      if (isNullBodyStatus(status)) {
+        try { response.destroy(); } catch { /* ignore */ }
+        try { req?.destroy(); } catch { /* ignore */ }
+        if (settled) return;
+        settled = true;
+        resolve(new Response(null, { status, headers: responseHeaders }));
+        return;
+      }
+
+      // The peer may have coded the body whatever this request asked for. Classify before the
+      // stream takes the socket so a coding this transport cannot undo fails on the ordinary
+      // error path rather than reaching the caller as bytes its parser cannot read.
+      const coding = classifyContentCoding(responseHeaders);
+      if (coding.kind === "unsupported") {
+        try { response.destroy(); } catch { /* ignore */ }
+        fail(new PinnedHttpError(
+          "unsupported_content_encoding",
+          `${context} returned an unsupported content-encoding: ${coding.coding}`,
+        ));
+        return;
+      }
+      if (coding.kind === "decodable") {
+        responseHeaders.delete("content-encoding");
+        // The declared length counted the coded bytes, not what the caller now reads.
+        responseHeaders.delete("content-length");
+      }
+
       let received = 0;
       const stream = new ReadableStream<Uint8Array>({
         start(controller) {
@@ -191,7 +324,14 @@ function pinnedHttpRequest(
 
       if (settled) return;
       settled = true;
-      resolve(new Response(stream, { status, headers: responseHeaders }));
+      const release = () => {
+        try { response.destroy(); } catch { /* ignore */ }
+        try { req?.destroy(); } catch { /* ignore */ }
+      };
+      const payload = coding.kind === "decodable"
+        ? decodedBody(stream, coding.format, maxBytes, context, release)
+        : stream;
+      resolve(new Response(payload, { status, headers: responseHeaders }));
     };
 
     const requestFn = parsed.protocol === "https:" ? https.request : http.request;
diff --git a/src/lib/plain-data.ts b/src/lib/plain-data.ts
new file mode 100644
index 00000000000..e2f705abc92
--- /dev/null
+++ b/src/lib/plain-data.ts
@@ -0,0 +1,103 @@
+/**
+ * Copying a value the way a consumer that must not observe later edits needs it copied.
+ *
+ * Serializing with JSON is not a copier and using it as one is a quiet hole: it drops functions
+ * without saying so, and it invokes getters and toJSON, so the object being copied gets to decide
+ * what the copy contains. Every read here goes through a property descriptor instead, including
+ * array elements, which an exotic array can define as accessors just as an object can.
+ *
+ * The contract is narrow on purpose. This copies what JSON could have produced and refuses
+ * everything else rather than approximating it: an accessor, a cycle, a function, a class instance,
+ * a Map, a Date, a symbol value, a bigint, a non-finite number. A caller that is refused has to
+ * decide what to do about it, which is the point; a copier that silently degraded would leave the
+ * caller believing it held a snapshot of something it never read.
+ *
+ * Symbol-keyed properties are skipped rather than refused. Process bookkeeping rides on symbols by
+ * convention here, and none of it is the data a consumer is being given a copy of.
+ */
+
+/** A copy, or a refusal. A union rather than a nullable value, because null is copyable data. */
+export type PlainDataCopy<T> = { readonly ok: true; readonly value: T } | { readonly ok: false };
+
+const REFUSED = Symbol("refused");
+
+export function copyPlainData<T>(value: T): PlainDataCopy<T> {
+  const copied = copyValue(value, new Set());
+  return copied === REFUSED ? { ok: false } : { ok: true, value: copied as T };
+}
+
+/**
+ * A stable string for comparing two plain-data values.
+ *
+ * Key-sorted entry pairs rather than objects, because property order is observable through
+ * serialization and two values that differ only in it are the same value.
+ */
+export function canonicalPlainData(value: unknown): string {
+  return JSON.stringify(sorted(value));
+}
+
+/** Own enumerable string keys, with null in the position of any key that is an accessor. */
+export function ownDataKeys(value: Record<string, unknown>): Array<string | null> {
+  return Object.keys(value).map(key => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor !== undefined && descriptor.get === undefined && descriptor.set === undefined ? key : null;
+  });
+}
+
+export function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function copyValue(value: unknown, seen: Set<object>): unknown {
+  if (value === null) return null;
+  const type = typeof value;
+  if (type === "string" || type === "boolean") return value;
+  if (type === "number") return Number.isFinite(value as number) ? value : REFUSED;
+  if (type !== "object") return REFUSED;
+  const object = value as object;
+  if (seen.has(object)) return REFUSED;
+  seen.add(object);
+  try {
+    if (Array.isArray(object)) return copyArray(object, seen);
+    if (!isPlainObject(object)) return REFUSED;
+    const copied: Record<string, unknown> = {};
+    for (const key of ownDataKeys(object)) {
+      if (key === null) return REFUSED;
+      const entry = (object as Record<string, unknown>)[key];
+      if (entry === undefined) continue;
+      const item = copyValue(entry, seen);
+      if (item === REFUSED) return REFUSED;
+      copied[key] = item;
+    }
+    return copied;
+  } finally {
+    seen.delete(object);
+  }
+}
+
+function copyArray(source: unknown[], seen: Set<object>): unknown {
+  const copied: unknown[] = [];
+  for (let index = 0; index < source.length; index += 1) {
+    const descriptor = Object.getOwnPropertyDescriptor(source, index);
+    // A hole is written as null, which is what a reader of the serialized value would find there.
+    if (descriptor === undefined) { copied.push(null); continue; }
+    if (descriptor.get !== undefined || descriptor.set !== undefined) return REFUSED;
+    if (descriptor.value === undefined) { copied.push(null); continue; }
+    const item = copyValue(descriptor.value, seen);
+    if (item === REFUSED) return REFUSED;
+    copied.push(item);
+  }
+  return copied;
+}
+
+function sorted(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(sorted);
+  if (value !== null && typeof value === "object") {
+    return Object.keys(value as Record<string, unknown>)
+      .sort()
+      .map(key => [key, sorted((value as Record<string, unknown>)[key])]);
+  }
+  return value;
+}
diff --git a/src/lib/process-control.ts b/src/lib/process-control.ts
index 165d21aeaa6..7c5bfbc115a 100644
--- a/src/lib/process-control.ts
+++ b/src/lib/process-control.ts
@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { isIP } from "node:net";
 import { loadConfig } from "../config";
 import { readRuntimePort } from "../config/process-state";
 import { configuredAdminToken } from "./admin-secrets";
@@ -50,9 +51,11 @@ export interface GracefulStopIo {
 }
 
 /**
- * Host to POST /api/stop against: follow the recorded bind hostname when it names a
- * concrete address (a proxy bound to ::1 or a LAN IP is unreachable on 127.0.0.1);
- * loopback aliases and wildcard binds all answer on IPv4 loopback.
+ * Host to POST /api/stop against: follow the recorded bind hostname only when it is
+ * an IP literal (a proxy bound to ::1 or a LAN IP is unreachable on 127.0.0.1).
+ * DNS names are not safe here because resolution may change between bind and stop,
+ * while this request carries the management token. Loopback aliases, DNS names, and
+ * wildcard binds therefore all fall back to IPv4 loopback.
  */
 export function gracefulStopHost(hostname: string | undefined): string {
   const trimmed = (hostname ?? "").trim();
@@ -61,8 +64,13 @@ export function gracefulStopHost(hostname: string | undefined): string {
     return "127.0.0.1";
   }
   if (lower === "::1" || lower === "[::1]") return "[::1]";
-  if (trimmed.startsWith("[") && trimmed.endsWith("]")) return trimmed;
-  return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
+  const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]")
+    ? trimmed.slice(1, -1)
+    : trimmed;
+  const ipVersion = isIP(unbracketed);
+  if (ipVersion === 6) return `[${unbracketed}]`;
+  if (ipVersion === 4) return unbracketed;
+  return "127.0.0.1";
 }
 
 /**
diff --git a/src/lib/provider-outbound.ts b/src/lib/provider-outbound.ts
index 87bfa94584b..799c8d69fa6 100644
--- a/src/lib/provider-outbound.ts
+++ b/src/lib/provider-outbound.ts
@@ -104,19 +104,67 @@ export async function providerRedirectError(response: Response, requestUrl: stri
   return `provider returned ${response.status} redirect to ${target}; configure the final provider URL directly`;
 }
 
+/**
+ * Default client identity for proxy-originated provider outbound requests.
+ *
+ * Every request through the provider outbound wrapper — connection tests, model
+ * discovery, quota probes — is initiated by the proxy itself, so there is no
+ * client request to inherit a User-Agent from, and the pinned Node-style
+ * transport sends none. WAF/CDN front ends commonly answer UA-less requests
+ * with a 403 that surfaced as "provider added but no models" (#5104). A caller
+ * that materializes its own User-Agent — registry static headers, provider
+ * `headers`, or a vendor-specific client fingerprint — keeps that value and is
+ * never given a second User-Agent; this only fills the name nobody claimed.
+ * The value is what survives, not its spelling: both the pinned transport and
+ * the SOCKS transport rebuild the set through `new Headers()`, which lowercases
+ * every name before it reaches the wire. Inference traffic never uses this
+ * wrapper, so the client-fingerprint rationale of #1751 is unaffected.
+ */
+const PROVIDER_OUTBOUND_DEFAULT_USER_AGENT = "opencodex";
+
+function hasUserAgentHeader(headers: HeadersInit | null | undefined): boolean {
+  if (!headers) return false;
+  if (headers instanceof Headers) return headers.has("user-agent");
+  if (Array.isArray(headers)) return headers.some(([name]) => name.toLowerCase() === "user-agent");
+  return Object.keys(headers).some(name => name.toLowerCase() === "user-agent");
+}
+
+function withDefaultOutboundUserAgent(
+  init: ProviderGetInit | ProviderPostInit,
+): ProviderGetInit | ProviderPostInit {
+  const headers = init.headers;
+  if (hasUserAgentHeader(headers)) return init;
+  if (headers instanceof Headers) {
+    const merged = new Headers(headers);
+    merged.set("User-Agent", PROVIDER_OUTBOUND_DEFAULT_USER_AGENT);
+    return { ...init, headers: merged };
+  }
+  if (Array.isArray(headers)) {
+    return { ...init, headers: [...headers, ["User-Agent", PROVIDER_OUTBOUND_DEFAULT_USER_AGENT]] };
+  }
+  return { ...init, headers: { ...(headers ?? {}), "User-Agent": PROVIDER_OUTBOUND_DEFAULT_USER_AGENT } };
+}
+
 async function providerOutboundRequest(
   name: string,
   provider: ProviderOutboundConfig,
   url: string,
   method: "GET" | "POST",
-  init: ProviderGetInit | ProviderPostInit,
+  rawInit: ProviderGetInit | ProviderPostInit,
   dependencies: ProviderOutboundDependencies = {},
 ): Promise<Response> {
+  // See PROVIDER_OUTBOUND_DEFAULT_USER_AGENT: this wrapper only carries proxy-originated
+  // diagnostic traffic, so it identifies itself unless the caller already did.
+  const init = withDefaultOutboundUserAgent(rawInit);
   const postUrl = method === "POST" ? new URL(url) : undefined;
   if (postUrl?.protocol !== undefined && postUrl.protocol !== "https:") {
     throw new ProviderOutboundPolicyError("provider POST URL must use HTTPS");
   }
-  if (provider.fetch) {
+  // A provider entry keeps unknown configuration keys, so `fetch` can arrive as a value the
+  // operator wrote into the file rather than an executor a caller attached. Calling that would
+  // throw inside discovery and fail the provider for a reason nothing in its configuration
+  // explains; the built-in transport is what a configured value means.
+  if (typeof provider.fetch === "function") {
     // A caller-owned executor cannot be peer-pinned here. This branch keeps literal/config
     // checks and redirect blocking, but does not provide the resolved-address guarantees of
     // the built-in transport. Main-request migration must define that executor contract first.
diff --git a/src/lib/socks5-fetch.ts b/src/lib/socks5-fetch.ts
index 725d0efb0e6..f4000925cf0 100644
--- a/src/lib/socks5-fetch.ts
+++ b/src/lib/socks5-fetch.ts
@@ -1,5 +1,6 @@
 import net, { type Socket } from "node:net";
 import tls, { type TLSSocket } from "node:tls";
+import { classifyContentCoding, isNullBodyStatus } from "./http-response-semantics";
 
 const DEFAULT_SOCKS5_PORT = 1080;
 const SOCKS5_CONNECT_TIMEOUT_MS = 30_000;
@@ -510,7 +511,9 @@ function responseBody(
 
 /** Statuses and methods that carry no response body, whatever the headers say about one. */
 function bodylessResponse(method: string, status: number): boolean {
-  return method === "HEAD" || status === 204 || status === 304 || (status >= 100 && status < 200);
+  // 205 belongs here for the same reason 204 does, and leaving it out was not a judgement call:
+  // a peer that resets the caller's view sends no body, so the Response constructor rejects one.
+  return method === "HEAD" || isNullBodyStatus(status) || (status >= 100 && status < 200);
 }
 
 /**
@@ -528,11 +531,121 @@ function bodylessResponse(method: string, status: number): boolean {
  * the coded path would fail responses that succeed uncompressed.
  */
 function contentCodingFormat(headers: Headers): "gzip" | "deflate" | undefined {
-  const coding = (headers.get("content-encoding") ?? "").trim().toLowerCase();
-  if (coding === "" || coding === "identity") return undefined;
-  if (coding === "gzip" || coding === "x-gzip") return "gzip";
-  if (coding === "deflate") return "deflate";
-  throw new Socks5FetchError("SOCKS5 upstream returned an unsupported content-encoding: " + coding);
+  const coding = classifyContentCoding(headers);
+  if (coding.kind === "identity") return undefined;
+  if (coding.kind === "decodable") return coding.format;
+  throw new Socks5FetchError("SOCKS5 upstream returned an unsupported content-encoding: " + coding.coding);
+}
+
+/** Read response heads until the final one, consuming the interim informational answers. */
+async function finalResponseHead(
+  reader: SocketReader,
+  signal: AbortSignal,
+): Promise<{ status: number; statusText: string; headers: Headers }> {
+  let head = parseResponseHead(await reader.readUntil(HEADER_END, MAX_RESPONSE_HEADER_BYTES, signal));
+  while (head.status >= 100 && head.status < 200 && head.status !== 101) {
+    head = parseResponseHead(await reader.readUntil(HEADER_END, MAX_RESPONSE_HEADER_BYTES, signal));
+  }
+  return head;
+}
+
+/**
+ * A promise that rejects with the caller's abort reason, and a way to stop listening.
+ *
+ * Destroying the socket is not enough to end a pending `bodyReader.read()`: that promise belongs
+ * to the caller's body stream, which knows nothing about this socket. Racing it against this one
+ * is what turns an abort into a settled fetch instead of a permanently pending one.
+ */
+function abortRejection(signal: AbortSignal): { promise: Promise<never>; dispose: () => void } {
+  let onAbort = (): void => { /* replaced below */ };
+  const promise = new Promise<never>((_resolve, reject) => {
+    // Reject with the caller's reason exactly, including `null` and `false`. A real
+    // `AbortSignal` always has one — `abort()` with no argument supplies an AbortError — so
+    // the fallback covers only a hand-built signal that exposes none.
+    onAbort = () => reject(signal.reason === undefined ? new Error("The operation was aborted") : signal.reason);
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
+  });
+  // The race below may settle on another branch first; this rejection must not be reported as
+  // unhandled when nobody is left waiting for it.
+  promise.catch(() => { /* surfaced by whoever loses the race */ });
+  return { promise, dispose: () => signal.removeEventListener("abort", onAbort) };
+}
+
+/**
+ * The two races below have different possible outcomes, so they have different result types.
+ * One union covering both would let the compiler accept reading `value` off a drain result,
+ * which is the kind of mistake a type is supposed to catch rather than describe.
+ */
+type Answered = { kind: "answered" };
+type BodyStep = { kind: "chunk"; value: Uint8Array } | { kind: "end" } | Answered;
+type DrainStep = { kind: "drained" } | Answered;
+
+/**
+ * Send the request body, settling on caller abort or on an answer that arrives first.
+ *
+ * A peer is entitled to answer a request it has not finished receiving — a 413 or a 401 lands
+ * while a large body is still going out — and a body stream is entitled to stall. Waiting for
+ * the upload to finish before looking at the socket made those two facts combine into a fetch
+ * that never settles, with the answer already sitting in the receive buffer.
+ *
+ * `answered` covers the head settling either way: a final response means the peer has stopped
+ * reading, and a terminal socket failure means nothing more can be written. Which of the two it
+ * was belongs to whoever awaits the head, so this only needs to know that it happened.
+ */
+async function uploadRequestBody(
+  socket: Socket,
+  request: Request,
+  chunked: boolean,
+  head: Promise<unknown>,
+): Promise<void> {
+  const body = request.body;
+  if (!body) return;
+  const signal = request.signal;
+  const bodyReader = body.getReader();
+  const abort = abortRejection(signal);
+  const answered: Promise<Answered> = head.then(
+    (): Answered => ({ kind: "answered" }),
+    (): Answered => ({ kind: "answered" }),
+  );
+  let completed = false;
+  try {
+    for (;;) {
+      const read: Promise<BodyStep> = bodyReader.read().then(
+        (result): BodyStep => (result.done ? { kind: "end" } : { kind: "chunk", value: result.value }),
+      );
+      // Releasing the lock below rejects a read still waiting on a source that stopped
+      // producing. That rejection is this function's own doing, not a failure to report.
+      read.catch(() => { /* settled by releasing the reader */ });
+      const step = await Promise.race([read, answered, abort.promise]);
+      if (step.kind === "answered") break;
+      if (step.kind === "end") {
+        completed = true;
+        break;
+      }
+      const payload = chunked
+        ? Buffer.concat([Buffer.from(`${step.value.byteLength.toString(16)}\r\n`), Buffer.from(step.value), CRLF])
+        : step.value;
+      if (socket.write(payload)) continue;
+      const drain: Promise<DrainStep> = waitForDrain(socket, signal).then((): DrainStep => ({ kind: "drained" }));
+      if ((await Promise.race([drain, answered, abort.promise])).kind === "answered") break;
+    }
+    // A terminating chunk written after the peer has already answered goes into a conversation
+    // that is over, and a peer that has moved on may read it as the head of the next request.
+    if (completed && chunked && !socket.write("0\r\n\r\n")) {
+      const drain: Promise<DrainStep> = waitForDrain(socket, signal).then((): DrainStep => ({ kind: "drained" }));
+      await Promise.race([drain, answered, abort.promise]);
+    }
+  } finally {
+    abort.dispose();
+    if (!completed) {
+      // Cancelling runs the caller's own cancel algorithm, which is free to never settle, so it
+      // is started rather than awaited. Releasing the lock is what actually frees a read still
+      // waiting on a body that stopped producing.
+      void bodyReader.cancel().catch(() => { /* the caller's stream owns this outcome */ });
+    }
+    try { bodyReader.releaseLock(); } catch { /* already released */ }
+  }
 }
 
 export async function socks5Fetch(
@@ -570,26 +683,16 @@ export async function socks5Fetch(
     const headers = requestHeaders(request, target);
     const head = `${request.method} ${target.pathname}${target.search} HTTP/1.1\r\n${headers.text}\r\n`;
     socket.write(head);
-    if (request.body) {
-      const bodyReader = request.body.getReader();
-      try {
-        while (true) {
-          const next = await bodyReader.read();
-          if (next.done) break;
-          const body = headers.chunked
-            ? Buffer.concat([Buffer.from(`${next.value.byteLength.toString(16)}\r\n`), Buffer.from(next.value), CRLF])
-            : next.value;
-          if (!socket.write(body)) await waitForDrain(socket, request.signal);
-        }
-        if (headers.chunked && !socket.write("0\r\n\r\n")) await waitForDrain(socket, request.signal);
-      } finally {
-        bodyReader.releaseLock();
-      }
-    }
-    let responseHead = parseResponseHead(await reader.readUntil(HEADER_END, MAX_RESPONSE_HEADER_BYTES, request.signal));
-    while (responseHead.status >= 100 && responseHead.status < 200 && responseHead.status !== 101) {
-      responseHead = parseResponseHead(await reader.readUntil(HEADER_END, MAX_RESPONSE_HEADER_BYTES, request.signal));
-    }
+    // Start reading the answer before the upload finishes, and keep one consumer of the socket
+    // reader for the whole exchange. The upload races this promise so an early final response or
+    // a terminal socket failure ends it, instead of leaving it waiting on a body chunk that is
+    // never coming while the answer sits in the receive buffer.
+    const pendingHead = finalResponseHead(reader, request.signal);
+    // The upload observes this promise through a handler of its own; this one keeps a rejection
+    // from being reported as unhandled in the window before the await below.
+    pendingHead.catch(() => { /* rethrown by the await below */ });
+    await uploadRequestBody(socket, request, headers.chunked, pendingHead);
+    const responseHead = await pendingHead;
     // A bodyless response has no coded bytes to undo, so its `content-encoding` describes the
     // representation it would have sent and must neither be decoded nor refused — a HEAD whose
     // peer advertises brotli is a correct answer, not an unreadable body. For everything else,
@@ -626,6 +729,13 @@ export async function socks5Fetch(
     request.signal.removeEventListener("abort", onAbort);
     reader?.dispose();
     socket.destroy();
+    // An aborted caller gets its own reason back. Several waiters inside this transport can win
+    // the race that settles an abort, and they do not agree on what to do with a reason they
+    // consider absent: the socket reader substitutes an Error for a null reason, others coerce
+    // anything that is not an Error. Without this, the same `abort(null)` surfaces as an Error
+    // or as null depending on scheduling. `undefined` is left alone so a hand-built signal
+    // still reaches the thrown cause below.
+    if (request.signal.aborted && request.signal.reason !== undefined) throw request.signal.reason;
     throw error;
   }
 }
diff --git a/src/lib/spend-ledger-owner.ts b/src/lib/spend-ledger-owner.ts
new file mode 100644
index 00000000000..40cf6dd07b4
--- /dev/null
+++ b/src/lib/spend-ledger-owner.ts
@@ -0,0 +1,364 @@
+/** Process-lifetime single-writer ownership for the shared spend journal. */
+import { Database } from "bun:sqlite";
+import { chmodSync, closeSync, lstatSync, mkdirSync, openSync, realpathSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { recordOwnedConfigPath } from "./config-ownership";
+import { assertNotRealHomeUnderTest } from "./test-home-guard";
+import { hardenSecretDir, hardenSecretPath } from "./windows-secret-acl";
+
+export const SPEND_LEDGER_OWNER_FILENAME = "spend-ledger-owner.sqlite";
+export const SPEND_LEDGER_RESTART_PARENT_ENV = "OCX_SPEND_LEDGER_RESTART_PARENT_PID";
+export const SPEND_LEDGER_RESTART_WAIT_MS = 5_000;
+const OWNER_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+
+export type SpendLedgerOwnerErrorCode =
+  | "SPEND_LEDGER_OWNER_BUSY"
+  | "SPEND_LEDGER_OWNER_UNAVAILABLE"
+  | "SPEND_LEDGER_OWNER_HOME_CONFLICT"
+  | "SPEND_LEDGER_OWNER_NOT_HELD";
+
+export class SpendLedgerOwnerError extends Error {
+  constructor(readonly code: SpendLedgerOwnerErrorCode, message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "SpendLedgerOwnerError";
+  }
+}
+
+export interface SpendLedgerOwnerLease {
+  release(): void;
+}
+
+interface ActiveOwner {
+  readonly home: string;
+  readonly database: Database;
+  references: number;
+}
+
+let activeOwner: ActiveOwner | null = null;
+let boundLedgerHome: string | null = null;
+/**
+ * Identity of the current ownership, not just of the home it covers.
+ *
+ * A home name alone cannot tell "still the lease I was built under" from "the same directory,
+ * owned again since". A ledger that only checked the home therefore came back to life across a
+ * release and a reacquire, writing totals it had accumulated before another writer owned the
+ * journal. Every acquisition that actually takes the lock mints a new value.
+ */
+let ownerGeneration = 0;
+const releaseHooks: Array<() => void> = [];
+
+/**
+ * Run when the last lease on a state directory goes away.
+ *
+ * The ledger singleton is bound to the home it was built for, so it has to go when ownership
+ * does; otherwise a process that starts a second server against a different state directory
+ * either writes the old home's journal or is refused for a conflict it no longer has. The
+ * journal on disk is the durable record and construction replays it, so nothing is lost.
+ */
+export function onSpendLedgerOwnerReleased(hook: () => void): void {
+  releaseHooks.push(hook);
+}
+
+function errorCode(error: unknown): unknown {
+  return error !== null && typeof error === "object" && "code" in error ? error.code : undefined;
+}
+
+function assertPrivateFile(path: string): void {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger ownership could not be established safely.",
+    );
+  }
+  if (process.platform !== "win32" && stat.uid !== process.getuid!()) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger ownership could not be established safely.",
+    );
+  }
+}
+
+function prepareOwnerPath(configDir: string): { home: string; path: string } {
+  const requested = resolve(configDir);
+  // First statement before mutation: tests must never acquire against the real user home.
+  assertNotRealHomeUnderTest(requested);
+  mkdirSync(requested, { recursive: true, mode: 0o700 });
+  const home = realpathSync.native(requested);
+  if (process.platform !== "win32") chmodSync(home, 0o700);
+  hardenSecretDir(home, { required: true });
+  const path = join(home, SPEND_LEDGER_OWNER_FILENAME);
+  // Registered while the directory is still EMPTY. Config ownership refuses to claim a
+  // directory that already has contents, so creating the database first meant a fresh home
+  // never got an ownership marker at all: the manifest was never written, and the database and
+  // its sidecars were left behind by a later uninstall because nothing recorded them.
+  recordOwnedConfigPath(home, path);
+  for (const suffix of OWNER_SIDECARS) recordOwnedConfigPath(home, `${path}${suffix}`);
+  try { closeSync(openSync(path, "wx", 0o600)); }
+  catch (error) { if (errorCode(error) !== "EEXIST") throw error; }
+  assertPrivateFile(path);
+  if (process.platform !== "win32") chmodSync(path, 0o600);
+  hardenSecretPath(path, { required: true });
+  assertPrivateFile(path);
+  return { home: process.platform === "win32" ? home.toLowerCase() : home, path };
+}
+
+function isBusy(error: unknown): boolean {
+  const code = errorCode(error);
+  const message = error instanceof Error ? error.message : "";
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED"
+    || /database (?:is|table is) locked/i.test(message);
+}
+
+function stateDirectoryIdentity(configDir: string): string {
+  const requested = resolve(configDir);
+  assertNotRealHomeUnderTest(requested);
+  let canonical = requested;
+  try { canonical = realpathSync.native(requested); } catch { /* acquisition owns creation */ }
+  return process.platform === "win32" ? canonical.toLowerCase() : canonical;
+}
+
+function restartHandoffWaitMs(): number {
+  const markedParent = process.env[SPEND_LEDGER_RESTART_PARENT_ENV];
+  delete process.env[SPEND_LEDGER_RESTART_PARENT_ENV];
+  return markedParent === String(process.ppid) ? SPEND_LEDGER_RESTART_WAIT_MS : 0;
+}
+
+/** Mark only a parent-exit restart child for bounded lease acquisition. */
+export function spendLedgerRestartEnvironment(
+  source: NodeJS.ProcessEnv,
+  parentPid?: number,
+): NodeJS.ProcessEnv {
+  const env = { ...source };
+  if (parentPid === undefined) delete env[SPEND_LEDGER_RESTART_PARENT_ENV];
+  else env[SPEND_LEDGER_RESTART_PARENT_ENV] = String(parentPid);
+  return env;
+}
+
+/**
+ * Hold one SQLite write transaction until the final in-process reference releases it.
+ * SQLite and the OS release a crashed process; no PID, timestamp, TTL or lock-file unlink
+ * can evict a live owner or mistake a reused process identity for this lease.
+ */
+export function acquireSpendLedgerOwner(configDir = getConfigDir()): SpendLedgerOwnerLease {
+  const requestedHome = stateDirectoryIdentity(configDir);
+  const busyTimeout = restartHandoffWaitMs();
+  if (boundLedgerHome !== null && boundLedgerHome !== requestedHome) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_HOME_CONFLICT",
+      "This process already owns the spend ledger for a different state directory.",
+    );
+  }
+  if (activeOwner) {
+    if (activeOwner.home !== requestedHome) {
+      throw new SpendLedgerOwnerError(
+        "SPEND_LEDGER_OWNER_HOME_CONFLICT",
+        "This process already owns the spend ledger for a different state directory.",
+      );
+    }
+    activeOwner.references += 1;
+    return leaseFor(activeOwner);
+  }
+
+  let prepared: { home: string; path: string };
+  try {
+    prepared = prepareOwnerPath(configDir);
+  } catch (cause) {
+    if (cause instanceof SpendLedgerOwnerError) throw cause;
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger ownership could not be established safely.",
+      { cause },
+    );
+  }
+
+  let database: Database | undefined;
+  try {
+    database = new Database(prepared.path, { create: true });
+    database.exec(`PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = ${busyTimeout}; BEGIN IMMEDIATE`);
+  } catch (cause) {
+    try { database?.close(); } catch { /* preserve acquisition failure */ }
+    if (isBusy(cause)) {
+      throw new SpendLedgerOwnerError(
+        "SPEND_LEDGER_OWNER_BUSY",
+        "Another OpenCodex process already owns this spend ledger. Use a separate OPENCODEX_HOME for an independent instance.",
+      );
+    }
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger ownership could not be established safely.",
+      { cause },
+    );
+  }
+
+  activeOwner = { home: prepared.home, database, references: 1 };
+  ownerGeneration += 1;
+  return leaseFor(activeOwner);
+}
+
+function leaseFor(owner: ActiveOwner): SpendLedgerOwnerLease {
+  let released = false;
+  return Object.freeze({
+    release(): void {
+      if (released) return;
+      released = true;
+      if (activeOwner !== owner || owner.references < 1) return;
+      owner.references -= 1;
+      if (owner.references > 0) return;
+      activeOwner = null;
+      boundLedgerHome = null;
+      for (const hook of releaseHooks) {
+        try { hook(); } catch { /* a discard hook must not mask a release failure */ }
+      }
+      let failure: unknown;
+      try { owner.database.exec("ROLLBACK"); } catch (error) { failure = error; }
+      try { owner.database.close(); } catch (error) { failure ??= error; }
+      if (failure !== undefined) {
+        throw new SpendLedgerOwnerError(
+          "SPEND_LEDGER_OWNER_UNAVAILABLE",
+          "Spend-ledger ownership could not be released cleanly.",
+          { cause: failure },
+        );
+      }
+    },
+  });
+}
+
+/** The ownership a ledger was built under, to be handed back on every later use. */
+export function currentSpendLedgerOwnerGeneration(): number {
+  return ownerGeneration;
+}
+
+/**
+ * Permission to touch one file under the owned state directory, for as long as this exact
+ * ownership lasts.
+ *
+ * A callback supplied by the caller cannot be this proof: the caller can pass one that does
+ * nothing, which is how a "required guard" still allowed an unowned write. A marker carried ON
+ * the object is not proof either, because an object spread copies it: `{ ...minted, path:
+ * elsewhere, assert() {} }` would look minted while pointing somewhere else. So the token
+ * carries nothing. The path and the ownership it was minted under live in a table only this
+ * module can read, keyed by the token's identity, and a copy is simply not that key.
+ */
+export interface SpendLedgerStorage {
+  readonly __spendLedgerStorage: unique symbol;
+}
+
+const mintedStorage = new WeakMap<object, { readonly path: string; readonly generation: number; readonly home: string }>();
+
+function trustedStorage(storage: SpendLedgerStorage): { readonly path: string; readonly generation: number; readonly home: string } {
+  const entry = typeof storage === "object" && storage !== null ? mintedStorage.get(storage) : undefined;
+  if (!entry) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_NOT_HELD",
+      "Spend-ledger ownership is required before the shared ledger can be used.",
+    );
+  }
+  return entry;
+}
+
+/**
+ * Mint storage permission for one file name directly under the owned state directory.
+ *
+ * The name is a file name, never a path: joining a caller-supplied path would let the caller
+ * choose the destination, which is the thing ownership is supposed to decide.
+ */
+export function mintSpendLedgerStorage(fileName: string): SpendLedgerStorage {
+  if (fileName.includes("/") || fileName.includes("\\") || fileName === "." || fileName === "..") {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger storage could not be established safely.",
+    );
+  }
+  assertSpendLedgerOwnerHeld();
+  const owner = activeOwner;
+  if (!owner) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_NOT_HELD",
+      "Spend-ledger ownership is required before the shared ledger can be used.",
+    );
+  }
+  const generation = ownerGeneration;
+  const home = owner.home;
+  // The token is deliberately empty: everything trustworthy about it is held here, under its
+  // identity, where a spread cannot reach.
+  const token = Object.freeze({}) as unknown as SpendLedgerStorage;
+  mintedStorage.set(token, { path: join(home, fileName), generation, home });
+  return token;
+}
+
+/** The file this token stands for, as this module recorded it at mint time. */
+export function spendLedgerStoragePath(storage: SpendLedgerStorage): string {
+  return trustedStorage(storage).path;
+}
+
+/**
+ * Refuse unless this exact token was minted here and its ownership is still current.
+ *
+ * Both halves matter: identity rules out a copy or a look-alike, and the generation rules out a
+ * token minted before the lock was dropped and taken again.
+ */
+export function assertStorageOwned(storage: SpendLedgerStorage): void {
+  const entry = trustedStorage(storage);
+  assertSpendLedgerOwnerGeneration(entry.generation, entry.home);
+}
+
+/**
+ * Refuse a handle built under an ownership that has since ended.
+ *
+ * The state directory may be the same one; what matters is that the lock was dropped and taken
+ * again in between, because another process could have written the journal while it was free.
+ */
+export function assertSpendLedgerOwnerGeneration(generation: number, configDir = getConfigDir()): void {
+  assertSpendLedgerOwnerHeld(configDir);
+  if (generation !== ownerGeneration) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_NOT_HELD",
+      "Spend-ledger ownership is required before the shared ledger can be used.",
+    );
+  }
+}
+
+/** The singleton journal may be touched only while its matching state directory is owned. */
+export function assertSpendLedgerOwnerHeld(configDir = getConfigDir()): void {
+  let home: string;
+  try {
+    const canonical = realpathSync.native(resolve(configDir));
+    home = process.platform === "win32" ? canonical.toLowerCase() : canonical;
+  } catch (cause) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_NOT_HELD",
+      "Spend-ledger ownership is required before the shared ledger can be used.",
+      { cause },
+    );
+  }
+  if (!activeOwner || activeOwner.home !== home || activeOwner.references < 1) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_NOT_HELD",
+      "Spend-ledger ownership is required before the shared ledger can be used.",
+    );
+  }
+}
+
+/** Permanently bind the live process-wide singleton to its first constructed home. */
+export function bindSpendLedgerOwnerHome(configDir = getConfigDir()): void {
+  assertSpendLedgerOwnerHeld(configDir);
+  const home = stateDirectoryIdentity(configDir);
+  if (boundLedgerHome !== null && boundLedgerHome !== home) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_HOME_CONFLICT",
+      "This process already owns the spend ledger for a different state directory.",
+    );
+  }
+  boundLedgerHome = home;
+}
+
+export function spendLedgerOwnerSnapshot(): { readonly ownership: "held" | "unheld" } {
+  return { ownership: activeOwner ? "held" : "unheld" };
+}
+
+/** Test seam paired with discarding the process-wide ledger singleton. */
+export function resetSpendLedgerOwnerBindingForTest(): void {
+  boundLedgerHome = null;
+}
diff --git a/src/lib/spend-reservation-ledger.ts b/src/lib/spend-reservation-ledger.ts
index 5c10efca770..1a7ff2b4c64 100644
--- a/src/lib/spend-reservation-ledger.ts
+++ b/src/lib/spend-reservation-ledger.ts
@@ -24,11 +24,10 @@
  * released. Minting a new root id mints no new budget because the identity and pool scopes
  * still hold the spend.
  *
- * SUPPORTED TOPOLOGY: this guarantees a single proxy process against its own journal. The
- * file is append-friendly, but nothing here serializes two live processes writing it, so a
- * second proxy sharing the same OPENCODEX_HOME is explicitly outside the guarantee -- that
- * needs a shared store with cross-process atomicity and is declared out of scope rather
- * than implied.
+ * SUPPORTED TOPOLOGY: one live writer owns one OPENCODEX_HOME journal. Every server and
+ * direct shared-ledger caller must hold the state-directory SQLite lease before replay,
+ * append or compaction. Independent homes remain independent; multi-host shared storage
+ * still needs a distributed transaction boundary and is outside this local lease.
  *
  * Five properties this file owes its callers. Each one was absent in the first draft, and a
  * budget that can be bypassed is worse than no budget because it looks like protection:
@@ -54,7 +53,7 @@
  *    that are re-applied to an EXISTING file rather than trusted from its creation.
  */
 
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
 import { dirname, join } from "node:path";
 // Definition-site import, not the ../config barrel -- same reasoning as
@@ -66,6 +65,12 @@ import type { OcxSpendConfig, OcxSpendScopeConfig } from "../types/config";
 import { assertNotRealHomeUnderTest } from "./test-home-guard";
 // Windows chmod does not remove inherited ACEs; this is the repository's icacls path.
 import { hardenSecretPath } from "./windows-secret-acl";
+import { assertSpendLedgerOwnerHeld, assertStorageOwned, bindSpendLedgerOwnerHome, mintSpendLedgerStorage, onSpendLedgerOwnerReleased, resetSpendLedgerOwnerBindingForTest, SpendLedgerOwnerError, spendLedgerOwnerSnapshot, spendLedgerStoragePath, type SpendLedgerStorage } from "./spend-ledger-owner";
+
+// The singleton belongs to the state directory it was built for. Releasing ownership hands that
+// directory to whoever comes next, so the in-memory copy goes with it and the next construction
+// replays the journal.
+onSpendLedgerOwnerReleased(() => { sharedLedger = undefined; });
 
 export const SPEND_LEDGER_JOURNAL_FILENAME = "spend-ledger.jsonl";
 /**
@@ -391,7 +396,70 @@ function hardenLedgerFile(path: string, options: { readonly force?: boolean } =
   } catch { /* best-effort: a non-owner cannot chmod */ }
 }
 
-export function createFileSpendJournal(path: string): SpendJournal {
+/**
+ * Fault injection for the journal's own filesystem steps. Internal test contract, not config.
+ *
+ * The compaction cleanup only runs when a step after the exclusive create fails, and there is no
+ * portable way to make a validate, harden or rename fail on demand. Without a seam the cleanup
+ * would ship asserted by reading alone, which is how a failure path stays broken.
+ */
+export type SpendJournalFaultStep = "stat" | "create" | "write" | "validate" | "harden" | "rename";
+
+let journalFaultForTests: ((step: SpendJournalFaultStep, temp: string) => void) | undefined;
+
+export function setSpendJournalFaultForTests(
+  fault: ((step: SpendJournalFaultStep, temp: string) => void) | undefined,
+): void {
+  journalFaultForTests = fault;
+}
+
+/**
+ * Does a directory entry exist here, whatever it points at?
+ *
+ * `existsSync` follows the link, so a symlink whose target is absent reads as "no file" and an
+ * append then creates that target somewhere else entirely. The entry itself is what decides
+ * whether the safety check runs.
+ */
+function ledgerEntryExists(path: string): boolean {
+  try {
+    journalFaultForTests?.("stat", path);
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    // Only a genuinely absent entry is absent. Treating every failure as "no file" meant a
+    // permission denial or an I/O error skipped assertSafeLedgerFile entirely and let the
+    // append proceed against whatever is actually there, which is the case that check exists
+    // for. An entry we cannot inspect is a refusal, not an empty slot.
+    //
+    // Raised as the module's typed error rather than the raw fs error: the path and errno of a
+    // state file are not something a client should be handed.
+    if ((error as NodeJS.ErrnoException | null)?.code === "ENOENT") return false;
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger storage could not be inspected safely.",
+      { cause: error },
+    );
+  }
+}
+
+function assertSafeLedgerFile(path: string): void {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1
+    || (process.platform !== "win32" && stat.uid !== process.getuid!())) {
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger storage could not be opened safely.",
+    );
+  }
+}
+
+/**
+ * The production journal. Its location comes from the owned state directory and every touch
+ * proves that ownership, so there is no entrypoint here that writes a caller-chosen path.
+ */
+export function createOwnedFileSpendJournal(storage: SpendLedgerStorage): SpendJournal {
+  assertStorageOwned(storage);
+  const path = spendLedgerStoragePath(storage);
   const ensureDir = (): string => {
     const dir = dirname(path);
     // The guard runs before any mutation so a rejected write leaves nothing behind.
@@ -401,26 +469,66 @@ export function createFileSpendJournal(path: string): SpendJournal {
   };
   return {
     read(): string[] {
-      if (!existsSync(path)) return [];
+      assertStorageOwned(storage);
+      if (!ledgerEntryExists(path)) return [];
+      assertSafeLedgerFile(path);
       // Replay is once per process and is the moment a journal inherited from an older build
       // or a restored backup first passes through here.
       hardenLedgerFile(path, { force: true });
       return readFileSync(path, "utf8").split("\n").filter((line) => line.length > 0);
     },
     append(line: string): void {
+      assertStorageOwned(storage);
       ensureDir();
-      const created = !existsSync(path);
+      const created = !ledgerEntryExists(path);
+      if (!created) assertSafeLedgerFile(path);
       appendFileSync(path, line + "\n", { encoding: "utf8", mode: 0o600 });
+      assertSafeLedgerFile(path);
       hardenLedgerFile(path, { force: created });
     },
     rewrite(lines: string[]): void {
+      assertStorageOwned(storage);
       ensureDir();
       // Same directory, so the rename is atomic on the same filesystem: a crash mid-compaction
       // leaves either the old journal or the new one, never a half-written ledger.
-      const temp = `${path}.compact-${process.pid}`;
-      writeFileSync(temp, lines.map((line) => line + "\n").join(""), { encoding: "utf8", mode: 0o600 });
-      hardenLedgerFile(temp, { force: true });
-      renameSync(temp, path);
+      if (ledgerEntryExists(path)) assertSafeLedgerFile(path);
+      const temp = `${path}.compact-${process.pid}-${randomBytes(6).toString("hex")}`;
+      // The creation is INSIDE the cleanup, not before it. The name carries random bytes, so a
+      // failure anywhere after the entry exists used to leave a uniquely named file and the next
+      // attempt made another: repeated failures accumulated instead of overwriting one fixed
+      // name. Only an entry this call created is removed, so a name that turned out to belong to
+      // something else is left alone, and the original journal and the primary error survive.
+      let fd: number | undefined;
+      let created = false;
+      let renamed = false;
+      try {
+        // Exclusive create FIRST, so "this entry is ours" is a fact rather than a guess about
+        // which error a combined write threw. EEXIST leaves created false and the name is left
+        // alone; every failure after this point is cleaned because the entry is provably ours,
+        // including a write that stopped partway through.
+        journalFaultForTests?.("create", temp);
+        fd = openSync(temp, "wx", 0o600);
+        created = true;
+        journalFaultForTests?.("write", temp);
+        writeFileSync(fd, lines.map((line) => line + "\n").join(""), { encoding: "utf8" });
+        closeSync(fd);
+        fd = undefined;
+        journalFaultForTests?.("validate", temp);
+        assertSafeLedgerFile(temp);
+        journalFaultForTests?.("harden", temp);
+        hardenLedgerFile(temp, { force: true });
+        journalFaultForTests?.("rename", temp);
+        renameSync(temp, path);
+        renamed = true;
+      } finally {
+        if (fd !== undefined) {
+          try { closeSync(fd); } catch { /* the compaction failure is the one to report */ }
+        }
+        if (created && !renamed) {
+          try { unlinkSync(temp); } catch { /* same */ }
+        }
+      }
+      assertSafeLedgerFile(path);
       hardenLedgerFile(path, { force: true });
     },
   };
@@ -433,17 +541,26 @@ export function createFileSpendJournal(path: string): SpendJournal {
  * recorded spend, which would hand every scope a fresh allowance -- so it is a file, not a
  * per-process value.
  */
-export function loadOrCreateSpendLedgerSalt(path: string): string {
-  if (existsSync(path)) {
+export function loadOrCreateSpendLedgerSalt(storage: SpendLedgerStorage): string {
+  assertStorageOwned(storage);
+  const path = spendLedgerStoragePath(storage);
+  if (ledgerEntryExists(path)) {
+    assertSafeLedgerFile(path);
     hardenLedgerFile(path, { force: true });
     const existing = readFileSync(path, "utf8").trim();
     if (/^[0-9a-f]{32,}$/.test(existing)) return existing;
+    throw new SpendLedgerOwnerError(
+      "SPEND_LEDGER_OWNER_UNAVAILABLE",
+      "Spend-ledger storage could not be opened safely.",
+    );
   }
   const dir = dirname(path);
+  assertStorageOwned(storage);
   assertNotRealHomeUnderTest(dir);
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   const salt = randomBytes(32).toString("hex");
-  writeFileSync(path, salt + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileSync(path, salt + "\n", { encoding: "utf8", mode: 0o600, flag: "wx" });
+  assertSafeLedgerFile(path);
   hardenLedgerFile(path, { force: true });
   return salt;
 }
@@ -529,6 +646,12 @@ export function createSpendReservationLedger(options: {
    * no file anyone could correlate.
    */
   readonly salt?: string;
+  /**
+   * Shared production ledgers prove their exact ownership before reading or changing
+   * accounting. Identity, not just the directory name: a handle kept across a release and a
+   * reacquire describes a journal another writer may have changed in between.
+   */
+  readonly assertOwnedAccounting?: () => void;
 } = {}): SpendReservationLedger {
   // Mutable because the ceilings are operator configuration, and configuration is reloadable.
   // The three bounds below are read through functions for the same reason: a value captured
@@ -538,6 +661,7 @@ export function createSpendReservationLedger(options: {
   const journal = options.journal;
   const now = options.now ?? (() => Date.now());
   const salt = options.salt ?? "";
+  const assertOwnedAccounting = options.assertOwnedAccounting;
   const maxTrackedScopes = (): number => policy.maxTrackedScopes ?? DEFAULT_MAX_TRACKED_SCOPES;
   const maxTrackedSends = (): number => policy.maxTrackedSends ?? DEFAULT_MAX_TRACKED_SENDS;
   const compactAfterRecords = (): number => policy.compactAfterRecords ?? DEFAULT_COMPACT_AFTER_RECORDS;
@@ -592,7 +716,8 @@ export function createSpendReservationLedger(options: {
       journal.append(JSON.stringify(record));
       recordsOnDisk += 1;
       return true;
-    } catch {
+    } catch (error) {
+      if (error instanceof SpendLedgerOwnerError) throw error;
       // In-memory state still bounds this process; the counter is how a caller learns the
       // restart guarantee degraded instead of discovering it after the fact.
       persistFailures += 1;
@@ -819,7 +944,8 @@ export function createSpendReservationLedger(options: {
     try {
       rewrite.call(journal, [JSON.stringify(checkpoint)]);
       recordsOnDisk = 1;
-    } catch {
+    } catch (error) {
+      if (error instanceof SpendLedgerOwnerError) throw error;
       // Compaction is maintenance, not accounting: a failed rewrite leaves the previous
       // journal intact and every figure in it still replayable.
       persistFailures += 1;
@@ -844,12 +970,15 @@ export function createSpendReservationLedger(options: {
   };
 
   return {
-    get persistFailures() { return persistFailures; },
-    get corruptRecords() { return corruptRecords; },
-    get degraded() { return persistFailures > 0 || corruptRecords > 0; },
-    get policy() { return policy; },
+    // Every figure this ledger reports describes a journal it must still own. Reporting one
+    // after ownership ended is the same error as writing then, with a quieter symptom.
+    get persistFailures() { assertOwnedAccounting?.(); return persistFailures; },
+    get corruptRecords() { assertOwnedAccounting?.(); return corruptRecords; },
+    get degraded() { assertOwnedAccounting?.(); return persistFailures > 0 || corruptRecords > 0; },
+    get policy() { assertOwnedAccounting?.(); return policy; },
 
     reserve(request: SpendReservationRequest): SpendReservationDecision {
+      assertOwnedAccounting?.();
       const tokens = sanitizeTokens(request.inputTokens) + sanitizeTokens(request.outputCeilingTokens);
       const at = request.at ?? now();
       const send = aliasFor("send", request.sendId);
@@ -904,6 +1033,7 @@ export function createSpendReservationLedger(options: {
     },
 
     markDispatched(sendId: string): boolean {
+      assertOwnedAccounting?.();
       const send = aliasFor("send", sendId);
       const reservation = reservations.get(send);
       if (!reservation || reservation.status !== "open") return false;
@@ -914,6 +1044,7 @@ export function createSpendReservationLedger(options: {
     },
 
     abandon(sendId: string): boolean {
+      assertOwnedAccounting?.();
       const send = aliasFor("send", sendId);
       const reservation = reservations.get(send);
       // Only an UNDISPATCHED reservation may be released for free. Once bytes have left for
@@ -926,6 +1057,7 @@ export function createSpendReservationLedger(options: {
     },
 
     settle(sendId: string, usage: SpendUsage): boolean {
+      assertOwnedAccounting?.();
       const send = aliasFor("send", sendId);
       const reservation = reservations.get(send);
       if (!reservation || !isLive(reservation.status)) return false;
@@ -937,6 +1069,7 @@ export function createSpendReservationLedger(options: {
     },
 
     markLost(sendId: string): boolean {
+      assertOwnedAccounting?.();
       const send = aliasFor("send", sendId);
       const reservation = reservations.get(send);
       if (!reservation || !isLive(reservation.status)) return false;
@@ -947,10 +1080,14 @@ export function createSpendReservationLedger(options: {
     },
 
     knows(sendId: string): boolean {
+      assertOwnedAccounting?.();
       return reservations.has(aliasFor("send", sendId));
     },
 
     snapshot(scope: SpendScope, scopeId: string): ScopeSpendSnapshot | undefined {
+      // Reading accounting from a handle whose ownership has ended is as wrong as writing it:
+      // the figures describe a journal this process no longer owns.
+      assertOwnedAccounting?.();
       const state = scopes.get(scopeKey(scope, aliasFor(scope, scopeId)));
       if (!state) return undefined;
       return {
@@ -962,11 +1099,13 @@ export function createSpendReservationLedger(options: {
     },
 
     exhausted(scope: SpendScope, scopeId: string): boolean {
+      assertOwnedAccounting?.();
       const state = scopes.get(scopeKey(scope, aliasFor(scope, scopeId)));
       return state !== undefined && isExhausted(scope, state);
     },
 
     prune(at: number = now()): void {
+      assertOwnedAccounting?.();
       // Removal requires BOTH inactive and not exhausted inside the window. An
       // exhausted-but-idle scope that was dropped would be recreated fresh under the
       // same id -- the exact laundering the ceiling exists to stop.
@@ -975,6 +1114,7 @@ export function createSpendReservationLedger(options: {
     },
 
     reconfigure(next: SpendReservationPolicy): void {
+      assertOwnedAccounting?.();
       policy = next;
     },
   };
@@ -1036,6 +1176,12 @@ export function spendPolicyFromConfig(spend: OcxSpendConfig | undefined): SpendR
  * configures no ceiling must not open a journal merely because the server started.
  */
 export function configureSharedSpendLedger(policy: SpendReservationPolicy): void {
+  // Recording a policy value touches no journal, so it needs no ownership. Changing a ledger
+  // that already exists does, because that ledger is a live view of an owned directory.
+  if (sharedLedger) {
+    assertSpendLedgerOwnerHeld();
+    bindSpendLedgerOwnerHome();
+  }
   sharedPolicy = policy;
   sharedLedger?.reconfigure(policy);
 }
@@ -1043,22 +1189,67 @@ export function configureSharedSpendLedger(policy: SpendReservationPolicy): void
 /**
  * Process-wide ledger backed by the journal under OPENCODEX_HOME. Created lazily so
  * importing the module -- or running a request path that never reserves -- touches no
- * disk.
+ * disk. One directory at a time, not one directory for the life of the process: the singleton
+ * is discarded when its ownership ends, so a later directory replays its own journal rather
+ * than inheriting figures from the previous one.
  */
 export function sharedSpendLedger(): SpendReservationLedger {
+  assertSpendLedgerOwnerHeld();
+  bindSpendLedgerOwnerHome();
   if (!sharedLedger) {
-    const home = getConfigDir();
+    // Minted by the owner module from the directory it actually owns, and carrying the exact
+    // ownership they were minted under. Nothing here chooses a path or supplies its own guard.
+    const journalStorage = mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME);
+    const saltStorage = mintSpendLedgerStorage(SPEND_LEDGER_SALT_FILENAME);
+    const journalPath = spendLedgerStoragePath(journalStorage);
+    const saltPath = spendLedgerStoragePath(saltStorage);
+    const assertOwnedAccounting = (): void => {
+      assertStorageOwned(journalStorage);
+      if (ledgerEntryExists(journalPath)) assertSafeLedgerFile(journalPath);
+      if (ledgerEntryExists(saltPath)) assertSafeLedgerFile(saltPath);
+    };
     sharedLedger = createSpendReservationLedger({
-      journal: createFileSpendJournal(join(home, SPEND_LEDGER_JOURNAL_FILENAME)),
-      salt: loadOrCreateSpendLedgerSalt(join(home, SPEND_LEDGER_SALT_FILENAME)),
+      journal: createOwnedFileSpendJournal(journalStorage),
+      salt: loadOrCreateSpendLedgerSalt(saltStorage),
       policy: sharedPolicy,
+      assertOwnedAccounting,
     });
   }
   return sharedLedger;
 }
 
-/** Test seam. Production never discards the ledger: that would reset a spent budget. */
+const MAX_DIAGNOSTIC_ERROR_COUNT = 1_000_000;
+
+/** Scalar-only and side-effect-free: reading diagnostics never constructs or replays. */
+export function spendLedgerDiagnosticsSnapshot(): {
+  readonly ownership: "held" | "unheld";
+  readonly initialized: boolean;
+  readonly configured: boolean;
+  readonly degraded: boolean;
+  readonly persistFailures: number;
+  readonly corruptRecords: number;
+} {
+  const ledger = sharedLedger;
+  const bounded = (value: number): number => Math.min(MAX_DIAGNOSTIC_ERROR_COUNT, Math.max(0, value));
+  return {
+    ...spendLedgerOwnerSnapshot(),
+    initialized: ledger !== undefined,
+    configured: spendCeilingsConfigured(sharedPolicy),
+    degraded: ledger?.degraded ?? false,
+    persistFailures: bounded(ledger?.persistFailures ?? 0),
+    corruptRecords: bounded(ledger?.corruptRecords ?? 0),
+  };
+}
+
+/**
+ * Test seam for discarding the singleton outright.
+ *
+ * Production discards it too, but only with the ownership it belongs to, which is what
+ * `onSpendLedgerOwnerReleased` does. Neither path resets a spent budget: the journal is the
+ * durable record and the next construction replays it.
+ */
 export function resetSharedSpendLedgerForTest(): void {
   sharedLedger = undefined;
   sharedPolicy = DEFAULT_SPEND_RESERVATION_POLICY;
+  resetSpendLedgerOwnerBindingForTest();
 }
diff --git a/src/lib/windows-system-proxy.ts b/src/lib/windows-system-proxy.ts
index 1316698b235..d347921c6bc 100644
--- a/src/lib/windows-system-proxy.ts
+++ b/src/lib/windows-system-proxy.ts
@@ -16,7 +16,7 @@ import { decodeWindowsTextBytes } from "./windows-text";
 const INTERNET_SETTINGS_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
 
 export type WindowsSystemProxyResult =
-  | { kind: "proxy"; url: string }
+  | { kind: "proxy"; httpUrl?: string; httpsUrl?: string }
   | { kind: "disabled" }
   | { kind: "socks-only" }
   | { kind: "unsupported" }
@@ -63,35 +63,40 @@ export function readWindowsProxyRegistry(): WindowsProxyRegistryValues | null {
 
 /**
  * `ProxyServer` is either a bare `host:port` (applies to every scheme) or a semicolon list of
- * `scheme=host:port` entries. Prefer the https entry, then http; a SOCKS-only value cannot be
- * mirrored into HTTP_PROXY/HTTPS_PROXY.
+ * `scheme=host:port` entries. Bare values apply to both HTTP and HTTPS destinations; per-scheme
+ * values retain their WinINET scope. A SOCKS-only value cannot be mirrored into HTTP(S)_PROXY.
  */
-export function parseWindowsProxyServer(value: string): { kind: "proxy"; url: string } | { kind: "socks-only" } | { kind: "disabled" } {
+export function parseWindowsProxyServer(value: string): Extract<WindowsSystemProxyResult, { kind: "proxy" | "socks-only" | "disabled" }> {
   const trimmed = value.trim();
   if (!trimmed) return { kind: "disabled" };
-  if (!trimmed.includes("=")) return normalize(trimmed);
+  if (!trimmed.includes("=")) {
+    const url = normalize(trimmed);
+    return url ? { kind: "proxy", httpUrl: url, httpsUrl: url } : { kind: "disabled" };
+  }
   const entries = new Map<string, string>();
   for (const part of trimmed.split(";")) {
     const eq = part.indexOf("=");
     if (eq <= 0) continue;
     entries.set(part.slice(0, eq).trim().toLowerCase(), part.slice(eq + 1).trim());
   }
-  const candidate = entries.get("https") || entries.get("http");
-  if (candidate) return normalize(candidate);
+  const httpUrl = normalize(entries.get("http") ?? "");
+  const httpsUrl = normalize(entries.get("https") ?? "");
+  if (httpUrl || httpsUrl) return { kind: "proxy", ...(httpUrl && { httpUrl }), ...(httpsUrl && { httpsUrl }) };
   if (entries.has("socks")) return { kind: "socks-only" };
   return { kind: "disabled" };
 }
 
-function normalize(hostPort: string): { kind: "proxy"; url: string } | { kind: "disabled" } {
+function normalize(hostPort: string): string | undefined {
+  if (!hostPort) return undefined;
   const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(hostPort) ? hostPort : `http://${hostPort}`;
   try {
     const url = new URL(withScheme);
-    if (!url.hostname || (url.protocol !== "http:" && url.protocol !== "https:")) return { kind: "disabled" };
+    if (!url.hostname || (url.protocol !== "http:" && url.protocol !== "https:")) return undefined;
     // Keep userinfo: a credentialed proxy is valid in HTTP_PROXY. Only the log strips it.
     const auth = url.username ? `${url.username}${url.password ? `:${url.password}` : ""}@` : "";
-    return { kind: "proxy", url: `${url.protocol}//${auth}${url.host}` };
+    return `${url.protocol}//${auth}${url.host}`;
   } catch {
-    return { kind: "disabled" };
+    return undefined;
   }
 }
 
diff --git a/src/oauth/callback-server.ts b/src/oauth/callback-server.ts
index a9d4b7f0034..f6c4c706f88 100644
--- a/src/oauth/callback-server.ts
+++ b/src/oauth/callback-server.ts
@@ -252,9 +252,10 @@ export abstract class OAuthCallbackFlow {
                 if (!parsed.code) return null;
                 // Kind-aware state enforcement: url/query-shaped input is an authorization
                 // RESPONSE and must carry a matching state — missing state is rejected, not
-                // downgraded to raw. Only a syntactically raw code (same PKCE session) is
-                // exempt, so the CLI/GUI paste fallback still works.
-                if (parsed.kind !== "raw" && expectedState && parsed.state !== expectedState) return null;
+                // downgraded to raw. A raw paste with an explicit code#state suffix is
+                // state-bearing too. Only a syntactically raw code WITHOUT a state suffix
+                // (same PKCE session) is exempt, so the CLI/GUI paste fallback still works.
+                if ((parsed.kind !== "raw" || parsed.state !== undefined) && expectedState && parsed.state !== expectedState) return null;
                 return { code: parsed.code, state: parsed.state ?? expectedState };
               })
               .catch((): CallbackResult | null => null),
diff --git a/src/oauth/generic-account-failover.ts b/src/oauth/generic-account-failover.ts
index b4c912c70d4..db2764d34c0 100644
--- a/src/oauth/generic-account-failover.ts
+++ b/src/oauth/generic-account-failover.ts
@@ -234,6 +234,7 @@ function stableGenericRoster(providerName: string): string[] {
  * quota-less provider off its active account on the very first request.
  */
 function isOverAutoSwitchThreshold(providerName: string, accountId: string, threshold: number, requestedModelId?: string | null): boolean {
+  if (threshold <= 0) return false;
   const headroom = accountHeadroomPercent(providerName, accountId, requestedModelId);
   if (headroom === null) return false;
   return 100 - headroom >= threshold;
diff --git a/src/oauth/health.ts b/src/oauth/health.ts
index 8c4332af850..7f596f13464 100644
--- a/src/oauth/health.ts
+++ b/src/oauth/health.ts
@@ -202,6 +202,7 @@ export function projectStoredOAuthAccountHealth(
 export function projectCodexAccountHealth(input: {
   accountId: string;
   needsReauth: boolean;
+  reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
   now?: number;
 }): OAuthAccountHealth {
   // One read serves every verdict below. Each lookup re-reads and re-hardens the whole store
@@ -230,6 +231,16 @@ export function projectCodexAccountHealth(input: {
 
   const needsReauth = input.needsReauth || validationAuthFailed || terminalGrantFailure;
 
+  // A stored verification failure carries its own cause. When the caller did not name a
+  // reason, surface the persisted one instead of flattening every verdict into
+  // `refresh_failed`.
+  const storedVerificationFailed = validationAuthFailed || terminalGrantFailure;
+  const storedFailureReason: "unauthorized" | "forbidden" | undefined = !storedVerificationFailed
+    ? undefined
+    : record?.lastCodexValidationError === "http_status:403" ? "forbidden"
+      : record?.lastCodexValidationError === "http_status:401" ? "unauthorized"
+      : undefined;
+
   // Deferred validation is only worth reporting while the credential itself is still viable. A
   // revoked grant needs a re-login, not a "Refresh quotas" click, so reauth is resolved first.
   if (!needsReauth && record?.codexValidationPending) {
@@ -239,7 +250,7 @@ export function projectCodexAccountHealth(input: {
   const snap = getCodexAccountHealthSnapshot(input.accountId, now);
   return projectOAuthAccountHealth({
     needsReauth,
-    reauthReason: needsReauth ? "refresh_failed" : undefined,
+    reauthReason: needsReauth ? (input.reauthReason ?? storedFailureReason ?? "refresh_failed") : undefined,
     cooldownUntilMs: snap?.cooldownUntil,
     cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
     now,
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index 471e16534ca..f33a6855c0b 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -1,6 +1,5 @@
 import type { KiroOAuthMetadata, OAuthController, OAuthCredentials } from "./types";
 import { initializeProviderModelSelection } from "../providers/initial-model-selection";
-import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfig } from "../config";
 import { resolveProviderApiKey } from "../providers/key-store";
@@ -51,8 +50,9 @@ import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../provider
 import { resolveProviderTransport } from "../providers/xai-transport";
 import { detectClaudeCodeToken, detectGrokCliToken, hasComparableGrokIdentity, isSameGrokIdentity, shouldAdoptGrokGeneration } from "./local-token-detect";
 import { logOAuthEvent } from "./log";
-import { captureConfigGeneration, sweepExpiredOnWrite, type GenerationContext } from "../lib/state-store-sweeper";
-import { retainedUtf8Bytes } from "../lib/admission";
+import { captureConfigGeneration, sweepExpiredOnWrite } from "../lib/state-store-sweeper";
+import { clearManualCodeSlot, ensureManualCodeSlot, kiroLoginSettling, loginAbort, loginState, waitForManualLoginCode } from "./login-flow-state";
+export { reconcileOAuthFlowState, submitManualLoginCode } from "./login-flow-state";
 import { randomUUID } from "node:crypto";
 export {
   CODEX_HEALTH_AUTH_FAILED_NOTE,
@@ -1710,110 +1710,6 @@ export async function runLogin(
  * localhost), the GUI can POST the final redirect URL or authorization code via
  * submitManualLoginCode(), which feeds OAuthController.onManualCodeInput.
  */
-const loginState = new Map<string, { error?: string; done: boolean }>();
-const loginAbort = new Map<string, AbortController>();
-const kiroLoginSettling = new Set<string>();
-
-/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
-interface ManualCodeSlot {
-  pendingInput?: string;
-  resolve?: (value: string) => void;
-  /** Registered by the callback flow so submits can validate state synchronously. */
-  expectedState?: string;
-}
-const loginManual = new Map<string, ManualCodeSlot>();
-const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
-let lastOAuthFlowReconciledGeneration = 0;
-
-export function reconcileOAuthFlowState(context: GenerationContext): number {
-  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
-  let removed = 0;
-  for (const [provider, state] of loginState) {
-    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
-    if (loginState.delete(provider)) removed += 1;
-    if (loginManual.delete(provider)) removed += 1;
-    if (loginAbort.delete(provider)) removed += 1;
-  }
-  lastOAuthFlowReconciledGeneration = context.generation;
-  return removed;
-}
-
-function clearManualCodeSlot(provider: string): void {
-  loginManual.delete(provider);
-}
-
-function ensureManualCodeSlot(provider: string): ManualCodeSlot {
-  let slot = loginManual.get(provider);
-  if (!slot) {
-    slot = {};
-    loginManual.set(provider, slot);
-  }
-  return slot;
-}
-
-/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
-function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
-  if (signal.aborted) {
-    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-  }
-  const slot = ensureManualCodeSlot(provider);
-  if (expectedState !== undefined) slot.expectedState = expectedState;
-  if (slot.pendingInput !== undefined) {
-    const value = slot.pendingInput;
-    slot.pendingInput = undefined;
-    return Promise.resolve(value);
-  }
-  return new Promise<string>((resolve, reject) => {
-    const onAbort = () => {
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    slot.resolve = (value: string) => {
-      signal.removeEventListener("abort", onAbort);
-      if (slot.resolve === resolve) slot.resolve = undefined;
-      resolve(value);
-    };
-  });
-}
-
-/**
- * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
- * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
- * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
- */
-export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
-  const trimmed = input.trim();
-  if (!trimmed) return { ok: false, error: "empty code" };
-  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
-  const st = loginState.get(provider);
-  if (!st || st.done) return { ok: false, error: "no login in progress" };
-  const slot = ensureManualCodeSlot(provider);
-  // Synchronous validation (validated request/ack): reject un-parseable input and
-  // authorization responses (url/query kind) whose state is missing or mismatched
-  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
-  // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
-  // re-validated by the callback loop.
-  const parsed = parseCallbackInput(trimmed);
-  // Command Code's manual fallback accepts a pasted JSON callback payload
-  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
-  // shared gate so the provider-specific parser can validate it.
-  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
-  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
-  if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
-    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
-    if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };
-  }
-  if (slot.resolve) {
-    const resolve = slot.resolve;
-    slot.resolve = undefined;
-    resolve(trimmed);
-  } else {
-    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
-    slot.pendingInput = trimmed;
-  }
-  return { ok: true };
-}
 
 export interface OAuthAccountSummary {
   id: string;
diff --git a/src/oauth/login-flow-state.ts b/src/oauth/login-flow-state.ts
new file mode 100644
index 00000000000..a3a4951c3f4
--- /dev/null
+++ b/src/oauth/login-flow-state.ts
@@ -0,0 +1,127 @@
+import { parseCallbackInput } from "./callback-server";
+import { retainedUtf8Bytes } from "../lib/admission";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+
+/**
+ * In-flight login flow state and the manual paste slot that feeds it.
+ *
+ * Split out of `index.ts` when that file crossed the repository file-size ratchet at 2009
+ * lines. The cut follows a seam rather than a line count: everything here is bookkeeping for
+ * a login that has started and not yet settled, and none of it reads or writes a stored
+ * credential. `index.ts` re-exports the two public names, so existing importers are unaffected.
+ */
+export const loginState = new Map<string, { error?: string; done: boolean }>();
+export const loginAbort = new Map<string, AbortController>();
+export const kiroLoginSettling = new Set<string>();
+
+/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
+export interface ManualCodeSlot {
+  pendingInput?: string;
+  resolve?: (value: string) => void;
+  /** Registered by the callback flow so submits can validate state synchronously. */
+  expectedState?: string;
+}
+const loginManual = new Map<string, ManualCodeSlot>();
+const OAUTH_PENDING_CODE_MAX_BYTES = 4 * 1024;
+let lastOAuthFlowReconciledGeneration = 0;
+
+export function reconcileOAuthFlowState(context: GenerationContext): number {
+  if (context.generation <= lastOAuthFlowReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [provider, state] of loginState) {
+    if (context.providerNames.has(provider) || !state.done || loginAbort.has(provider)) continue;
+    if (loginState.delete(provider)) removed += 1;
+    if (loginManual.delete(provider)) removed += 1;
+    if (loginAbort.delete(provider)) removed += 1;
+  }
+  lastOAuthFlowReconciledGeneration = context.generation;
+  return removed;
+}
+
+export function clearManualCodeSlot(provider: string): void {
+  loginManual.delete(provider);
+}
+
+export function ensureManualCodeSlot(provider: string): ManualCodeSlot {
+  let slot = loginManual.get(provider);
+  if (!slot) {
+    slot = {};
+    loginManual.set(provider, slot);
+  }
+  return slot;
+}
+
+/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
+export function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
+  if (signal.aborted) {
+    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+  }
+  const slot = ensureManualCodeSlot(provider);
+  if (expectedState !== undefined) slot.expectedState = expectedState;
+  if (slot.pendingInput !== undefined) {
+    const value = slot.pendingInput;
+    slot.pendingInput = undefined;
+    return Promise.resolve(value);
+  }
+  return new Promise<string>((resolve, reject) => {
+    const onAbort = () => {
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    slot.resolve = (value: string) => {
+      signal.removeEventListener("abort", onAbort);
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      resolve(value);
+    };
+  });
+}
+
+/**
+ * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
+ * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
+ * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
+ */
+export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
+  const trimmed = input.trim();
+  if (!trimmed) return { ok: false, error: "empty code" };
+  if (retainedUtf8Bytes(trimmed) > OAUTH_PENDING_CODE_MAX_BYTES) return { ok: false, error: "code too large" };
+  const st = loginState.get(provider);
+  if (!st || st.done) return { ok: false, error: "no login in progress" };
+  const slot = ensureManualCodeSlot(provider);
+  // Synchronous validation (validated request/ack): reject un-parseable input and
+  // authorization responses (url/query kind) whose state is missing or mismatched
+  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
+  // protected — but a raw paste carrying an explicit #state suffix is state-bearing
+  // and checked too. Early posts (flow not yet waiting, no expectedState) are
+  // stashed and re-validated by the callback loop.
+  const parsed = parseCallbackInput(trimmed);
+  // Command Code's manual fallback accepts a pasted JSON callback payload
+  // (`{ apiKey, state, ... }`) which has no `code` param. Let it through the
+  // shared gate so the provider-specific parser can validate it.
+  const isCommandCodeJson = provider === "command-code" && trimmed.startsWith("{") && !parsed.code;
+  if (!parsed.code && !isCommandCodeJson) return { ok: false, error: "no authorization code found in input" };
+  // A raw paste carrying an explicit code#state suffix is state-bearing too: it
+  // must match the expected state rather than bypass validation.
+  const stateBearing = parsed.kind !== "raw" || parsed.state !== undefined;
+  if (stateBearing && slot.expectedState !== undefined) {
+    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
+    if (parsed.state !== slot.expectedState) {
+      return {
+        ok: false,
+        error: parsed.kind === "raw"
+          ? "state mismatch — paste the bare code, or the correct code#state from THIS login attempt"
+          : "state mismatch — paste the redirect URL from THIS login attempt",
+      };
+    }
+  }
+  if (slot.resolve) {
+    const resolve = slot.resolve;
+    slot.resolve = undefined;
+    resolve(trimmed);
+  } else {
+    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
+    slot.pendingInput = trimmed;
+  }
+  return { ok: true };
+}
diff --git a/src/providers/derive.ts b/src/providers/derive.ts
index fb1050522f3..299b95cc413 100644
--- a/src/providers/derive.ts
+++ b/src/providers/derive.ts
@@ -1,5 +1,6 @@
 import type { CodexAccountMode, OcxProviderConfig } from "../types";
 import { cloneFastWire } from "./fastwire";
+import { resolveModelPolicy } from "./resolved-model-policy";
 import {
   PROVIDER_REGISTRY,
   registryEntryForProviderDestination,
@@ -220,6 +221,14 @@ export function applyDirectReasoningEffortContracts(
  */
 export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderConfig {
   const liveModels = registryEntrySupportsLiveModelDiscovery(entry) ? entry.liveModels : false;
+  const staticPolicy = resolveModelPolicy({
+    providerName: entry.id,
+    modelId: entry.defaultModel ?? entry.models?.[0] ?? "__provider_seed__",
+    provider: { adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind },
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    effectiveAuth: { authMode: entry.authKind },
+  }).provider;
   return {
     adapter: entry.adapter,
     baseUrl: entry.baseUrl,
@@ -239,17 +248,17 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     ...(entry.models ? { models: [...entry.models] } : {}),
     ...(liveModels !== undefined ? { liveModels } : {}),
     ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
-    ...(entry.modelContextWindows ? { modelContextWindows: { ...entry.modelContextWindows } } : {}),
-    ...(entry.modelDisplayNames ? { modelDisplayNames: { ...entry.modelDisplayNames } } : {}),
-    ...(entry.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(entry.modelInputModalities) } : {}),
-    ...(entry.modelMaxInputTokens ? { modelMaxInputTokens: { ...entry.modelMaxInputTokens } } : {}),
+    ...(staticPolicy.modelContextWindows ? { modelContextWindows: { ...staticPolicy.modelContextWindows } } : {}),
+    ...(staticPolicy.modelDisplayNames ? { modelDisplayNames: { ...staticPolicy.modelDisplayNames } } : {}),
+    ...(staticPolicy.modelInputModalities ? { modelInputModalities: cloneRecordOfArrays(staticPolicy.modelInputModalities) } : {}),
+    ...(staticPolicy.modelMaxInputTokens ? { modelMaxInputTokens: { ...staticPolicy.modelMaxInputTokens } } : {}),
     ...(entry.defaultMaxOutputTokens !== undefined ? { defaultMaxOutputTokens: entry.defaultMaxOutputTokens } : {}),
-    ...(entry.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...entry.modelMaxOutputTokens } } : {}),
+    ...(staticPolicy.modelMaxOutputTokens ? { modelMaxOutputTokens: { ...staticPolicy.modelMaxOutputTokens } } : {}),
     ...(entry.reasoningEfforts ? { reasoningEfforts: [...entry.reasoningEfforts] } : {}),
-    ...(entry.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(entry.modelReasoningEfforts) } : {}),
-    ...(entry.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...entry.modelDefaultReasoningEfforts } } : {}),
-    ...(entry.reasoningEffortMap ? { reasoningEffortMap: { ...entry.reasoningEffortMap } } : {}),
-    ...(entry.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(entry.modelReasoningEffortMap) } : {}),
+    ...(staticPolicy.modelReasoningEfforts ? { modelReasoningEfforts: cloneRecordOfArrays(staticPolicy.modelReasoningEfforts) } : {}),
+    ...(staticPolicy.modelDefaultReasoningEfforts ? { modelDefaultReasoningEfforts: { ...staticPolicy.modelDefaultReasoningEfforts } } : {}),
+    ...(staticPolicy.reasoningEffortMap ? { reasoningEffortMap: { ...staticPolicy.reasoningEffortMap } } : {}),
+    ...(staticPolicy.modelReasoningEffortMap ? { modelReasoningEffortMap: cloneNestedRecord(staticPolicy.modelReasoningEffortMap) } : {}),
     ...(entry.reasoningWireFormat ? { reasoningWireFormat: entry.reasoningWireFormat } : {}),
     ...(entry.noVisionModels ? { noVisionModels: [...entry.noVisionModels] } : {}),
     ...(entry.noReasoningModels ? { noReasoningModels: [...entry.noReasoningModels] } : {}),
@@ -447,13 +456,16 @@ function applyVerbosityDefaults(prov: OcxProviderConfig, entry: ProviderRegistry
  * was skipped and the reasoning ladder was advertised without summary support — exactly the
  * inconsistency that makes Codex drop the inbound reasoning object.
  *
- * Deliberately narrow: reasoning-summary and effort metadata only, via
+ * Deliberately narrow: reasoning-summary, effort, and replay-compatibility metadata only, via
  * `registryEntryForProviderDestination`, which matches fixed key destinations and refuses
  * templated or overridable base URLs. A custom row keeps its own identity for everything else.
  */
 function enrichReasoningMetadataByDestination(prov: OcxProviderConfig): void {
   const destination = registryEntryForProviderDestination(prov);
   applyReasoningSummaryDefaults(prov, destination?.modelSupportsReasoningSummaries);
+  if (prov.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined) {
+    prov.dropResponsesReasoningItems = destination.dropResponsesReasoningItems;
+  }
   if (destination?.modelReasoningEfforts) {
     prov.modelReasoningEfforts = fillRecordOfArrays(destination.modelReasoningEfforts, prov.modelReasoningEfforts);
   }
@@ -491,6 +503,14 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     modelReasoningEffortMap: prov.modelReasoningEffortMap,
   };
   const seed = providerConfigSeed(entry);
+  const resolvedStatic = resolveModelPolicy({
+    providerName: name,
+    modelId: prov.defaultModel ?? entry.defaultModel ?? "__provider_enrich__",
+    provider: prov,
+    registryEntry: entry,
+    transportMatchedRegistry: true,
+    ...(prov.authMode ? { effectiveAuth: { authMode: prov.authMode } } : {}),
+  }).provider;
   repairStaticModelCatalogProvider(name, prov);
   if (prov.apiKeyTransport === undefined && seed.apiKeyTransport !== undefined) prov.apiKeyTransport = seed.apiKeyTransport;
   if (!prov.defaultModel && seed.defaultModel) prov.defaultModel = seed.defaultModel;
@@ -504,10 +524,8 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (!prov.modelContextWindows && seed.modelContextWindows) prov.modelContextWindows = { ...seed.modelContextWindows };
   // Per-model fill, not all-or-nothing: an operator who renamed ONE model must still receive
   // labels for the rest, and an existing install must pick up newly seeded rows on enrich.
-  if (seed.modelDisplayNames) {
-    prov.modelDisplayNames = { ...seed.modelDisplayNames, ...(prov.modelDisplayNames ?? {}) };
-  }
-  if (seed.modelInputModalities) prov.modelInputModalities = fillRecordOfArrays(seed.modelInputModalities, prov.modelInputModalities);
+  if (resolvedStatic.modelDisplayNames) prov.modelDisplayNames = { ...resolvedStatic.modelDisplayNames };
+  if (resolvedStatic.modelInputModalities) prov.modelInputModalities = cloneRecordOfArrays(resolvedStatic.modelInputModalities);
   if (prov.defaultMaxOutputTokens === undefined && seed.defaultMaxOutputTokens !== undefined) prov.defaultMaxOutputTokens = seed.defaultMaxOutputTokens;
   if (!prov.modelMaxOutputTokens && seed.modelMaxOutputTokens) prov.modelMaxOutputTokens = { ...seed.modelMaxOutputTokens };
   if ((!prov.reasoningEfforts || hasLegacyClinePassReasoningEfforts(name, prov)) && seed.reasoningEfforts) {
@@ -518,9 +536,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   // provider. That split the two planes apart — routing merges these maps per key
   // (mergeRecordFill in src/router.ts), so the wire honored the effort while /v1/models and
   // every client export showed no effort control at all.
-  if (seed.modelReasoningEfforts) {
-    prov.modelReasoningEfforts = fillRecordOfArrays(seed.modelReasoningEfforts, prov.modelReasoningEfforts);
-  }
+  if (resolvedStatic.modelReasoningEfforts) prov.modelReasoningEfforts = cloneRecordOfArrays(resolvedStatic.modelReasoningEfforts);
   if (!prov.modelDefaultReasoningEfforts && seed.modelDefaultReasoningEfforts) prov.modelDefaultReasoningEfforts = { ...seed.modelDefaultReasoningEfforts };
   if (!prov.reasoningEffortMap && seed.reasoningEffortMap) prov.reasoningEffortMap = { ...seed.reasoningEffortMap };
   if (!prov.modelReasoningEffortMap && seed.modelReasoningEffortMap) prov.modelReasoningEffortMap = cloneNestedRecord(seed.modelReasoningEffortMap);
@@ -563,6 +579,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
     prov.supportsResponsesCustomTools = entry.supportsResponsesCustomTools;
   }
   if (prov.preserveResponsesReasoningContent === undefined && entry.preserveResponsesReasoningContent !== undefined) prov.preserveResponsesReasoningContent = entry.preserveResponsesReasoningContent;
+  if (prov.dropResponsesReasoningItems === undefined && entry.dropResponsesReasoningItems !== undefined) prov.dropResponsesReasoningItems = entry.dropResponsesReasoningItems;
   applyReasoningSummaryDefaults(prov, entry.modelSupportsReasoningSummaries);
   applyServiceTierModelDefaults(prov, serviceTierModelDefaultsFor(entry, prov));
   applyVerbosityDefaults(prov, entry);
diff --git a/src/providers/devin-cli-authmode-migration.ts b/src/providers/devin-cli-authmode-migration.ts
index 8bb56d46412..a816e0b626a 100644
--- a/src/providers/devin-cli-authmode-migration.ts
+++ b/src/providers/devin-cli-authmode-migration.ts
@@ -12,14 +12,12 @@
  * key: the `devin-cli` registry entry is gone, so the PROVIDER_REGISTRY lookup
  * that gated the rewrite here could never fire again.
  *
- * The adapter repair must keep working for CUSTOM-NAMED rows. The ACP adapter
- * was removed, so `"devin-cli"` is not a constructible adapter id and
- * `createRegisteredAdapter` would throw `Unknown adapter: devin-cli`. The
- * canonical `devin` row gets its adapter pinned from the registry by
- * `routedProviderConfig`, but a row named e.g. `"devin-acp"` has nothing
- * pinning it and would fail every request. So every row naming the retired
- * adapter is rewritten to `devin`, whatever the row is called, and each
- * rewrite is reported.
+ * Custom-named rows fail closed. The retired ACP transport used the installed
+ * CLI's identity and ignored both configured and caller credentials, so
+ * silently changing one of those rows into a cloud provider could send a
+ * credential with different provenance to Cognition. The warning tells the
+ * operator to reconfigure it explicitly; retaining the unknown adapter id
+ * prevents requests from reaching any upstream in the meantime.
  *
  * A row carrying the retired ACP identity URL is repointed at the api-server
  * in the same pass. That URL was never a destination — it existed only so
@@ -55,10 +53,16 @@ export function projectDevinCliAuthMode(config: OcxConfig): DevinCliAuthModeProj
   const warnings: string[] = [];
   let changed = false;
 
-  // Every row, not only the registry id: a custom-named row had no registry pin,
-  // so after the ACP removal it is the one that cannot construct an adapter.
   for (const [name, row] of Object.entries(config.providers ?? {})) {
     if (!row || row.adapter !== RETIRED_ACP_ADAPTER) continue;
+    if (name !== RETIRED_ACP_ADAPTER) {
+      warnings.push(
+        `left custom provider "${name}" unchanged because adapter ${RETIRED_ACP_ADAPTER} was removed: `
+        + "the row was not migrated; switch its adapter to devin and configure Devin authentication "
+        + "explicitly before using this provider.",
+      );
+      continue;
+    }
     row.adapter = "devin";
     changed = true;
     let detail = "";
diff --git a/src/providers/key-failover.ts b/src/providers/key-failover.ts
index ba7193d2b57..e4552df141a 100644
--- a/src/providers/key-failover.ts
+++ b/src/providers/key-failover.ts
@@ -11,6 +11,8 @@
 import { commitProviderApiKeySelection } from "./api-key-selection";
 import type { ProviderApiKeySelection } from "../types/provider";
 import { routedProviderConfig } from "../router";
+import { getProviderRegistryEntry } from "./registry";
+import { normalizedBaseUrl } from "./quota/vendor-probes-key";
 import type { OcxConfig, OcxProviderConfig, RateLimitRetryPolicy, TransientRetryPolicy } from "../types";
 import { OPENCODE_GO_SESSION_HEADER } from "./opencode-go-transport";
 import { resolveProviderTransport, type OcxProviderTransport } from "./xai-transport";
@@ -278,6 +280,43 @@ const DEFAULT_RATE_LIMIT_RETRY = {
   respectRetryAfter: true,
 } as const satisfies Required<RateLimitRetryPolicy>;
 
+/**
+ * Patient same-target 429 fallback for the OpenCode Go destination
+ * (https://opencode.ai/zen/go/v1), which serves subscription traffic such as Muse Spark.
+ * Single-key pools cannot fail over, so without this a burst 429 surfaces immediately and
+ * the client retry budget aborts the goal. Six 10s-paced attempts absorb a short burst
+ * window (effective replays are additionally bounded by the shared per-request send
+ * budget); Retry-After is still honored and capped. An explicit `retryOn429` (including
+ * `enabled: false`) always overrides this fallback.
+ */
+const OPENCODE_GO_RATE_LIMIT_RETRY = {
+  enabled: true,
+  attempts: 6,
+  intervalMs: 10_000,
+  maxIntervalMs: 60_000,
+  respectRetryAfter: true,
+} as const satisfies Required<RateLimitRetryPolicy>;
+
+/** True when the provider row points at the OpenCode Go destination. */
+export function isOpenCodeGoDestination(
+  provider: Partial<Pick<OcxProviderConfig, "baseUrl" | "authMode">>,
+): boolean {
+  const raw = typeof provider.baseUrl === "string" ? provider.baseUrl : "";
+  if (!raw.trim()) return false;
+  // Endpoint identity, not adapter identity: the runtime adapter is already overridden
+  // per model by the time the recovery loop runs (muse-spark rides `openai-responses`
+  // while the preset declares `openai-chat`), so an adapter-strict lookup misses it.
+  // Canonicalize with the shared quota-probe normalizer so host case and explicit
+  // default ports compare equal; userinfo, query, and fragment never match
+  // (follow-up to the review on #5067).
+  const endpoint = normalizedBaseUrl(raw.trim());
+  if (!endpoint) return false;
+  const entry = getProviderRegistryEntry("opencode-go");
+  if (!entry) return false;
+  const candidates = [entry.baseUrl, ...(entry.destinationAliases ?? []).map(alias => alias.baseUrl)];
+  return candidates.some(url => normalizedBaseUrl(url.trim()) === endpoint);
+}
+
 /**
  * Default transient-5xx retry used when a provider opts in with a bare
  * `transientRetryOn5xx: {}`. `attempts` is a TOTAL send budget, not extra retries.
@@ -513,29 +552,38 @@ export function selectProactiveApiKeyTransport(
 }
 
 /**
- * Normalize a provider's `retryOn429` policy, or return null when the knob is absent,
- * explicitly disabled, or the provider is not key-auth (OAuth/forward credentials must not be
- * replayed on the same token, forward passthrough never reaches the recovery loop anyway, and
- * local runtimes have no remote key to preserve). The returned policy is fully defaulted so
- * callers never re-check fields.
+ * Normalize a provider's `retryOn429` policy. An explicit object always wins (including
+ * `enabled: false` to opt out). When the knob is absent, the OpenCode Go destination
+ * (subscription traffic such as Muse Spark) falls back to a patient same-key policy so a
+ * burst 429 waits and replays instead of surfacing to the client and aborting a long
+ * session; every other provider without the knob keeps today's fail-fast behavior.
+ * OAuth/forward/local credentials are never replayed on the same token. The returned
+ * policy is fully defaulted so callers never re-check fields.
  */
 export function rateLimitRetryPolicyFor(
-  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode">,
+  provider: Pick<OcxProviderConfig, "retryOn429" | "authMode"> &
+    Partial<Pick<OcxProviderConfig, "baseUrl" | "adapter">>,
 ): Required<RateLimitRetryPolicy> | null {
   const policy = provider.retryOn429;
-  if (!policy || policy.enabled === false) return null;
-  // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
-  // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
-  // same token, local runtimes have no remote key to preserve, and unknown/custom values are
-  // rejected rather than guessed at.
+  if (policy) {
+    if (policy.enabled === false) return null;
+    // Fail closed: only explicit key auth or the documented omitted-default (undefined == key for
+    // custom API-key providers) may use same-key replays. OAuth/forward are never replayed on the
+    // same token, local runtimes have no remote key to preserve, and unknown/custom values are
+    // rejected rather than guessed at.
+    if (provider.authMode !== undefined && provider.authMode !== "key") return null;
+    return {
+      enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
+      attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
+      intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
+      maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
+      respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
+    };
+  }
+  // No explicit knob: patient fallback for the OpenCode Go destination only.
   if (provider.authMode !== undefined && provider.authMode !== "key") return null;
-  return {
-    enabled: policy.enabled ?? DEFAULT_RATE_LIMIT_RETRY.enabled,
-    attempts: policy.attempts ?? DEFAULT_RATE_LIMIT_RETRY.attempts,
-    intervalMs: policy.intervalMs ?? DEFAULT_RATE_LIMIT_RETRY.intervalMs,
-    maxIntervalMs: policy.maxIntervalMs ?? DEFAULT_RATE_LIMIT_RETRY.maxIntervalMs,
-    respectRetryAfter: policy.respectRetryAfter ?? DEFAULT_RATE_LIMIT_RETRY.respectRetryAfter,
-  };
+  if (!isOpenCodeGoDestination(provider)) return null;
+  return { ...OPENCODE_GO_RATE_LIMIT_RETRY };
 }
 
 /**
diff --git a/src/providers/model-rename-migration.ts b/src/providers/model-rename-migration.ts
index 89c9b6f577e..0606fe3dcd9 100644
--- a/src/providers/model-rename-migration.ts
+++ b/src/providers/model-rename-migration.ts
@@ -14,9 +14,12 @@
 // This migration is deliberately NOT general reconciliation. It rewrites exactly
 // one thing: an id this file declares retired, on a provider that still carries
 // the registry's transport, and only when the registry currently seeds the
-// replacement. Everything else in the row is left alone.
+// replacement — and it skips a field where the retired entry is registry residue
+// with nothing left to carry forward (see `isRegistryResidue`, issue #5066).
+// Everything else in the row is left alone.
 
 import { PROVIDER_REGISTRY } from "./registry";
+import { providerConfigSeed } from "./derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 export interface ModelRename {
@@ -194,6 +197,54 @@ function registrySeedsTarget(rename: ModelRename): boolean {
   return !!entry?.models?.includes(rename.to);
 }
 
+/** The row the registry contributes to a saved config, or `undefined` when it dropped the id. */
+function registrySeed(provider: string): Record<string, unknown> | undefined {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === provider);
+  return entry ? (providerConfigSeed(entry) as unknown as Record<string, unknown>) : undefined;
+}
+
+/** Whether a saved list or model-keyed record names this id at all. */
+function publishes(container: unknown, id: string): boolean {
+  if (Array.isArray(container)) return container.includes(id);
+  if (!container || typeof container !== "object") return false;
+  return id in (container as Record<string, unknown>);
+}
+
+/**
+ * Whether this field’s retired entry is registry residue rather than something to repair.
+ *
+ * Two things have to be true. The registry’s own seed — `providerConfigSeed`, the row both the
+ * OAuth preset (`deriveOAuthProviderConfig`) and `enrichProviderFromRegistry` contribute — must
+ * still publish the retired id in this field, so the entry arrives in the config on its own. And
+ * the saved field must already carry the supported id, so the rename would only DELETE a key,
+ * with nothing to carry forward.
+ *
+ * Under those two conditions the rewrite is worse than a no-op, because it never converges.
+ * `startServer` runs this migration and then `reconcileOAuthProviders`, and
+ * `applyOAuthPresetCatalog` copies the preset’s record over the saved one whenever the two
+ * differ. The deletion is undone inside the same boot, the config is written twice, and the user
+ * is told about a rename that never sticks on every single start. Issue #5066 is exactly that:
+ * `ANTIGRAVITY_MODEL_CONTEXT_WINDOWS` derives a window for every compatibility alias, so
+ * `modelContextWindows` holds a key for all nine retired Flash ids beside the live ones — the
+ * nine `[model-rename-migration]` lines the reporter saw at every `ocx start`, none of which
+ * required them to have selected any of those nine models.
+ *
+ * Those registry entries are deliberate and stay: a request that still names `gemini-3.6-flash`
+ * routes to 3.7 and needs a context window under the id it asked for. The second condition is
+ * what keeps this narrow. A row that saved `{ "gemini-3.6-flash": 1048576 }` and nothing else
+ * still gets the value carried onto the supported id, because dropping it there would blank the
+ * record instead of moving it (`tests/adapters/google/gemini-37-flash-migration.test.ts`).
+ */
+function isRegistryResidue(
+  seed: Record<string, unknown> | undefined,
+  field: string,
+  saved: unknown,
+  rename: ModelRename,
+): boolean {
+  if (!seed) return false;
+  return publishes(seed[field], rename.from) && publishes(saved, rename.to);
+}
+
 export interface ModelRenameProjection {
   config: OcxConfig;
   changed: boolean;
@@ -226,14 +277,17 @@ export function projectModelRenames(
     // Provider config is a closed interface, so index through one unknown-cast
     // view rather than casting at each assignment.
     const row = prov as unknown as Record<string, unknown>;
+    const seed = registrySeed(rename.provider);
     let touched = false;
     for (const field of MODEL_ID_LISTS) {
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
       const next = renameInList(row[field], rename.from, rename.to);
       if (!next) continue;
       row[field] = next;
       touched = true;
     }
     for (const field of MODEL_KEYED_RECORDS) {
+      if (isRegistryResidue(seed, field, row[field], rename)) continue;
       const next = rename.dropReasoningEffortMap && field === "modelReasoningEffortMap"
         ? dropFromRecord(row[field], rename.from)
         : renameInRecord(row[field], rename.from, rename.to);
diff --git a/src/providers/model-rename-startup.ts b/src/providers/model-rename-startup.ts
index 51f1b35da89..0f15b695cd6 100644
--- a/src/providers/model-rename-startup.ts
+++ b/src/providers/model-rename-startup.ts
@@ -1,12 +1,13 @@
 import { mutatePersistedConfig } from "../config";
 import { projectModelRenames } from "./model-rename-migration";
 import { projectStaleContextWindows } from "./stale-context-window-migration";
+import { projectStaleVisionClassifications } from "./stale-vision-classification-migration";
 import { projectDevinCliAuthMode } from "./devin-cli-authmode-migration";
 import type { OcxConfig } from "../types";
 
 /**
- * The startup projection: registry model renames, then the context-window
- * repair. Both fix a saved row the registry can no longer reach on its own —
+ * The startup projection: registry model renames, then the context-window and
+ * vision-classification repairs. All three fix a saved row the registry can no longer reach on its own —
  * `enrichProviderFromRegistry` backfills a missing field and never rewrites a
  * present one — so they share this pass rather than adding a second boot step
  * with its own persistence, adopt, and failure handling.
@@ -14,11 +15,12 @@ import type { OcxConfig } from "../types";
 export function projectStartupConfigRepairs(config: OcxConfig): ReturnType<typeof projectModelRenames> {
   const renames = projectModelRenames(config);
   const windows = projectStaleContextWindows(renames.config);
-  const devinCli = projectDevinCliAuthMode(windows.config);
+  const vision = projectStaleVisionClassifications(windows.config);
+  const devinCli = projectDevinCliAuthMode(vision.config);
   return {
     config: devinCli.config,
-    changed: renames.changed || windows.changed || devinCli.changed,
-    warnings: [...renames.warnings, ...windows.warnings, ...devinCli.warnings],
+    changed: renames.changed || windows.changed || vision.changed || devinCli.changed,
+    warnings: [...renames.warnings, ...windows.warnings, ...vision.warnings, ...devinCli.warnings],
   };
 }
 
diff --git a/src/providers/openai-virtual-models.ts b/src/providers/openai-virtual-models.ts
index ea05b4d3db7..5aabe83907b 100644
--- a/src/providers/openai-virtual-models.ts
+++ b/src/providers/openai-virtual-models.ts
@@ -3,6 +3,9 @@ import { OPENAI_API_PROVIDER_ID } from "./openai-tiers";
 import type { OcxParsedRequest } from "../types";
 import type { RouteResult } from "../router";
 import type { RequestLogContext } from "../server/request-log";
+import type { InboundWire } from "./registry/types";
+import { providerMatchesRegistryTransportWithStaticGuards } from "./static-model-discovery";
+import { resolveModelPolicy } from "./resolved-model-policy";
 
 export interface OpenAiVirtualModelResolution {
   selectedModelId: string;
@@ -49,18 +52,55 @@ export function resolveOpenAiVirtualModel(
   return validateOpenAiVirtualModelDefinition(selectedModelId, definition);
 }
 
+export function captureOpenAiVirtualWirePolicy(
+  route: RouteResult,
+  resolution: OpenAiVirtualModelResolution,
+  inboundWire: InboundWire = "responses",
+): void {
+  // applyOpenAiVirtualModel is also a public mutation helper with older focused callers that
+  // construct only providerName/modelId/provider. Production RouteResult builders always capture
+  // staticPolicy; a legacy partial shape has no authority to recapture and keeps the old rewrite.
+  if (!route.staticPolicy) return;
+  const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === route.providerName);
+  route.staticPolicy = resolveModelPolicy({
+    providerName: route.providerName,
+    modelId: resolution.wireModelId,
+    provider: route.provider,
+    registryEntry: entry,
+    transportMatchedRegistry: !!entry
+      && providerMatchesRegistryTransportWithStaticGuards(route.providerName, route.provider),
+    inboundWire,
+    modelCapabilities: route.provider.modelCapabilities?.[resolution.wireModelId],
+    ...(route.provider.authMode ? { effectiveAuth: { authMode: route.provider.authMode } } : {}),
+    ...(route.staticPolicy?.effectiveAlias !== undefined
+      ? { effectiveAlias: route.staticPolicy.effectiveAlias }
+      : {}),
+  });
+}
+
 export function applyOpenAiVirtualModel(
   parsed: OcxParsedRequest,
   route: RouteResult,
   logCtx: RequestLogContext,
+  inboundWire: InboundWire = "responses",
 ): OpenAiVirtualModelResolution | undefined {
-  const selectedModelId = logCtx.model && logCtx.model !== route.modelId ? logCtx.model : route.modelId;
-  const resolution = resolveOpenAiVirtualModel(route.providerName, selectedModelId);
+  // Routing has already removed the provider namespace and resolved model aliases. Never use
+  // logCtx.model for identity: it is reporting state and can still contain a namespaced selector.
+  const resolution = resolveOpenAiVirtualModel(route.providerName, route.modelId)
+    ?? (() => {
+      // Preserve the public helper's idempotent second-call contract from its own mutation
+      // provenance, without promoting reporting state back into routing authority.
+      const selected = parsed._openAiVirtualSelectedModelId;
+      if (typeof selected !== "string") return undefined;
+      const remembered = resolveOpenAiVirtualModel(route.providerName, selected);
+      return remembered?.wireModelId === route.modelId ? remembered : undefined;
+    })();
   if (!resolution) return undefined;
 
   logCtx.model = resolution.selectedModelId;
   logCtx.resolvedModel = resolution.wireModelId;
   route.modelId = resolution.wireModelId;
+  captureOpenAiVirtualWirePolicy(route, resolution, inboundWire);
   parsed.modelId = resolution.wireModelId;
   parsed._openAiVirtualSelectedModelId = resolution.selectedModelId;
 
diff --git a/src/providers/quota/antigravity.ts b/src/providers/quota/antigravity.ts
index bafdc1eee02..928b10e2570 100644
--- a/src/providers/quota/antigravity.ts
+++ b/src/providers/quota/antigravity.ts
@@ -1,6 +1,6 @@
 import { antigravityUserAgent } from "../../adapters/client-fingerprint";
 import { DestinationDnsResolutionError } from "../../lib/destination-policy";
-import { PinnedHttpError } from "../../lib/pinned-http";
+import { PinnedHttpError, type PinnedHttpErrorCode } from "../../lib/pinned-http";
 import { ProviderOutboundPolicyError, providerOutboundPost, providerRedirectError, type ProviderOutboundDependencies } from "../../lib/provider-outbound";
 import { getValidAccessToken } from "../../oauth";
 import { getAccountCredential, getCredential } from "../../oauth/store";
@@ -193,10 +193,30 @@ type AntigravityQuotaProbeResult =
   | { kind: "available"; quota: ProviderQuota; source: "google-antigravity:retrieveUserQuotaSummary" | "google-antigravity:fetchAvailableModels" }
   | { kind: "unavailable"; failure: QuotaFailureCode; legacy: { kind: "null" } | { kind: "throw"; error: unknown } };
 
+/**
+ * Every pinned-transport failure code, classified once.
+ *
+ * A conditional that named one code and sent the rest to `timeout` was correct only for as long
+ * as the union held exactly the codes it was written against. When the transport learned to
+ * report a coding it cannot undo, that answer was reported as a timeout, which is a different
+ * operational story entirely. A total map makes a new code a compile error here rather than a
+ * quiet misdiagnosis.
+ */
+const PINNED_QUOTA_FAILURES = {
+  connect_timeout: "timeout",
+  first_byte_timeout: "timeout",
+  inactivity_timeout: "timeout",
+  // The response arrived and cannot be used: too large, coded in a format this transport cannot
+  // undo, or coded bytes that did not decode. None of these is a timing failure.
+  output_byte_limit: "response_unusable",
+  unsupported_content_encoding: "response_unusable",
+  content_decode_failed: "response_unusable",
+} satisfies Record<PinnedHttpErrorCode, QuotaFailureCode>;
+
 function quotaTransportFailure(error: unknown): QuotaFailureCode {
   if (error instanceof ProviderOutboundPolicyError) return "destination_blocked";
   if (error instanceof DestinationDnsResolutionError) return "dns_failed";
-  if (error instanceof PinnedHttpError) return error.code === "output_byte_limit" ? "response_unusable" : "timeout";
+  if (error instanceof PinnedHttpError) return PINNED_QUOTA_FAILURES[error.code];
   if (error instanceof DOMException && error.name === "TimeoutError") return "timeout";
   return "transport_error";
 }
diff --git a/src/providers/quota/vendor-probes-key.ts b/src/providers/quota/vendor-probes-key.ts
index 17594f548e4..08544bc3c2c 100644
--- a/src/providers/quota/vendor-probes-key.ts
+++ b/src/providers/quota/vendor-probes-key.ts
@@ -915,7 +915,7 @@ async function fetchNeuralwattQuota(provider: string, config: OcxProviderConfig)
 }
 
 
-function normalizedBaseUrl(value: string): string | null {
+export function normalizedBaseUrl(value: string): string | null {
   try {
     const url = new URL(value);
     if (url.username || url.password || url.search || url.hash) return null;
diff --git a/src/providers/registry/entries-core.ts b/src/providers/registry/entries-core.ts
index 1c36394256c..f16f9f15687 100644
--- a/src/providers/registry/entries-core.ts
+++ b/src/providers/registry/entries-core.ts
@@ -30,6 +30,8 @@ import {
   OPENAI_API_GPT56_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORTS,
   META_MUSE_REASONING_EFFORT_MAP,
+  META_MUSE_CODE_REASONING_EFFORTS,
+  META_MUSE_CODE_REASONING_EFFORT_MAP,
   META_MUSE_CONTEXT_WINDOW,
   META_MUSE_MODELS,
   OPENAI_DAYBREAK_MODELS,
@@ -599,12 +601,15 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     label: "Meta Muse Code (CLI credential)",
     adapter: "openai-responses",
     baseUrl: "https://api.meta.ai/v1",
-    // Meta own client sends this on every Muse Code call. We never have, so a future
-    // server-side requirement would break every Muse request with no local signal.
+    // Meta's own client sends these on every Muse Code call. The compatibility marker
+    // is transparent while selecting the credential surface that accepts `max`.
     // Declared here rather than in a transport hook so it also covers model discovery
     // (src/oauth/index.ts:1176) and still yields to a user-set header
     // (mergeRegistryStaticHeaders, src/providers/registry.ts:3494).
-    staticHeaders: { "x-api-version": "1.0.0" },
+    staticHeaders: {
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "x-api-version": "1.0.0",
+    },
     authKind: "oauth",
     oauthId: "meta-muse",
     dashboardUrl: "https://dev.meta.ai",
@@ -615,8 +620,8 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     liveModels: false,
     modelContextWindows: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CONTEXT_WINDOW])),
     modelInputModalities: Object.fromEntries(META_MUSE_MODELS.map(id => [id, ["text", "image"] as ["text", "image"]])),
-    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORTS])),
-    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_REASONING_EFFORT_MAP])),
+    modelReasoningEfforts: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(META_MUSE_MODELS.map(id => [id, META_MUSE_CODE_REASONING_EFFORT_MAP])),
     note: "Signs in to Meta with a browser device code on any platform, then mints the Muse Code subscription key. That grant is reimplemented from the one the Muse Code CLI performs and has NOT been exercised against Meta from OpenCodex, so treat the first login as unverified. If the Muse Code CLI is already signed in on macOS, the existing key is imported instead of starting a new grant. A pasted key from https://dev.meta.ai still works as a fallback when a device login cannot complete, and faces the same format check and live validation. A device login authenticates as Meta own Muse Code client, which is a stronger claim than reusing a key the CLI already minted. Meta scopes that credential to the Muse Code CLI, so this is an UNSUPPORTED use: Meta does not authorize subscription coverage outside its own CLI, how these calls settle is not observable from the API, and you should treat every call as billable against your account. The key, imported or pasted, is copied into OpenCodex's auth store. For an account signed in with the device login, OpenCodex refreshes Meta's subscription windows on demand from the same key endpoint the login uses, at most once every five minutes. For an imported or pasted key there is no endpoint to query them on demand, so OpenCodex reads them from streaming responses and shows the last observed value with its age; refreshing one then requires another streaming turn, and translated (non-passthrough) turns report none. Rate limits apply per team, not per key. For a supported path use the meta-model provider with your own key (export it as META_MODEL_API_KEY).",
   },
   {
@@ -652,6 +657,11 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Zen Go can close a Chat stream after a fully assembled function call without sending
     // finish_reason or [DONE] (#2260). The adapter still rejects incomplete argument JSON.
     openaiChatEofTolerance: true,
+    // Muse Spark on OpenCode Go can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor": { graceMs: 5_000 },
+    },
     // Go rejects reasoning.encrypted_content with previous_response_id (#3838).
     // Use explicit replay history and the existing stateless Responses policy.
     statelessResponses: true,
@@ -696,17 +706,25 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
       "glm-5.3-flash": ["text", "image"],
       // Experimental DeepSeek vision preview — expected to merge into deepseek-v4-flash later.
       [DEEPSEEK_VISION_PREVIEW_MODEL]: ["text", "image"],
-      // This route is text-only upstream — it is already listed in this preset's
-      // noVisionModels, which routes images through the proxy's vision sidecar and
-      // makes the catalog advertise image input on its behalf. The positive
-      // text-only declaration is what reaches an EXISTING install: derive.ts fills
-      // noVisionModels all-or-nothing, so a config persisted before this id joined
-      // the list keeps a stale list, the sidecar predicate never matches, the row
-      // carries no modality at all, and any combo containing it collapses to
-      // ["text"] (#4505). modelInputModalities IS per-key filled, so this
-      // declaration lands on old configs. It states the route's real upstream
-      // capability and keeps the sidecar explicitly distinct from native vision.
-      "deepseek-v4.1-flash": ["text"],
+      // This route became natively multimodal; it is NOT a sidecar consumer.
+      //
+      // History: the id was declared text-only here and listed in this preset's
+      // noVisionModels, which routed its images through the vision sidecar (#4505).
+      // That classification came from jawcode metadata and went stale. Probed
+      // 2026-09-19 against https://opencode.ai/zen/go/v1/chat/completions with the
+      // headers this proxy sends: the route accepts an image_url part and the model
+      // reads it correctly (a four-band colour chart was described in the right
+      // order). Its sibling deepseek-v4-flash on the same gateway still answers
+      // HTTP 400 "Model only supports text input", which is what keeps the two
+      // distinct here rather than collapsing them.
+      //
+      // The declaration is what reaches an EXISTING install: derive.ts fills
+      // noVisionModels all-or-nothing, so a config persisted while the stale list
+      // was current keeps it forever, and modelInputModalities is filled per-key
+      // BENEATH the saved value. Both halves are repaired by
+      // stale-vision-classification-migration.ts; correcting the registry alone
+      // would fix new installs and leave existing ones stripping images.
+      "deepseek-v4.1-flash": ["text", "image"],
       // Muse Spark Contributor is natively multimodal on Zen Go: it accepts input_image
       // parts over /responses (probed 2026-08-26). Without this declaration the catalog
       // advertises it text-only and the Codex app blocks image attachments client-side with
@@ -760,7 +778,10 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // Kimi K2.7 Code accepts text+image+video: do NOT list it here.
     noVisionModels: [
       "glm-5.3", "glm-5.2", "glm-5", "glm-5.1",
-      "deepseek-v4.1-flash", "deepseek-v4-flash",
+      // deepseek-v4.1-flash is deliberately absent: probed natively multimodal on this
+      // gateway 2026-09-19 (see the modelInputModalities note above). Its sibling
+      // deepseek-v4-flash stays listed — that route rejects image_url upstream.
+      "deepseek-v4-flash",
       "mimo-v2-pro", "mimo-v2.5-pro",
       "minimax-m2.5", "minimax-m2.7",
       "qwen3.7-max",
@@ -1237,3 +1258,4 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     note: "Serverless Inference subscription API. Live discovery exposes only kimi-k2-instruct because Vultr documents it as the sole tool-calling model.",
   },
 ];
+
diff --git a/src/providers/registry/entries-extended.ts b/src/providers/registry/entries-extended.ts
index 8c0c40a3802..a3ffe393c67 100644
--- a/src/providers/registry/entries-extended.ts
+++ b/src/providers/registry/entries-extended.ts
@@ -746,9 +746,22 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     id: "volcengine-coding-plan",
     label: "Volcengine Ark Coding Plan",
     baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
-    adapter: "openai-chat",
+    responsesPath: "/responses",
+    adapter: "openai-responses",
     authKind: "key",
+    supportsServiceTier: false,
     preserveCustomDestination: true,
+    // A row already saved on Chat keeps Chat. This is a `preserveCustomDestination` key entry,
+    // so `providerMatchesRegistryTransport` refuses the adapter mismatch and the request path
+    // returns the stored row untouched; the alias below still hands it this entry's metadata.
+    // Deliberately no startup config migration: the Z.AI one (`zai-responses-migration.ts`) is
+    // safe only because it rewrites rows the router already canonicalizes, and it gates on
+    // `providerMatchesRegistryTransport` to guarantee that. A Chat row here is NOT canonicalized,
+    // so migrating it would change a wire the operator is actually using, and a marker added
+    // now cannot tell the old default apart from a deliberate pre-upgrade Chat choice.
+    destinationAliases: [{ baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3", adapter: "openai-chat" }],
+    // Validated Ark Coding Plan continuations reject replayed reasoning items.
+    dropResponsesReasoningItems: true,
     dashboardUrl: "https://console.volcengine.com/ark/region:ark+cn-beijing/overview",
     defaultModel: "ark-code-latest",
     models: VOLCENGINE_CODING_PLAN_MODELS,
@@ -798,6 +811,21 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     defaultModel: "qwen3.8-max",
     models: ALIBABA_TOKEN_PLAN_MODELS,
     liveModels: false,
+    // Alibaba documents an OpenAI-compatible Responses API on this same /compatible-mode/v1 base
+    // and ships an official Codex integration guide on wire_api = "responses" (#5097). The
+    // gateway serves the same models over both wires, and qwen3.8-flash, qwen3.7-plus and
+    // glm-5.3 carry live end-to-end evidence there (custom tools, reasoning replay, streaming,
+    // multi-turn continuation).
+    //
+    // That is deliberately NOT expressed as a modelWireDefaults pin. Pinning would move every
+    // existing Codex user of those models onto a different upstream with no config change, and
+    // one delta is unresolved: preserveReasoningContentModels below is read by the CHAT adapter,
+    // while the Responses serializer reads preserveResponsesReasoningContent, which this entry
+    // does not set. On the Responses wire those models would replay with blanked reasoning
+    // content -- less state than they carry today. Z.AI and DeepSeek set both flags together for
+    // exactly this reason. Until that flag is justified against this gateway, Responses stays a
+    // documented per-model modelAdapters opt-in;
+    // tests/providers/alibaba-token-plan-responses-optin.test.ts holds both halves.
     note: "Token Plan Personal Edition · China (Beijing)",
     modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
     modelContextWindows: ALIBABA_TOKEN_PLAN_CONTEXT_WINDOWS,
@@ -1027,6 +1055,11 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     // Same DeepSeek routes as the Go preset above, behind the same vendor, so they carry
     // the same json_schema rejection (#1338 / #1415).
     noJsonSchemaModels: [...DEEPSEEK_GATEWAY_THINKING_MODELS, ...OPENCODE_FREE_DEEPSEEK_MODELS],
+    // Muse Spark on Zen can sit silent during prolonged reasoning and close without a protocol terminal.
+    modelResponsesTerminalRepair: {
+      "muse-spark-1.2-contributor-free": { graceMs: 5_000 },
+      "muse-spark-1.3-contributor-free": { graceMs: 5_000 },
+    },
   },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
   {
@@ -1329,3 +1362,4 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
     note: "Official CodeBuddy Code CLI (Tencent Cloud), China/internal environment. Uses the documented CODEBUDDY_API_KEY + headless CLI surface; never reads desktop sessions or private console endpoints. Region-isolated from codebuddy (Global); credentials are never exchanged across regions. v1 disables CLI tools (--tools \"\"): text/reasoning only for now. Requires `npm i -g @tencent-ai/codebuddy-code`. AUP/routing authorization flagged for maintainer security review.",
   },
 ];
+
diff --git a/src/providers/registry/model-ids.ts b/src/providers/registry/model-ids.ts
new file mode 100644
index 00000000000..94de3fd7d99
--- /dev/null
+++ b/src/providers/registry/model-ids.ts
@@ -0,0 +1,168 @@
+import type { ProviderRegistryEntry } from "./types";
+
+/**
+ * What a registry field's KEYS mean for selector decoding.
+ *
+ * An encoded selector is decoded against the native model ids a provider is known to accept.
+ * That set used to be a hand-written list of eight registry maps, so an id declared only in an
+ * unlisted map could not be decoded, and every new model-keyed field had to be remembered.
+ *
+ * Every field of ProviderRegistryEntry is classified below, including the ones that carry no
+ * model identity at all. That is deliberate: the "satisfies" check makes a new registry field a
+ * TYPE error until somebody decides what its keys mean, rather than letting it default to
+ * invisible. The two checks are different and both matter - the satisfies clause proves the
+ * classification is exhaustive when this compiles, and the parity test proves the fields the
+ * shipped registry actually carries are the ones classified here.
+ *
+ * These are decode hints and nothing more. A hint does not publish a catalog row, grant
+ * availability or entitlement, and it does not confer transport authority: the caller still
+ * checks registry transport identity before asking for them, and an ambiguous selector is still
+ * rejected rather than guessed.
+ */
+type RegistryFieldModelIdRole =
+  | { readonly kind: "none" }
+  | { readonly kind: "record-keys" }
+  | { readonly kind: "nested-record-keys"; readonly key: "modelSupportsServiceTier" };
+
+const NONE = { kind: "none" } as const;
+const RECORD_KEYS = { kind: "record-keys" } as const;
+/**
+ * Key-auth declares its own service-tier support under a nested map.
+ *
+ * Reading its keys is identity evidence only. It does not activate the key-auth service tier,
+ * which stays the business of the service-tier resolver.
+ */
+const KEY_AUTH_SERVICE_TIER = { kind: "nested-record-keys", key: "modelSupportsServiceTier" } as const;
+
+/**
+ * Not a configuration surface. Exported so the parity suite can compare this classification
+ * against the fields the shipped registry entries actually carry at runtime.
+ */
+export const REGISTRY_FIELD_MODEL_ID_ROLES = {
+  id: NONE,
+  label: NONE,
+  adapter: NONE,
+  baseUrl: NONE,
+  apiKeyTransport: NONE,
+  alias: NONE,
+  authKind: NONE,
+  codexAccountMode: NONE,
+  allowKeyAuthOverride: NONE,
+  allowPrivateNetworkByDefault: NONE,
+  keyOptional: NONE,
+  apiKeyValidation: NONE,
+  freeTier: NONE,
+  allowBaseUrlOverride: NONE,
+  preserveCustomDestination: NONE,
+  baseUrlChoices: NONE,
+  staticHeaders: NONE,
+  modelSuffixBracketStrip: NONE,
+  featured: NONE,
+  sponsor: NONE,
+  dashboardPreset: NONE,
+  note: NONE,
+  dashboardUrl: NONE,
+  defaultModel: NONE,
+  models: NONE,
+  liveModels: NONE,
+  modelWireDefaults: RECORD_KEYS,
+  fastWire: NONE,
+  modelResponsesUpstreamStreaming: RECORD_KEYS,
+  modelResponsesTerminalRepair: RECORD_KEYS,
+  responsesItemIdRepair: NONE,
+  responsesPath: NONE,
+  chatCompletionsPath: NONE,
+  destinationAliases: NONE,
+  statelessResponses: NONE,
+  requiresAdjacentResponsesToolResults: NONE,
+  requiresPairedResponsesToolResults: NONE,
+  annotateEmptyToolOutputs: NONE,
+  supportsServiceTier: NONE,
+  supportsOpenAiWebSearchToolFields: NONE,
+  supportsResponsesCustomTools: NONE,
+  modelSupportsServiceTier: RECORD_KEYS,
+  keyAuthServiceTier: KEY_AUTH_SERVICE_TIER,
+  fastTierDescription: NONE,
+  modelServiceTierCapabilityBaseUrlGuard: NONE,
+  preserveResponsesReasoningContent: NONE,
+  dropResponsesReasoningItems: NONE,
+  modelSupportsReasoningSummaries: RECORD_KEYS,
+  modelSupportsVerbosity: RECORD_KEYS,
+  supportsVerbosity: NONE,
+  modelDiscovery: NONE,
+  contextWindow: NONE,
+  modelContextWindows: RECORD_KEYS,
+  modelDisplayNames: RECORD_KEYS,
+  modelInputModalities: RECORD_KEYS,
+  defaultMaxOutputTokens: NONE,
+  modelMaxOutputTokens: RECORD_KEYS,
+  reasoningEfforts: NONE,
+  modelReasoningEfforts: RECORD_KEYS,
+  modelDefaultReasoningEfforts: RECORD_KEYS,
+  reasoningEffortMap: NONE,
+  modelReasoningEffortMap: RECORD_KEYS,
+  directReasoningEffortModels: NONE,
+  reasoningWireFormat: NONE,
+  noVisionModels: NONE,
+  noReasoningModels: NONE,
+  noTemperatureModels: NONE,
+  noTopPModels: NONE,
+  noPenaltyModels: NONE,
+  noJsonSchemaModels: NONE,
+  parallelToolCalls: NONE,
+  promptCacheKey: NONE,
+  chatServiceTier: NONE,
+  openaiChatEofTolerance: NONE,
+  autoToolChoiceOnlyModels: NONE,
+  preserveReasoningContentModels: NONE,
+  requiresReasoningPlaceholderModels: NONE,
+  showThinkingSummary: NONE,
+  reasoningSplitModels: NONE,
+  reasoningDetailsModels: NONE,
+  thinkingToggleModels: NONE,
+  thinkingBudgetModels: NONE,
+  escapeBuiltinToolNames: NONE,
+  oauthId: NONE,
+  virtualModels: RECORD_KEYS,
+  modelMaxInputTokens: RECORD_KEYS,
+  jawcodeBundle: NONE,
+  extraMetadataAliases: NONE,
+  metadataModelIdNormalize: NONE,
+  googleMode: NONE,
+  project: NONE,
+  location: NONE,
+} satisfies Record<keyof ProviderRegistryEntry, RegistryFieldModelIdRole>;
+
+/**
+ * The native model ids this registry entry names, in registry-field order, first seen wins.
+ *
+ * Only KEYS are collected. virtualModels is a map whose keys are the selected identities and
+ * whose values name a transport target, so its wireModelId values are deliberately not read:
+ * a wire target is not something a client may select by name.
+ */
+export function registryModelIdKeys(entry: ProviderRegistryEntry): readonly string[] {
+  const ids: string[] = [];
+  const seen = new Set<string>();
+  const add = (key: string): void => {
+    if (key.length === 0 || seen.has(key)) return;
+    seen.add(key);
+    ids.push(key);
+  };
+  for (const field of Object.keys(REGISTRY_FIELD_MODEL_ID_ROLES) as (keyof ProviderRegistryEntry)[]) {
+    const role = REGISTRY_FIELD_MODEL_ID_ROLES[field];
+    if (role.kind === "none") continue;
+    if (role.kind === "record-keys") {
+      const map = entry[field];
+      if (typeof map !== "object" || map === null) continue;
+      for (const key of Object.keys(map)) add(key);
+      continue;
+    }
+    // The nested role belongs to keyAuthServiceTier alone, so its owner is read by name.
+    // ProviderRegistryEntry is an interface and carries no implicit index signature, so a
+    // by-name read is what keeps this loop typed instead of asserted through unknown.
+    const nested = entry.keyAuthServiceTier?.[role.key];
+    if (typeof nested !== "object" || nested === null) continue;
+    for (const key of Object.keys(nested)) add(key);
+  }
+  return Object.freeze(ids);
+}
diff --git a/src/providers/registry/model-seeds.ts b/src/providers/registry/model-seeds.ts
index 62517025e53..a1d9661395a 100644
--- a/src/providers/registry/model-seeds.ts
+++ b/src/providers/registry/model-seeds.ts
@@ -177,6 +177,15 @@ export const META_MUSE_REASONING_EFFORTS = ["minimal", "low", "medium", "high",
 export const META_MUSE_REASONING_EFFORT_MAP: Record<string, string> = Object.fromEntries(
   META_MUSE_REASONING_EFFORTS.map(effort => [effort, effort]),
 );
+/*
+ * Muse Code credentials have a separate capability contract. Meta's authenticated
+ * /muse-code/models roster advertises max for both 1.3 models, and the Responses API
+ * accepts it when the request identifies the Muse client surface.
+ */
+export const META_MUSE_CODE_REASONING_EFFORTS = [...META_MUSE_REASONING_EFFORTS, "max"];
+export const META_MUSE_CODE_REASONING_EFFORT_MAP: Record<string, string> = Object.fromEntries(
+  META_MUSE_CODE_REASONING_EFFORTS.map(effort => [effort, effort]),
+);
 /** Both Muse Spark 1.3 tiers publish a 1,048,576-token window (dev.meta.ai/docs/models). */
 export const META_MUSE_CONTEXT_WINDOW = 1_048_576;
 export const META_MUSE_MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"];
diff --git a/src/providers/registry/types.ts b/src/providers/registry/types.ts
index 6a303650976..0a31facef64 100644
--- a/src/providers/registry/types.ts
+++ b/src/providers/registry/types.ts
@@ -264,6 +264,8 @@ export interface ProviderRegistryEntry {
   modelServiceTierCapabilityBaseUrlGuard?: (baseUrl: string) => boolean;
   /** Registry default for plaintext reasoning replay; see `OcxProviderConfig.preserveResponsesReasoningContent`. Registry-only like `supportsServiceTier`. */
   preserveResponsesReasoningContent?: boolean;
+  /** Registry default for dropping replayed reasoning items for Responses upstreams that reject them. */
+  dropResponsesReasoningItems?: boolean;
   /** Registry defaults for per-model Codex reasoning propagation; explicit user keys win during enrichment. */
   modelSupportsReasoningSummaries?: Record<string, boolean>;
   /** Registry defaults for per-model Codex Responses verbosity support. */
diff --git a/src/providers/resolved-model-policy-merge.ts b/src/providers/resolved-model-policy-merge.ts
new file mode 100644
index 00000000000..b767d903c36
--- /dev/null
+++ b/src/providers/resolved-model-policy-merge.ts
@@ -0,0 +1,167 @@
+import type { OcxProviderConfig } from "../types";
+import { MODEL_ADAPTER_OVERRIDE_ALLOWED } from "../types";
+import type { InboundWire, ModelWireDefault, ProviderRegistryEntry } from "./registry/types";
+
+export type StaticPolicySource =
+  | "operator" | "operator-capability" | "captured-auth"
+  | "registry" | "hard-pin" | "provider-default" | "unknown";
+
+export function detachedClone<T>(value: T): T {
+  if (Array.isArray(value)) return value.map(item => detachedClone(item)) as T;
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value as Record<string, unknown>)
+      .map(([key, nested]) => [key, detachedClone(nested)])) as T;
+  }
+  return value;
+}
+
+export function recursivelyFreeze<T>(value: T): T {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+  for (const nested of Object.values(value as Record<string, unknown>)) recursivelyFreeze(nested);
+  return Object.freeze(value);
+}
+
+export function scalar<T>(operator: T | undefined, registry: T | undefined): [T | undefined, StaticPolicySource] {
+  if (operator !== undefined) return [detachedClone(operator), "operator"];
+  if (registry !== undefined) return [detachedClone(registry), "registry"];
+  return [undefined, "unknown"];
+}
+
+export function mapFill<T>(
+  registry: Readonly<Record<string, T>> | undefined,
+  operator: Readonly<Record<string, T>> | undefined,
+): [Record<string, T> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  return [detachedClone({ ...(registry ?? {}), ...(operator ?? {}) }), operator ? "operator" : "registry"];
+}
+
+export function nestedMapFill(
+  registry: Readonly<Record<string, Record<string, string>>> | undefined,
+  operator: Readonly<Record<string, Record<string, string>>> | undefined,
+): [Record<string, Record<string, string>> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  const merged: Record<string, Record<string, string>> = {};
+  for (const [key, value] of Object.entries(registry ?? {})) merged[key] = { ...value };
+  for (const [key, value] of Object.entries(operator ?? {})) {
+    merged[key] = { ...(merged[key] ?? {}), ...value };
+  }
+  return [merged, operator ? "operator" : "registry"];
+}
+
+export function positiveCapMap(
+  registry: Readonly<Record<string, number>> | undefined,
+  operator: Readonly<Record<string, number>> | undefined,
+): [Record<string, number> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  const merged = { ...(registry ?? {}) };
+  for (const [key, value] of Object.entries(operator ?? {})) {
+    merged[key] = typeof merged[key] === "number" ? Math.min(merged[key]!, value) : value;
+  }
+  return [merged, operator ? "operator" : "registry"];
+}
+
+export function stableUnion(
+  registry: readonly string[] | undefined,
+  operator: readonly string[] | undefined,
+): [string[] | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  return [[...new Set([...(registry ?? []), ...(operator ?? [])])], operator ? "operator" : "registry"];
+}
+
+export function staticHeaders(
+  registry: Readonly<Record<string, string>> | undefined,
+  operator: Readonly<Record<string, string>> | undefined,
+): [Record<string, string> | undefined, StaticPolicySource] {
+  if (!registry && !operator) return [undefined, "unknown"];
+  if (!registry) return [{ ...(operator ?? {}) }, "operator"];
+  if (!operator) return [{ ...registry }, "registry"];
+  const claimed = new Set(Object.keys(operator).map(name => name.toLowerCase()));
+  const merged: Record<string, string> = { ...operator };
+  for (const [name, value] of Object.entries(registry)) {
+    if (!claimed.has(name.toLowerCase())) merged[name] = value;
+  }
+  return [merged, "operator"];
+}
+
+export function resolvedBaseUrl(
+  entry: Readonly<ProviderRegistryEntry> | undefined,
+  provider: Readonly<OcxProviderConfig>,
+): [string, StaticPolicySource] {
+  if (!entry) return [provider.baseUrl, "operator"];
+  const configured = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
+  const configuredIsResolved = configured.length > 0 && !/\{[^}]*\}/.test(configured);
+  if (entry.allowBaseUrlOverride && !configuredIsResolved) {
+    throw new Error(`Invalid baseUrl for provider "${entry.id}": expected a nonblank URL without unresolved placeholders`);
+  }
+  return (/\{[^}]*\}/.test(entry.baseUrl) || entry.allowBaseUrlOverride) && configuredIsResolved
+    ? [configured, "operator"]
+    : [entry.baseUrl, "registry"];
+}
+
+export function sameStringArray(left: readonly string[] | undefined, right: readonly string[]): boolean {
+  return left?.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+/** Legacy config-map lookup: exact id, colon family, then case-folded exact id. */
+export function legacyModelValue<T>(record: Readonly<Record<string, T>> | undefined, modelId: string): T | undefined {
+  if (!record) return undefined;
+  if (Object.hasOwn(record, modelId)) return record[modelId];
+  const colon = modelId.indexOf(":");
+  if (colon > 0 && Object.hasOwn(record, modelId.slice(0, colon))) return record[modelId.slice(0, colon)];
+  const folded = modelId.toLowerCase();
+  return Object.entries(record).find(([key]) => key.toLowerCase() === folded)?.[1];
+}
+
+/** Provenance from the same merged-key walk as legacyModelValue. */
+export function legacyModelSource<T>(
+  operator: Readonly<Record<string, T>> | undefined,
+  registry: Readonly<Record<string, T>> | undefined,
+  modelId: string,
+): StaticPolicySource {
+  const merged = { ...(registry ?? {}), ...(operator ?? {}) };
+  let winningKey: string | undefined;
+  if (Object.hasOwn(merged, modelId)) winningKey = modelId;
+  const colon = modelId.indexOf(":");
+  if (winningKey === undefined && colon > 0 && Object.hasOwn(merged, modelId.slice(0, colon))) {
+    winningKey = modelId.slice(0, colon);
+  }
+  if (winningKey === undefined) {
+    const folded = modelId.toLowerCase();
+    winningKey = Object.keys(merged).find(key => key.toLowerCase() === folded);
+  }
+  if (winningKey === undefined) return "unknown";
+  return Object.hasOwn(operator ?? {}, winningKey) ? "operator" : "registry";
+}
+
+export function anthropicFamilyContextWindow(
+  record: Readonly<Record<string, number>> | undefined,
+  id: string,
+): number | undefined {
+  if (!record || !id.toLowerCase().startsWith("claude-")) return undefined;
+  let candidate = id;
+  while (true) {
+    const cut = candidate.lastIndexOf("-");
+    if (cut <= 0 || !/^\d+$/.test(candidate.slice(cut + 1))) return undefined;
+    candidate = candidate.slice(0, cut);
+    const value = record[candidate]
+      ?? Object.entries(record).find(([key]) => key.toLowerCase() === candidate.toLowerCase())?.[1];
+    if (typeof value === "number" && value > 0) return value;
+  }
+}
+
+export function wireDefault(
+  declared: ModelWireDefault | undefined,
+  provider: Readonly<OcxProviderConfig>,
+  entry: Readonly<ProviderRegistryEntry> | undefined,
+  inbound: InboundWire,
+  effectiveAuthMode: OcxProviderConfig["authMode"] | undefined,
+): string | undefined {
+  if (declared === undefined || !MODEL_ADAPTER_OVERRIDE_ALLOWED.has(provider.adapter)) return undefined;
+  if (typeof declared !== "string") {
+    if (!declared.inbound.includes(inbound)) return undefined;
+    const authMode = effectiveAuthMode ?? provider.authMode ?? entry?.authKind;
+    if (declared.authModes && authMode && !declared.authModes.includes(authMode)) return undefined;
+  }
+  const wire = typeof declared === "string" ? declared : declared.wire;
+  return MODEL_ADAPTER_OVERRIDE_ALLOWED.has(wire) ? wire : undefined;
+}
diff --git a/src/providers/resolved-model-policy.ts b/src/providers/resolved-model-policy.ts
new file mode 100644
index 00000000000..7c3553a3d26
--- /dev/null
+++ b/src/providers/resolved-model-policy.ts
@@ -0,0 +1,406 @@
+import type { ModelCapabilities, OcxProviderConfig } from "../types";
+import { MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
+import { isCanonicalOpenAiForwardProvider } from "./openai-tiers";
+import { resolveProviderAuthTransport } from "./fastwire";
+import { registryEntrySupportsLiveModelDiscovery } from "./static-model-discovery";
+import type { InboundWire, ProviderRegistryEntry, ResponsesTerminalRepairPolicy } from "./registry/types";
+import {
+  anthropicFamilyContextWindow,
+  detachedClone,
+  legacyModelValue,
+  legacyModelSource,
+  mapFill,
+  nestedMapFill,
+  positiveCapMap,
+  recursivelyFreeze,
+  resolvedBaseUrl,
+  sameStringArray,
+  scalar,
+  stableUnion,
+  staticHeaders,
+  wireDefault,
+  type StaticPolicySource,
+} from "./resolved-model-policy-merge";
+export type { StaticPolicySource } from "./resolved-model-policy-merge";
+export type StaticProviderPolicyField =
+  | "adapter" | "baseUrl" | "apiKeyTransport" | "headers" | "authMode" | "codexAccountMode"
+  | "responsesPath" | "chatCompletionsPath" | "keyOptional" | "freeTier" | "modelSuffixBracketStrip"
+  | "defaultModel" | "models" | "liveModels" | "contextWindow" | "modelContextWindows"
+  | "modelDisplayNames" | "modelInputModalities" | "modelMaxInputTokens" | "defaultMaxOutputTokens"
+  | "modelMaxOutputTokens" | "reasoningEfforts" | "modelReasoningEfforts" | "modelReasoningEffortsAuthoritative"
+  | "modelDefaultReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap"
+  | "reasoningWireFormat" | "noVisionModels" | "noReasoningModels" | "noTemperatureModels"
+  | "noTopPModels" | "noPenaltyModels" | "noJsonSchemaModels" | "parallelToolCalls"
+  | "promptCacheKey" | "chatServiceTier" | "openaiChatEofTolerance" | "statelessResponses"
+  | "requiresAdjacentResponsesToolResults" | "requiresPairedResponsesToolResults" | "annotateEmptyToolOutputs"
+  | "fastWire" | "supportsServiceTier" | "modelSupportsServiceTier" | "supportsOpenAiWebSearchToolFields"
+  | "supportsResponsesCustomTools" | "preserveResponsesReasoningContent" | "dropResponsesReasoningItems"
+  | "modelSupportsReasoningSummaries"
+  | "supportsVerbosity" | "modelSupportsVerbosity" | "responsesItemIdRepair" | "autoToolChoiceOnlyModels"
+  | "preserveReasoningContentModels" | "requiresReasoningPlaceholderModels" | "reasoningSplitModels"
+  | "reasoningDetailsModels" | "thinkingToggleModels" | "thinkingBudgetModels" | "showThinkingSummary"
+  | "escapeBuiltinToolNames" | "googleMode" | "project" | "location" | "modelCapabilities"
+  | "modelAutoCompactTokenLimits" | "modelSuppressSyntheticMax" | "modelReasoningSummaryDelivery"
+  | "codexToolMode" | "modelAdapters";
+type StaticProviderPolicyShape = Pick<OcxProviderConfig, StaticProviderPolicyField>;
+export type ResolvedProviderStaticPolicy = Readonly<Partial<StaticProviderPolicyShape>> & Readonly<{
+  adapter: string;
+  baseUrl: string;
+}>;
+export interface ResolvedPerModelStaticPolicy {
+  readonly adapter: string;
+  readonly contextWindow?: number;
+  readonly inputModalities?: readonly string[];
+  readonly maxInputTokens?: number;
+  readonly maxOutputTokens?: number;
+  readonly reasoningEfforts?: readonly string[];
+  readonly defaultReasoningEffort?: string;
+  readonly supportsReasoningSummaries?: boolean;
+  readonly supportsVerbosity?: boolean;
+  readonly supportsServiceTier?: boolean;
+  readonly fastTierDescription?: string;
+  readonly directReasoningEffort?: boolean;
+  readonly responsesUpstreamStreaming?: boolean;
+  readonly responsesTerminalRepair?: Readonly<ResponsesTerminalRepairPolicy>;
+}
+export interface ResolvedModelPolicy {
+  readonly version: 1;
+  readonly providerName: string;
+  readonly modelId: string;
+  readonly transportMatchedRegistry: boolean;
+  readonly effectiveAlias?: string | null;
+  readonly provider: ResolvedProviderStaticPolicy;
+  readonly model: Readonly<ResolvedPerModelStaticPolicy>;
+  readonly provenance: Readonly<{
+    alias: StaticPolicySource;
+    provider: Readonly<Partial<Record<StaticProviderPolicyField, StaticPolicySource>>>;
+    model: Readonly<Partial<Record<keyof ResolvedPerModelStaticPolicy, StaticPolicySource>>>;
+  }>;
+}
+export interface ResolveModelPolicyInput {
+  readonly providerName: string;
+  /** Final wire identity after resolveModelAlias and resolveOpenAiVirtualModel; public selection stays diagnostic-only. */
+  readonly modelId: string;
+  readonly provider: Readonly<OcxProviderConfig>;
+  readonly registryEntry?: Readonly<ProviderRegistryEntry>;
+  readonly transportMatchedRegistry: boolean;
+  readonly inboundWire?: InboundWire;
+  /** Exact post-rewrite model capability declaration captured by the caller. */
+  readonly modelCapabilities?: Readonly<ModelCapabilities>;
+  /** Credential-free live admission result: key only after a usable override, otherwise the registry mode. */
+  readonly effectiveAuth?: Readonly<{ authMode: NonNullable<OcxProviderConfig["authMode"]> }>;
+  /** Capture-time collision-aware alias decision. Omit to use provider then registry fallback. */
+  readonly effectiveAlias?: string | null;
+  readonly effectiveAliasSource?: Exclude<StaticPolicySource, "hard-pin" | "provider-default">;
+}
+export interface ObservedModelLimits {
+  readonly contextWindow?: number;
+  readonly maxInputTokens?: number;
+  readonly maxOutputTokens?: number;
+}
+/** Call-local projection: observed values stay outside ResolvedModelPolicy and may only narrow caps. */
+export function clampObservedModelLimits(
+  policy: Readonly<Pick<ResolvedPerModelStaticPolicy, "contextWindow" | "maxInputTokens" | "maxOutputTokens">>,
+  observed: Readonly<ObservedModelLimits>,
+): Readonly<ObservedModelLimits> {
+  const clamp = (staticCap: number | undefined, observedValue: number | undefined): number | undefined => {
+    if (observedValue === undefined) return staticCap;
+    return staticCap === undefined ? observedValue : Math.min(staticCap, observedValue);
+  };
+  const contextWindow = clamp(policy.contextWindow, observed.contextWindow);
+  const clampedMaxInputTokens = clamp(policy.maxInputTokens, observed.maxInputTokens);
+  const maxInputTokens = clampedMaxInputTokens !== undefined && contextWindow !== undefined
+    ? Math.min(clampedMaxInputTokens, contextWindow)
+    : clampedMaxInputTokens;
+  const maxOutputTokens = clamp(policy.maxOutputTokens, observed.maxOutputTokens);
+  return Object.freeze({
+    ...(contextWindow !== undefined ? { contextWindow } : {}),
+    ...(maxInputTokens !== undefined ? { maxInputTokens } : {}),
+    ...(maxOutputTokens !== undefined ? { maxOutputTokens } : {}),
+  });
+}
+export function resolveModelPolicy(input: ResolveModelPolicyInput): ResolvedModelPolicy {
+  const entry = input.transportMatchedRegistry ? input.registryEntry : undefined;
+  const provider = input.provider;
+  const providerPolicy: Partial<StaticProviderPolicyShape> = {};
+  const providerProvenance: Partial<Record<StaticProviderPolicyField, StaticPolicySource>> = {};
+  const [baseUrl, baseUrlSource] = resolvedBaseUrl(entry, provider);
+  const put = <K extends StaticProviderPolicyField>(key: K, value: StaticProviderPolicyShape[K] | undefined, source: StaticPolicySource): void => {
+    if (value !== undefined) providerPolicy[key] = detachedClone(value) as never;
+    providerProvenance[key] = source;
+  };
+  const putScalar = <K extends StaticProviderPolicyField>(key: K, registryValue: StaticProviderPolicyShape[K] | undefined): void => {
+    const [value, source] = scalar(provider[key], registryValue);
+    put(key, value, source);
+  };
+  const putUnion = (key: StaticProviderPolicyField, registryValue: readonly string[] | undefined): void => {
+    const [value, source] = stableUnion(registryValue, provider[key] as string[] | undefined);
+    put(key, value as never, source);
+  };
+  const putMergedMap = <K extends StaticProviderPolicyField, T>(
+    key: K,
+    registryValue: Readonly<Record<string, T>> | undefined,
+    operatorValue: Readonly<Record<string, T>> | undefined,
+  ): void => {
+    const [value, source] = mapFill(registryValue, operatorValue);
+    put(key, value as StaticProviderPolicyShape[K], source);
+  };
+  put("adapter", entry?.adapter ?? provider.adapter, entry ? "registry" : "operator");
+  put("baseUrl", baseUrl, baseUrlSource);
+  putScalar("apiKeyTransport", entry?.apiKeyTransport);
+  const [headers, headersSource] = staticHeaders(entry?.staticHeaders, provider.headers);
+  put("headers", headers, headersSource);
+  const resolvedAuthMode = input.effectiveAuth?.authMode
+    ?? (entry?.authKind === "forward" || entry?.authKind === "oauth"
+      ? entry.authKind
+      : provider.authMode === "forward" ? undefined : provider.authMode ?? entry?.authKind);
+  put("authMode", resolvedAuthMode, input.effectiveAuth
+    ? "captured-auth"
+    : entry?.authKind === "forward" || entry?.authKind === "oauth" ? "registry"
+    : provider.authMode !== undefined ? "operator" : entry ? "registry" : "unknown");
+  putScalar("codexAccountMode", entry?.codexAccountMode);
+  const keyAuthDefaults = entry?.allowKeyAuthOverride === true
+    && resolvedAuthMode === "key"
+    && ["authorization_bearer", "x_api_key"].includes(resolveProviderAuthTransport(
+      provider.adapter,
+      resolvedAuthMode,
+      provider.apiKeyTransport,
+    ))
+    ? entry.keyAuthServiceTier
+    : undefined;
+  for (const key of [
+    "responsesPath", "chatCompletionsPath", "keyOptional", "freeTier", "modelSuffixBracketStrip",
+    "defaultModel", "models", "liveModels", "contextWindow", "defaultMaxOutputTokens",
+    "reasoningWireFormat", "parallelToolCalls", "promptCacheKey",
+    "openaiChatEofTolerance", "statelessResponses",
+    "requiresAdjacentResponsesToolResults", "requiresPairedResponsesToolResults",
+    "annotateEmptyToolOutputs", "fastWire", "supportsServiceTier",
+    "supportsOpenAiWebSearchToolFields", "supportsResponsesCustomTools",
+    "preserveResponsesReasoningContent", "dropResponsesReasoningItems",
+    "supportsVerbosity", "responsesItemIdRepair",
+    "showThinkingSummary", "escapeBuiltinToolNames", "googleMode", "project", "location",
+  ] as const) putScalar(key, entry?.[key] as StaticProviderPolicyShape[typeof key] | undefined);
+  const legacyClinePassLadder = entry !== undefined && input.providerName === "cline-pass"
+    && provider.reasoningWireFormat === "gateway-object"
+    && sameStringArray(provider.reasoningEfforts, ["low"]);
+  put("reasoningEfforts", legacyClinePassLadder ? entry?.reasoningEfforts : provider.reasoningEfforts ?? entry?.reasoningEfforts,
+    legacyClinePassLadder || provider.reasoningEfforts === undefined ? entry?.reasoningEfforts ? "registry" : "unknown" : "operator");
+  put("chatServiceTier", provider.chatServiceTier ?? keyAuthDefaults?.chatServiceTier ?? entry?.chatServiceTier,
+    provider.chatServiceTier !== undefined ? "operator" : keyAuthDefaults?.chatServiceTier !== undefined ? "registry" : entry?.chatServiceTier !== undefined ? "registry" : "unknown");
+  put("supportsServiceTier", provider.supportsServiceTier ?? keyAuthDefaults?.supportsServiceTier ?? entry?.supportsServiceTier,
+    provider.supportsServiceTier !== undefined ? "operator" : keyAuthDefaults?.supportsServiceTier !== undefined ? "registry" : entry?.supportsServiceTier !== undefined ? "registry" : "unknown");
+  if (entry && !registryEntrySupportsLiveModelDiscovery(entry)) put("liveModels", false, "registry");
+  putMergedMap("modelDisplayNames", entry?.modelDisplayNames, provider.modelDisplayNames);
+  putMergedMap("modelInputModalities", entry?.modelInputModalities, provider.modelInputModalities);
+  putMergedMap("modelMaxOutputTokens", entry?.modelMaxOutputTokens, provider.modelMaxOutputTokens);
+  putMergedMap("modelReasoningEfforts", entry?.modelReasoningEfforts, provider.modelReasoningEfforts);
+  // Operator-only: no registry entry declares it, and it decides whether the map above is the
+  // wire contract or only the catalog's. A policy reader that omitted it would report the same
+  // effective ladder for two providers that send different efforts.
+  put("modelReasoningEffortsAuthoritative", provider.modelReasoningEffortsAuthoritative,
+    provider.modelReasoningEffortsAuthoritative !== undefined ? "operator" : "unknown");
+  putMergedMap("modelDefaultReasoningEfforts", entry?.modelDefaultReasoningEfforts, provider.modelDefaultReasoningEfforts);
+  const registryServiceTier = !entry?.modelServiceTierCapabilityBaseUrlGuard
+    || entry.modelServiceTierCapabilityBaseUrlGuard(provider.baseUrl)
+    ? entry?.modelSupportsServiceTier
+    : undefined;
+  const registryServiceTierDefaults = registryServiceTier || keyAuthDefaults?.modelSupportsServiceTier
+    ? { ...(registryServiceTier ?? {}), ...(keyAuthDefaults?.modelSupportsServiceTier ?? {}) }
+    : undefined;
+  putMergedMap("modelSupportsServiceTier", registryServiceTierDefaults, provider.modelSupportsServiceTier);
+  putMergedMap("modelSupportsReasoningSummaries", entry?.modelSupportsReasoningSummaries, provider.modelSupportsReasoningSummaries);
+  putMergedMap("modelSupportsVerbosity", entry?.modelSupportsVerbosity, provider.modelSupportsVerbosity);
+  for (const key of [
+    "modelCapabilities", "modelAutoCompactTokenLimits", "modelSuppressSyntheticMax",
+    "modelReasoningSummaryDelivery", "codexToolMode", "modelAdapters",
+  ] as const) putScalar(key, undefined);
+  for (const key of ["modelContextWindows", "modelMaxInputTokens"] as const) {
+    const [value, source] = input.providerName === "openai-apikey"
+      ? positiveCapMap(entry?.[key], provider[key])
+      : mapFill(entry?.[key], provider[key]);
+    put(key, value, source);
+  }
+  const [effortMap, effortMapSource] = mapFill(entry?.reasoningEffortMap, provider.reasoningEffortMap);
+  put("reasoningEffortMap", effortMap, effortMapSource);
+  const [modelEffortMap, modelEffortMapSource] = nestedMapFill(entry?.modelReasoningEffortMap, provider.modelReasoningEffortMap);
+  put("modelReasoningEffortMap", modelEffortMap, modelEffortMapSource);
+  for (const key of [
+    "noVisionModels", "noReasoningModels", "noTemperatureModels", "noTopPModels",
+    "noPenaltyModels", "noJsonSchemaModels", "autoToolChoiceOnlyModels",
+    "preserveReasoningContentModels", "requiresReasoningPlaceholderModels",
+    "reasoningSplitModels", "reasoningDetailsModels", "thinkingToggleModels", "thinkingBudgetModels",
+  ] as const) putUnion(key, entry?.[key]);
+  for (const directModel of entry?.directReasoningEffortModels ?? []) {
+    const staleBudget = [directModel, ...(entry?.thinkingBudgetModels ?? [])];
+    const routedStaleBudget = [...(entry?.thinkingBudgetModels ?? []), directModel];
+    if (sameStringArray(provider.thinkingBudgetModels, staleBudget)
+      || sameStringArray(provider.thinkingBudgetModels, routedStaleBudget)) {
+      providerPolicy.thinkingBudgetModels = [...(entry?.thinkingBudgetModels ?? [])];
+      providerProvenance.thinkingBudgetModels = "registry";
+    }
+    const explicitEfforts = Object.entries(provider.modelReasoningEfforts ?? {})
+      .filter(([key]) => key.toLowerCase() === directModel.toLowerCase());
+    if (explicitEfforts.length > 0) {
+      for (const key of Object.keys(providerPolicy.modelReasoningEfforts ?? {})) {
+        if (key.toLowerCase() === directModel.toLowerCase()) delete providerPolicy.modelReasoningEfforts![key];
+      }
+      for (const [key, value] of explicitEfforts) (providerPolicy.modelReasoningEfforts ??= {})[key] = [...value];
+    } else if (entry?.modelReasoningEfforts?.[directModel] !== undefined) {
+      (providerPolicy.modelReasoningEfforts ??= {})[directModel] = [...entry.modelReasoningEfforts[directModel]!];
+    }
+    const explicitDefault = Object.entries(provider.modelDefaultReasoningEfforts ?? {})
+      .filter(([key]) => key.toLowerCase() === directModel.toLowerCase());
+    if (explicitDefault.length > 0) {
+      for (const key of Object.keys(providerPolicy.modelDefaultReasoningEfforts ?? {})) {
+        if (key.toLowerCase() === directModel.toLowerCase()) delete providerPolicy.modelDefaultReasoningEfforts![key];
+      }
+      for (const [key, value] of explicitDefault) (providerPolicy.modelDefaultReasoningEfforts ??= {})[key] = value;
+    } else if (entry?.modelDefaultReasoningEfforts?.[directModel] !== undefined) {
+      (providerPolicy.modelDefaultReasoningEfforts ??= {})[directModel] = entry.modelDefaultReasoningEfforts[directModel]!;
+    }
+    const explicitMap = Object.entries(provider.modelReasoningEffortMap ?? {})
+      .filter(([key]) => key.toLowerCase() === directModel.toLowerCase());
+    for (const key of Object.keys(providerPolicy.modelReasoningEffortMap ?? {})) {
+      if (key.toLowerCase() === directModel.toLowerCase()) delete providerPolicy.modelReasoningEffortMap![key];
+    }
+    if (explicitMap.length > 0) {
+      for (const [key, value] of explicitMap) (providerPolicy.modelReasoningEffortMap ??= {})[key] = { ...value };
+    } else {
+      (providerPolicy.modelReasoningEffortMap ??= {})[directModel] = {};
+    }
+  }
+  const modelValue = <T>(record: Readonly<Record<string, T>> | undefined): T | undefined =>
+    legacyModelValue(record, input.modelId);
+  const modelSource = <T>(operator: Readonly<Record<string, T>> | undefined, registry: Readonly<Record<string, T>> | undefined): StaticPolicySource =>
+    legacyModelSource(operator, registry, input.modelId);
+  const modelOrProviderSource = <T>(
+    operatorMap: Readonly<Record<string, T>> | undefined, registryMap: Readonly<Record<string, T>> | undefined,
+    operatorDefault: T | undefined, registryDefault: T | undefined,
+  ): StaticPolicySource => {
+    const exact = modelSource(operatorMap, registryMap);
+    return exact !== "unknown" ? exact : operatorDefault !== undefined ? "operator" : registryDefault !== undefined ? "registry" : "unknown";
+  };
+  const configuredAdapter = provider.modelAdapters?.[input.modelId];
+  const pin = pinnedWireAdapter(input.providerName, input.modelId);
+  const normalizedModelId = input.modelId.trim().toLowerCase();
+  const registryWire = wireDefault(entry?.modelWireDefaults?.[normalizedModelId], provider, entry,
+    input.inboundWire ?? "responses", resolvedAuthMode);
+  const explicitWire = configuredAdapter && MODEL_ADAPTER_OVERRIDE_ALLOWED.has(configuredAdapter)
+    ? configuredAdapter
+    : undefined;
+  const providerAdapter = providerPolicy.adapter ?? provider.adapter;
+  const effectiveProviderForWire = resolvedAuthMode === provider.authMode
+    ? provider
+    : { ...provider, authMode: resolvedAuthMode };
+  const canonicalForward = isCanonicalOpenAiForwardProvider(effectiveProviderForWire);
+  const adapter = pin
+    ?? (!canonicalForward ? explicitWire ?? registryWire : undefined)
+    ?? providerAdapter;
+  const adapterSource: StaticPolicySource = pin
+    ? "hard-pin"
+    : explicitWire && !canonicalForward
+      ? "operator"
+      : registryWire && !canonicalForward
+        ? "registry"
+        : "provider-default";
+  const declaredModalities = input.modelCapabilities?.inputModalities;
+  const capabilityModalities = Array.isArray(declaredModalities) && declaredModalities.length > 0
+    ? [...declaredModalities]
+    : undefined;
+  const exactContextWindow = modelValue(providerPolicy.modelContextWindows);
+  const familyContextWindow = providerPolicy.adapter === "anthropic"
+    ? anthropicFamilyContextWindow(providerPolicy.modelContextWindows, input.modelId)
+    : undefined;
+  const modelContextWindow = exactContextWindow ?? familyContextWindow ?? providerPolicy.contextWindow;
+  const exactMaxInputTokens = modelValue(providerPolicy.modelMaxInputTokens);
+  const modelMaxInputTokens = exactMaxInputTokens !== undefined && modelContextWindow !== undefined
+    ? Math.min(exactMaxInputTokens, modelContextWindow)
+    : exactMaxInputTokens;
+  const exactMaxOutputTokens = modelValue(providerPolicy.modelMaxOutputTokens);
+  const modelMaxOutputTokens = exactMaxOutputTokens ?? providerPolicy.defaultMaxOutputTokens;
+  const modelReasoningEfforts = modelValue(providerPolicy.modelReasoningEfforts) ?? providerPolicy.reasoningEfforts;
+  const modelSupportsReasoningSummaries = modelValue(providerPolicy.modelSupportsReasoningSummaries)
+    ?? (modelValue(providerPolicy.modelReasoningSummaryDelivery) !== undefined ? true : undefined);
+  const modelSupportsVerbosity = modelValue(providerPolicy.modelSupportsVerbosity) ?? providerPolicy.supportsVerbosity;
+  const modelSupportsServiceTier = modelValue(providerPolicy.modelSupportsServiceTier) ?? providerPolicy.supportsServiceTier;
+  const model: ResolvedPerModelStaticPolicy = {
+    adapter,
+    ...(modelContextWindow !== undefined ? { contextWindow: modelContextWindow } : {}),
+    ...(capabilityModalities ?? modelValue(providerPolicy.modelInputModalities) !== undefined
+      ? { inputModalities: capabilityModalities ?? modelValue(providerPolicy.modelInputModalities) }
+      : {}),
+    ...(modelMaxInputTokens !== undefined ? { maxInputTokens: modelMaxInputTokens } : {}),
+    ...(modelMaxOutputTokens !== undefined ? { maxOutputTokens: modelMaxOutputTokens } : {}),
+    ...(modelReasoningEfforts !== undefined ? { reasoningEfforts: modelReasoningEfforts } : {}),
+    ...(modelValue(providerPolicy.modelDefaultReasoningEfforts) !== undefined ? { defaultReasoningEffort: modelValue(providerPolicy.modelDefaultReasoningEfforts) } : {}),
+    ...(modelSupportsReasoningSummaries !== undefined ? { supportsReasoningSummaries: modelSupportsReasoningSummaries } : {}),
+    ...(modelSupportsVerbosity !== undefined ? { supportsVerbosity: modelSupportsVerbosity } : {}),
+    ...(modelSupportsServiceTier !== undefined ? { supportsServiceTier: modelSupportsServiceTier } : {}),
+    ...(modelSupportsServiceTier === true && entry?.fastTierDescription !== undefined
+      ? { fastTierDescription: entry.fastTierDescription }
+      : {}),
+    ...(entry?.directReasoningEffortModels?.includes(input.modelId) ? { directReasoningEffort: true } : {}),
+    ...(entry?.modelResponsesUpstreamStreaming?.[normalizedModelId] !== undefined
+      ? { responsesUpstreamStreaming: entry.modelResponsesUpstreamStreaming[normalizedModelId] }
+      : {}),
+    ...(entry?.modelResponsesTerminalRepair?.[normalizedModelId] !== undefined
+      ? { responsesTerminalRepair: entry.modelResponsesTerminalRepair[normalizedModelId] }
+      : {}),
+  };
+  const modelProvenance: Partial<Record<keyof ResolvedPerModelStaticPolicy, StaticPolicySource>> = {
+    adapter: adapterSource,
+  };
+  modelProvenance.contextWindow = modelOrProviderSource(provider.modelContextWindows, entry?.modelContextWindows, provider.contextWindow, entry?.contextWindow);
+  if (modelProvenance.contextWindow === "unknown" && familyContextWindow !== undefined) {
+    modelProvenance.contextWindow = anthropicFamilyContextWindow(provider.modelContextWindows, input.modelId) !== undefined
+      ? "operator"
+      : "registry";
+  }
+  modelProvenance.inputModalities = capabilityModalities
+    ? "operator-capability"
+    : modelSource(provider.modelInputModalities, entry?.modelInputModalities);
+  modelProvenance.maxInputTokens = modelSource(provider.modelMaxInputTokens, entry?.modelMaxInputTokens);
+  modelProvenance.maxOutputTokens = modelOrProviderSource(
+    provider.modelMaxOutputTokens,
+    entry?.modelMaxOutputTokens,
+    provider.defaultMaxOutputTokens,
+    entry?.defaultMaxOutputTokens,
+  );
+  modelProvenance.reasoningEfforts = modelOrProviderSource(provider.modelReasoningEfforts, entry?.modelReasoningEfforts, provider.reasoningEfforts, entry?.reasoningEfforts);
+  modelProvenance.defaultReasoningEffort = modelSource(
+    provider.modelDefaultReasoningEfforts,
+    entry?.modelDefaultReasoningEfforts,
+  );
+  modelProvenance.supportsReasoningSummaries = modelSource(provider.modelSupportsReasoningSummaries, entry?.modelSupportsReasoningSummaries);
+  if (modelProvenance.supportsReasoningSummaries === "unknown" && modelValue(provider.modelReasoningSummaryDelivery) !== undefined) {
+    modelProvenance.supportsReasoningSummaries = "operator";
+  }
+  modelProvenance.supportsVerbosity = modelOrProviderSource(provider.modelSupportsVerbosity, entry?.modelSupportsVerbosity, provider.supportsVerbosity, entry?.supportsVerbosity);
+  const exactServiceTierSource = modelSource(provider.modelSupportsServiceTier, registryServiceTierDefaults);
+  modelProvenance.supportsServiceTier = exactServiceTierSource !== "unknown" ? exactServiceTierSource
+    : providerProvenance.supportsServiceTier ?? "unknown";
+  modelProvenance.responsesUpstreamStreaming = model.responsesUpstreamStreaming === undefined ? "unknown" : "registry";
+  modelProvenance.responsesTerminalRepair = model.responsesTerminalRepair === undefined ? "unknown" : "registry";
+  modelProvenance.fastTierDescription = model.fastTierDescription === undefined ? "unknown" : "registry";
+  modelProvenance.directReasoningEffort = model.directReasoningEffort === undefined ? "unknown" : "registry";
+  const alias = input.effectiveAlias !== undefined
+    ? input.effectiveAlias
+    : provider.alias !== undefined
+      ? provider.alias
+      : entry?.alias;
+  const aliasSource: StaticPolicySource = input.effectiveAlias !== undefined
+    ? input.effectiveAliasSource ?? "operator"
+    : provider.alias !== undefined
+      ? "operator"
+    : entry?.alias !== undefined ? "registry" : "unknown";
+  return recursivelyFreeze(detachedClone({
+    version: 1 as const,
+    providerName: input.providerName,
+    modelId: input.modelId,
+    transportMatchedRegistry: entry !== undefined,
+    ...(alias !== undefined ? { effectiveAlias: alias } : {}),
+    provider: providerPolicy as ResolvedProviderStaticPolicy,
+    model,
+    provenance: { alias: aliasSource, provider: providerProvenance, model: modelProvenance },
+  }));
+}
diff --git a/src/providers/stale-vision-classification-migration.ts b/src/providers/stale-vision-classification-migration.ts
new file mode 100644
index 00000000000..e27cb186268
--- /dev/null
+++ b/src/providers/stale-vision-classification-migration.ts
@@ -0,0 +1,137 @@
+/**
+ * Repair vision classifications a saved config inherited from a stale registry seed.
+ *
+ * `enrichProviderFromRegistry` is fill-only and asymmetric, which is right for a hand-tuned
+ * value but freezes a wrong one:
+ *
+ * - `noVisionModels` is filled ALL-OR-NOTHING (`if (!prov.noVisionModels && seed.noVisionModels)`),
+ *   so a config saved while the list was current keeps that list forever.
+ * - `modelInputModalities` is filled per-key BENEATH the saved value, so a saved `["text"]` for
+ *   one id survives every later registry correction.
+ *
+ * Correcting the registry therefore fixes new installs only. This projection is the other half.
+ * It repairs the two saved values a stale seed left behind, in both states that reach a running
+ * process:
+ *
+ * - the full pair: modalities still exactly the stale declaration, and the id in the list. Both
+ *   are rewritten.
+ * - the half-repaired row: modalities already corrected but the id still in the list. The
+ *   sidecar predicate reads `noVisionModels` BEFORE the modality list, so that row keeps
+ *   stripping images until the name goes as well; this projection removes it and leaves the
+ *   modalities untouched.
+ *
+ * The paired modalities value is the guard in both states, which is also why it has to be
+ * readable: a name in the list with no modality declaration beside it is ambiguous — either a
+ * half-finished repair or an entry the operator added on purpose — and this projection does not
+ * guess which. It leaves that row alone.
+ *
+ * Identity is the same rule enrichment uses, read from the same helper: the registry must still
+ * own the row (`providerMatchesRegistryTransport`, the check `enrichProviderFromRegistry` makes
+ * before it writes registry metadata) and the row must still be on the entry's adapter.
+ * `opencode-go` is an existing key preset without `preserveCustomDestination`, so the id alone
+ * claims a row — exactly as it does for enrichment — while an entry that opts into destination
+ * preservation narrows this projection for free.
+ *
+ * Nothing here writes `modelCapabilities`. That is the dedicated per-model axis, it outranks
+ * every source this file touches, and it is where a deliberate text-only override belongs
+ * (`ocx provider edit <provider> --model <id> --text-only` writes it).
+ *
+ * Scope is deliberately one entry. The Go gateway's `deepseek-v4.1-flash` was declared text-only
+ * from jawcode metadata and was measured natively multimodal on 2026-09-19 (see the note at that
+ * entry in `registry/entries-core.ts`). Its sibling `deepseek-v4-flash` still rejects images
+ * upstream, and the sibling Zen tiers (`opencode-zen`, `opencode-free`) could not be probed at
+ * all — an unverified tier is not evidence, so neither is touched here.
+ */
+import { PROVIDER_REGISTRY, providerMatchesRegistryTransport } from "./registry";
+import type { OcxConfig } from "../types";
+
+export interface StaleVisionClassification {
+  /** Registry provider id whose saved rows may carry the wrong classification. */
+  provider: string;
+  model: string;
+  /** The stale saved modalities this migration is allowed to replace, and nothing else. */
+  fromModalities: string[];
+  toModalities: string[];
+}
+
+export interface StaleVisionClassificationProjection {
+  config: OcxConfig;
+  changed: boolean;
+  warnings: string[];
+}
+
+export const STALE_VISION_CLASSIFICATIONS: readonly StaleVisionClassification[] = [
+  {
+    provider: "opencode-go",
+    model: "deepseek-v4.1-flash",
+    fromModalities: ["text"],
+    toModalities: ["text", "image"],
+  },
+];
+
+/**
+ * Whether the registry still owns the row whose saved values would be rewritten.
+ *
+ * `providerMatchesRegistryTransport` is the rule enrichment applies, so this projection and the
+ * fill that put the stale values there answer identity the same way. Adapter equality stays as
+ * an additional tightening: a row moved onto another wire is not the row the seed described,
+ * however the registry entry is pinned.
+ */
+function providerStillMatchesRegistry(id: string, prov: OcxConfig["providers"][string]): boolean {
+  const entry = PROVIDER_REGISTRY.find(row => row.id === id);
+  if (entry === undefined || entry.adapter !== prov.adapter) return false;
+  return providerMatchesRegistryTransport(id, prov);
+}
+
+function sameModalities(current: unknown, expected: readonly string[]): boolean {
+  return Array.isArray(current)
+    && current.length === expected.length
+    && current.every((value, index) => value === expected[index]);
+}
+
+/** Pure projection. The caller decides whether to persist. */
+export function projectStaleVisionClassifications(
+  config: OcxConfig,
+  entries: readonly StaleVisionClassification[] = STALE_VISION_CLASSIFICATIONS,
+): StaleVisionClassificationProjection {
+  const warnings: string[] = [];
+  const repaired = new Map<string, string[]>();
+
+  for (const entry of entries) {
+    const prov = config.providers?.[entry.provider];
+    if (!prov) continue;
+    if (!providerStillMatchesRegistry(entry.provider, prov)) continue;
+    const modalities = prov.modelInputModalities;
+    if (!modalities) continue;
+    // The paired modalities value is the guard, and it decides which of the two states above this
+    // row is in. Anything else is a declaration this file does not own.
+    const saved = modalities[entry.model];
+    const stale = sameModalities(saved, entry.fromModalities);
+    const alreadyMigrated = sameModalities(saved, entry.toModalities);
+    if (!stale && !alreadyMigrated) continue;
+    const visionList = Array.isArray(prov.noVisionModels) ? prov.noVisionModels : undefined;
+    const listed = visionList !== undefined && visionList.includes(entry.model);
+    // Half-repaired rows have nothing left to do once the name is gone; the full pair is rewritten
+    // whether or not the name was ever listed, because `derive.ts` fills the two fields
+    // independently and a per-key modality fill can land without the all-or-nothing list.
+    if (!stale && !listed) continue;
+    if (stale) modalities[entry.model] = [...entry.toModalities];
+    if (visionList !== undefined && listed) {
+      prov.noVisionModels = visionList.filter(id => id !== entry.model);
+    }
+    const repairedList = repaired.get(entry.provider) ?? [];
+    repairedList.push(stale
+      ? `${entry.model} ${entry.fromModalities.join("+")} -> ${entry.toModalities.join("+")}`
+      : `${entry.model} dropped from noVisionModels (modalities already ${entry.toModalities.join("+")})`);
+    repaired.set(entry.provider, repairedList);
+  }
+
+  for (const [provider, list] of repaired) {
+    warnings.push(
+      `repaired the stale registry vision seed for ${list.length} model(s) on "${provider}": `
+      + `${list.join(", ")}.`,
+    );
+  }
+
+  return { config, changed: repaired.size > 0, warnings };
+}
diff --git a/src/responses/apply-patch-envelope.ts b/src/responses/apply-patch-envelope.ts
index 7d3d885a9a0..fdca20259bc 100644
--- a/src/responses/apply-patch-envelope.ts
+++ b/src/responses/apply-patch-envelope.ts
@@ -34,18 +34,6 @@ function stripMarkdownCodeFence(text: string, toolName: string): string {
   return match ? match[1] : text;
 }
 
-/**
- * The single-field wrappers `unwrapFreeformToolInput` accepts for one tool name, besides the
- * canonical `input`.
- *
- * Exported so the streaming side can hold a buffer that is still turning into one of these.
- * A second list of key names beside this one is how the streamed bytes and the completed item
- * come to disagree, which is the defect it exists to prevent (#5047).
- */
-export function freeformFallbackKeys(toolName: string): readonly string[] {
-  return FREEFORM_FALLBACK_KEYS[toolName] ?? [];
-}
-
 /** Unwrap the `{input:string}` function-call wrapper used for freeform tools. */
 export function unwrapFreeformToolInput(argumentsText: unknown, toolName = ""): string {
   if (typeof argumentsText !== "string") return "";
diff --git a/src/responses/freeform-wrapper-scan.ts b/src/responses/freeform-wrapper-scan.ts
new file mode 100644
index 00000000000..5ba91987e49
--- /dev/null
+++ b/src/responses/freeform-wrapper-scan.ts
@@ -0,0 +1,279 @@
+// Bounded classification of a PARTIAL freeform tool-call wrapper.
+//
+// `unwrapFreeformToolInput` decides the completed input with `JSON.parse`, which does not care
+// what order an object's properties arrive in or how their names are spelled. The streaming side
+// has to reach the same answer from a prefix, and it used to do that by comparing the buffer
+// against the literal `{"input":"`. Spellings `JSON.parse` calls identical therefore matched no
+// wrapper at all, streamed as raw JSON, and then completed as the unwrapped body:
+// `{"metadata":1,"input":"cmd"}` and `{"\u0069nput":"cmd"}` both previewed the whole object and
+// completed as `cmd` (#5151). #5047 and #5129 closed the compact and whitespace spellings of the
+// same disagreement; reordering and escaping are the two the literal matcher could never see,
+// because RFC 8259 objects are unordered and their names are strings with escapes.
+//
+// So the prefix is scanned as JSON instead of matched as text. The scan answers one question —
+// which wrapper, if any, the completed text will unwrap to — and it answers it three ways:
+//
+//   `input`  the canonical key is present with a string value, whatever preceded it and however
+//            its name was spelled. Its value can be decoded progressively, because
+//            `unwrapFreeformToolInput` gives an own `input` precedence over every other property.
+//   `raw`    no wrapper can apply, because the text is not an object or because it is one that
+//            `JSON.parse` will reject. Completion returns the buffer, so streaming it agrees.
+//   `hold`   undecided. A key that has not arrived yet can still change the answer, so nothing
+//            is published until the object parses and completion's own rule decides.
+//
+// The bound matters as much as the classification. A scan that walks the whole buffer on every
+// delta is quadratic in the argument size, so classification gives up after
+// `MAX_FREEFORM_WRAPPER_SCAN_CHARS` and holds. Giving up costs preview, never agreement: a held
+// buffer is still resolved by the authoritative parse at completion.
+
+/** The insignificant whitespace `JSON.parse` accepts between tokens. */
+export const JSON_WHITESPACE = new Set([" ", "\t", "\n", "\r"]);
+
+/** The two-character escapes JSON defines, and nothing else. */
+export const JSON_ESCAPES = new Map<string, string>([
+  ['"', '"'], ["\\", "\\"], ["/", "/"],
+  ["b", "\b"], ["f", "\f"], ["n", "\n"], ["r", "\r"], ["t", "\t"],
+]);
+
+/**
+ * How far a classification scan walks before it gives up and holds.
+ *
+ * A wrapper's own structure — its property names and the small scalar siblings a model puts
+ * beside the body — lives at the front of the object. A buffer still undecided after this much
+ * scanning is one whose preceding values are large, and holding it is what the routed
+ * restoration path already does for every unrecognized object.
+ */
+export const MAX_FREEFORM_WRAPPER_SCAN_CHARS = 4096;
+
+const CANONICAL_KEY = "input";
+
+/** The buffer ends inside a token: what follows can still change the answer. */
+const HOLD = -1;
+/** `JSON.parse` will reject this text no matter what is appended to it. */
+const NEVER = -2;
+
+export type FreeformWrapperScan =
+  | { kind: "hold"; parse: boolean }
+  | { kind: "raw" }
+  | { kind: "input"; valueStart: number };
+
+/** Index of the first non-whitespace character at or after `from`, or HOLD past the end. */
+function skipWhitespace(text: string, from: number): number {
+  let i = from;
+  while (i < text.length && JSON_WHITESPACE.has(text[i]!)) i++;
+  return i < text.length ? i : HOLD;
+}
+
+/**
+ * Index just past the complete JSON string opening at `from`, or HOLD / NEVER.
+ *
+ * This reports a BOUNDARY where `decodeJsonStringPrefix` reports a decoded PREFIX: one has to
+ * fail on a truncated string and the other has to return what it decoded so far. They answer
+ * different questions about the same bytes and share one escape table so they cannot disagree
+ * about which escapes exist.
+ */
+function scanString(text: string, from: number): number {
+  let i = from + 1;
+  while (i < text.length) {
+    const c = text[i]!;
+    if (c === '"') return i + 1;
+    if (c === "\\") {
+      const n = text[i + 1];
+      if (n === undefined) return HOLD;
+      if (n === "u") {
+        const hex = text.slice(i + 2, i + 6);
+        if (hex.length < 4) return HOLD;
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) return NEVER;
+        i += 6;
+        continue;
+      }
+      if (!JSON_ESCAPES.has(n)) return NEVER;
+      i += 2;
+      continue;
+    }
+    // A literal control character is not legal inside a JSON string.
+    if (c.charCodeAt(0) <= 0x1f) return NEVER;
+    i++;
+  }
+  return HOLD;
+}
+
+const JSON_NUMBER_CHARS = /[-+0-9.eE]/;
+const JSON_NUMBER = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$/;
+
+/** Index just past one complete scalar at `from`, or HOLD / NEVER. */
+function scanScalar(text: string, from: number): number {
+  const c = text[from]!;
+  if (c === '"') return scanString(text, from);
+  if (c === "t" || c === "f" || c === "n") {
+    const literal = c === "t" ? "true" : c === "f" ? "false" : "null";
+    if (text.startsWith(literal, from)) return from + literal.length;
+    return literal.startsWith(text.slice(from)) ? HOLD : NEVER;
+  }
+  let end = from;
+  while (end < text.length && JSON_NUMBER_CHARS.test(text[end]!)) end++;
+  if (end === from) return NEVER;
+  // A number running to the end of the buffer can still grow another digit or exponent.
+  if (end >= text.length) return HOLD;
+  return JSON_NUMBER.test(text.slice(from, end)) ? end : NEVER;
+}
+
+/** Index where the value of the member whose name opens at `from` begins, or HOLD / NEVER. */
+function scanMemberKey(text: string, from: number): number {
+  if (text[from] !== '"') return NEVER;
+  const nameEnd = scanString(text, from);
+  if (nameEnd < 0) return nameEnd;
+  const colon = skipWhitespace(text, nameEnd);
+  if (colon === HOLD) return HOLD;
+  if (text[colon] !== ":") return NEVER;
+  return skipWhitespace(text, colon + 1);
+}
+
+/**
+ * Index just past one complete JSON value at `from`, or HOLD / NEVER.
+ *
+ * Containers are walked with an explicit stack rather than recursion: the value being skipped
+ * is provider-controlled, and a deeply nested one must not be able to exhaust the call stack.
+ */
+function scanValue(text: string, from: number): number {
+  const closers: string[] = [];
+  let i = from;
+  for (;;) {
+    const c = text[i]!;
+    if (c === "{" || c === "[") {
+      const closer = c === "{" ? "}" : "]";
+      closers.push(closer);
+      const first = skipWhitespace(text, i + 1);
+      if (first === HOLD) return HOLD;
+      if (text[first] === closer) {
+        closers.pop();
+        i = first + 1;
+      } else if (closer === "}") {
+        const value = scanMemberKey(text, first);
+        if (value < 0) return value;
+        i = value;
+        continue;
+      } else {
+        i = first;
+        continue;
+      }
+    } else {
+      const end = scanScalar(text, i);
+      if (end < 0) return end;
+      i = end;
+    }
+
+    // One value is complete: close whatever it finished and find the next value, if any.
+    for (;;) {
+      if (closers.length === 0) return i;
+      const at = skipWhitespace(text, i);
+      if (at === HOLD) return HOLD;
+      const closer = closers[closers.length - 1]!;
+      if (text[at] === closer) {
+        closers.pop();
+        i = at + 1;
+        continue;
+      }
+      if (text[at] !== ",") return NEVER;
+      const next = skipWhitespace(text, at + 1);
+      if (next === HOLD) return HOLD;
+      if (closer === "}") {
+        const value = scanMemberKey(text, next);
+        if (value < 0) return value;
+        i = value;
+      } else {
+        i = next;
+      }
+      break;
+    }
+  }
+}
+
+/**
+ * Which wrapper the completed text will unwrap to, as far as this prefix can say.
+ *
+ * Fallback keys are deliberately not recognized here. They only unwrap when exactly one of them
+ * carries a string, and a second one can still arrive, so no prefix decides them — which makes
+ * them indistinguishable from any other undecided object and lets one HOLD cover both.
+ */
+export function scanFreeformWrapper(text: string): FreeformWrapperScan {
+  // One clamp rather than a budget threaded through every helper. Every helper already holds
+  // when it runs off the end of what it can see, so a buffer whose classification needs more
+  // than this holds for exactly the right reason, and no scan can cost more than this many
+  // characters however large the arguments grow. Indices into the clamp are indices into the
+  // full text, because the clamp is a prefix of it.
+  const bounded = text.length > MAX_FREEFORM_WRAPPER_SCAN_CHARS
+    ? text.slice(0, MAX_FREEFORM_WRAPPER_SCAN_CHARS)
+    : text;
+  // `parse` is true only where this scan actually SAW the object close. Every other hold ran
+  // out of buffer or out of budget, and in both cases asking `JSON.parse` is work with no
+  // possible payoff: the first is provably incomplete, and the second would re-read a growing
+  // buffer on every delta that happens to end in a brace — repeated braces inside a long
+  // unterminated string are enough to make that quadratic. Holding a budget-exhausted prefix
+  // costs nothing that matters, because the value it would release arrives in the same instant
+  // as the authoritative completion that follows it.
+  const hold = (): FreeformWrapperScan => ({ kind: "hold", parse: false });
+  const open = skipWhitespace(bounded, 0);
+  if (open === HOLD) return hold();
+  // Not an object, so no wrapper rule reaches it: arrays, scalars and ordinary bodies all
+  // complete as themselves.
+  if (bounded[open] !== "{") return { kind: "raw" };
+
+  let i = open + 1;
+  for (;;) {
+    const at = skipWhitespace(bounded, i);
+    if (at === HOLD) return hold();
+    if (bounded[at] === "}") return afterTopLevelClose(bounded, at + 1);
+    if (bounded[at] !== '"') return { kind: "raw" };
+
+    const nameEnd = scanString(bounded, at);
+    if (nameEnd === HOLD) return hold();
+    if (nameEnd === NEVER) return { kind: "raw" };
+    let name: string;
+    try {
+      // The authoritative decoder for the name, so `{"\u0069nput":...}` resolves to the same
+      // key completion sees. Decoding it by hand here is the second implementation that would
+      // drift from `JSON.parse`, which is how this defect existed in the first place.
+      name = JSON.parse(bounded.slice(at, nameEnd)) as string;
+    } catch {
+      return { kind: "raw" };
+    }
+
+    const colon = skipWhitespace(bounded, nameEnd);
+    if (colon === HOLD) return hold();
+    if (bounded[colon] !== ":") return { kind: "raw" };
+    const valueAt = skipWhitespace(bounded, colon + 1);
+    if (valueAt === HOLD) return hold();
+
+    if (name === CANONICAL_KEY) {
+      // An own `input` wins over everything else in the object, so this is decidable now. A
+      // non-string value is decidable too, in the other direction: completion hands back the
+      // argument text unchanged rather than unwrapping a value it cannot use.
+      return bounded[valueAt] === '"'
+        ? { kind: "input", valueStart: valueAt + 1 }
+        : { kind: "raw" };
+    }
+
+    const valueEnd = scanValue(bounded, valueAt);
+    if (valueEnd === HOLD) return hold();
+    if (valueEnd === NEVER) return { kind: "raw" };
+
+    const next = skipWhitespace(bounded, valueEnd);
+    if (next === HOLD) return hold();
+    if (bounded[next] === ",") {
+      i = next + 1;
+      continue;
+    }
+    if (bounded[next] === "}") return afterTopLevelClose(bounded, next + 1);
+    return { kind: "raw" };
+  }
+}
+
+/**
+ * The object closed without a canonical key. Only whitespace may follow one that parses, so
+ * anything else makes the text raw; otherwise the completed parse decides between a fallback
+ * wrapper and no wrapper at all.
+ */
+function afterTopLevelClose(text: string, from: number): FreeformWrapperScan {
+  return skipWhitespace(text, from) === HOLD ? { kind: "hold", parse: true } : { kind: "raw" };
+}
diff --git a/src/responses/legacy-dotted-tool-name-repair.ts b/src/responses/legacy-dotted-tool-name-repair.ts
new file mode 100644
index 00000000000..4346c1c0415
--- /dev/null
+++ b/src/responses/legacy-dotted-tool-name-repair.ts
@@ -0,0 +1,134 @@
+import { collectResponsesToolGroups } from "./tool-groups";
+import { isSchemaValidResponsesToolName, wireToolInnerName } from "./tool-name-aliases";
+import { CODE_MODE_HELPER_WIRE_NAMES, dottedToolName, namespacedToolName } from "../types";
+
+/**
+ * The one invented namespace this proxy is known to have emitted. Routed providers flatten a
+ * namespaced call as `ns.name`, and a provider that invents the grouping picks `default`; #3402,
+ * #4176 and #4412 all repaired that spelling on the way IN, each on its own path.
+ *
+ * This is deliberately one literal prefix rather than a rule. "Strip everything before the first
+ * dot" would silently rewrite a legitimate tool name that happens to contain a dot in some other
+ * provider's vocabulary, and a replayed history item is the worst possible place to guess: it names
+ * a call that already happened.
+ */
+const LEGACY_INVENTED_NAMESPACE_PREFIX = "default.";
+
+/** Item types whose `name` the upstream validates against the tool-name pattern. */
+const NAMED_CALL_ITEM_TYPES = new Set(["function_call", "custom_tool_call"]);
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+type DeclarationView = {
+  /** Wire spellings the caller's own catalog declares, including flattened namespace forms. */
+  readonly spellings: ReadonlySet<string>;
+  /** How many declared identities answer to a given inner name. */
+  readonly ownersByInnerName: ReadonlyMap<string, number>;
+};
+
+/**
+ * Read the request's own catalog. Namespace children contribute their inner name and both
+ * flattened spellings, which is what makes a declared `default` namespace distinguishable from an
+ * invented one.
+ */
+function readDeclarations(body: unknown): DeclarationView {
+  const spellings = new Set<string>();
+  const owners = new Map<string, number>();
+  const identities = new Map<string, Set<string>>();
+  const claim = (innerName: string, identity: string): void => {
+    const seen = identities.get(innerName);
+    if (seen === undefined) identities.set(innerName, new Set([identity]));
+    else seen.add(identity);
+  };
+  for (const group of collectResponsesToolGroups(body)) {
+    for (const spec of group) {
+      if (!isPlainObject(spec)) continue;
+      if (spec.type === "namespace" && Array.isArray(spec.tools)) {
+        const namespace = typeof spec.name === "string" ? spec.name : undefined;
+        if (namespace === undefined) continue;
+        for (const child of spec.tools) {
+          const inner = wireToolInnerName(child);
+          if (!inner) continue;
+          spellings.add(namespacedToolName(namespace, inner));
+          spellings.add(dottedToolName(namespace, inner));
+          claim(inner, JSON.stringify([namespace, inner]));
+        }
+        continue;
+      }
+      const name = wireToolInnerName(spec);
+      if (!name) continue;
+      spellings.add(name);
+      claim(name, JSON.stringify([null, name]));
+    }
+  }
+  for (const [inner, owning] of identities) owners.set(inner, owning.size);
+  return { spellings, ownersByInnerName: owners };
+}
+
+/**
+ * Canonical name a legacy dotted alias should be replayed under, or undefined to leave it alone.
+ *
+ * Fail-closed in both directions that matter. A dotted spelling the caller's catalog actually
+ * declares is a real tool identity, so it is never stripped — rewriting it would change which tool
+ * the history says was called. A suffix claimed by two declared identities is ambiguous and is
+ * left as it is. Only two things resolve: a suffix that names exactly one declared tool, and the
+ * bounded set of code-mode helper spellings, which a code-mode catalog never declares because they
+ * exist only as nested `tools.*` helpers inside `exec`.
+ */
+function repairedCallName(name: string, declarations: DeclarationView): string | undefined {
+  if (isSchemaValidResponsesToolName(name)) return undefined;
+  if (!name.startsWith(LEGACY_INVENTED_NAMESPACE_PREFIX)) return undefined;
+  if (declarations.spellings.has(name)) return undefined;
+  const suffix = name.slice(LEGACY_INVENTED_NAMESPACE_PREFIX.length);
+  if (!isSchemaValidResponsesToolName(suffix)) return undefined;
+  const owners = declarations.ownersByInnerName.get(suffix);
+  if (owners === 1) return suffix;
+  if (owners !== undefined) return undefined;
+  return CODE_MODE_HELPER_WIRE_NAMES.has(suffix) ? suffix : undefined;
+}
+
+function repairedItem(item: unknown, declarations: DeclarationView): unknown {
+  if (!isPlainObject(item)) return item;
+  if (typeof item.type !== "string" || !NAMED_CALL_ITEM_TYPES.has(item.type)) return item;
+  // An item carrying an explicit namespace is a namespaced identity whose `name` is the inner
+  // name; it is not the flattened shape this repairs, and its own field is the authority.
+  if (item.namespace !== undefined) return item;
+  if (typeof item.name !== "string") return item;
+  const repaired = repairedCallName(item.name, declarations);
+  return repaired === undefined ? item : { ...item, name: repaired };
+}
+
+/**
+ * Make an already-damaged conversation replayable.
+ *
+ * A `function_call` whose name violates `^[a-zA-Z0-9_-]+$` is not a one-turn failure: Codex stores
+ * the item, and the upstream then refuses EVERY later request that replays it
+ * (`Invalid 'input[N].name': ...`) — including the automatic compaction a long task or a side chat
+ * triggers. The emit-side fix stops new items from being created; without this the conversations
+ * that already contain one stay permanently unusable, which is the part of #5095 that actually
+ * hurts.
+ *
+ * Only replayed input items are touched. The caller's tool catalog is never rewritten, and a body
+ * with nothing to repair is returned by reference.
+ */
+export function repairLegacyDottedToolCallNames(body: unknown): unknown {
+  if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
+  if (!body.input.some(item =>
+    isPlainObject(item)
+    && typeof item.type === "string"
+    && NAMED_CALL_ITEM_TYPES.has(item.type)
+    && typeof item.name === "string"
+    && item.name.startsWith(LEGACY_INVENTED_NAMESPACE_PREFIX)
+  )) return body;
+
+  const declarations = readDeclarations(body);
+  let changed = false;
+  const input = body.input.map(item => {
+    const repaired = repairedItem(item, declarations);
+    if (repaired !== item) changed = true;
+    return repaired;
+  });
+  return changed ? { ...body, input } : body;
+}
diff --git a/src/responses/progressive-freeform-input.ts b/src/responses/progressive-freeform-input.ts
new file mode 100644
index 00000000000..8ac1af79013
--- /dev/null
+++ b/src/responses/progressive-freeform-input.ts
@@ -0,0 +1,130 @@
+import { unwrapFreeformToolInput } from "./apply-patch-envelope";
+import { JSON_ESCAPES, scanFreeformWrapper } from "./freeform-wrapper-scan";
+
+/**
+ * Whether a body could still grow into one complete outer Markdown fence.
+ *
+ * `stripMarkdownCodeFence` removes such a fence at completion for exactly the two tools that
+ * own the grammar, so a fenced body's streamed bytes and its completed input disagree unless
+ * the stream holds. A buffer that does not open with a fence can never acquire one, so
+ * ordinary bodies are unaffected; a buffer that does keeps its preview suppressed for the
+ * whole call, because a closing fence can still be followed by more text that withdraws it.
+ */
+function mayBecomeFencedBody(text: string, toolName: string): boolean {
+  if (toolName !== "exec" && toolName !== "apply_patch") return false;
+  const head = text.trimStart();
+  if (head === "") return true;
+  return head.startsWith("```") || "```".startsWith(head);
+}
+
+const LOW_SURROGATE_ESCAPE = /^\\u[dD][c-fC-F][0-9a-fA-F]{2}$/;
+
+/**
+ * The decoded prefix of a JSON string body, stopping at the first byte it cannot resolve.
+ *
+ * Every stop is a hold rather than a guess, because `JSON.parse` decides the completed value
+ * and anything invented here would be retracted. Three of them are not obvious:
+ *
+ * An escape JSON does not define makes the whole wrapper unparseable no matter what arrives
+ * next, so completion falls back to the raw text. Returning `null` for that case stops the
+ * preview rather than continuing to decode a value the completed item will never carry.
+ * `\\b` and `\\f` are defined, and were previously decoded to the letters b and f.
+ *
+ * A lone high surrogate is not a character. Emitting one alone puts an unpaired code unit in a
+ * delta the client has to decode by itself, so the pair is emitted together or not at all.
+ */
+function decodeJsonStringPrefix(body: string): string | null {
+  let out = "";
+  for (let i = 0; i < body.length; i++) {
+    const c = body[i];
+    if (c === '"') break; // unescaped closing quote: value complete
+    if (c !== "\\") {
+      // A literal control character is not legal inside a JSON string, so `JSON.parse` will
+      // reject this wrapper and completion will return the raw text. Emitting the decoded value
+      // first is the disagreement this decoder exists to prevent, so stop instead.
+      if (c!.charCodeAt(0) <= 0x1f) return null;
+      out += c;
+      continue;
+    }
+    const n = body[i + 1];
+    if (n === undefined) break; // escape split across chunks: wait for more
+    if (n === "u") {
+      const hex = body.slice(i + 2, i + 6);
+      if (hex.length < 4) break; // split across chunks: wait for more
+      if (!/^[0-9a-fA-F]{4}$/.test(hex)) return null; // never parses
+      const code = parseInt(hex, 16);
+      if (code >= 0xd800 && code <= 0xdbff) {
+        const low = body.slice(i + 6, i + 12);
+        if (!LOW_SURROGATE_ESCAPE.test(low)) break;
+        out += String.fromCharCode(code, parseInt(low.slice(2), 16));
+        i += 11;
+        continue;
+      }
+      out += String.fromCharCode(code);
+      i += 5;
+      continue;
+    }
+    const escaped = JSON_ESCAPES.get(n);
+    if (escaped === undefined) return null; // never parses
+    out += escaped;
+    i += 1;
+  }
+  return out;
+}
+
+/**
+ * The value to stream so far, or `null` to HOLD because nothing can be decided yet.
+ *
+ * `input` is decidable from its prefix: `unwrapFreeformToolInput` returns it whenever the
+ * key is present, whatever else the object carries, so its value can be unescaped
+ * progressively and never retracted.
+ *
+ * One case escapes that claim and is accepted rather than fixed: a duplicate `input` key.
+ * `JSON.parse` keeps the last one, so `{"input":"a","input":"b"}` streams a and completes with
+ * b. Closing it means holding every canonical wrapper until its object parses, which is the
+ * progressive streaming this path exists to provide. The completed item stays authoritative,
+ * and no model emits a duplicate key in practice.
+ *
+ * A wrapper that turns invalid AFTER streaming has committed has the same shape and the same
+ * answer. `{"input":"a` followed by `\\qb"}` has already published a when the undefined escape
+ * arrives, and completion returns the raw text because nothing parses. The preview stops
+ * there: no rewind, and no decoded text the completed item does not contain. Bounding the
+ * damage is what is available without giving up progressive streaming, and the args are
+ * unusable in that case whichever representation wins.
+ *
+ * A fallback key is not decidable. It only unwraps when it is the SINGLE string field, and a
+ * second key can still arrive — so a value emitted early would have to be taken back. That is
+ * the rewind this holds instead: stream nothing until the object closes, then publish the one
+ * repaired body. The routed passthrough in `responses-custom-tool-repair.ts` already holds
+ * any object prefix for the same reason (#5047).
+ *
+ * An object that has not reached a canonical key YET is in exactly that position, and used to
+ * be treated as raw because it did not match the literal `{"input":"`. It holds now: `input`
+ * can still arrive after other properties, or wearing an escaped spelling, and completion would
+ * then unwrap a body whose wrapper syntax had already been published as deltas (#5151). The
+ * cost of holding is preview on an object body that turns out not to be a wrapper; the cost of
+ * not holding was publishing bytes the completed item removes.
+ */
+export function progressiveFreeformInput(args: string, toolName: string): string | null {
+  const scan = scanFreeformWrapper(args);
+  if (scan.kind === "input") {
+    const decoded = decodeJsonStringPrefix(args.slice(scan.valueStart));
+    if (decoded === null) return null;
+    return mayBecomeFencedBody(decoded, toolName) ? null : decoded;
+  }
+  if (scan.kind === "raw") return mayBecomeFencedBody(args, toolName) ? null : args;
+
+  // Undecided: some wrapper may still apply, and only the completed object says which one.
+  // The parse runs exactly where the scan SAW the object close, so it reads a buffer the scan
+  // already walked and its cost is bounded by the same clamp. A hold from either limit stays
+  // held: an incomplete object has nothing to parse, and re-reading a budget-exhausted buffer
+  // on every delta is quadratic work for a delta that would arrive in the same instant as the
+  // authoritative completion behind it.
+  if (!scan.parse) return null;
+  try {
+    JSON.parse(args);
+  } catch {
+    return null;
+  }
+  return unwrapFreeformToolInput(args, toolName);
+}
diff --git a/src/responses/reasoning-envelope.ts b/src/responses/reasoning-envelope.ts
index 9b97dd060ab..60612864fdd 100644
--- a/src/responses/reasoning-envelope.ts
+++ b/src/responses/reasoning-envelope.ts
@@ -63,6 +63,36 @@ export function encodeReasoningEnvelope(envelope: ReasoningEnvelope, budget?: Tr
   }
 }
 
+/**
+ * Whether a thinking part's `signature` is an attestation some provider issued, rather than
+ * the serialized reasoning item the parser parks in the same field.
+ *
+ * `src/responses/parser.ts` stores `JSON.stringify(reasoningItem)` on an UNSIGNED thinking
+ * part so the opaque item survives a same-provider round trip. Every adapter that forwards a
+ * signature upstream is forwarding an opaque attestation, and a provider asked to verify our
+ * own parser state cannot recognize it. The predicate lives beside the envelope code that owns
+ * this field's representation rather than in one adapter, because a private second copy is how
+ * the side that writes the field and a side that reads it come to disagree about what it holds.
+ *
+ * This is a deny-list for exactly that one shape, not a guess at what an attestation looks
+ * like. `src/adapters/anthropic.ts` applies a stricter allow-list on top of it, because an
+ * Anthropic signature has a known base64 spelling; that shape is a fact about Anthropic's wire
+ * and is not assumed of any other provider's token here.
+ */
+export function isProviderIssuedThinkingSignature(
+  signature: string | undefined,
+): signature is string {
+  if (typeof signature !== "string" || signature.length === 0) return false;
+  if (!signature.startsWith("{")) return true;
+  try {
+    const parsed: unknown = JSON.parse(signature);
+    return !parsed || typeof parsed !== "object" || Array.isArray(parsed)
+      || (parsed as { type?: unknown }).type !== "reasoning";
+  } catch {
+    return true;
+  }
+}
+
 /** Decode an ocxr1 envelope; returns null for native (OpenAI-encrypted) blobs or garbage. */
 export function decodeReasoningEnvelope(encryptedContent: string, budget?: TranslatorBudget): ReasoningEnvelope | null {
   if (!encryptedContent.startsWith(OCX_REASONING_PREFIX)) return null;
diff --git a/src/responses/state.ts b/src/responses/state.ts
index 35237de6db7..1037f0d28f0 100644
--- a/src/responses/state.ts
+++ b/src/responses/state.ts
@@ -135,11 +135,10 @@ export type ResidentInput = Omit<ResidentResponseState, "kind" | "sizeBytes">;
 
 export type PreviousResponseReplayFailure = {
   code: "previous_response_not_found";
-  reason: "spill_missing" | "spill_corrupt" | "spill_failed" | "spill_too_large";
+  reason: "spill_missing" | "spill_corrupt" | "spill_failed" | "spill_too_large" | "scope_mismatch";
 };
 
 const states = new Map<string, StoredResponseState>();
-const replayScopeMismatches = new WeakSet<object>();
 let storedResponseBytes = 0;
 let residentResponseBytes = 0;
 let oldestResidentId: string | undefined;
@@ -1044,11 +1043,6 @@ function normalizedClientThreadId(value: unknown): string | undefined {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
 
-function withoutPreviousResponseId(request: Record<string, unknown>): Record<string, unknown> {
-  const { previous_response_id: _previousResponseId, ...freshRequest } = request;
-  return freshRequest;
-}
-
 export function expandPreviousResponseInput(body: unknown, clientThreadId?: string): unknown {
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
   const request = body as Record<string, unknown>;
@@ -1068,10 +1062,9 @@ export function expandPreviousResponseInput(body: unknown, clientThreadId?: stri
   // A Codex task must never inherit another task's continuation, nor a legacy unscoped entry.
   // Unscoped callers retain backward-compatible replay only with other unscoped entries.
   if (requestThreadId !== storedThreadId) {
-    const freshRequest = withoutPreviousResponseId(request);
-    replayScopeMismatches.add(freshRequest);
+    replayFailures.set(request, { code: "previous_response_not_found", reason: "scope_mismatch" });
     replayScopeMismatchDrops += 1;
-    return freshRequest;
+    return body;
   }
   // The client already replayed this history verbatim. Prepending the stored copy would
   // double it, and the doubled turn is stored again, so the next turn triples (#1412 saw
@@ -1136,9 +1129,9 @@ export function copyPreviousResponseReplayProvenance(source: unknown, target: un
   replayedInputPrefixLengths.set(target, prefixLength);
 }
 
-/** True when a stale or foreign previous_response_id was removed from this exact request body. */
+/** True when this exact request could not replay because its task scope did not match. */
 export function previousResponseScopeMismatch(body: unknown): boolean {
-  return !!body && typeof body === "object" && replayScopeMismatches.has(body as object);
+  return previousResponseReplayFailure(body)?.reason === "scope_mismatch";
 }
 
 export function previousResponseConversationId(responseId: string | undefined): string | undefined {
diff --git a/src/responses/tool-name-aliases.ts b/src/responses/tool-name-aliases.ts
index 1943a686bfd..28464f284f1 100644
--- a/src/responses/tool-name-aliases.ts
+++ b/src/responses/tool-name-aliases.ts
@@ -19,6 +19,21 @@ export function dottedAliasIsUnambiguous(namespace: string, name: string): boole
   return !namespace.includes("__") && !name.includes("__");
 }
 
+/**
+ * Charset the Responses API enforces on a tool-call `name`.
+ *
+ * A name outside it is not merely rejected for the turn that carries it: Codex stores the item in
+ * the conversation, and every later request that replays that history is refused before it runs
+ * (`Invalid 'input[N].name': string does not match pattern '^[a-zA-Z0-9_-]+$'`). One relayed item
+ * therefore ends the conversation permanently, which is why the emit boundary treats an invalid
+ * name as a defect to repair rather than as a name to forward. See #5095.
+ */
+const RESPONSES_TOOL_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+
+export function isSchemaValidResponsesToolName(name: string): boolean {
+  return RESPONSES_TOOL_NAME_PATTERN.test(name);
+}
+
 export function wireToolInnerName(tool: unknown): string | undefined {
   if (!isPlainObject(tool)) return undefined;
   const nestedFunction = tool.type === "function" && isPlainObject(tool.function)
@@ -76,4 +91,3 @@ export function collectAmbiguousDottedAliases(specGroups: readonly unknown[]): S
   for (const [alias, owner] of owners) if (owner === null) ambiguous.add(alias);
   return ambiguous;
 }
-
diff --git a/src/router.ts b/src/router.ts
index 3e28a911869..84e4347bb61 100644
--- a/src/router.ts
+++ b/src/router.ts
@@ -15,10 +15,12 @@ import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { redactSecretString, redactUrlForLog } from "./lib/redact";
 import {
   PROVIDER_REGISTRY,
-  mergeRegistryStaticHeaders,
   providerCodexAccountMode,
-  registryModelServiceTierCapabilityApplies,
+  registryEntryForProviderDestination,
 } from "./providers/registry";
+// Imported from the module directly rather than through the registry facade, which is at its
+// file-size cap.
+import { registryModelIdKeys } from "./providers/registry/model-ids";
 import { applyDirectReasoningEffortContracts, hasLegacyClinePassReasoningEfforts } from "./providers/derive";
 import { cloneFastWire } from "./providers/fastwire";
 import {
@@ -29,11 +31,10 @@ import {
   isCanonicalOpenAiForwardProvider,
   LEGACY_CHATGPT_PROVIDER_ID,
   LEGACY_OPENAI_MULTI_PROVIDER_ID,
-  OPENAI_API_PROVIDER_ID,
   OPENAI_CODEX_PROVIDER_ID,
 } from "./providers/openai-tiers";
 import { decodeRoutedModelIdOrThrow, encodeRoutedModelId } from "./providers/slug-codec";
-import { resolveModelAlias } from "./providers/default-aliases";
+import { effectiveProviderAliasDecision, resolveModelAlias } from "./providers/default-aliases";
 import { resolveBlockedModelRedirect } from "./lib/shadow-call";
 import { getStaleCached } from "./codex/model-cache";
 import { codexAccountNamespaceEntries } from "./codex/account-namespaces";
@@ -46,6 +47,7 @@ import {
 import { getRoutingProfile, resolvePolicyProfileId, POLICY_NAMESPACE } from "./routing/profile";
 import { evaluatePolicyProfile, type PolicyRequestEvidence } from "./routing/evaluator";
 import { assemblePolicyCandidateEvidence } from "./routing/compatibility/assemble";
+import { resolveModelPolicy, type ResolvedModelPolicy } from "./providers/resolved-model-policy";
 
 export class UnknownRoutingPolicyError extends Error {
   constructor(readonly profileId: string) {
@@ -69,6 +71,8 @@ export interface RouteResult {
   providerName: string;
   provider: OcxProviderConfig;
   modelId: string;
+  /** Immutable static policy for the current final wire model. */
+  staticPolicy: ResolvedModelPolicy;
   /** Which deterministic routing path produced this route (RI-01). */
   routeKind: RouteDecisionKind;
   /** Stable wire reason code for the selected route (RI-01). */
@@ -83,6 +87,29 @@ export interface RouteResult {
   routeDecision?: RouteDecisionTraceV1;
 }
 
+export function captureRouteStaticPolicy(
+  providerName: string,
+  modelId: string,
+  provider: OcxProviderConfig,
+  effectiveAlias?: string | null,
+  inboundWire: "responses" | "chat" | "anthropic" = "responses",
+): ResolvedModelPolicy {
+  const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
+  const transportMatchedRegistry = !!registryEntry
+    && providerMatchesRegistryTransportWithStaticGuards(providerName, provider);
+  return resolveModelPolicy({
+    providerName,
+    modelId,
+    provider,
+    registryEntry,
+    transportMatchedRegistry,
+    inboundWire,
+    modelCapabilities: provider.modelCapabilities?.[modelId],
+    ...(provider.authMode ? { effectiveAuth: { authMode: provider.authMode } } : {}),
+    ...(effectiveAlias !== undefined ? { effectiveAlias } : {}),
+  });
+}
+
 const MODEL_PROVIDER_PATTERNS: Array<{ providerNames: string[]; prefixes: string[] }> = [
   {
     providerNames: ["anthropic"],
@@ -117,19 +144,11 @@ export function knownModelIdsForProvider(
     : undefined;
   for (const id of registry?.models ?? []) ids.add(id);
   // Registry model-keyed hint maps double as known native ids (e.g. NVIDIA carries no
-  // static models list but names `moonshotai/kimi-k2.6` in its effort/window maps).
-  for (const map of [
-    registry?.modelContextWindows,
-    registry?.modelInputModalities,
-    registry?.modelReasoningEfforts,
-    registry?.modelDefaultReasoningEfforts,
-    registry?.modelReasoningEffortMap,
-    registry?.modelMaxOutputTokens,
-    registry?.modelSupportsServiceTier,
-    registry?.modelSupportsVerbosity,
-  ]) {
-    for (const id of Object.keys(map ?? {})) ids.add(id);
-  }
+  // static models list but names `moonshotai/kimi-k2.6` in its effort/window maps). Which
+  // maps count is classified by the registry itself rather than listed here, so an id declared
+  // only in a map this function forgot is no longer undecodable, and a new model-keyed field
+  // fails typecheck until its keys are given a meaning.
+  for (const id of registry ? registryModelIdKeys(registry) : []) ids.add(id);
   for (const cached of getStaleCached(provName) ?? []) ids.add(cached.id);
   for (const model of config?.customModels ?? []) {
     if (model.provider === provName && model.modelId) ids.add(model.modelId);
@@ -137,66 +156,6 @@ export function knownModelIdsForProvider(
   return [...ids];
 }
 
-// Merge registry-default effort maps under user values so built-in provider configs can
-// carry real upstream aliases without a disk migration. User overrides win per-key.
-function mergeRecord(
-  seed: Record<string, string> | undefined,
-  user: Record<string, string> | undefined,
-): Record<string, string> | undefined {
-  if (!seed && !user) return undefined;
-  return { ...(seed ?? {}), ...(user ?? {}) };
-}
-
-function mergeNestedRecord(
-  seed: Record<string, Record<string, string>> | undefined,
-  user: Record<string, Record<string, string>> | undefined,
-): Record<string, Record<string, string>> | undefined {
-  if (!seed && !user) return undefined;
-  const out: Record<string, Record<string, string>> = {};
-  for (const [key, value] of Object.entries(seed ?? {})) out[key] = { ...value };
-  for (const [key, value] of Object.entries(user ?? {})) out[key] = { ...(out[key] ?? {}), ...value };
-  return out;
-}
-
-function mergeStringArray(
-  seed: string[] | undefined,
-  user: string[] | undefined,
-): string[] | undefined {
-  if (!seed && !user) return undefined;
-  return [...new Set([...(seed ?? []), ...(user ?? [])])];
-}
-
-function mergeRecordFill<T>(
-  seed: Record<string, T> | undefined,
-  user: Record<string, T> | undefined,
-): Record<string, T> | undefined {
-  if (!seed && !user) return undefined;
-  return { ...(seed ?? {}), ...(user ?? {}) };
-}
-
-function mergePositiveNumberCaps(
-  seed: Record<string, number> | undefined,
-  user: Record<string, number> | undefined,
-): Record<string, number> | undefined {
-  if (!seed && !user) return undefined;
-  const out = { ...(seed ?? {}) };
-  for (const [key, value] of Object.entries(user ?? {})) {
-    out[key] = typeof out[key] === "number" ? Math.min(out[key]!, value) : value;
-  }
-  return out;
-}
-
-function mergeStringArrayRecord(
-  seed: Record<string, string[]> | undefined,
-  user: Record<string, string[]> | undefined,
-): Record<string, string[]> | undefined {
-  if (!seed && !user) return undefined;
-  const out: Record<string, string[]> = {};
-  for (const [key, value] of Object.entries(seed ?? {})) out[key] = [...value];
-  for (const [key, value] of Object.entries(user ?? {})) out[key] = [...value];
-  return out;
-}
-
 /** Same endpoint modulo surrounding space and trailing slashes — matches `matchBaseUrlChoice`. */
 function isSameEndpoint(a: string, b: string): boolean {
   return a.trim().replace(/\/+$/, "") === b.trim().replace(/\/+$/, "");
@@ -302,7 +261,20 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
   if (!registryEntry || !providerMatchesRegistryTransportWithStaticGuards(providerName, provider)) {
     assertProviderDestinationAllowed(providerName, provider);
-    return { ...provider, apiKey: usableResolvedApiKey(provider.apiKey) };
+    // A row whose adapter no longer matches its registry entry still reaches the Responses
+    // adapter when one model opts in through `modelAdapters` — a Volcengine Coding Plan config
+    // saved on Chat, for instance. The replay-drop flag belongs to the DESTINATION rather than
+    // to the provider-wide wire, so it is filled here too; without it that continuation forwards
+    // the reasoning item the upstream answers 400 to. Destination matching refuses templated and
+    // overridable base URLs, so this cannot follow a retargeted row, and an explicit value wins.
+    const destination = registryEntryForProviderDestination(provider);
+    return {
+      ...provider,
+      apiKey: usableResolvedApiKey(provider.apiKey),
+      ...(provider.dropResponsesReasoningItems === undefined && destination?.dropResponsesReasoningItems !== undefined
+        ? { dropResponsesReasoningItems: destination.dropResponsesReasoningItems }
+        : {}),
+    };
   }
   const resolvedApiKey = usableResolvedApiKey(provider.apiKey);
   const staticModelCatalog = !providerSupportsLiveModelDiscovery(providerName, provider);
@@ -317,46 +289,42 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
       : registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
         ? registryEntry.authKind
         : provider.authMode === "forward" ? undefined : provider.authMode;
-  const reasoningEffortMap = mergeRecord(registryEntry.reasoningEffortMap, provider.reasoningEffortMap);
-  const modelReasoningEffortMap = mergeNestedRecord(registryEntry.modelReasoningEffortMap, provider.modelReasoningEffortMap);
-  const modelReasoningEfforts = mergeStringArrayRecord(registryEntry.modelReasoningEfforts, provider.modelReasoningEfforts);
-  const modelDefaultReasoningEfforts = mergeRecordFill(registryEntry.modelDefaultReasoningEfforts, provider.modelDefaultReasoningEfforts);
-  const modelContextWindows = providerName === OPENAI_API_PROVIDER_ID
-    ? mergePositiveNumberCaps(registryEntry.modelContextWindows, provider.modelContextWindows)
-    : mergeRecordFill(registryEntry.modelContextWindows, provider.modelContextWindows);
-  const modelInputModalities = mergeRecordFill(registryEntry.modelInputModalities, provider.modelInputModalities);
+  const staticPolicy = resolveModelPolicy({
+    providerName,
+    modelId: "__provider_static__",
+    provider,
+    registryEntry,
+    transportMatchedRegistry: true,
+    ...(canonicalAuthMode ? { effectiveAuth: { authMode: canonicalAuthMode } } : {}),
+  }).provider;
+  const reasoningEffortMap = staticPolicy.reasoningEffortMap;
+  const modelReasoningEffortMap = staticPolicy.modelReasoningEffortMap;
+  const modelReasoningEfforts = staticPolicy.modelReasoningEfforts;
+  const modelDefaultReasoningEfforts = staticPolicy.modelDefaultReasoningEfforts;
+  const modelContextWindows = staticPolicy.modelContextWindows;
+  const modelInputModalities = staticPolicy.modelInputModalities;
   // Registry static headers are documented as applying to every upstream request, so they are
   // filled at resolve time rather than only at seed time: a config written before a header
   // existed, or one carrying any header of its own, would otherwise never receive it. User
   // headers win, matched case-insensitively so an override replaces rather than duplicates.
-  const headers = mergeRegistryStaticHeaders(registryEntry.staticHeaders, provider.headers);
-  const modelMaxInputTokens = providerName === OPENAI_API_PROVIDER_ID
-    ? mergePositiveNumberCaps(registryEntry.modelMaxInputTokens, provider.modelMaxInputTokens)
-    : mergeRecordFill(registryEntry.modelMaxInputTokens, provider.modelMaxInputTokens);
-  const modelMaxOutputTokens = mergeRecordFill(registryEntry.modelMaxOutputTokens, provider.modelMaxOutputTokens);
-  const modelSupportsServiceTier = mergeRecordFill(
-    registryModelServiceTierCapabilityApplies(registryEntry, provider)
-      ? registryEntry.modelSupportsServiceTier
-      : undefined,
-    provider.modelSupportsServiceTier,
-  );
-  const modelSupportsVerbosity = mergeRecordFill(
-    registryEntry.modelSupportsVerbosity,
-    provider.modelSupportsVerbosity,
-  );
-  const noVisionModels = mergeStringArray(registryEntry.noVisionModels, provider.noVisionModels);
-  const noReasoningModels = mergeStringArray(registryEntry.noReasoningModels, provider.noReasoningModels);
-  const noTemperatureModels = mergeStringArray(registryEntry.noTemperatureModels, provider.noTemperatureModels);
-  const noTopPModels = mergeStringArray(registryEntry.noTopPModels, provider.noTopPModels);
-  const noPenaltyModels = mergeStringArray(registryEntry.noPenaltyModels, provider.noPenaltyModels);
-  const noJsonSchemaModels = mergeStringArray(registryEntry.noJsonSchemaModels, provider.noJsonSchemaModels);
-  const autoToolChoiceOnlyModels = mergeStringArray(registryEntry.autoToolChoiceOnlyModels, provider.autoToolChoiceOnlyModels);
-  const preserveReasoningContentModels = mergeStringArray(registryEntry.preserveReasoningContentModels, provider.preserveReasoningContentModels);
-  const requiresReasoningPlaceholderModels = mergeStringArray(registryEntry.requiresReasoningPlaceholderModels, provider.requiresReasoningPlaceholderModels);
-  const reasoningSplitModels = mergeStringArray(registryEntry.reasoningSplitModels, provider.reasoningSplitModels);
-  const reasoningDetailsModels = mergeStringArray(registryEntry.reasoningDetailsModels, provider.reasoningDetailsModels);
-  const thinkingToggleModels = mergeStringArray(registryEntry.thinkingToggleModels, provider.thinkingToggleModels);
-  const thinkingBudgetModels = mergeStringArray(registryEntry.thinkingBudgetModels, provider.thinkingBudgetModels);
+  const headers = staticPolicy.headers;
+  const modelMaxInputTokens = staticPolicy.modelMaxInputTokens;
+  const modelMaxOutputTokens = staticPolicy.modelMaxOutputTokens;
+  const modelSupportsServiceTier = staticPolicy.modelSupportsServiceTier;
+  const modelSupportsVerbosity = staticPolicy.modelSupportsVerbosity;
+  const noVisionModels = staticPolicy.noVisionModels;
+  const noReasoningModels = staticPolicy.noReasoningModels;
+  const noTemperatureModels = staticPolicy.noTemperatureModels;
+  const noTopPModels = staticPolicy.noTopPModels;
+  const noPenaltyModels = staticPolicy.noPenaltyModels;
+  const noJsonSchemaModels = staticPolicy.noJsonSchemaModels;
+  const autoToolChoiceOnlyModels = staticPolicy.autoToolChoiceOnlyModels;
+  const preserveReasoningContentModels = staticPolicy.preserveReasoningContentModels;
+  const requiresReasoningPlaceholderModels = staticPolicy.requiresReasoningPlaceholderModels;
+  const reasoningSplitModels = staticPolicy.reasoningSplitModels;
+  const reasoningDetailsModels = staticPolicy.reasoningDetailsModels;
+  const thinkingToggleModels = staticPolicy.thinkingToggleModels;
+  const thinkingBudgetModels = staticPolicy.thinkingBudgetModels;
   const registryBaseUrlIsTemplate = /\{[^}]*\}/.test(registryEntry.baseUrl);
   const userBaseUrl = typeof provider.baseUrl === "string" ? provider.baseUrl.trim() : "";
   const userBaseUrlIsResolved = userBaseUrl.length > 0 && !/\{[^}]*\}/.test(userBaseUrl);
@@ -417,6 +385,9 @@ export function routedProviderConfig(providerName: string, provider: OcxProvider
     ...(provider.preserveResponsesReasoningContent === undefined && registryEntry.preserveResponsesReasoningContent !== undefined
       ? { preserveResponsesReasoningContent: registryEntry.preserveResponsesReasoningContent }
       : {}),
+    ...(provider.dropResponsesReasoningItems === undefined && registryEntry.dropResponsesReasoningItems !== undefined
+      ? { dropResponsesReasoningItems: registryEntry.dropResponsesReasoningItems }
+      : {}),
     // The request path resolves through routedProviderConfig() and never calls
     // enrichProviderFromRegistry(), so a saved provider row written before the
     // registry learned this flag must be backfilled here or route.provider never
@@ -565,10 +536,15 @@ function routeResult(
   const effectiveModelId = redirected ?? modelId;
   const effectiveRouteReason = redirected ? "blocked-model-redirect" : routeReason;
   const codexAccountMode = providerCodexAccountMode(providerName, provider);
+  const routedProvider = routedProviderConfig(providerName, provider);
+  const effectiveAlias = config
+    ? effectiveProviderAliasDecision(providerName, provider, config)
+    : undefined;
   return {
     providerName,
-    provider: routedProviderConfig(providerName, provider),
+    provider: routedProvider,
     modelId: effectiveModelId,
+    staticPolicy: captureRouteStaticPolicy(providerName, effectiveModelId, routedProvider, effectiveAlias),
     routeKind,
     routeReason: effectiveRouteReason,
     ...(codexAccountMode ? { codexAccountMode } : {}),
diff --git a/src/routing/compatibility/behavior.ts b/src/routing/compatibility/behavior.ts
index 24cbc55e8f0..40d8096162a 100644
--- a/src/routing/compatibility/behavior.ts
+++ b/src/routing/compatibility/behavior.ts
@@ -200,6 +200,12 @@ export function resolveProductionBehaviorValues(
         : reasoningEfforts.length > 0 || Boolean(registryEntry?.reasoningEfforts),
     ),
     "reasoning.efforts": behaviorRow("provider_config", reasoningEfforts),
+    // Whether the configured ladder above is what the WIRE uses, or only what the catalog
+    // advertises. An adapter shipping its own per-model table (command-code) otherwise wins for
+    // models it knows, and it also repairs a refused rung by replaying without the effort. Two
+    // routes that disagree about this send different bytes and recover differently, so they are
+    // not the same compatibility subject and must not share evidence.
+    "reasoning.effortsAuthoritative": behaviorRow("provider_config", effective.modelReasoningEffortsAuthoritative === true),
     "reasoning.defaultEffort": behaviorRow("provider_config", defaultReasoningEffort),
     "reasoning.effortMap": behaviorRow("provider_config", reasoningEffortMap),
     "reasoning.wireFormat": behaviorRow("provider_config", effective.reasoningWireFormat ?? null),
@@ -209,6 +215,9 @@ export function resolveProductionBehaviorValues(
     }),
     "reasoning.replayMode": behaviorRow("provider_config", {
       preserveResponses: effective.preserveResponsesReasoningContent === true,
+      // Dropping replayed reasoning items changes the continuation body, so two routes that
+      // disagree about it are not the same compatibility subject and must not share evidence.
+      dropResponses: effective.dropResponsesReasoningItems === true,
       preserveContent: includesModel(effective.preserveReasoningContentModels, modelId),
       placeholder: includesModel(effective.requiresReasoningPlaceholderModels, modelId),
     }),
diff --git a/src/routing/compatibility/subject.ts b/src/routing/compatibility/subject.ts
index be4b8517f42..7eaa4abea9c 100644
--- a/src/routing/compatibility/subject.ts
+++ b/src/routing/compatibility/subject.ts
@@ -1,5 +1,8 @@
 import type { OcxConfig, OcxProviderConfig } from "../../types";
 import type { InboundWire } from "../../providers/registry";
+import { getProviderRegistryEntry } from "../../providers/registry";
+import { providerMatchesRegistryTransportWithStaticGuards } from "../../providers/static-model-discovery";
+import { resolveModelPolicy } from "../../providers/resolved-model-policy";
 import { subjectIdForSubject } from "../../lab/digest";
 import { buildRouteSubjectV1 } from "../../lab/subject/route-subject";
 import { buildProtocolSubjectV1 } from "../../lab/subject/protocol-subject";
@@ -65,7 +68,19 @@ export function resolveCompatibilitySubjectsForInboundWire(
   inboundWire: InboundWire,
   configDir?: string,
 ): ResolvedPolicyCompatibilitySubjects {
-  const effective = resolveWireProtocolOverride(providerName, modelId, routed, inboundWire);
+  const registryEntry = getProviderRegistryEntry(providerName);
+  const staticPolicy = resolveModelPolicy({
+    providerName,
+    modelId,
+    provider: routed,
+    registryEntry,
+    transportMatchedRegistry: !!registryEntry
+      && providerMatchesRegistryTransportWithStaticGuards(providerName, routed),
+    inboundWire,
+    modelCapabilities: routed.modelCapabilities?.[modelId],
+    ...(routed.authMode ? { effectiveAuth: { authMode: routed.authMode } } : {}),
+  });
+  const effective = resolveWireProtocolOverride(providerName, modelId, routed, inboundWire, staticPolicy);
   const baseUrl = typeof effective.baseUrl === "string" ? effective.baseUrl.trim() : "";
   const adapter = effective.adapter ?? "openai-responses";
   const inboundProtocol = inboundProtocolForWire(inboundWire);
diff --git a/src/server/adapter-resolve.ts b/src/server/adapter-resolve.ts
index 32bec2825b4..a2c0cc921b8 100644
--- a/src/server/adapter-resolve.ts
+++ b/src/server/adapter-resolve.ts
@@ -3,6 +3,7 @@ import type { OcxProviderConfig } from "../types";
 import { isWirePinnedModel, MODEL_ADAPTER_OVERRIDE_ALLOWED, pinnedWireAdapter } from "../types";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { type InboundWire, providerModelWireDefault } from "../providers/registry";
+import type { ResolvedModelPolicy } from "../providers/resolved-model-policy";
 
 /**
  * Resolve the wire a single model should use: a hard pin first, then a configured
@@ -22,7 +23,15 @@ export function resolveWireProtocolOverride(
   modelId: string,
   providerConfig: OcxProviderConfig,
   inbound: InboundWire = "responses",
+  staticPolicy?: ResolvedModelPolicy,
 ): OcxProviderConfig {
+  // RouteResult policy is recaptured for the original inbound protocol whenever routing selects
+  // or replaces a destination, so every downstream rebuild consumes the same adapter authority.
+  if (staticPolicy) {
+    return staticPolicy.model.adapter !== providerConfig.adapter
+      ? { ...providerConfig, adapter: staticPolicy.model.adapter }
+      : providerConfig;
+  }
   const pinned = pinnedWireAdapter(providerName, modelId);
   if (pinned && providerConfig.adapter !== pinned) {
     return { ...providerConfig, adapter: pinned };
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index 554f9e298b4..c8f53c861ae 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -942,12 +942,15 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   supportsServiceTier: "editor",
   modelSupportsServiceTier: "editor",
   preserveResponsesReasoningContent: "editor",
+  dropResponsesReasoningItems: "editor",
+  modelReasoningEffortsAuthoritative: "editor",
   decodesNativeCompactionBlobs: "editor",
   allowEncryptedV2AgentTasks: "editor",
   allowPrivateNetwork: "editor",
   upstreamHttpVersion: "editor",
   upstreamWebsocket: "editor",
   directGeminiWireRenames: "editor",
+  googleToolSchemaPolicy: "editor",
   disabled: "editor",
   codexAccountMode: "editor",
   apiKey: "redacted",
diff --git a/src/server/chat-completions.ts b/src/server/chat-completions.ts
index cbd04787052..8a611e70e4b 100644
--- a/src/server/chat-completions.ts
+++ b/src/server/chat-completions.ts
@@ -23,7 +23,7 @@ import { classifyError, cyberPolicyErrorType, CYBER_POLICY_ERROR_CODE, isCyberPo
 import { redactSecretString } from "../lib/redact";
 import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
-import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import { resolveOpenCodeGoTransport } from "../providers/opencode-go-transport";
@@ -153,7 +153,10 @@ async function handleChatCompletionsWithBudget(
     // Preserve the routed destination for Go recognition, then settle the wire before
     // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
     const routedProvider = route.provider;
-    const wireProvider = resolveWireProtocolOverride(route.providerName, route.modelId, routedProvider, "chat");
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, routedProvider, route.staticPolicy.effectiveAlias, "chat",
+    );
+    const wireProvider = resolveWireProtocolOverride(route.providerName, route.modelId, routedProvider, "chat", route.staticPolicy);
     route.provider = resolveOpenCodeGoTransport(
       wireProvider,
       getOrAllocateRequestSessionLane(req),
diff --git a/src/server/claude-messages.ts b/src/server/claude-messages.ts
index b44fab2a95c..b73199dd15a 100644
--- a/src/server/claude-messages.ts
+++ b/src/server/claude-messages.ts
@@ -29,7 +29,7 @@ import {
 } from "../claude/outbound";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { estimateTokens } from "../lib/token-estimate";
-import { NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
+import { captureRouteStaticPolicy, NoEligiblePolicyCandidateError, UnknownRoutingPolicyError, routeModel } from "../router";
 import { evidenceFromBody } from "../routing/request-evidence";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
@@ -420,7 +420,7 @@ async function anthropicNativePassthrough(
   // count_tokens too — counts must match what the real send will contain, and the 32MB
   // body cap applies to it equally. Non-message bodies pass through untouched.
   if (Array.isArray(body.messages)) {
-    await normalizeAnthropicImages(body.messages);
+    await normalizeAnthropicImages(body.messages, { abortSignal: req.signal });
     enforceAnthropicImageLimits(body.messages);
   }
   const headers = new Headers();
@@ -817,7 +817,10 @@ async function handleClaudeMessagesWithBudget(
     const route = routeModel(config, internalBody.model as string, evidenceFromBody(internalBody));
     // Settle the wire once so the sampling decision below reads the effective
     // adapter rather than the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic");
+    route.staticPolicy = captureRouteStaticPolicy(
+      route.providerName, route.modelId, route.provider, route.staticPolicy.effectiveAlias, "anthropic",
+    );
+    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "anthropic", route.staticPolicy);
     logCtx.routeDecision = route.routeDecision;
     if (route.provider.adapter === "openai-responses") {
       delete internalBody.max_output_tokens;
diff --git a/src/server/effort-row.ts b/src/server/effort-row.ts
index 9ac49bf23cc..b7e4d7af96b 100644
--- a/src/server/effort-row.ts
+++ b/src/server/effort-row.ts
@@ -30,7 +30,9 @@ export interface EffortRowOptions {
 }
 
 export function isKnownId(knownIds: EffortRowKnownIds | undefined, id: string): boolean {
-  return typeof knownIds === "function" ? knownIds(id) : knownIds?.has(id) === true;
+  return typeof knownIds === "function"
+    ? knownIds(id)
+    : knownIds?.has(id) === true || knownIds?.has(id.toLowerCase()) === true;
 }
 
 export function effortRowId(baseId: string, effort: string): string {
@@ -43,6 +45,12 @@ export function effortRowId(baseId: string, effort: string): string {
  */
 export function knownEffortRowIds(config: OcxConfig): Set<string> {
   const ids = new Set<string>();
+  const addAlias = (id: string): void => {
+    ids.add(id);
+    // Model aliases are resolved case-insensitively. Preserve that contract here so an
+    // alias cannot be mistaken for a synthetic effort row before ordinary routing runs.
+    ids.add(id.toLowerCase());
+  };
   for (const [providerName, provider] of Object.entries(config.providers)) {
     const known = knownModelIdsForProvider(providerName, provider, config);
     const namespaces = [providerName, provider.alias].filter((value): value is string => (
@@ -54,8 +62,8 @@ export function knownEffortRowIds(config: OcxConfig): Set<string> {
       for (const namespace of namespaces) ids.add(`${namespace}/${id}`);
     }
     for (const alias of Object.values(provider.modelAliases ?? {})) {
-      ids.add(alias);
-      for (const namespace of namespaces) ids.add(`${namespace}/${alias}`);
+      addAlias(alias);
+      for (const namespace of namespaces) addAlias(`${namespace}/${alias}`);
     }
   }
   for (const [id, combo] of Object.entries(config.combos ?? {})) {
diff --git a/src/server/grok-responses-control-frame.ts b/src/server/grok-responses-control-frame.ts
index e910daf99d6..4d10340bfc9 100644
--- a/src/server/grok-responses-control-frame.ts
+++ b/src/server/grok-responses-control-frame.ts
@@ -1,10 +1,137 @@
-import { sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 const GROK_CONTROL_FRAME_TYPES: Record<string, true> = {
   "codex.rate_limits": true,
   "codex.response.metadata": true,
 };
 
+const GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS = ["created_at", "completed_at"] as const;
+
+type JsonRange = { start: number; end: number };
+
+function skipJsonWhitespace(payload: string, index: number): number {
+  while (index < payload.length && /[\t\n\r ]/.test(payload[index] ?? "")) index += 1;
+  return index;
+}
+
+function findJsonStringEnd(payload: string, start: number): number | undefined {
+  for (let index = start + 1; index < payload.length; index += 1) {
+    if (payload[index] === "\\") index += 1;
+    else if (payload[index] === '"') return index + 1;
+  }
+  return undefined;
+}
+
+function findJsonValueEnd(payload: string, start: number): number | undefined {
+  if (payload[start] === '"') return findJsonStringEnd(payload, start);
+  if (payload[start] !== "{" && payload[start] !== "[") {
+    let index = start;
+    while (index < payload.length && !",}]".includes(payload[index] ?? "")) index += 1;
+    return index;
+  }
+
+  let depth = 0;
+  let inString = false;
+  for (let index = start; index < payload.length; index += 1) {
+    const char = payload[index];
+    if (inString) {
+      if (char === "\\") index += 1;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    else if (char === "{" || char === "[") depth += 1;
+    else if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return undefined;
+}
+
+function findResponseObjectRange(payload: string): JsonRange | null {
+  let cursor = skipJsonWhitespace(payload, 0);
+  if (payload[cursor] !== "{") return null;
+  cursor += 1;
+  let responseRange: JsonRange | null = null;
+
+  while (cursor < payload.length) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined) return null;
+    if (key === "response" && payload[valueStart] === "{") {
+      responseRange = { start: valueStart, end: valueEnd };
+    }
+
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") return responseRange;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  return null;
+}
+
+function rewriteIntegralTimestamp(payload: string, field: string, value: number, event: unknown): string | null {
+  const responseRange = findResponseObjectRange(payload);
+  if (responseRange === null) return null;
+  let cursor = responseRange.start + 1;
+  let candidate: { start: number; length: number } | null = null;
+  while (cursor < responseRange.end) {
+    cursor = skipJsonWhitespace(payload, cursor);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== '"') return null;
+    const keyEnd = findJsonStringEnd(payload, cursor);
+    if (keyEnd === undefined) return null;
+    let key: unknown;
+    try {
+      key = JSON.parse(payload.slice(cursor, keyEnd));
+    } catch {
+      return null;
+    }
+    cursor = skipJsonWhitespace(payload, keyEnd);
+    if (payload[cursor] !== ":") return null;
+    const valueStart = skipJsonWhitespace(payload, cursor + 1);
+    const valueEnd = findJsonValueEnd(payload, valueStart);
+    if (valueEnd === undefined || valueEnd > responseRange.end) return null;
+    const valueToken = payload.slice(valueStart, valueEnd).trimEnd();
+    if (
+      key === field &&
+      /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/.test(valueToken) &&
+      valueToken !== String(value) &&
+      Number(valueToken) === value
+    ) {
+      if (candidate !== null) return null;
+      candidate = { start: valueStart, length: valueToken.length };
+    }
+    cursor = skipJsonWhitespace(payload, valueEnd);
+    if (payload[cursor] === "}") break;
+    if (payload[cursor] !== ",") return null;
+    cursor += 1;
+  }
+  if (candidate === null) return payload;
+
+  const rewritten = `${payload.slice(0, candidate.start)}${value}${payload.slice(candidate.start + candidate.length)}`;
+  try {
+    return JSON.stringify(JSON.parse(rewritten)) === JSON.stringify(event) ? rewritten : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Hide Codex-only control frames from Grok's strict Responses decoder.
  *
@@ -41,3 +168,35 @@ export function createGrokResponsesControlFrameBlockRewrite(): SseBlockRewrite {
       : [block];
   };
 }
+
+/** Normalize safe integer response timestamps for Grok's strict Responses decoder. */
+export function createGrokResponsesTimestampBlockRewrite(): SseBlockRewrite {
+  return (block) => {
+    const payload = sseDataPayload(block);
+    if (payload === null || payload === "[DONE]") return [block];
+
+    let event: unknown;
+    try {
+      event = JSON.parse(payload);
+    } catch {
+      return [block];
+    }
+    if (!event || typeof event !== "object" || Array.isArray(event)) return [block];
+    const eventRecord = event as Record<string, unknown>;
+    if (typeof eventRecord.type !== "string" || !eventRecord.type.startsWith("response.")) return [block];
+    if (!eventRecord.response || typeof eventRecord.response !== "object" || Array.isArray(eventRecord.response)) {
+      return [block];
+    }
+    const response = eventRecord.response as Record<string, unknown>;
+    let rewrittenPayload = payload;
+    for (const field of GROK_RESPONSE_INTEGER_TIMESTAMP_FIELDS) {
+      const value = response[field];
+      if (value === undefined) continue;
+      if (typeof value !== "number" || value < 0 || !Number.isSafeInteger(value)) return [block];
+      const rewritten = rewriteIntegralTimestamp(rewrittenPayload, field, value, event);
+      if (rewritten === null) return [block];
+      rewrittenPayload = rewritten;
+    }
+    return rewrittenPayload === payload ? [block] : [replaceSseDataPayload(block, rewrittenPayload)];
+  };
+}
diff --git a/src/server/index.ts b/src/server/index.ts
index 47323e0f681..af20051d9eb 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -116,7 +116,6 @@ import {
   type RequestLogEntry,
 } from "./request-log";
 import { sessionLaneIdFromRequest } from "./request-log-conversation";
-import { configureSharedSpendLedger, spendPolicyFromConfig } from "../lib/spend-reservation-ledger";
 import { admitHttpWorkflowTurn, workflowDecisionRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
 export {
   addFinalRequestLog,
@@ -205,8 +204,15 @@ import {
 import { detectInstall } from "../update/index";
 import { createServeOptions, type ServerIngress } from "./index/serve-options";
 import { inspectStartupOwnership, setStartupCacheInvalidationWrite, warnAgentTaskRecoveryStartup, warnPlaintextV2AgentMessagesStartup, type StartServerDeps } from "./index/startup-warnings";
+import { acquireSpendLedgerServerLifecycle, type SpendLedgerServerLifecycle } from "./index/spend-ledger-lifecycle";
 
 export function startServer(port?: number, deps: StartServerDeps = {}): Server<WsData> {
+  const spendLedgerLifecycle = acquireSpendLedgerServerLifecycle(getConfigDir());
+  try { return startServerWithSpendLedgerOwner(port, deps, spendLedgerLifecycle); }
+  catch (error) { spendLedgerLifecycle.releaseAfterFailedStart(); throw error; }
+}
+
+function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartServerDeps, spendLedgerLifecycle: SpendLedgerServerLifecycle): Server<WsData> {
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();
   // Captured before loadConfig() starts the optional ACL flight so stop() drains the same dir
   // even if OPENCODEX_HOME changes underneath a long-lived process.
@@ -299,12 +305,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   registerAppOwnedMemorySweepFallback();
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
-  // Operator token ceilings (#4546). Applied before the listener binds: the shared ledger is
-  // built on the first reservation, and a request arriving before this ran would build it with
-  // no policy and enforce nothing. An absent `spend` section resolves to the unconfigured
-  // default, which refuses nothing and opens no journal -- so on an install that never wrote
-  // the key this line changes no behaviour at all.
-  configureSharedSpendLedger(spendPolicyFromConfig(config.spend));
+  // Observe-only mode still journals physical sends, so every server owns before configuring.
+  spendLedgerLifecycle.configure(config.spend);
   registerCodexCooldownRecoveryProbeWorker(config);
   // Issue #42 Phase 3: opt-in archived auto-cleanup (default OFF). Unref'd hourly
   // tick for daily/weekly; startup evaluation is fire-and-forget after listen.
@@ -703,7 +705,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       get remoteWorkspaceStopping() { return remoteWorkspaceStopping; },
     });
 
-    server = Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost });
+    server = spendLedgerLifecycle.track(Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost }));
 
     // Both binds are one startup transaction (#1102). If the loopback bind fails after the
     // public one succeeded, leaving the public listener up would strand it: the CLI's port
@@ -711,11 +713,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     // accumulating listeners. Roll back and rethrow the original error instead.
     if (loopbackListenerPort !== null) {
       try {
-        loopbackServer = Bun.serve<WsData>({
+        loopbackServer = spendLedgerLifecycle.track(Bun.serve<WsData>({
           ...serveOptions,
           port: loopbackListenerPort,
           hostname: "127.0.0.1",
-        });
+        }));
       } catch (error) {
         try {
           // startServer is synchronous, so this rollback cannot await. Bun begins closing the
@@ -731,11 +733,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     }
     if (managementIngressPort !== null) {
       try {
-        managementIngressServer = Bun.serve<WsData>({
+        managementIngressServer = spendLedgerLifecycle.track(Bun.serve<WsData>({
           ...serveOptions,
           port: managementIngressPort,
           hostname: "127.0.0.1",
-        });
+        }));
       } catch (error) {
         // Preserve the management bind failure while synchronously initiating rollback of every
         // listener already opened in this startup transaction. startServer must not become async.
@@ -792,7 +794,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             // removes the dir right after stop() settles would hit EPERM/EBUSY on Windows
             // otherwise. Runs even when an earlier release rejected — that rejection still
             // propagates, but not before the child is drained.
-            await flushConfigDirHardening(startupConfigDir);
+            try { spendLedgerLifecycle.release(); }
+            finally { await flushConfigDirHardening(startupConfigDir); }
           }
         },
       );
diff --git a/src/server/index/serve-options.ts b/src/server/index/serve-options.ts
index 5bcbb60a5ef..657f5f0b5b9 100644
--- a/src/server/index/serve-options.ts
+++ b/src/server/index/serve-options.ts
@@ -37,6 +37,7 @@ import {
   type WsData,
 } from "../ws-bridge";
 import { websocketsEnabled } from "../../config";
+import { metricsExportEnabled } from "../../config/feature-flags";
 import { grokDefaultReasoningEffort } from "../../grok/effort";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -84,6 +85,7 @@ import {
 } from "../request-log";
 import { sessionLaneIdFromRequest } from "../request-log-conversation";
 import { responseWithDeferredRequestLog } from "../relay";
+import { createRequestMetricsOwner } from "../request-metrics";
 import {
   corsHeaders,
   managementCorsHeaders,
@@ -266,6 +268,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
     port,
   } = ctx;
   void port;
+  const requestMetrics = metricsExportEnabled(config) ? createRequestMetricsOwner() : undefined;
+  const requestMetricsLogContext = requestMetrics ? { requestMetricsRecorder: requestMetrics } : {};
+  const requestManagementApiDeps: ManagementApiDeps = requestMetrics
+    ? { ...managementApiDeps, requestMetrics: { snapshot: () => requestMetrics.snapshot() } }
+    : managementApiDeps;
   const serveOptions = {
       idleTimeout: 255,
       // Bun rejects an oversized body before `fetch` runs, so the listener has to be raised
@@ -616,7 +623,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             }), req, config);
           }
         }
-        const mgmtResponse = await handleManagementAPI(req, url, config, managementApiDeps, principal, managementSessionControl);
+        const mgmtResponse = await handleManagementAPI(req, url, config, requestManagementApiDeps, principal, managementSessionControl);
         if (mgmtResponse) return withManagementCors(mgmtResponse, req, config);
         return withManagementCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
       }
@@ -1197,6 +1204,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "responses",
         };
@@ -1233,6 +1241,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "image_gen",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         const endpoint = url.pathname.endsWith("/edits") ? "edits" as const : "generations" as const;
@@ -1290,6 +1299,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "context_history",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1316,6 +1326,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "web_search",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1340,6 +1351,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "responses",
         };
@@ -1347,29 +1359,41 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         let logged = false;
         const finalizeNativePassthroughLog = (
           status: number,
-          meta: { terminalStatus?: ResponsesTerminalStatus; closeReason: "terminal" | "client_cancel" },
+          meta: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
         ) => {
           if (logged) return;
           logged = true;
           addFinalRequestLog(requestId, start, logCtx, status, meta);
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
-          const response = await handleResponses(req, config, logCtx, {
-            turnAdmissionLease,
-            admission,
-            onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
-            abortSignal: req.signal,
-            onFirstOutput: () => recordFirstOutput(logCtx, start),
-            onNativePassthroughTerminal: status => {
-              finalizeNativePassthroughLog(httpStatusForRequestLogTerminal(status, logCtx), {
-                terminalStatus: status,
-                closeReason: "terminal",
-              });
-            },
-            onNativePassthroughCancel: () => {
-              finalizeNativePassthroughLog(499, { closeReason: "client_cancel" });
-            },
-          });
+          let response: Response;
+          try {
+            response = await handleResponses(req, config, logCtx, {
+              turnAdmissionLease,
+              admission,
+              onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
+              abortSignal: req.signal,
+              onFirstOutput: () => recordFirstOutput(logCtx, start),
+              onNativePassthroughTerminal: status => {
+                finalizeNativePassthroughLog(httpStatusForRequestLogTerminal(status, logCtx), {
+                  terminalStatus: status,
+                  closeReason: "terminal",
+                });
+              },
+              onNativePassthroughCancel: () => {
+                finalizeNativePassthroughLog(499, { closeReason: "client_cancel" });
+              },
+            });
+          } catch (error) {
+            // A bounded upstream body can fail before handleResponses returns a client response.
+            // Finalize before rethrow so accounting observes the physical send while the caller
+            // retains the existing reset/rejection instead of receiving a synthesized response.
+            finalizeNativePassthroughLog(
+              req.signal.aborted ? 499 : 502,
+              { closeReason: req.signal.aborted ? "client_cancel" : "non_stream" },
+            );
+            throw error;
+          }
           return withRequestLogId(
             withCors(responseWithDeferredRequestLog(response, requestId, start, logCtx), req, policy),
             requestId,
@@ -1414,6 +1438,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "messages",
         };
@@ -1443,6 +1468,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "chat",
         };
@@ -1466,7 +1492,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         }
         const start = Date.now();
         const requestId = nextRequestLogId(start);
-        const logCtx: RequestLogContext = { model: TRANSCRIPTION_MODEL, provider: "unknown", ...admissionFields(admission) };
+        const logCtx: RequestLogContext = {
+          model: TRANSCRIPTION_MODEL,
+          provider: "unknown",
+          ...requestMetricsLogContext,
+          ...admissionFields(admission),
+        };
         return runAdmittedHttpTurn(req, policy, async lease => {
           const response = await handleAudioTranscriptions(req, config, logCtx, admission, lease);
           addFinalRequestLog(requestId, start, logCtx, response.status);
@@ -1497,6 +1528,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "gpt-live",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1544,10 +1576,23 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "gpt-live",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
+        let liveRequestFinalized = false;
+        const finalizeLiveRequest = (
+          status: number,
+          meta?: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
+        ): void => {
+          if (liveRequestFinalized) return;
+          liveRequestFinalized = true;
+          addFinalRequestLog(requestId, start, logCtx, status, meta);
+        };
         const turnAdmissionLease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
-        if (!turnAdmissionLease) return serverBusyResponse(req, "active turns", policy);
+        if (!turnAdmissionLease) {
+          finalizeLiveRequest(503);
+          return serverBusyResponse(req, "active turns", policy);
+        }
         const audioController = audioClient ? new AbortController() : undefined;
         if (audioController) registerTurn(audioController, turnAdmissionLease);
         const acquisition = audioController
@@ -1567,18 +1612,26 @@ export function createServeOptions(ctx: ServeOptionsContext) {
                 ? await resolveLiveSidebandUpgrade(req, config, logCtx, liveSidebandTarget, turnAdmissionLease)
                 : formatErrorResponse(401, "authentication_error", "opencodex API key required");
         } catch (error) {
-          releaseAcquisition();
+          try { releaseAcquisition(); }
+          finally {
+            finalizeLiveRequest(req.signal.aborted ? 499 : 500,
+              req.signal.aborted ? { closeReason: "client_cancel" } : undefined);
+          }
           throw error;
         }
         if (acquisition?.signal.aborted) {
+          const status = req.signal.aborted ? 499 : acquisition.didExpire() ? 504 : 503;
           try { if (!(resolved instanceof Response) && "finish" in resolved) resolved.finish(); }
-          finally { releaseAcquisition(); }
-          return withCors(formatErrorResponse(req.signal.aborted ? 499 : acquisition.didExpire() ? 504 : 503,
+          finally {
+            try { releaseAcquisition(); }
+            finally { finalizeLiveRequest(status, status === 499 ? { closeReason: "client_cancel" } : undefined); }
+          }
+          return withCors(formatErrorResponse(status,
             "upstream_error", acquisition.didExpire() ? "Audio connection timed out" : "Audio connection canceled"), req, policy);
         }
         if (resolved instanceof Response) {
           releaseAcquisition();
-          addFinalRequestLog(requestId, start, logCtx, resolved.status);
+          finalizeLiveRequest(resolved.status);
           return withCors(resolved, req, policy);
         }
         const audio = "finish" in resolved ? resolved : undefined;
@@ -1591,7 +1644,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           else releaseAcquisition();
         };
         if (req.signal.aborted) {
-          discardUpgrade();
+          try { discardUpgrade(); }
+          finally { finalizeLiveRequest(499, { closeReason: "client_cancel" }); }
           return withCors(formatErrorResponse(499, "client_closed_request", "Audio connection canceled"), req, policy);
         }
         const upstreamHandshake = await openLiveSidebandUpstream(
@@ -1609,7 +1663,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           } else {
             discardUpgrade();
           }
-          addFinalRequestLog(requestId, start, logCtx, upstreamHandshake.status);
+          finalizeLiveRequest(upstreamHandshake.status,
+            upstreamHandshake.status === 499 ? { closeReason: "client_cancel" } : undefined);
           console.error("[live] sideband upstream handshake failed: " + upstreamHandshake.message);
           return withCors(
             formatErrorResponse(upstreamHandshake.status, upstreamHandshake.code, upstreamHandshake.message),
@@ -1625,7 +1680,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             code: "upstream_error",
             message: "voice upstream closed before client upgrade",
           };
-          addFinalRequestLog(requestId, start, logCtx, failure.status);
+          finalizeLiveRequest(failure.status);
           return withCors(formatErrorResponse(failure.status, failure.code, failure.message), req, policy);
         }
         let upgraded = false;
@@ -1657,11 +1712,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             /* ignore */
           }
           closeLiveSidebandBeforeUpgrade(upstreamHandshake.socket, () => discardUpgrade());
+          finalizeLiveRequest(502);
           return withCors(formatErrorResponse(502, "upstream_error", "Audio WebSocket upgrade failed"), req, policy);
         }
         if (upgraded) {
           acquisition?.clear();
-          addFinalRequestLog(requestId, start, logCtx, 101);
+          finalizeLiveRequest(101);
           return undefined as unknown as Response;
         }
         try {
@@ -1670,6 +1726,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           /* ignore */
         }
         closeLiveSidebandBeforeUpgrade(upstreamHandshake.socket, () => discardUpgrade());
+        finalizeLiveRequest(426);
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, policy);
       }
 
@@ -1760,7 +1817,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
 
       return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
     },
-    websocket: createWebsocketHandler(ctx),
+    websocket: createWebsocketHandler(ctx, requestMetrics),
   } as const;
   return serveOptions;
 }
diff --git a/src/server/index/spend-ledger-lifecycle.ts b/src/server/index/spend-ledger-lifecycle.ts
new file mode 100644
index 00000000000..d7250642470
--- /dev/null
+++ b/src/server/index/spend-ledger-lifecycle.ts
@@ -0,0 +1,66 @@
+import type { OcxSpendConfig } from "../../types/config";
+import {
+  acquireSpendLedgerOwner,
+  type SpendLedgerOwnerLease,
+} from "../../lib/spend-ledger-owner";
+import {
+  configureSharedSpendLedger,
+  spendPolicyFromConfig,
+} from "../../lib/spend-reservation-ledger";
+
+export interface SpendLedgerServerLifecycle {
+  configure(spend: OcxSpendConfig | undefined): void;
+  track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T;
+  release(): void;
+  releaseAfterFailedStart(): void;
+}
+
+/** Acquire before config loading so every later startup failure has one rollback owner. */
+export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedgerServerLifecycle {
+  const owner: SpendLedgerOwnerLease = acquireSpendLedgerOwner(configDir);
+  // Each entry returns whatever the listener's own stop returned. Typed as void-or-promise
+  // because the rollback below has to WAIT on it: declaring it `() => void` let the call site
+  // compile while statically erasing the promise it needs to await.
+  const failedStartStops: Array<() => void | Promise<void>> = [];
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    owner.release();
+  };
+  return {
+    configure(spend): void {
+      configureSharedSpendLedger(spendPolicyFromConfig(spend));
+    },
+    track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T {
+      // Capture the raw stop before startServer replaces the public method with full teardown.
+      const stop = server.stop.bind(server);
+      failedStartStops.push(() => stop(true));
+      return server;
+    },
+    release,
+    releaseAfterFailedStart(): void {
+      // Every listener that came up is stopped, newest first, and the lease is held until those
+      // stops have actually SETTLED. Bun's Server.stop(true) returns a promise that resolves
+      // once connections are closed, so discarding it handed the state directory back while a
+      // listener could still be serving, which is the one thing single-writer ownership exists
+      // to prevent.
+      //
+      // This stays synchronous and returns void on purpose: startServer must not become async,
+      // so the wait is a continuation rather than an await. Rollback failures are contained
+      // because the startup error that brought us here is the one worth reporting.
+      const settling: Promise<unknown>[] = [];
+      for (const stop of failedStartStops.splice(0).reverse()) {
+        try {
+          const pending = stop();
+          if (pending !== undefined) settling.push(Promise.resolve(pending));
+        } catch { /* a rollback failure must not replace the startup error that caused it */ }
+      }
+      const finish = (): void => {
+        try { release(); } catch { /* same: the startup error is the one that matters */ }
+      };
+      if (settling.length === 0) { finish(); return; }
+      void Promise.allSettled(settling).then(finish);
+    },
+  };
+}
diff --git a/src/server/index/websocket-handler.ts b/src/server/index/websocket-handler.ts
index 17fbb6e30be..3022e62c4a3 100644
--- a/src/server/index/websocket-handler.ts
+++ b/src/server/index/websocket-handler.ts
@@ -85,13 +85,17 @@ import {
   resolveLiveSidebandUpgrade,
 } from "../live";
 import type { ServeOptionsContext } from "./serve-options";
+import type { RequestMetricsRecorder } from "../request-metrics";
 
 /**
  * The WebSocket half of the Bun.serve options, split out of serve-options.ts to keep that file
  * under the 2,000-line ratchet threshold. The body is the original handler verbatim; it reads the
  * same startServer context the HTTP half does, so it takes the same context object.
  */
-export function createWebsocketHandler(ctx: ServeOptionsContext) {
+export function createWebsocketHandler(
+  ctx: ServeOptionsContext,
+  requestMetricsRecorder?: RequestMetricsRecorder,
+) {
   const { config, deps } = ctx;
   return {
       maxPayloadLength: MAX_WS_FRAME_BYTES,
@@ -283,6 +287,7 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
           const logCtx: RequestLogContext = {
             model: "unknown",
             provider: "unknown",
+            ...(requestMetricsRecorder ? { requestMetricsRecorder } : {}),
             ...(wsAdmission ? admissionFields(wsAdmission) : {}),
             inboundProtocol: "responses",
           };
diff --git a/src/server/management-api.ts b/src/server/management-api.ts
index bf1ccd7d144..7c8766367c2 100644
--- a/src/server/management-api.ts
+++ b/src/server/management-api.ts
@@ -63,6 +63,7 @@ import { handleLogsUsageRoutes } from "./management/logs-usage-routes";
 import { handleStorageLogGuardRoutes } from "./management/storage-log-guard-routes";
 import { handleRequestHistoryRoutes } from "./management/request-history-routes";
 import { handleRoutingAnalyticsRoutes } from "./management/routing-analytics-routes";
+import { handleMetricsRoutes } from "./management/metrics-routes";
 import { handleProviderRoutes } from "./management/provider-routes";
 import { handleModelRoutes } from "./management/model-routes";
 import { handleAgentSettingsRoutes } from "./management/agent-settings-routes";
@@ -276,6 +277,7 @@ export async function handleManagementAPI(
     ??     (await handleQuotaResetRoutesOnDemand(ctx))
     ??     (await handleWorkflowBudgetRoutesOnDemand(ctx))
     ??     (await handleGrokCouponRoutesOnDemand(ctx))
+    ??     handleMetricsRoutes(ctx)
     ??     (await handleRoutingAnalyticsRoutes(ctx))
     ??     (await handleRoutingProfileRoutesOnDemand(ctx))
     ??     (await handleProviderRoutes(ctx))
diff --git a/src/server/management-auth.ts b/src/server/management-auth.ts
index 58ae3f7d606..944d3686b97 100644
--- a/src/server/management-auth.ts
+++ b/src/server/management-auth.ts
@@ -12,7 +12,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, join } from "node:path";
-import { adminApiTokenFilePath } from "../lib/admin-secrets";
+import { adminApiTokenFilePath, opencodeCatalogToken } from "../lib/admin-secrets";
 import {
   LOCAL_MANAGEMENT_CAPABILITY_HEADER,
   LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER,
@@ -297,6 +297,7 @@ export function createManagementSessionControl(state: ManagementAuthState): Mana
  */
 export type ManagementPrincipal =
   | "admin-token"
+  | "opencode-catalog-token"
   | "gui-session"
   | "gui-pair-capability"
   | "local-read-capability"
@@ -484,6 +485,16 @@ function requestManagementCredential(req: Request): string | null {
     || null;
 }
 
+function isOpencodeCatalogRequest(req: Request): boolean {
+  if (req.method !== "GET") return false;
+  try {
+    const url = new URL(req.url);
+    return url.pathname === "/api/models" && url.search === "";
+  } catch {
+    return false;
+  }
+}
+
 function resolveManagementAdmission(
   req: Request,
   state: ManagementAuthState,
@@ -500,6 +511,9 @@ function resolveManagementAdmission(
   else if (state.available) {
     const actual = requestManagementCredential(req);
     if (actual && equalSecret(actual, state.token)) principal = "admin-token";
+    else if (actual && isOpencodeCatalogRequest(req) && equalSecret(actual, opencodeCatalogToken(state.token))) {
+      principal = "opencode-catalog-token";
+    }
     else if (config && authorizeGuiSessionRequest(req, config, state).ok) principal = "gui-session";
   }
   if (principal) admittedManagementRequests.set(req, principal);
diff --git a/src/server/management/aside-profile-routes.ts b/src/server/management/aside-profile-routes.ts
index 8047e6c7a85..956dc8eafe0 100644
--- a/src/server/management/aside-profile-routes.ts
+++ b/src/server/management/aside-profile-routes.ts
@@ -3,14 +3,19 @@ import { ClientPathError } from "../../clients/config-export";
 import { IntegrationMutationBusyError } from "../../integrations/mutation-flight";
 import { IntegrationWriterLockBusyError } from "../../integrations/writer-lock";
 import {
-  getAsideProfileState, listAsideProfileStates, mutateAsideProfiles, refreshAsideProfiles,
-  type AsideProfilesInput,
+  getAsideProfileState, listAsideProfileStates, mutateAsideProfiles, previewAsideProfile, refreshAsideProfiles,
+  type AsideProfilesInput, type AsideProfileWriteOutcome,
 } from "../../integrations/aside-profiles";
 import {
   listAsideOperations, findAsideOperation, restoreAsideProfile, deleteAsideOperation,
   asideOperationMatchesCurrent,
 } from "../../integrations/aside-profile-journal";
+import type { AsideOperation } from "../../integrations/aside-profile-journal";
 import type { WriteRefused } from "../../integrations/writer";
+import type { IntegrationWriteInput } from "../../integrations/writer";
+import type { IntegrationMutationPlan, IntegrationPlanOperation } from "../../integrations/mutation-plan";
+import { previewIntegration } from "../../integrations/mutation-plan";
+import { exportSnapshotIdentity, previewExportSnapshot } from "./model-rows";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, readOptionalManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import { jsonResponse } from "../auth-cors";
@@ -22,6 +27,142 @@ export interface AsideProfileRouteOptions {
 
 class ProfileQueryError extends Error { readonly status = 400; readonly code = "invalid_aside_profile"; }
 
+/**
+ * The confirmed plan carried with this request, or null when there is none.
+ *
+ * Both fields or neither, and the operation must be the one being requested. Dropping a supplied
+ * binding would be the worst available behaviour: the caller believes their confirmation is being
+ * checked while the mutation proceeds unchecked.
+ */
+function asideBinding(
+  body: { operation?: unknown; planFingerprint?: unknown },
+  expected: IntegrationPlanOperation,
+): { operation: IntegrationPlanOperation; fingerprint: string } | null {
+  const { operation, planFingerprint } = body;
+  if (operation === undefined && planFingerprint === undefined) return null;
+  if (operation === undefined || typeof planFingerprint !== "string" || planFingerprint.length === 0) {
+    throw new ProfileQueryError("operation and planFingerprint must be sent together");
+  }
+  if (operation !== expected) throw new ProfileQueryError("operation does not match the requested change");
+  return { operation: expected, fingerprint: planFingerprint };
+}
+
+/**
+ * The guard a bound profile change runs before it writes anything.
+ *
+ * It re-plans the same profile scope and compares. The hooks that call it sit ahead of the
+ * preference write and the journal import, which is the only placement that helps here: those two
+ * happen before any writer lock is taken, so a check under that lock would fire after the thing it
+ * was meant to prevent.
+ */
+/**
+ * The check a bound Aside change runs, against the input that change is about to write from.
+ *
+ * It plans the prepared input it is given rather than building one of its own. Rebuilding meant
+ * reading the live configuration a second time, so a configuration edited to something else and
+ * back again while this action was in flight produced a check that agreed with a plan the write
+ * never described.
+ *
+ * Exported so the check itself can be exercised with a real prepared input and a roster that
+ * actually moved. The window it closes needs an ordinary load to complete while a mutation is
+ * preparing, which no test seam reaches from outside; a copy of the guard would prove nothing
+ * about the one the route installs. It takes only the configuration from the request context.
+ */
+export function asideGuardFor(
+  ctx: Pick<ManagementContext, "config">,
+  capturedIdentity: string,
+  profileIdValue: number,
+  binding: { operation: IntegrationPlanOperation; fingerprint: string },
+  request: { opId?: string; confirmDrift?: boolean; resolved?: AsideOperation },
+  capture: { plan: IntegrationMutationPlan | null },
+): (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null> {
+  return async prepared => {
+    const plan = planFor(prepared, profileIdValue, binding, request);
+    /*
+     * The roster this confirmation was planned against has to still be the retained one. Only its
+     * rows were carried into the mutation, so an ordinary load completing while this action
+     * prepared could have replaced or retired the snapshot, and fingerprinting the carried rows
+     * would then accept a confirmation for a roster the operator no longer has. The non-Aside
+     * guard verifies the same identity; this one verifies it before the preference write, which is
+     * the last moment that still precedes every effect this action has.
+     */
+    const rosterMoved = exportSnapshotIdentity(ctx.config) !== capturedIdentity;
+    if (!rosterMoved && plan.canApply && plan.fingerprint === binding.fingerprint) return null;
+    capture.plan = plan;
+    return {
+      ok: false,
+      reason: "conflict",
+      state: plan.state,
+      clientId: "aside",
+      message: rosterMoved
+        ? "the model roster changed while confirming"
+        : "that confirmation no longer describes this profile",
+      profileId: profileIdValue,
+    };
+  };
+}
+
+/**
+ * The same comparison, run again immediately before the document is written.
+ *
+ * Aside takes no writer lock, and its preference write and journal import sit between the first
+ * check and the write that check authorizes. A target edited in that window is read fresh by the
+ * writer, which then compares it against itself and finds nothing to object to, so a confirmation
+ * about the earlier file would still overwrite the later one.
+ *
+ * The roster is deliberately not re-examined here. This action has just written the operator's
+ * preference into the configuration, which retires the retained roster by design, so asking that
+ * question at this point would refuse every confirmation on principle. What is asked is the one
+ * thing this moment can answer: does the plan the operator confirmed still describe this file.
+ */
+export function asideLateGuardFor(
+  profileIdValue: number,
+  binding: { operation: IntegrationPlanOperation; fingerprint: string },
+  request: { opId?: string; confirmDrift?: boolean; resolved?: AsideOperation },
+  capture: { plan: IntegrationMutationPlan | null },
+): (prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null> {
+  return async prepared => {
+    const plan = planFor(prepared, profileIdValue, binding, request);
+    if (plan.canApply && plan.fingerprint === binding.fingerprint) return null;
+    capture.plan = plan;
+    return {
+      ok: false,
+      reason: "conflict",
+      state: plan.state,
+      clientId: "aside",
+      message: "that confirmation no longer describes this profile",
+      profileId: profileIdValue,
+    };
+  };
+}
+
+function planFor(
+  prepared: IntegrationWriteInput,
+  profileIdValue: number,
+  binding: { operation: IntegrationPlanOperation; fingerprint: string },
+  request: { opId?: string; confirmDrift?: boolean; resolved?: AsideOperation },
+): IntegrationMutationPlan {
+  return previewIntegration(prepared, {
+    profileId: profileIdValue,
+    operation: binding.operation,
+    ...(request.opId === undefined ? {} : { opId: request.opId }),
+    ...(request.confirmDrift === undefined ? {} : { confirmDrift: request.confirmDrift }),
+    // The row the route selected, so the guard and the mutation mean the same operation even
+    // when more than one valid copy exists.
+    ...(request.resolved === undefined
+      ? {}
+      : { resolved: { entry: request.resolved.entry, store: request.resolved.store } }),
+  });
+}
+
+function stalePlanResponse(ctx: ManagementContext, plan: IntegrationMutationPlan): Response {
+  return jsonResponse({
+    error: "integration preview is stale",
+    code: "integration_preview_stale",
+    plan,
+  }, 409, ctx.req, ctx.config);
+}
+
 const ASIDE_INTEGRATION_PATH = "/api/client-integrations/aside";
 const ASIDE_PROFILES_PATH = "/api/client-integrations/aside/profiles";
 
@@ -75,7 +216,7 @@ function nestedProfileContext(ctx: ManagementContext): { ctx: ManagementContext;
     url.searchParams.set("client", "aside");
     return { ctx: { ...ctx, url }, action: "journal" };
   }
-  if (parts.length > 2 || !parts[0] || (parts[1] !== undefined && !["journal", "restore"].includes(parts[1]))) {
+  if (parts.length > 2 || !parts[0] || (parts[1] !== undefined && !["journal", "restore", "preview"].includes(parts[1]))) {
     throw new ProfileQueryError("Invalid Aside profile path");
   }
   const prior = url.searchParams.get("profile");
@@ -107,12 +248,62 @@ export async function handleAsideProfileRoutes(
       }
       return null;
     }
+    if (normalized.action === "preview") {
+      if (req.method !== "POST") return null;
+      // A plan describes one profile, so an unscoped preview has nothing to describe.
+      if (id === undefined) throw new ProfileQueryError("a plan applies to one profile");
+      const body = await readProfileBody(req);
+      if (!isObject(body)) throw new ProfileQueryError("preview body must be an object");
+      const operation = body.operation;
+      if (operation !== "apply" && operation !== "overwrite" && operation !== "disable" && operation !== "restore") {
+        throw new ProfileQueryError("operation must be apply, overwrite, disable or restore");
+      }
+      if (operation === "restore" && (typeof body.opId !== "string" || !body.opId.trim())) {
+        throw new ProfileQueryError("opId must be a non-empty string");
+      }
+      // The preview resolves the row the same way the mutation will, once, here.
+      const selected = operation === "restore"
+        ? findAsideOperation(options.input(), String(body.opId).trim(), id)
+        : null;
+      if (operation === "restore" && selected === null) {
+        return jsonResponse({
+          error: "integration operation not found",
+          code: "integration_operation_not_found",
+        }, 404, req, ctx.config);
+      }
+      const roster = previewExportSnapshot(ctx.config);
+      if (roster === null) {
+        return jsonResponse({
+          error: "no model roster is cached yet, so this change cannot be planned",
+          code: "integration_preview_unavailable",
+        }, 409, req, ctx.config);
+      }
+      const plan = await previewAsideProfile({ ...options.input(), models: roster.models }, {
+        profileId: id,
+        operation,
+        ...(operation === "restore"
+          ? {
+            opId: String(body.opId).trim(),
+            confirmDrift: body.confirmDrift === true,
+            ...(selected === null ? {} : { resolved: { entry: selected.entry, store: selected.store } }),
+          }
+          : {}),
+      });
+      return jsonResponse(plan, 200, req, ctx.config);
+    }
     if (normalized.action === "restore") {
       if (req.method !== "POST") return null;
       const body = await readProfileBody(req);
       if (!isObject(body) || typeof body.opId !== "string" || !body.opId.trim()
         || (body.confirmDrift !== undefined && typeof body.confirmDrift !== "boolean")) throw new ProfileQueryError("Invalid Aside restore request");
-      return asideRestoreResponse(ctx, { opId: body.opId.trim(), confirmDrift: body.confirmDrift === true }, options);
+      // Rebuilding the body here previously dropped any binding, so a bound nested restore
+      // reached the writer with its confirmation unexamined. Forward the fields as sent.
+      return asideRestoreResponse(ctx, {
+        opId: body.opId.trim(),
+        confirmDrift: body.confirmDrift === true,
+        ...(body.operation === undefined ? {} : { operation: body.operation }),
+        ...(body.planFingerprint === undefined ? {} : { planFingerprint: body.planFingerprint }),
+      }, options);
     }
     if (url.pathname === "/api/client-integrations/aside/sync") {
       if (req.method !== "POST") return null;
@@ -134,7 +325,38 @@ export async function handleAsideProfileRoutes(
     if (!isObject(body) || typeof body.enabled !== "boolean") throw new ProfileQueryError("enabled must be a boolean");
     if (body.overwriteConflict !== undefined && typeof body.overwriteConflict !== "boolean") throw new ProfileQueryError("overwriteConflict must be a boolean");
     if (body.overwriteConflict === true && !body.enabled) throw new ProfileQueryError("overwriteConflict applies only to enabling an integration");
-    const batch = await mutateAsideProfiles(options.input(), { enabled: body.enabled, profileId: id, overwriteConflict: body.overwriteConflict === true });
+    // An exact profile is required before a binding could ever mean anything: one fingerprint
+    // cannot honestly describe several independently changing files.
+    const expected: IntegrationPlanOperation = body.enabled
+      ? (body.overwriteConflict === true ? "overwrite" : "apply")
+      : "disable";
+    if ((body.operation !== undefined || body.planFingerprint !== undefined) && id === undefined) {
+      throw new ProfileQueryError("a confirmed plan applies to one profile");
+    }
+    const binding = asideBinding(body, expected);
+    const capture: { plan: IntegrationMutationPlan | null } = { plan: null };
+    let mutationInput = options.input();
+    let revalidate: ((prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>) | undefined;
+    let revalidateBeforeWrite: ((prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>) | undefined;
+    if (binding !== null && id !== undefined) {
+      const roster = previewExportSnapshot(ctx.config);
+      if (roster === null) {
+        return jsonResponse({
+          error: "no model roster is cached yet, so this change cannot be planned",
+          code: "integration_preview_unavailable",
+        }, 409, req, ctx.config);
+      }
+      // One roster for the guard and the mutation, so they cannot disagree by construction.
+      mutationInput = { ...mutationInput, models: roster.models };
+      revalidate = asideGuardFor(ctx, roster.identity, id, binding, {}, capture);
+      revalidateBeforeWrite = asideLateGuardFor(id, binding, {}, capture);
+    }
+    const batch = await mutateAsideProfiles(
+      mutationInput,
+      { enabled: body.enabled, profileId: id, overwriteConflict: body.overwriteConflict === true },
+      revalidate ? { revalidate, ...(revalidateBeforeWrite ? { revalidateBeforeWrite } : {}) } : undefined,
+    );
+    if (capture.plan) return stalePlanResponse(ctx, capture.plan);
     if (id !== undefined) {
       const result = batch.results[0];
       if (!result) throw new Error("Aside profile mutation returned no result");
@@ -180,7 +402,9 @@ export async function asideJournalResponse(
 }
 
 export async function asideRestoreResponse(
-  ctx: ManagementContext, body: { opId: string; confirmDrift?: boolean }, options: AsideProfileRouteOptions,
+  ctx: ManagementContext,
+  body: { opId: string; confirmDrift?: boolean; operation?: unknown; planFingerprint?: unknown },
+  options: AsideProfileRouteOptions,
 ): Promise<Response | null> {
   try {
     validateClientSelector(ctx);
@@ -196,7 +420,42 @@ export async function asideRestoreResponse(
       if (id === undefined) return null;
       return jsonResponse({ error: "integration operation not found", code: "integration_operation_not_found", opId: body.opId }, 404, ctx.req, ctx.config);
     }
-    const result = await restoreAsideProfile(input, { ...body, profileId: operation.profileId });
+    if ((body.operation !== undefined || body.planFingerprint !== undefined) && id === undefined) {
+      throw new ProfileQueryError("a confirmed plan applies to one profile");
+    }
+    const restoreBinding = asideBinding(body, "restore");
+    const capture: { plan: IntegrationMutationPlan | null } = { plan: null };
+    let restoreInput = input;
+    let revalidate: ((prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>) | undefined;
+    let revalidateBeforeWrite: ((prepared: IntegrationWriteInput) => Promise<AsideProfileWriteOutcome | null>) | undefined;
+    if (restoreBinding !== null) {
+      const roster = previewExportSnapshot(ctx.config);
+      if (roster === null) {
+        return jsonResponse({
+          error: "no model roster is cached yet, so this change cannot be planned",
+          code: "integration_preview_unavailable",
+        }, 409, ctx.req, ctx.config);
+      }
+      restoreInput = { ...restoreInput, models: roster.models };
+      revalidate = asideGuardFor(ctx, roster.identity, operation.profileId, restoreBinding, {
+        opId: body.opId,
+        confirmDrift: body.confirmDrift === true,
+        resolved: operation,
+      }, capture);
+      revalidateBeforeWrite = asideLateGuardFor(operation.profileId, restoreBinding, {
+        opId: body.opId,
+        confirmDrift: body.confirmDrift === true,
+        resolved: operation,
+      }, capture);
+    }
+    const result = await restoreAsideProfile(
+      restoreInput,
+      // The same row the preview and guard used. Letting the mutation resolve its own copy is how
+      // a confirmation ends up bound to an operation other than the one that runs.
+      { ...body, profileId: operation.profileId, selectedOperation: operation },
+      revalidate ? { revalidate, ...(revalidateBeforeWrite ? { revalidateBeforeWrite } : {}) } : undefined,
+    );
+    if (capture.plan) return stalePlanResponse(ctx, capture.plan);
     return result.ok ? jsonResponse(result, 200, ctx.req, ctx.config) : options.failure(result);
   } catch (error) {
     if (error instanceof ClientPathError && !ctx.url.searchParams.has("profile")
diff --git a/src/server/management/config-routes.ts b/src/server/management/config-routes.ts
index 52363af8361..6db5ca3f35c 100644
--- a/src/server/management/config-routes.ts
+++ b/src/server/management/config-routes.ts
@@ -1,3 +1,5 @@
+import { compactionRoutingSchema } from "../../config/schema/leaf-validators";
+import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
@@ -342,6 +344,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
         reason: "not_requested",
         retryable: false,
       }),
+      compactionRouting: config.compactionRouting ?? null,
       startupHealth: await readStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
@@ -433,6 +436,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexMainAccountHardLock?: unknown;
       codexDesktopAuthless?: unknown;
       codexClientCompaction?: unknown;
+      compactionRouting?: unknown;
     };
     if (body.codexAutoStart === undefined
       && body.streamMode === undefined
@@ -444,8 +448,9 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       && body.fastRows === undefined
       && body.codexMainAccountHardLock === undefined
       && body.codexDesktopAuthless === undefined
-      && body.codexClientCompaction === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, or codexClientCompaction" }, 400);
+      && body.codexClientCompaction === undefined
+      && body.compactionRouting === undefined) {
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, codexAccountPickerEnabled, codexQuotaAutoRefresh, oauthOpenBrowser, ultraFastTier, fastRows, codexMainAccountHardLock, codexDesktopAuthless, codexClientCompaction, or compactionRouting" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -475,6 +480,12 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.codexClientCompaction !== undefined && typeof body.codexClientCompaction !== "boolean") {
       return jsonResponse({ error: "codexClientCompaction boolean is required" }, 400);
     }
+    const compactionRouting = body.compactionRouting == null
+      ? body.compactionRouting
+      : compactionRoutingSchema.safeParse(body.compactionRouting);
+    if (compactionRouting != null && !compactionRouting.success) {
+      return jsonResponse({ error: "compactionRouting requires a model, an optional valid reasoningEffort, and optional non-repeating triggers drawn from \"manual\" and \"auto\"" }, 400);
+    }
     let quotaAutoRefreshChange: { id: string; window: "fiveHour" | "weekly"; enabled: boolean } | undefined;
     if (body.codexQuotaAutoRefresh !== undefined) {
       if (!isPlainRecord(body.codexQuotaAutoRefresh)) {
@@ -504,6 +515,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     )) {
       return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
     }
+    const restoreCompactionRouting = captureConfigTopLevelRollback(config, ["compactionRouting"]);
     const previousSettings = {
       codexAutoStart: config.codexAutoStart,
       hasCodexAutoStart: Object.hasOwn(config, "codexAutoStart"),
@@ -570,6 +582,8 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       else if (body.codexDesktopAuthless === false) deleteConfigTopLevelKey(config, "codexDesktopAuthless");
       if (body.codexClientCompaction === true) config.codexClientCompaction = true;
       else if (body.codexClientCompaction === false) deleteConfigTopLevelKey(config, "codexClientCompaction");
+      if (compactionRouting === null) deleteConfigTopLevelKey(config, "compactionRouting");
+      else if (compactionRouting?.success) config.compactionRouting = compactionRouting.data;
       if (quotaAutoRefreshChange) {
         const { id, window, enabled } = quotaAutoRefreshChange;
         const setting = { ...(config.codexQuotaAutoRefresh?.[id] ?? {}) };
@@ -618,6 +632,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       if (previousSettings.hasCodexClientCompaction) {
         config.codexClientCompaction = previousSettings.codexClientCompaction;
       } else deleteConfigTopLevelKey(config, "codexClientCompaction");
+      restoreCompactionRouting();
       throw error;
     }
     if (typeof body.appOwnedMemoryBudgetMb === "number") {
@@ -669,6 +684,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       codexDesktopAuthless: authlessIsEnabled,
       codexClientCompaction: clientCompactionIsEnabled,
       codexDesktopSwitches,
+      compactionRouting: config.compactionRouting ?? null,
       codexMainAccountHardLock: config.codexMainAccountHardLock === true,
       mainAccountHardLock: getMainAccountHardLockStatus(config),
       startupHealth: await readStartupHealth(config),
diff --git a/src/server/management/context.ts b/src/server/management/context.ts
index cb0e1185f8a..7adee1a781c 100644
--- a/src/server/management/context.ts
+++ b/src/server/management/context.ts
@@ -19,6 +19,7 @@ import type {
   performCodexRestart,
   readCodexAppServerState,
 } from "../../codex/app-server-restart-service";
+import type { RequestMetricsSnapshotter } from "../request-metrics";
 
 import type { RemoteWorkspaceHub } from "../../remote-control/workspace-hub";
 import type { RemoteWorkspaceSessionService } from "../../remote-control/workspace-sessions";
@@ -31,6 +32,8 @@ export type RemoteWorkspaceSessionsApi = Pick<RemoteWorkspaceSessionService,
   "availability" | "list" | "create" | "prompt" | "submitPrompt" | "stop" | "shutdown">;
 
 export interface ManagementApiDeps {
+  /** Read-only process-local aggregate metrics; absent keeps the scrape route unavailable. */
+  requestMetrics?: RequestMetricsSnapshotter;
   remoteWorkspaceHub?: RemoteWorkspaceHubApi;
   remoteWorkspaceSessions?: RemoteWorkspaceSessionsApi;
   /** The listener retains and awaits teardown only after this optional subsystem activates. */
diff --git a/src/server/management/integration-routes.ts b/src/server/management/integration-routes.ts
index 2363e745d5d..7ae8a16d466 100644
--- a/src/server/management/integration-routes.ts
+++ b/src/server/management/integration-routes.ts
@@ -31,6 +31,7 @@ import {
   disableIntegrationCoordinated,
   overwriteIntegrationCoordinated,
   restoreIntegrationCoordinated,
+  type CoordinatedIntegrationOptions,
   type IntegrationRestoreInput,
   type IntegrationWriteInput,
   type WriteRefused,
@@ -45,7 +46,13 @@ import {
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 import type { ManagementContext } from "./context";
-import { loadExportModels } from "./model-rows";
+import { exportSnapshotIdentity, loadExportModels, previewExportSnapshot } from "./model-rows";
+import {
+  previewIntegration,
+  type IntegrationMutationPlan,
+  type IntegrationPlanOperation,
+  type PreviewRequest,
+} from "../../integrations/mutation-plan";
 
 
 const INTEGRATION_ROUTE_PREFIX = "/api/client-integrations/";
@@ -246,6 +253,37 @@ async function buildIntegrationWriteInput(
   };
 }
 
+/**
+ * The same input a mutation would build, from the read-only roster.
+ *
+ * It differs from the mutation's in exactly one way, and the difference is deliberate: the roster
+ * comes from `previewExportModels`, which gathers without running the initial-selection finalizer
+ * that persists configuration. Everything else is shared, so a preview and the commit that follows
+ * it cannot disagree for any reason except the state genuinely moving.
+ */
+async function buildIntegrationPreviewInput(
+  clientId: IntegrationClientId,
+  ctx: ManagementContext,
+  store: IntegrationStateStore,
+): Promise<{ input: IntegrationWriteInput; identity: string } | null> {
+  const snapshot = previewExportSnapshot(ctx.config);
+  // No cached roster means no honest snapshot to plan against. Gathering one here would make a
+  // read refresh credentials and write the provider cache, which is the thing preview must not do.
+  if (snapshot === null) return null;
+  return {
+    identity: snapshot.identity,
+    input: {
+      clientId,
+      models: snapshot.models,
+      config: ctx.config,
+      port: Number(ctx.url.port) || ctx.config.port,
+      store,
+      io: integrationMutationTestHooks?.io,
+      ...pathOverrides(),
+    },
+  };
+}
+
 /**
  * The file's current bytes, or `null` when it is missing.
  *
@@ -271,6 +309,97 @@ function invalidClientResponse(ctx: ManagementContext): Response {
   }, 400, ctx.req, ctx.config);
 }
 
+/**
+ * No cached model roster, so there is nothing honest to plan against.
+ *
+ * Answered as a bounded refusal rather than by gathering one: discovery refreshes credentials and
+ * writes the provider cache, and a preview that did either would be a write wearing a read's name.
+ * The caller opens the models view or performs the mutation directly.
+ */
+function previewUnavailableResponse(ctx: ManagementContext): Response {
+  return jsonResponse({
+    error: "no model roster is cached yet, so this change cannot be planned",
+    code: "integration_preview_unavailable",
+  }, 409, ctx.req, ctx.config);
+}
+
+/**
+ * A confirmed plan, or a reason the request cannot carry one.
+ *
+ * Both fields or neither. A half-bound request is rejected rather than quietly treated as
+ * unbound, because dropping one half would answer 200 to a caller who believed their
+ * confirmation was being checked.
+ */
+function planBindingOf(
+  body: Record<string, unknown>,
+): { operation: IntegrationPlanOperation; fingerprint: string } | "none" | "half" | "unknown-operation" {
+  const { operation, planFingerprint } = body;
+  if (operation === undefined && planFingerprint === undefined) return "none";
+  if (operation === undefined || typeof planFingerprint !== "string" || planFingerprint.length === 0) return "half";
+  if (operation !== "apply" && operation !== "overwrite" && operation !== "disable" && operation !== "restore") {
+    return "unknown-operation";
+  }
+  return { operation, fingerprint: planFingerprint };
+}
+
+function halfBoundResponse(ctx: ManagementContext): Response {
+  return jsonResponse({
+    error: "operation and planFingerprint must be sent together",
+    code: "invalid_preview_binding",
+  }, 400, ctx.req, ctx.config);
+}
+
+/**
+ * Re-plan and compare before the mutation runs.
+ *
+ * The fingerprint is an optimistic token, never authorization: management authentication and
+ * every ownership rule still apply. What it adds is that a confirmation stops meaning anything
+ * the moment the state it described moved, and the refusal carries a fresh plan so the operator
+ * decides again against what is true now.
+ */
+function stalePlanGuard(
+  clientId: IntegrationClientId,
+  ctx: ManagementContext,
+  store: IntegrationStateStore,
+  request: PreviewRequest,
+  fingerprint: string,
+  capturedIdentity: string | null,
+): {
+  revalidate: NonNullable<CoordinatedIntegrationOptions["revalidate"]>;
+  response: () => Response | null;
+} {
+  let stale: IntegrationMutationPlan | "unavailable" | null = null;
+  return {
+    revalidate: async frozen => {
+      /*
+       * Plan the coordinator's OWN frozen input, never a freshly built one. Rebuilding here let
+       * the check validate against one roster while the mutation wrote from another, because an
+       * ordinary load can replace the snapshot at any time and nothing serialises that against
+       * this lock. The captured identity is verified separately, so a replacement is detected
+       * without ever swapping the roster this mutation is about to use.
+       */
+      if (exportSnapshotIdentity(ctx.config) !== capturedIdentity) {
+        const refreshed = await buildIntegrationPreviewInput(clientId, ctx, store);
+        stale = refreshed === null ? "unavailable" : previewIntegration(refreshed.input, request);
+        return { ok: false, reason: "conflict", state: "conflict", clientId, message: "the model roster changed while confirming" };
+      }
+      const plan = previewIntegration(frozen, request);
+      if (plan.canApply && plan.fingerprint === fingerprint) return null;
+      stale = plan;
+      return { ok: false, reason: "conflict", state: plan.state, clientId, message: "that confirmation no longer describes this file" };
+    },
+    response: () => {
+      if (stale === null) return null;
+      if (stale === "unavailable") return previewUnavailableResponse(ctx);
+      return jsonResponse({
+        error: "integration preview is stale",
+        code: "integration_preview_stale",
+        plan: stale,
+      }, 409, ctx.req, ctx.config);
+    },
+  };
+}
+
 function internalErrorResponse(error: unknown, ctx: ManagementContext): Response {
   return jsonResponse({
     error: error instanceof Error ? error.message : String(error),
@@ -565,6 +694,88 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }
   }
 
+  if (url.pathname === "/api/client-integrations/preview") {
+    if (req.method !== "POST") return null;
+    const parsed = await readJsonBody(ctx);
+    if (parsed instanceof Response) return parsed;
+    if (!isPlainRecord(parsed)) {
+      return jsonResponse({ error: "preview body must be an object", code: "invalid_preview_body" }, 400, req, ctx.config);
+    }
+    const previewClient = parsed.clientId;
+    if (typeof previewClient !== "string"
+      || !(INTEGRATION_CLIENT_IDS as readonly string[]).includes(previewClient)) {
+      return invalidClientResponse(ctx);
+    }
+    /*
+     * Aside is a set of profiles, not one file, and every mutation it has requires a profile. A
+     * plan built here would describe the legacy single-account location and no bound mutation
+     * would accept it, so an operator could confirm something nothing can carry out. The canonical
+     * per-profile preview answers this question properly, and the mutation routes already refuse
+     * the unscoped spelling the same way.
+     */
+    if (previewClient === "aside") {
+      return jsonResponse({ error: "Use the canonical Aside profile path", code: "invalid_aside_profile_path" }, 400, req, ctx.config);
+    }
+    const operation = parsed.operation;
+    if (operation !== "apply" && operation !== "overwrite" && operation !== "disable") {
+      return jsonResponse({
+        error: "operation must be apply, overwrite or disable",
+        code: "invalid_preview_operation",
+      }, 400, req, ctx.config);
+    }
+    try {
+      const captured = await buildIntegrationPreviewInput(previewClient as IntegrationClientId, ctx, integrationStore());
+      if (!captured) return previewUnavailableResponse(ctx);
+      return jsonResponse(previewIntegration(captured.input, { operation }), 200, req, ctx.config);
+    } catch (error) {
+      return internalErrorResponse(error, ctx);
+    }
+  }
+
+  if (url.pathname === "/api/client-integrations/restore/preview") {
+    if (req.method !== "POST") return null;
+    const parsed = await readJsonBody(ctx);
+    if (parsed instanceof Response) return parsed;
+    if (!isPlainRecord(parsed) || typeof parsed.opId !== "string" || parsed.opId.trim().length === 0) {
+      return jsonResponse({ error: "opId must be a non-empty string", code: "invalid_op_id" }, 400, req, ctx.config);
+    }
+    if (parsed.confirmDrift !== undefined && typeof parsed.confirmDrift !== "boolean") {
+      return jsonResponse({ error: "confirmDrift must be a boolean", code: "invalid_confirm_drift" }, 400, req, ctx.config);
+    }
+    const opId = parsed.opId.trim();
+    try {
+      const store = integrationStore();
+      const operation = store.findOperation(opId);
+      /*
+       * Answered as "not found" rather than by reading the row back to the caller. A preview is
+       * reached before any confirmation, so it is the cheapest place to probe journal contents,
+       * and it declines to be one.
+       */
+      if (!operation) {
+        return jsonResponse({
+          error: "integration operation not found",
+          code: "integration_operation_not_found",
+          opId,
+        }, 404, req, ctx.config);
+      }
+      // Same rule, decided after the row is found so an unscoped undo of an Aside operation is
+      // refused for what it is rather than answered as a missing operation.
+      if (operation.clientId === "aside") {
+        return jsonResponse({ error: "Use the canonical Aside profile path", code: "invalid_aside_profile_path" }, 400, req, ctx.config);
+      }
+      const captured = await buildIntegrationPreviewInput(operation.clientId, ctx, store);
+      if (!captured) return previewUnavailableResponse(ctx);
+      const plan = previewIntegration(captured.input, {
+        operation: "restore",
+        opId,
+        confirmDrift: parsed.confirmDrift ?? false,
+      });
+      return jsonResponse(plan, 200, req, ctx.config);
+    } catch (error) {
+      return internalErrorResponse(error, ctx);
+    }
+  }
+
   if (url.pathname === "/api/client-integrations/restore") {
     if (req.method !== "POST") return null;
     const parsed = await readJsonBody(ctx);
@@ -584,7 +795,22 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
 
     const opId = parsed.opId.trim();
     const confirmDrift = parsed.confirmDrift ?? false;
-    const asideRestore = await asideRestoreResponse(ctx, { opId, confirmDrift }, profileOptions);
+    const restoreBinding = planBindingOf(parsed);
+    if (restoreBinding === "half") return halfBoundResponse(ctx);
+    if (restoreBinding === "unknown-operation" || (restoreBinding !== "none" && restoreBinding.operation !== "restore")) {
+      return jsonResponse({
+        error: "operation does not match the requested change",
+        code: "invalid_preview_operation",
+      }, 400, req, ctx.config);
+    }
+    // The binding travels with the request. Dropping it here routed a bound Aside restore into
+    // the unbound path, which executed the mutation while its confirmation went unexamined.
+    const asideRestore = await asideRestoreResponse(ctx, {
+      opId,
+      confirmDrift,
+      ...(parsed.operation === undefined ? {} : { operation: parsed.operation }),
+      ...(parsed.planFingerprint === undefined ? {} : { planFingerprint: parsed.planFingerprint }),
+    }, profileOptions);
     if (asideRestore) return asideRestore;
     let restoreClientId: IntegrationClientId | undefined;
     try {
@@ -607,7 +833,21 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
         }, 410, req, ctx.config);
       }
 
-      const writeInput = await buildIntegrationWriteInput(operation.clientId, ctx, store);
+      const boundRestore = restoreBinding === "none"
+        ? null
+        : await buildIntegrationPreviewInput(operation.clientId, ctx, store);
+      if (restoreBinding !== "none" && boundRestore === null) return previewUnavailableResponse(ctx);
+      const writeInput = boundRestore
+        ? boundRestore.input
+        : await buildIntegrationWriteInput(operation.clientId, ctx, store);
+      const restoreGuard = restoreBinding === "none" ? null : stalePlanGuard(
+        operation.clientId,
+        ctx,
+        store,
+      { operation: "restore", opId, confirmDrift },
+      restoreBinding.fingerprint,
+        boundRestore === null ? null : boundRestore.identity,
+    );
       const restoreInput: IntegrationRestoreInput = {
         ...writeInput,
         opId,
@@ -619,8 +859,11 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
         writeInput.io?.now ?? Date.now,
         () => restoreIntegrationCoordinated(restoreInput, {
           lockSeams: integrationMutationTestHooks?.lockSeams,
+          ...(restoreGuard ? { revalidate: restoreGuard.revalidate } : {}),
         }),
       );
+      const restoreStale = restoreGuard?.response();
+      if (restoreStale) return restoreStale;
       if (!result.ok) {
         /*
          * Drift is NOT special-cased here.
@@ -698,20 +941,59 @@ export async function handleIntegrationRoutes(ctx: ManagementContext): Promise<R
     }, 400, req, ctx.config);
   }
 
+  const requestedOperation: IntegrationPlanOperation = parsed.enabled
+    ? (parsed.overwriteConflict === true ? "overwrite" : "apply")
+    : "disable";
+  const binding = planBindingOf(parsed);
+  if (binding === "half") return halfBoundResponse(ctx);
+  if (binding === "unknown-operation" || (binding !== "none" && binding.operation !== requestedOperation)) {
+    // A confirmation that names a different operation than the request performs is not a
+    // confirmation of this request.
+    return jsonResponse({
+      error: "operation does not match the requested change",
+      code: "invalid_preview_operation",
+    }, 400, req, ctx.config);
+  }
+
   try {
-    const input = await buildIntegrationWriteInput(requestedClient, ctx, integrationStore());
+    /*
+     * A bound request is built from the same passive roster the guard re-plans against, and an
+     * unbound one keeps its existing refreshing path. Building the refreshing input first would
+     * have had the mutation and its own confirmation check disagree about the roster by
+     * construction, which is the disagreement this binding exists to detect.
+     */
+    const boundToggle = binding === "none"
+      ? null
+      : await buildIntegrationPreviewInput(requestedClient, ctx, integrationStore());
+    if (binding !== "none" && boundToggle === null) return previewUnavailableResponse(ctx);
+    const input = boundToggle
+      ? boundToggle.input
+      : await buildIntegrationWriteInput(requestedClient, ctx, integrationStore());
+    const guard = binding === "none" ? null : stalePlanGuard(
+      requestedClient,
+      ctx,
+      integrationStore(),
+      { operation: binding.operation },
+      binding.fingerprint,
+      boundToggle === null ? null : boundToggle.identity,
+    );
     const result = await runIntegrationMutationFlight(
       requestedClient,
       parsed.enabled ? (parsed.overwriteConflict === true ? "overwrite" : "apply") : "disable",
       input.io?.now ?? Date.now,
       () => {
-        const options = { lockSeams: integrationMutationTestHooks?.lockSeams };
+        const options = {
+          lockSeams: integrationMutationTestHooks?.lockSeams,
+          ...(guard ? { revalidate: guard.revalidate } : {}),
+        };
         if (!parsed.enabled) return disableIntegrationCoordinated(input, options);
         return parsed.overwriteConflict === true
           ? overwriteIntegrationCoordinated(input, options)
           : applyIntegrationCoordinated(input, options);
       },
     );
+    const stale = guard?.response();
+    if (stale) return stale;
     if (!result.ok) return writerFailureResponse(requestedClient, result, ctx);
     return jsonResponse(result satisfies IntegrationToggleEnvelope, 200, req, ctx.config);
   } catch (error) {
diff --git a/src/server/management/metrics-routes.ts b/src/server/management/metrics-routes.ts
new file mode 100644
index 00000000000..5c5f867d312
--- /dev/null
+++ b/src/server/management/metrics-routes.ts
@@ -0,0 +1,20 @@
+import type { ManagementContext } from "./context";
+
+export function handleMetricsRoutes(ctx: ManagementContext): Response | null {
+  if (ctx.url.pathname === "/api/metrics" && ctx.req.method === "GET") {
+    if (!ctx.deps.requestMetrics) {
+      return Response.json({ error: { code: "not_found", message: "metrics export is disabled" } }, {
+        status: 404,
+        headers: { "Cache-Control": "no-store" },
+      });
+    }
+    return new Response(ctx.deps.requestMetrics.snapshot(), {
+      status: 200,
+      headers: {
+        "Cache-Control": "no-store",
+        "Content-Type": "text/plain;version=0.0.4",
+      },
+    });
+  }
+  return null;
+}
diff --git a/src/server/management/model-rows.ts b/src/server/management/model-rows.ts
index e406979468a..a78d9ca3bbc 100644
--- a/src/server/management/model-rows.ts
+++ b/src/server/management/model-rows.ts
@@ -9,6 +9,12 @@
  * Bodies are unchanged from their previous home; only `export` was added.
  */
 import type { CatalogModel } from "../../codex/catalog";
+import { observeModelCacheRevision } from "../../codex/model-cache";
+import {
+  captureExportConfigAdmission,
+  isExportConfigAdmissionCurrent,
+  type ExportConfigAdmission,
+} from "../../config/admitted-identity";
 import {
   catalogModelSlug,
   filterCatalogVisibleModels,
@@ -28,7 +34,7 @@ import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import type { OcxConfig } from "../../types";
 import { ensureCodexEntitlementFreshness } from "../../codex/model-entitlements";
 import { fetchAllModels } from "./shared";
-import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { initialModelSelectionPending, pendingModelSelectionProviders } from "../../providers/initial-model-selection";
 import { catalogFastRowEligible, fastRowId } from "../fast-row";
 import { knownEffortRowIds } from "../effort-row";
 
@@ -77,14 +83,29 @@ export function effectiveManagementDisplayName(
  */
 export async function listManagementModelRows(
   config: OcxConfig,
-  options: { entitlementWaitMs?: number } = {},
+  options: {
+    entitlementWaitMs?: number;
+    models?: readonly CatalogModel[];
+    /** Filled with each provider's content revision as of the moment its rows were chosen. */
+    providerContentRevisions?: Map<string, string>;
+  } = {},
 ): Promise<ManagementModelRow[]> {
-  const [models] = await Promise.all([
-    fetchAllModels(config),
-    ensureCodexEntitlementFreshness(config, {
-      waitMs: options.entitlementWaitMs ?? 3_000,
-    }),
-  ]);
+  /*
+   * A supplied roster skips the gather, and that is the point rather than an optimization.
+   * `fetchAllModels` reaches providers and can persist an initial model selection, which a
+   * read-only caller must not do. Everything below this line is the projection — the disabled
+   * computation, native and account-bound rows, custom rows and the public list — so a caller
+   * that brings its own roster still sees exactly what a writer would, and the two cannot
+   * disagree about the roster for any reason except the roster itself.
+   */
+  const models = options.models === undefined
+    ? (await Promise.all([
+      fetchAllModels(config, options.providerContentRevisions),
+      ensureCodexEntitlementFreshness(config, {
+        waitMs: options.entitlementWaitMs ?? 3_000,
+      }),
+    ]))[0]
+    : [...options.models];
   const disabled = new Set(config.disabledModels ?? []);
   // Native GPT passthrough rows lead (provider "openai", bare-slug namespaced ids): sourced
   // from the static supported set so a disabled model stays listed and re-enableable.
@@ -236,10 +257,201 @@ export function toExportModel(row: ManagementModelRow): ExportModel {
  * tab is absent from `/v1/models` and exporting it would hand the client a
  * selector the proxy refuses to route.
  */
-export async function loadExportModels(config: OcxConfig): Promise<ExportModel[]> {
-  const rows = await listManagementModelRows(config);
+export async function loadExportModels(
+  config: OcxConfig,
+  models?: readonly CatalogModel[],
+): Promise<ExportModel[]> {
+  // Initial selection adopts into the live configuration and persists it, so it has to finish
+  // before anything is admitted. Admitting first would bind this roster to bytes the same load is
+  // about to rewrite, and finalizing against a detached copy would adopt the choices into the copy
+  // while leaving the live configuration pending.
+  if (models === undefined && pendingModelSelectionProviders(config).size > 0) {
+    const { resolvePendingInitialModelSelection } = await import("../../providers/initial-model-selection-runtime");
+    await resolvePendingInitialModelSelection(config);
+  }
+  // The configuration this pass will use from beginning to end, proved to be the one on disk.
+  // Without it there is nothing that may be retained, and the caller still gets its rows: only the
+  // preview authority is withheld.
+  const admission = captureExportConfigAdmission(config);
+  const admitted = admission?.config ?? config;
+  // The gather stamps each provider as it chooses its rows, so the roster and the revisions that
+  // vouch for it come from the same moment. Sampling afterwards would let a concurrent flight's
+  // publication be recorded against rows it never produced.
+  const gathered = new Map<string, string>();
+  // Gathering here rather than through the shared fetch is what keeps the detached copy out of the
+  // initial-selection finalizer: the projection below takes a roster, and that branch performs no
+  // discovery and no configuration write. The entitlement refresh keeps the budget it has always
+  // had, and runs alongside as it did inside the projection.
+  const roster = models === undefined
+    ? (await Promise.all([
+      (await import("../../codex/catalog")).gatherRoutedModels(admitted, { providerContentRevisions: gathered }),
+      ensureCodexEntitlementFreshness(admitted, { waitMs: 3_000 }),
+    ]))[0]
+    : models;
+  const rows = await listManagementModelRows(admitted, { models: roster });
   // Management deliberately lists the full roster so hidden models can be enabled.
   // A client picker must also honor the provider selection, not just its blocklist.
-  const visibleRouted = new Set(filterCatalogVisibleModels(rows.filter(row => !row.native), config));
-  return rows.filter(row => !row.disabled && (row.native || visibleRouted.has(row))).map(toExportModel);
+  const visibleRouted = new Set(filterCatalogVisibleModels(rows.filter(row => !row.native), admitted));
+  const exported = rows.filter(row => !row.disabled && (row.native || visibleRouted.has(row))).map(toExportModel);
+  // Retain the FINAL projection, not an input to it. A preview that rebuilt from raw provider
+  // caches would miss static and forward providers, which never populate one, and would skip the
+  // retention, metadata, combo and filtering this function applies afterwards.
+  // A deep clone, not a frozen view of the caller's array. Freezing the array alone left the model
+  // objects shared, so a caller mutating one in place would have silently rewritten the roster a
+  // later preview plans against, and the fingerprint would have moved with it.
+  // Still the configuration these rows were chosen under, on disk and in hand alike. Revalidating
+  // rather than re-reading an identity is what makes this fail closed: a configuration that moved
+  // during the load leaves no snapshot rather than one recorded under a state its rows never had.
+  if (admission === null || !isExportConfigAdmissionCurrent(admission, config)) {
+    lastExportSnapshot = null;
+    return exported;
+  }
+  // Prefer the revisions the gather stamped; fall back to observing only when the roster was
+  // supplied and no gather happened, where there is nothing tighter to use.
+  const cacheStamp = gathered.size > 0 ? stampFrom(admitted, gathered) : modelCacheStamp(admitted);
+  const retained = lastExportSnapshot;
+  /*
+   * An identical roster keeps the identity it already had.
+   *
+   * The generation moved on every load, so an ordinary read that rebuilt the same rows, which the
+   * Integrations collection does, invalidated a confirmation an operator was in the middle of
+   * submitting. Nothing about the roster had changed; only the counter had. The rows themselves
+   * are compared rather than assumed equal from the configuration and the cache stamp, because a
+   * projection also reads entitlement state neither of those two describes.
+   */
+  const projection = Object.freeze(structuredClone(exported));
+  if (retained !== null
+    && retained.cacheStamp === cacheStamp
+    && isExportConfigAdmissionCurrent(retained.admission, config)
+    && JSON.stringify(retained.models) === JSON.stringify(projection)) {
+    return exported;
+  }
+  lastExportSnapshot = { admission, cacheStamp, generation: ++exportSnapshotGeneration, models: projection };
+  return exported;
+}
+
+/**
+ * The completed export roster from the last ordinary load, if it still describes this config.
+ *
+ * A preview may not gather, so it reads only what an authoritative load already finished. The
+ * admission it carries proved, when the roster was built, that the configuration in hand was the
+ * one on disk; a later read repeats that proof, so a rewritten file, an edited resident object or
+ * a mutated working copy each retire the snapshot rather than letting a preview plan against a
+ * configuration nobody has.
+ *
+ * A cold process has no snapshot and the caller answers a bounded refusal, and an ordinary load
+ * populates one: the Integrations collection read calls `loadExportModels`, so the page an
+ * operator opens before confirming anything is usually the page that fills this in. That is not a
+ * repair for every refusal. A configuration that disagrees with its file keeps refusing however
+ * many times the page is opened, because nothing here reloads or reconciles anything; once the
+ * two agree again the next ordinary read rebuilds the snapshot by itself.
+ */
+let lastExportSnapshot:
+  | { admission: ExportConfigAdmission; cacheStamp: string; generation: number; models: readonly ExportModel[] }
+  | null = null;
+let exportSnapshotGeneration = 0;
+
+/**
+ * A process-local prefix for the roster identity a caller carries between a preview and the
+ * mutation that confirms it.
+ *
+ * The identity used to be the configuration digest with a counter appended, which handed a
+ * dashboard an opaque-looking string that was in fact a fingerprint of the operator's
+ * configuration file. It only has to be unforgeable within this process and distinct across
+ * restarts, so it says nothing about the configuration at all.
+ */
+const rosterIdentityPrefix = `r${Math.trunc(Math.random() * 0xffffffff).toString(36)}`;
+
+function rosterIdentity(generation: number): string {
+  return `${rosterIdentityPrefix}:${generation}`;
+}
+
+/**
+ * Where the gathered half of the roster stands, observed without changing it.
+ *
+ * The config key cannot see a provider's models changing underneath an unchanged configuration,
+ * which is exactly what discovery does. This reads the cache's own generation for each configured
+ * provider through the passive observer, so a completed discovery retires the snapshot and a
+ * preview stops planning against a roster that no longer reflects the provider.
+ */
+function modelCacheStamp(config: OcxConfig): string {
+  return Object.keys(config.providers ?? {})
+    .sort()
+    .map(provider => `${provider}=${observeModelCacheRevision(provider)}`)
+    .join(",");
+}
+
+/**
+ * The same stamp shape, built from revisions the gather recorded rather than from observation.
+ *
+ * A provider the gather did not report falls back to observation so the stamp stays total; that
+ * happens for a provider configured after the rows were chosen, and it retires the snapshot on
+ * the next read rather than pretending the roster covered it.
+ */
+function stampFrom(config: OcxConfig, gathered: ReadonlyMap<string, string>): string {
+  return Object.keys(config.providers ?? {})
+    .sort()
+    .map(provider => `${provider}=${gathered.get(provider) ?? observeModelCacheRevision(provider)}`)
+    .join(",");
+}
+
+/**
+ * Opaque identity of the snapshot a caller is holding, or null when there is none for this config.
+ *
+ * A fingerprint check that rebuilt its own roster could validate against one snapshot while the
+ * mutation wrote from another, because an ordinary load can replace the snapshot at any moment and
+ * nothing about that is serialised against the writer lock. Carrying this identity alongside the
+ * captured roster lets a revalidation prove the snapshot it captured is still the current one
+ * without ever swapping the roster the mutation is about to use.
+ */
+export function exportSnapshotIdentity(config: OcxConfig): string | null {
+  const snapshot = lastExportSnapshot;
+  if (snapshot === null) return null;
+  if (!isExportConfigAdmissionCurrent(snapshot.admission, config)) return null;
+  if (snapshot.cacheStamp !== modelCacheStamp(config)) return null;
+  return rosterIdentity(snapshot.generation);
+}
+
+/** Test seam: a fresh process has no snapshot, and suites must be able to reproduce that. */
+export function resetExportSnapshotForTests(): void {
+  lastExportSnapshot = null;
+}
+
+/**
+ * The export roster for a read that must change nothing at all, or null when there is not one.
+ *
+ * Skipping the initial-selection finalizer was not enough. Discovery itself refreshes credentials
+ * and writes the provider model cache, so a preview that gathered would still be a write dressed
+ * as a read, and "the models list already does this" describes what a GET happens to do rather
+ * than what a preview is allowed to do.
+ *
+ * So this reads already-captured per-provider cache entries and never fetches. When no provider
+ * has a cached roster there is no honest snapshot to plan against, and the caller reports a
+ * bounded refusal rather than triggering a gather to manufacture one.
+ */
+export function previewExportSnapshot(
+  config: OcxConfig,
+): { models: readonly ExportModel[]; identity: string } | null {
+  // One synchronous read of one const. Taking the roster and its identity in two steps let a
+  // concurrent load publish a new snapshot between them, so a caller could hold one roster while
+  // believing it held the identity of another.
+  const snapshot = lastExportSnapshot;
+  if (snapshot === null) return null;
+  // The roster was built from a configuration proved to be the one on disk; this asks whether both
+  // are still that same configuration, and reads nothing but the file to answer.
+  if (!isExportConfigAdmissionCurrent(snapshot.admission, config)) return null;
+  // A completed discovery retires the snapshot: the configuration is unchanged, but the models it
+  // resolves to are not the ones this roster was built from.
+  if (snapshot.cacheStamp !== modelCacheStamp(config)) return null;
+  // Cloned on the way out as well as on the way in. The retained copy is the authority, and a
+  // reader holding its objects could edit the roster every later preview plans against without
+  // going anywhere near this module.
+  return {
+    models: structuredClone(snapshot.models) as readonly ExportModel[],
+    identity: rosterIdentity(snapshot.generation),
+  };
+}
+
+export function previewExportModels(config: OcxConfig): readonly ExportModel[] | null {
+  return previewExportSnapshot(config)?.models ?? null;
 }
diff --git a/src/server/management/route-registry.ts b/src/server/management/route-registry.ts
index 525bb705e22..95dc71be749 100644
--- a/src/server/management/route-registry.ts
+++ b/src/server/management/route-registry.ts
@@ -38,8 +38,17 @@ export type ExemptionReason =
   | "test-seam"
   /** The CLI reaches the same data through a local transport instead of HTTP. */
   | "local-transport"
+  /** Machine scrape target whose HTTP exposition is the operator contract. */
+  | "scrape-target"
   /** Older clients use this alias; the current CLI drives its declared replacement. */
   | "compatibility-alias"
+  /**
+   * A read-only POST whose purpose is to bind an interactive confirmation to the mutation that
+   * immediately follows it. There is no standalone thing for a CLI to do with one: the plan is
+   * only meaningful to the caller that is about to commit it, and a scripted caller drives the
+   * mutation directly.
+   */
+  | "interactive-preview"
   /** Unreachable in the live dispatch order; delete rather than expose. */
   | "dead"
   /**
@@ -159,6 +168,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
   { method: "DELETE", path: "/api/client-integrations/aside/profiles/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside history deletion uses the dashboard journal cleanup; the CLI has history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "GET", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode" },
+  { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/preview", module: "server/management/aside-profile-routes", mutates: false, mechanism: "prefix-decode", exempt: { reason: "interactive-preview", why: "Plans one Aside profile's change so a dashboard confirmation can show what would change and bind to it. Read-only, and useful only to the caller about to commit; a scripted caller drives the profile toggle or restore directly." } },
   { method: "DELETE", path: "/api/client-integrations/aside/profiles/{profileId}/journal", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode", exempt: { reason: "deferred-verb", why: "Aside profile history deletion uses the dashboard journal cleanup; the CLI has scoped history and restore but no deletion verb yet.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "POST", path: "/api/client-integrations/aside/profiles/{profileId}/restore", module: "server/management/aside-profile-routes", mutates: true, mechanism: "prefix-decode" },
   // server/management/codex-prompt-routes
@@ -197,6 +207,8 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "GET", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: false },
   { method: "DELETE", path: "/api/client-integrations/journal", module: "server/management/integration-routes", mutates: true, exempt: { reason: "deferred-verb", why: "Retiring one rollback row is a dashboard-local cleanup; the CLI verb that would drive it is owed by a later work-phase and is not implemented here.", owner: "260904_priority65_closeout WP7", ownerDoc: "devlog/_fin/260904_priority65_closeout/060_wp7_rollback_journal_crud.md" } },
   { method: "POST", path: "/api/client-integrations/restore", module: "server/management/integration-routes", mutates: true },
+  { method: "POST", path: "/api/client-integrations/preview", module: "server/management/integration-routes", mutates: false, exempt: { reason: "interactive-preview", why: "Plans an apply, overwrite or disable so a dashboard confirmation can show what would change and bind to it. Read-only, and useful only to the caller about to commit; a scripted caller drives PUT /api/client-integrations/{clientId} directly." } },
+  { method: "POST", path: "/api/client-integrations/restore/preview", module: "server/management/integration-routes", mutates: false, exempt: { reason: "interactive-preview", why: "Plans an undo so drift is shown before a restore rather than discovered by a rejected mutation. Read-only, and useful only to the caller about to commit; a scripted caller drives POST /api/client-integrations/restore directly." } },
   // server/management/lab-automation-routes
   { method: "GET", path: "/api/lab/automation", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
   { method: "GET", path: "/api/lab/automation/runs", module: "server/management/lab-automation-routes", mutates: false, exempt: { reason: "local-transport", why: "ocx lab reads the same rows from the local SQLite projection; src/cli/lab.ts imports ../lab/query directly and never fetches /api/lab." } },
@@ -234,6 +246,8 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/storage/trash/restore", module: "server/management/logs-usage-routes", mutates: true },
   { method: "PUT", path: "/api/debug", module: "server/management/logs-usage-routes", mutates: true },
   { method: "PUT", path: "/api/storage/cleanup-policy", module: "server/management/logs-usage-routes", mutates: true },
+  // server/management/metrics-routes
+  { method: "GET", path: "/api/metrics", module: "server/management/metrics-routes", mutates: false, exempt: { reason: "scrape-target", why: "This machine scrape target exposes authenticated text exposition for monitoring systems; a CLI JSON verb would be a different contract." } },
   // server/management/model-routes
   { method: "GET", path: "/api/aliases", module: "server/management/model-routes", mutates: false },
   { method: "GET", path: "/api/catalog", module: "server/management/model-routes", mutates: false },
diff --git a/src/server/management/shared.ts b/src/server/management/shared.ts
index c48f5f53f7a..fa3845250f2 100644
--- a/src/server/management/shared.ts
+++ b/src/server/management/shared.ts
@@ -245,12 +245,19 @@ export function requestLogDto(
  * share the same fetch, the same per-provider cache (dedups Codex's frequent /v1/models polling),
  * and the same stale fallback when a provider blips, instead of a parallel uncached copy.
  */
-export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]> {
+export async function fetchAllModels(
+  config: OcxConfig,
+  /** Filled with each provider's content revision as of the moment its rows were chosen. */
+  providerContentRevisions?: Map<string, string>,
+): Promise<CatalogModel[]> {
   const { gatherRoutedModels } = await import("../../codex/catalog");
   const baseline = captureInitialSelectionBaseline(config);
-  if (!baseline) return gatherRoutedModels(config);
+  if (!baseline) return gatherRoutedModels(config, providerContentRevisions ? { providerContentRevisions } : undefined);
   const outcomes: Array<{ provider: string; state: "authoritative" | "degraded" }> = [];
-  const models = await gatherRoutedModels(config, { providerModelOutcomes: outcomes });
+  const models = await gatherRoutedModels(config, {
+    providerModelOutcomes: outcomes,
+    ...(providerContentRevisions ? { providerContentRevisions } : {}),
+  });
   finalizeInitialModelSelection(config, baseline, uniqueCatalogModelsForPublicList(models),
     outcomes.filter(outcome => outcome.state === "authoritative").map(outcome => outcome.provider));
   return models;
diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index cfcc9ca416c..f88c4209b2f 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -36,6 +36,7 @@ import { isServiceViable } from "../../service";
 import { readRuntimePort } from "../../config/process-state";
 import { withProcessRuntimeProvenance } from "../../lib/bun-runtime";
 import { selfLaunchArgv } from "../../lib/self-launch-argv";
+import { spendLedgerRestartEnvironment } from "../../lib/spend-ledger-owner";
 import {
   MEMORY_DRAIN_RESTART_MS,
   REPLACEMENT_READY_TIMEOUT_MS,
@@ -225,8 +226,12 @@ function spawnDetachedStart(
   return new Promise<void>((resolve, reject) => {
     let child: ReturnType<typeof spawn>;
     try {
-      const env: NodeJS.ProcessEnv = { ...process.env };
-      delete env.OCX_SERVICE;
+      const sourceEnv: NodeJS.ProcessEnv = { ...process.env };
+      delete sourceEnv.OCX_SERVICE;
+      const env = spendLedgerRestartEnvironment(
+        sourceEnv,
+        waitForHealthBeforeParentExit ? undefined : process.pid,
+      );
       child = spawn(process.execPath, launchArgs, {
         detached: true,
         stdio: "ignore",
diff --git a/src/server/management/system-routes.ts b/src/server/management/system-routes.ts
index 3819a8e52d6..04d9f566210 100644
--- a/src/server/management/system-routes.ts
+++ b/src/server/management/system-routes.ts
@@ -39,6 +39,7 @@ import {
 } from "../../lib/codex-restart-contract";
 import { jsonResponse } from "../auth-cors";
 import { getInspectionCounters } from "../relay";
+import { spendLedgerDiagnosticsSnapshot } from "../../lib/spend-reservation-ledger";
 import type {
   performCodexRestart,
   readCodexAppServerState,
@@ -60,6 +61,7 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       version,
       uptime: process.uptime(),
       pid: process.pid,
+      spendLedger: spendLedgerDiagnosticsSnapshot(),
     });
   }
   if (url.pathname === "/api/system/memory" && req.method === "GET") {
diff --git a/src/server/management/usage-aggregate-cache.ts b/src/server/management/usage-aggregate-cache.ts
index 1cabf9b85bb..519ff7775f2 100644
--- a/src/server/management/usage-aggregate-cache.ts
+++ b/src/server/management/usage-aggregate-cache.ts
@@ -66,6 +66,7 @@ const pinnedAggregates = new Set<RetainedUsageAggregate>();
 let baseFlight: Promise<UsageAggregateResult> | null = null;
 const filteredFlights = new Map<string, Promise<UsageAggregateResult>>();
 const retainedFilteredAggregates = new Map<string, RetainedUsageAggregate>();
+const MAX_CONCURRENT_FILTERED_AGGREGATES = 4;
 
 function currentTimeZone(): string {
   return Intl.DateTimeFormat().resolvedOptions().timeZone;
@@ -283,6 +284,9 @@ export async function getFilteredUsageAggregate(filter: {
   ]);
   const existing = filteredFlights.get(key);
   if (existing) return existing;
+  if (filteredFlights.size >= MAX_CONCURRENT_FILTERED_AGGREGATES) {
+    throw new Error("too many concurrent filtered usage aggregates");
+  }
 
   const flight = refreshFilteredAggregate(key, normalizedFilter, fixedWindow);
   filteredFlights.set(key, flight);
diff --git a/src/server/readiness.ts b/src/server/readiness.ts
index 5dc3c2021f4..f48cfb5591a 100644
--- a/src/server/readiness.ts
+++ b/src/server/readiness.ts
@@ -3,10 +3,30 @@
  *
  * `GET /healthz` answers "is the process alive and serving HTTP?" the instant the
  * listener binds. Readiness is stricter: the proxy is "ready" only after the
- * post-startup Codex catalog/config sync (`syncModelsToCodex`) has settled with
- * `ok=true` and no catalog-sync warning. Until then the process is live (Codex can
- * open a socket) but not ready (a request would race the sync or hit a stale
- * catalog), so clients should back off.
+ * post-startup Codex catalog/config sync (`syncModelsToCodex`) has SETTLED and
+ * reported `ok=true`. Until it settles the process is live (Codex can open a
+ * socket) but not ready — a request would race the sync — so clients back off.
+ *
+ * What readiness is NOT (#5181): it is not a verdict on the local Codex client's
+ * artifacts. A nonempty `warning` used to be terminal here, which made a
+ * degradation of files written into the local Codex home permanently un-ready a
+ * proxy that was serving every other provider correctly. In a single-replica
+ * Kubernetes deployment that removed the only Service endpoint.
+ *
+ * `ok` and `warning` are separate fields in the sync result because they answer
+ * separate questions, and the gate must not conflate them. `ok` is the sync's own
+ * verdict on whether the essential work — config injection, and the write
+ * admission that precedes it — succeeded. `warning` names a degradation the sync
+ * itself decided to continue past: no catalog source so Codex keeps its native
+ * catalog, combos omitted from the catalog, a conversation-history relabel left
+ * to Codex's own writer, or a caught catalog-refresh exception after which
+ * injection still runs and still reports its own `ok`. None of those stops this
+ * process from accepting HTTP or routing to a provider, so none of them may close
+ * the gate.
+ *
+ * That boundary is not new, only extended: the Claude Code roster reconciliation
+ * in `src/cli/claude-agent-startup-sync.ts` already delays the ready transition
+ * without being allowed to fail it, on the same reasoning.
  *
  * Design contract (per P1 review):
  *  - NO module-global mutable state. Each `startServer` invocation gets its own
@@ -65,8 +85,11 @@ export interface SyncOutcomeLike {
 
 /**
  * Drive the gate from the post-startup sync. Awaits `syncFn`; the gate goes to
- * `ready` ONLY on `ok=true` with no nonempty warning. A throw, `null`, `ok=false`,
- * or a nonempty warning transitions to `failed`. Used directly by `handleStart`
+ * `ready` on `ok=true`. A throw, `null`, or `ok !== true` transitions to
+ * `failed`; a nonempty `warning` does not, because the sync that produced it
+ * still reported the essential work done (see the file header, #5181). A throw
+ * and `null` stay terminal because neither is a classified outcome: the startup
+ * path did not reach a verdict, so the gate cannot claim one. Used by `handleStart`
  * so the startup transition is unit-testable without spawning the proxy. Returns
  * the raw sync outcome so a caller that also needs the #1046 write flags (did the
  * sync actually write the catalog/cache?) can keep them without a second call.
@@ -90,10 +113,6 @@ export async function runStartupReadinessSync(
     gate.markFailed();
     return result;
   }
-  if (result.warning !== undefined && result.warning !== "") {
-    gate.markFailed();
-    return result;
-  }
   gate.markReady();
   return result;
 }
diff --git a/src/server/relay-eager.ts b/src/server/relay-eager.ts
index e8388cb7094..e1fc209c563 100644
--- a/src/server/relay-eager.ts
+++ b/src/server/relay-eager.ts
@@ -30,6 +30,7 @@ import {
   createSseTerminalOutputBoundary,
   doneFrame,
   failedTailFrame,
+  refusalFailedTailFrame,
   upstreamErrorTailFrame,
 } from "./relay";
 import {
@@ -127,6 +128,23 @@ export function relaySseEagerBounded(
       return null;
     }
   };
+  /**
+   * Same tail, except that a refusal the boundary already captured outranks the
+   * read failure that followed it — the upstream ended the turn before the
+   * socket did (#5176).
+   */
+  const encodeTerminalTail = (error: unknown): Uint8Array | null => {
+    const refusalCode = terminalBoundary.upstreamRefusalCode();
+    const refusalMessage = terminalBoundary.upstreamError();
+    if (refusalCode === undefined || refusalMessage === undefined) {
+      return encodeFailedTail(error);
+    }
+    try {
+      return refusalFailedTailFrame(terminalEncoder, refusalMessage, refusalCode);
+    } catch {
+      return null;
+    }
+  };
   const rewriteDecoder = activeRewrite ? new TextDecoder() : null;
   const rewriteEncoder = activeRewrite ? new TextEncoder() : null;
   const rewriteBudget = opts?.rewriteBudget;
@@ -313,7 +331,11 @@ export function relaySseEagerBounded(
             const upstreamError = terminalBoundary.upstreamError() ?? opts?.upstreamError;
             const upstreamErrorFrame = upstreamError === undefined
               ? adapterEofFrame
-              : upstreamErrorTailFrame(terminalEncoder, upstreamError);
+              : upstreamErrorTailFrame(
+                terminalEncoder,
+                upstreamError,
+                terminalBoundary.upstreamRefusalCode(),
+              );
             queuedBytes += upstreamErrorFrame.byteLength + terminalSentinel.byteLength;
             try {
               controllerRef?.enqueue(upstreamErrorFrame);
@@ -439,7 +461,7 @@ export function relaySseEagerBounded(
         // getters, toString) that re-entrantly cancel the client or abort the
         // upstream. Build the tail FIRST, then re-check eligibility before
         // committing to the synthetic terminal (adversarial review blocker).
-        const tail = encodeFailedTail(err);
+        const tail = encodeTerminalTail(err);
         if (tail && canDeliver()) {
           // Inspection and client framing have separate bounded parsers. If
           // inspection resynchronized after an oversized frame and observed a
diff --git a/src/server/relay.ts b/src/server/relay.ts
index 1e71ea35b90..7e84092fb62 100644
--- a/src/server/relay.ts
+++ b/src/server/relay.ts
@@ -5,6 +5,9 @@ import {
   CYBER_POLICY_FALLBACK_MESSAGE,
   isCyberPolicyCode,
   isCyberPolicyMessage,
+  isTerminalRefusalCode,
+  safetyRefusalCodeFromMessage,
+  terminalRefusalFallbackMessage,
   upstreamErrorMessageFromPayload,
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
@@ -150,16 +153,61 @@ export function failedTailFrame(encoder: TextEncoder, err: unknown): Uint8Array
   return encoder.encode(`\n\nevent: response.failed\ndata: ${payload}\n\n${DONE_SSE_FRAME_TEXT}`);
 }
 
-export function upstreamErrorTailFrame(encoder: TextEncoder, message: string): Uint8Array {
+/**
+ * Close a turn the upstream ended without a Responses terminal.
+ *
+ * `refusalCode` carries the upstream's own verdict when it gave one. Codex
+ * classifies this terminal by `error.code` alone and retries everything outside
+ * its fatal set (codex-rs/codex-api/src/sse/responses.rs:423-450), so stamping
+ * `upstream_server_error` on a refusal delivered it as a retryable disconnect
+ * and drove the reconnect loop in #5176. Without a refusal code the terminal is
+ * unchanged: a genuine transport failure stays retryable, which is what it is.
+ */
+export function upstreamErrorTailFrame(
+  encoder: TextEncoder,
+  message: string,
+  refusalCode?: string,
+): Uint8Array {
+  return encoder.encode(
+    `event: response.failed\ndata: ${upstreamErrorFailedPayload(message, refusalCode)}\n\n`,
+  );
+}
+
+function upstreamErrorFailedPayload(message: string, refusalCode?: string): string {
   const error = {
-    type: "upstream_error",
-    code: "upstream_server_error",
+    type: refusalCode === undefined ? "upstream_error" : "invalid_request_error",
+    code: refusalCode ?? "upstream_server_error",
     message: redactSecretString(message).slice(0, MAX_TAIL_ERROR_MESSAGE_CHARS),
   };
-  return encoder.encode(`event: response.failed\ndata: ${JSON.stringify({
+  return JSON.stringify({
     type: "response.failed",
-    response: { status: "failed", error, last_error: error },
-  })}\n\n`);
+    response: {
+      status: "failed",
+      error,
+      last_error: error,
+      ...(refusalCode === undefined ? {} : { retryable: false }),
+    },
+  });
+}
+
+/**
+ * Terminal for a read that failed after the upstream had already refused.
+ *
+ * Framed exactly like {@link failedTailFrame} — leading blank line to close a
+ * partial block, then the sentinel — but carrying the refusal instead of the
+ * generic reset. The refusal is the real outcome of the turn and the socket
+ * teardown that followed it is not, so reporting `upstream_reset` here would
+ * restart a turn the upstream has already ended (#5176).
+ */
+export function refusalFailedTailFrame(
+  encoder: TextEncoder,
+  message: string,
+  refusalCode: string,
+): Uint8Array {
+  const payload = upstreamErrorFailedPayload(message, refusalCode);
+  return encoder.encode(
+    `\n\nevent: response.failed\ndata: ${payload}\n\n${DONE_SSE_FRAME_TEXT}`,
+  );
 }
 
 function boundedBareUpstreamErrorMessage(payload: unknown): string | undefined {
@@ -169,12 +217,57 @@ function boundedBareUpstreamErrorMessage(payload: unknown): string | undefined {
   return message ? redactSecretString(message).slice(0, MAX_TAIL_ERROR_MESSAGE_CHARS) : undefined;
 }
 
+/**
+ * A bare upstream `error` event reduced to what the synthesized terminal needs.
+ *
+ * The structured code is authoritative whenever the upstream sent one: a code
+ * that is not a refusal means the upstream did not refuse, whatever its
+ * diagnostic text happens to quote. Recognized refusal copy is read only when
+ * no code was carried anywhere on the event, which is the shape #5176 reports.
+ * A refusal code with no message still yields a terminal, because Codex accepts
+ * that shape and supplies its own copy for it.
+ *
+ * The candidate topology mirrors {@link upstreamErrorMessageFromPayload}: code
+ * and message must be read from the same places, or an event whose message is
+ * nested under `response.error` would contribute text while its verdict went
+ * unseen.
+ */
+function boundedBareUpstreamError(payload: unknown): {
+  message: string;
+  refusalCode: string | undefined;
+} | undefined {
+  const root = asJsonRecord(payload);
+  if (!root || root.type !== "error") return undefined;
+  const message = boundedBareUpstreamErrorMessage(payload);
+  const response = asJsonRecord(root.response);
+  // Precedence is {@link upstreamErrorMessageFromPayload}'s, so the envelope
+  // that supplied the message also supplies the verdict. Taking the FIRST code
+  // rather than searching for a refusal is what stops a refusal nested below a
+  // transient one from overruling it.
+  const code = [
+    asJsonRecord(root.error),
+    asJsonRecord(root.last_error),
+    asJsonRecord(response?.error),
+    asJsonRecord(response?.incomplete_details),
+    root,
+  ]
+    .map(candidate => stringField(candidate, "code"))
+    .find(candidate => candidate !== undefined);
+  const refusalCode = code !== undefined
+    ? (isTerminalRefusalCode(code) ? code : undefined)
+    : message === undefined ? undefined : safetyRefusalCodeFromMessage(message);
+  if (message !== undefined) return { message, refusalCode };
+  if (refusalCode === undefined) return undefined;
+  return { message: terminalRefusalFallbackMessage(refusalCode), refusalCode };
+}
+
 export type SseTerminalOutputBoundary = {
   feed(chunk: Uint8Array): Uint8Array;
   finish(): Uint8Array;
   terminalSeen(): boolean;
   doneSeen(): boolean;
   upstreamError(): string | undefined;
+  upstreamRefusalCode(): string | undefined;
   dispose(): void;
 };
 
@@ -197,6 +290,7 @@ export function createSseTerminalOutputBoundary(
   let pendingDone: { block: Uint8Array; delimiter: Uint8Array } | null = null;
   let disposed = false;
   let upstreamError: string | undefined;
+  let upstreamRefusalCode: string | undefined;
 
   const processFrames = (
     frames: ReturnType<BoundedSseFrameBuffer["feed"]>,
@@ -210,8 +304,11 @@ export function createSseTerminalOutputBoundary(
       const parsed = payload === null ? undefined : parseSsePayload(payload);
       // Observe on the client reader itself: a tee inspection branch may lag
       // behind EOF, so its log context cannot determine the outgoing terminal.
-      const message = boundedBareUpstreamErrorMessage(parsed);
-      if (message !== undefined) upstreamError = message;
+      const bare = boundedBareUpstreamError(parsed);
+      if (bare !== undefined) {
+        upstreamError = bare.message;
+        upstreamRefusalCode = bare.refusalCode;
+      }
       const safetyBuffering = dropSafetyBuffering && parsed !== undefined
         ? codexSafetyBufferingBlockAction(parsed) : "keep";
       if (safetyBuffering === "drop") continue;
@@ -278,6 +375,7 @@ export function createSseTerminalOutputBoundary(
     terminalSeen: () => terminal,
     doneSeen: () => done,
     upstreamError: () => upstreamError,
+    upstreamRefusalCode: () => upstreamRefusalCode,
     dispose() {
       if (disposed) return;
       disposed = true;
@@ -349,7 +447,11 @@ export function relaySseWithFailedTail(
               const upstreamError = terminalBoundary.upstreamError() ?? opts?.upstreamError;
               controller.enqueue(upstreamError === undefined
                 ? adapterEofIncompleteFrame(encoder)
-                : upstreamErrorTailFrame(encoder, upstreamError));
+                : upstreamErrorTailFrame(
+                  encoder,
+                  upstreamError,
+                  terminalBoundary.upstreamRefusalCode(),
+                ));
               controller.enqueue(doneFrame(encoder));
             }
             terminalBoundary.dispose();
@@ -378,7 +480,11 @@ export function relaySseWithFailedTail(
             if (!terminalBoundary.doneSeen()) controller.enqueue(doneFrame(encoder));
           } else {
             // Leading blank line terminates a partial SSE block so the failed frame parses cleanly.
-            controller.enqueue(failedTailFrame(encoder, err));
+            const refusalCode = terminalBoundary.upstreamRefusalCode();
+            const refusalMessage = terminalBoundary.upstreamError();
+            controller.enqueue(refusalCode !== undefined && refusalMessage !== undefined
+              ? refusalFailedTailFrame(encoder, refusalMessage, refusalCode)
+              : failedTailFrame(encoder, err));
           }
           controller.close();
         } catch { /* client already torn down */ }
@@ -720,6 +826,9 @@ export function responseWithDeferredRequestLog(
           // convention for a client cancellation or upstream read failure.
           const status = reason === "cancel" ? 499 : reason === "read_error" ? 502 : response.status;
           addFinalRequestLog(requestId, start, logCtx, status, {
+            ...(reason === "eof" && logCtx.observedTerminalStatus
+              ? { terminalStatus: logCtx.observedTerminalStatus }
+              : {}),
             closeReason: reason === "cancel" ? "client_cancel" : "non_stream",
           }, addLog);
         },
diff --git a/src/server/request-log.ts b/src/server/request-log.ts
index 6a0c7220dad..f3d73ba8984 100644
--- a/src/server/request-log.ts
+++ b/src/server/request-log.ts
@@ -12,6 +12,7 @@ import {
   isCyberPolicyCode,
   isCyberPolicyMessage,
   isRateLimitOrQuotaFailureMessage,
+  isUpstreamResetReplayRefusedMessage,
   upstreamErrorMessageFromPayload,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
@@ -22,6 +23,7 @@ import { normalizeRouteDecisionTrace, type RouteDecisionTraceV1 } from "../routi
 import type { AdapterRequest } from "../adapters/base";
 import type { RequestSpendSettlement } from "./responses/request-spend";
 import type { AdapterTierMetadata } from "../providers/fastwire";
+import { UPSTREAM_RESET_REPLAY_REFUSED_CODE } from "../lib/upstream-retry";
 import { redactSecretString, sanitizeLogMetadataString } from "../lib/redact";
 import {
   appendUsageEntry,
@@ -67,10 +69,15 @@ import { inferCursorContextWindow } from "../adapters/cursor/discovery";
 import { KIRO_MODEL_CONTEXT_WINDOWS, normalizeKiroModelId } from "../providers/kiro-models";
 import { DEVIN_MODEL_CONTEXT_WINDOWS } from "../adapters/devin/live-models";
 import { modelRecordValue } from "../reasoning-effort";
+import type { RequestMetricsRecorder } from "./request-metrics";
 
 export interface RequestLogContext {
   model: string;
   provider: string;
+  /** Optional process-lifetime aggregate sink, injected by the server composition owner. */
+  requestMetricsRecorder?: RequestMetricsRecorder;
+  /** Bounded terminal enum observed while inspecting a buffered response body. */
+  observedTerminalStatus?: ResponsesTerminalStatus;
   /**
    * Identity of the ONE logical request this context serves (#4546). Set from the execution
    * budget minted at ingress; a retry leg, a repair refetch and a combo child share it.
@@ -291,6 +298,7 @@ export interface RequestLogEntry {
 }
 
 const requestLog: RequestLogEntry[] = [];
+const requestLogObserversForTests = new Set<(entry: RequestLogEntry) => void>();
 const MAX_LOG_SIZE = 2000;
 const requestLogEntryBytes = new WeakMap<RequestLogEntry, number>();
 let requestLogBytes = 0;
@@ -491,6 +499,9 @@ export function addRequestLog(entry: RequestLogEntry) {
   else if (retained !== entry) delete retained.claudeCompatibility;
   entry = retained;
   retainRequestLogEntry(entry);
+  for (const observer of requestLogObserversForTests) {
+    try { observer(entry); } catch { /* test observation must never fail request logging */ }
+  }
   try {
     // Failure diagnostics survive the 200-entry ring buffer by riding the persisted
     // usage entry (devlog/_plan/260716_claudecode_hardening/030). Success rows stay
@@ -566,6 +577,12 @@ export function addRequestLog(entry: RequestLogEntry) {
   }
 }
 
+/** Test-only finalized-row observation without polling the management projection. */
+export function observeRequestLogsForTests(observer: (entry: RequestLogEntry) => void): () => void {
+  requestLogObserversForTests.add(observer);
+  return () => { requestLogObserversForTests.delete(observer); };
+}
+
 export function nextRequestLogId(_timestamp = Date.now()): string {
   return `ocx-${randomBytes(16).toString("hex")}`;
 }
@@ -714,7 +731,15 @@ export function requestLogErrorCode(
     }
     return "permission_denied";
   }
-  if (status === 429) return "rate_limit_exceeded";
+  if (status === 429) {
+    // A refused ambiguous reset answers 429 by design (it must not invite a client
+    // retry that could duplicate inference); classify it by its message so the log
+    // distinguishes a proxy refusal from provider throttling.
+    if (upstreamError?.trim() && isUpstreamResetReplayRefusedMessage(upstreamError)) {
+      return UPSTREAM_RESET_REPLAY_REFUSED_CODE;
+    }
+    return "rate_limit_exceeded";
+  }
   if (status === 503) return "server_is_overloaded";
   if (status >= 500) return "upstream_server_error";
   return `http_${status}`;
@@ -766,6 +791,22 @@ export function catalogModelSupportsServiceTier(modelId: string, serviceTier: st
 
 export function applyResponseLogMetadata(logCtx: RequestLogContext, payload: unknown): void {
   if (!payload || typeof payload !== "object") return;
+  if (logCtx.observedTerminalStatus === undefined) {
+    const eventType = (payload as { type?: unknown }).type;
+    const response = (payload as { response?: unknown }).response;
+    const responseStatus = response && typeof response === "object"
+      ? (response as { status?: unknown }).status
+      : (payload as { status?: unknown }).status;
+    if (eventType === "response.completed") {
+      logCtx.observedTerminalStatus = "completed";
+    } else if (eventType === "response.failed") {
+      logCtx.observedTerminalStatus = "failed";
+    } else if (eventType === "response.incomplete") {
+      logCtx.observedTerminalStatus = "incomplete";
+    } else if (responseStatus === "completed" || responseStatus === "failed" || responseStatus === "incomplete") {
+      logCtx.observedTerminalStatus = responseStatus;
+    }
+  }
   const source = "response" in payload && typeof (payload as { response?: unknown }).response === "object"
     ? (payload as { response?: unknown }).response
     : payload;
@@ -1317,6 +1358,17 @@ export function addFinalRequestLog(
   const usageStatus = aggregate?.status ?? existing.status;
   const totalTokens = aggregate?.totalTokens ?? existing.totalTokens;
   const spend = requestSpendRecord(logCtx, attempts);
+  const durationMs = Date.now() - start;
+  logCtx.requestMetricsRecorder?.recordFinalRequest({
+    ...(logCtx.inboundProtocol ? { protocol: logCtx.inboundProtocol } : {}),
+    status: effectiveStatus,
+    durationMs,
+    ...(logCtx.firstOutputMs !== undefined ? { firstOutputMs: logCtx.firstOutputMs } : {}),
+    ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
+    ...(closeReason ? { closeReason } : {}),
+    ...(attempts !== undefined ? { attempts } : {}),
+    ...(spend ? { spendSends: spend.sends } : {}),
+  });
   const cacheProvenance = classifyCacheTelemetryProvenance(loggedUsage, {
     wireParsed: logCtx.usageWireParsed === true,
   });
@@ -1364,7 +1416,7 @@ export function addFinalRequestLog(
       : {}),
     ...(logCtx.resolvedModel ? { resolvedModel: logCtx.resolvedModel } : {}),
     status: effectiveStatus,
-    durationMs: Date.now() - start,
+    durationMs,
     ...(logCtx.firstOutputMs !== undefined ? { firstOutputMs: logCtx.firstOutputMs } : {}),
     ...(errorCode ? { errorCode } : {}),
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
@@ -1809,4 +1861,5 @@ export function clearRequestLogsForTests(): void {
   requestLog.length = 0;
   requestLogBytes = 0;
   requestLogsHydratedFromDisk = false;
+  requestLogObserversForTests.clear();
 }
diff --git a/src/server/request-metrics.ts b/src/server/request-metrics.ts
new file mode 100644
index 00000000000..d6126d5d9da
--- /dev/null
+++ b/src/server/request-metrics.ts
@@ -0,0 +1,236 @@
+import type { ResponsesTerminalStatus } from "../bridge";
+import type { AttemptRecoveryKind } from "../usage/log";
+
+export const REQUEST_METRICS_PROTOCOLS = Object.freeze(["responses", "chat", "messages", "unknown"] as const);
+export const REQUEST_METRICS_RESULTS = Object.freeze(["completed", "failed", "incomplete", "aborted"] as const);
+export const REQUEST_METRICS_RECOVERY_CLASSES = Object.freeze([
+  "transient",
+  "connection",
+  "credential",
+  "rate_limit",
+  "payload",
+  "empty_completion",
+  "effort_downgrade",
+  "other",
+] as const);
+
+export const REQUEST_DURATION_BUCKETS_SECONDS = Object.freeze([0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60] as const);
+export const REQUEST_TTFT_BUCKETS_SECONDS = Object.freeze([0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30] as const);
+
+export type RequestMetricsProtocol = typeof REQUEST_METRICS_PROTOCOLS[number];
+export type RequestMetricsResult = typeof REQUEST_METRICS_RESULTS[number];
+export type RequestMetricsRecoveryClass = typeof REQUEST_METRICS_RECOVERY_CLASSES[number];
+
+export interface RequestMetricFinalFact {
+  protocol?: "responses" | "chat" | "messages";
+  status: number;
+  durationMs: number;
+  firstOutputMs?: number;
+  terminalStatus?: ResponsesTerminalStatus;
+  closeReason?: "terminal" | "client_cancel" | "non_stream" | "body_stall" | "body_overflow";
+  attempts?: ReadonlyArray<{
+    sendCount: number;
+    recoveryKinds: readonly AttemptRecoveryKind[];
+  }>;
+  spendSends?: number;
+}
+
+export interface RequestMetricsRecorder {
+  recordFinalRequest(fact: RequestMetricFinalFact): void;
+}
+
+export interface RequestMetricsSnapshotter {
+  snapshot(): string;
+}
+
+export interface RequestMetricsOwner extends RequestMetricsRecorder, RequestMetricsSnapshotter {
+  resetForTests(): void;
+}
+
+interface HistogramCell {
+  buckets: number[];
+  count: number;
+  sum: number;
+}
+
+const protocolCell = (value: RequestMetricsProtocol): number => REQUEST_METRICS_PROTOCOLS.indexOf(value);
+const resultCell = (value: RequestMetricsResult): number => REQUEST_METRICS_RESULTS.indexOf(value);
+const recoveryCell = (value: RequestMetricsRecoveryClass): number => REQUEST_METRICS_RECOVERY_CLASSES.indexOf(value);
+
+function matrix(rows: number, columns: number): number[][] {
+  return Array.from({ length: rows }, () => Array.from({ length: columns }, () => 0));
+}
+
+function histograms(bounds: readonly number[]): HistogramCell[][] {
+  return Array.from({ length: REQUEST_METRICS_PROTOCOLS.length }, () => (
+    Array.from({ length: REQUEST_METRICS_RESULTS.length }, () => ({
+      buckets: Array.from({ length: bounds.length + 1 }, () => 0),
+      count: 0,
+      sum: 0,
+    }))
+  ));
+}
+
+function classifyResult(fact: RequestMetricFinalFact): RequestMetricsResult {
+  if (fact.closeReason === "client_cancel" || fact.status === 499) return "aborted";
+  if (fact.terminalStatus === "failed") return "failed";
+  if (fact.terminalStatus === "incomplete"
+    || fact.closeReason === "body_stall"
+    || fact.closeReason === "body_overflow") return "incomplete";
+  if (fact.terminalStatus === "completed") return "completed";
+  if (fact.terminalStatus === undefined
+    && (fact.status === 101 || (fact.status >= 200 && fact.status < 400))) return "completed";
+  return "failed";
+}
+
+function recoveryClass(kind: AttemptRecoveryKind): RequestMetricsRecoveryClass {
+  switch (kind) {
+    case "transient-5xx": return "transient";
+    case "connection-reset": return "connection";
+    case "oauth-401":
+    case "key-401": return "credential";
+    case "key-429":
+    case "rate-limit-429":
+    case "anthropic-oauth-429":
+    case "oauth-account-429": return "rate_limit";
+    case "image-413":
+    case "console-go-upload-retry":
+    case "opaque-blob-rejection": return "payload";
+    case "empty-completion": return "empty_completion";
+    case "reasoning-effort-downgrade": return "effort_downgrade";
+    default: return "other";
+  }
+}
+
+function observeHistogram(cell: HistogramCell, bounds: readonly number[], value: number): void {
+  if (!Number.isFinite(value) || value < 0) return;
+  cell.count += 1;
+  cell.sum += value;
+  for (let index = 0; index < bounds.length; index += 1) {
+    if (value <= bounds[index]!) cell.buckets[index]! += 1;
+  }
+  cell.buckets[bounds.length]! += 1;
+}
+
+function sampleLabels(protocol: RequestMetricsProtocol, result?: RequestMetricsResult): string {
+  return result === undefined
+    ? `{protocol="${protocol}"}`
+    : `{protocol="${protocol}",result="${result}"}`;
+}
+
+function appendHistogram(
+  lines: string[],
+  name: string,
+  help: string,
+  values: HistogramCell[][],
+  bounds: readonly number[],
+): void {
+  lines.push(`# HELP ${name} ${help}`, `# TYPE ${name} histogram`);
+  for (const protocol of REQUEST_METRICS_PROTOCOLS) {
+    for (const result of REQUEST_METRICS_RESULTS) {
+      const cell = values[protocolCell(protocol)]![resultCell(result)]!;
+      for (let index = 0; index < bounds.length; index += 1) {
+        lines.push(`${name}_bucket{protocol="${protocol}",result="${result}",le="${bounds[index]}"} ${cell.buckets[index]}`);
+      }
+      lines.push(`${name}_bucket{protocol="${protocol}",result="${result}",le="+Inf"} ${cell.buckets[bounds.length]}`);
+      lines.push(`${name}_sum${sampleLabels(protocol, result)} ${cell.sum}`);
+      lines.push(`${name}_count${sampleLabels(protocol, result)} ${cell.count}`);
+    }
+  }
+}
+
+export function createRequestMetricsOwner(
+  processStartTimeSeconds = Date.now() / 1000,
+): RequestMetricsOwner {
+  let logicalRequests = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RESULTS.length);
+  let physicalSends = Array.from({ length: REQUEST_METRICS_PROTOCOLS.length }, () => 0);
+  let recoveries = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RECOVERY_CLASSES.length);
+  let durations = histograms(REQUEST_DURATION_BUCKETS_SECONDS);
+  let ttft = histograms(REQUEST_TTFT_BUCKETS_SECONDS);
+  let missingTtft = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RESULTS.length);
+
+  return {
+    recordFinalRequest(fact): void {
+      const protocol: RequestMetricsProtocol = fact.protocol ?? "unknown";
+      const result = classifyResult(fact);
+      const protocolIndex = protocolCell(protocol);
+      const resultIndex = resultCell(result);
+      logicalRequests[protocolIndex]![resultIndex]! += 1;
+
+      const attempts = fact.attempts;
+      const sends = attempts === undefined
+        ? (Number.isInteger(fact.spendSends) && fact.spendSends! >= 0 ? fact.spendSends! : 0)
+        : attempts.reduce((total, attempt) => (
+          Number.isInteger(attempt.sendCount) && attempt.sendCount >= 0 ? total + attempt.sendCount : total
+        ), 0);
+      physicalSends[protocolIndex]! += sends;
+
+      for (const attempt of attempts ?? []) {
+        for (const kind of new Set(attempt.recoveryKinds)) {
+          recoveries[protocolIndex]![recoveryCell(recoveryClass(kind))]! += 1;
+        }
+      }
+
+      observeHistogram(durations[protocolIndex]![resultIndex]!, REQUEST_DURATION_BUCKETS_SECONDS, fact.durationMs / 1000);
+      if (typeof fact.firstOutputMs === "number" && Number.isFinite(fact.firstOutputMs) && fact.firstOutputMs >= 0) {
+        observeHistogram(ttft[protocolIndex]![resultIndex]!, REQUEST_TTFT_BUCKETS_SECONDS, fact.firstOutputMs / 1000);
+      } else {
+        missingTtft[protocolIndex]![resultIndex]! += 1;
+      }
+    },
+
+    snapshot(): string {
+      const lines: string[] = [
+        "# HELP opencodex_logical_requests_total Finalized logical requests in this process.",
+        "# TYPE opencodex_logical_requests_total counter",
+      ];
+      for (const protocol of REQUEST_METRICS_PROTOCOLS) {
+        for (const result of REQUEST_METRICS_RESULTS) {
+          lines.push(`opencodex_logical_requests_total${sampleLabels(protocol, result)} ${logicalRequests[protocolCell(protocol)]![resultCell(result)]}`);
+        }
+      }
+      lines.push(
+        "# HELP opencodex_physical_sends_total Upstream sends made by finalized logical requests in this process.",
+        "# TYPE opencodex_physical_sends_total counter",
+      );
+      for (const protocol of REQUEST_METRICS_PROTOCOLS) {
+        lines.push(`opencodex_physical_sends_total${sampleLabels(protocol)} ${physicalSends[protocolCell(protocol)]}`);
+      }
+      lines.push(
+        "# HELP opencodex_recoveries_total Distinct recovery kinds observed per physical attempt in this process.",
+        "# TYPE opencodex_recoveries_total counter",
+      );
+      for (const protocol of REQUEST_METRICS_PROTOCOLS) {
+        for (const recovery of REQUEST_METRICS_RECOVERY_CLASSES) {
+          lines.push(`opencodex_recoveries_total{protocol="${protocol}",recovery="${recovery}"} ${recoveries[protocolCell(protocol)]![recoveryCell(recovery)]}`);
+        }
+      }
+      appendHistogram(lines, "opencodex_request_duration_seconds", "Finalized logical request duration in seconds.", durations, REQUEST_DURATION_BUCKETS_SECONDS);
+      appendHistogram(lines, "opencodex_ttft_seconds", "Observed time to first output in seconds.", ttft, REQUEST_TTFT_BUCKETS_SECONDS);
+      lines.push(
+        "# HELP opencodex_ttft_missing_total Finalized logical requests without an observed time to first output.",
+        "# TYPE opencodex_ttft_missing_total counter",
+      );
+      for (const protocol of REQUEST_METRICS_PROTOCOLS) {
+        for (const result of REQUEST_METRICS_RESULTS) {
+          lines.push(`opencodex_ttft_missing_total${sampleLabels(protocol, result)} ${missingTtft[protocolCell(protocol)]![resultCell(result)]}`);
+        }
+      }
+      lines.push(
+        "# HELP opencodex_metrics_process_start_time_seconds Unix time when this process metrics owner started.",
+        "# TYPE opencodex_metrics_process_start_time_seconds gauge",
+        `opencodex_metrics_process_start_time_seconds ${processStartTimeSeconds}`,
+      );
+      return `${lines.join("\n")}\n`;
+    },
+
+    resetForTests(): void {
+      logicalRequests = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RESULTS.length);
+      physicalSends = Array.from({ length: REQUEST_METRICS_PROTOCOLS.length }, () => 0);
+      recoveries = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RECOVERY_CLASSES.length);
+      durations = histograms(REQUEST_DURATION_BUCKETS_SECONDS);
+      ttft = histograms(REQUEST_TTFT_BUCKETS_SECONDS);
+      missingTtft = matrix(REQUEST_METRICS_PROTOCOLS.length, REQUEST_METRICS_RESULTS.length);
+    },
+  };
+}
diff --git a/src/server/responses-custom-tool-repair.ts b/src/server/responses-custom-tool-repair.ts
index 1cb167b9f4f..3b4130ae7f9 100644
--- a/src/server/responses-custom-tool-repair.ts
+++ b/src/server/responses-custom-tool-repair.ts
@@ -1,6 +1,7 @@
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { mayBecomePatchEnvelope, normalizeApplyPatchDelimiters } from "../responses/apply-patch-envelope";
 import { compileCodeModeHelperInput, resolveCodeModeHelperName } from "../responses/code-mode-helper-compat";
+import { progressiveFreeformInput } from "../responses/progressive-freeform-input";
 import { declaresCodeModeExec } from "../types/tools";
 import {
   customToolItemId,
@@ -15,50 +16,10 @@ import {
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
 
-/** Exact compact prefix used by our upstream rewriter; progressive matching also
- *  tolerates insignificant JSON whitespace via FREEFORM_WRAP_PREFIX_RE. */
-const FREEFORM_WRAP_PREFIX = '{"input":"';
-const FREEFORM_WRAP_PREFIX_RE = /^\s*\{\s*"input"\s*:\s*"/;
-
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
-/**
- * Progressive decode of the freeform `{ "input": "…" }` wrapper.
- * Returns null when the accumulated text does not (yet) match that wrapper so
- * callers suppress deltas and rely on `response.custom_tool_call_input.done`.
- */
-function partialCustomToolInput(argumentsText: string): string | null {
-  const match = FREEFORM_WRAP_PREFIX_RE.exec(argumentsText);
-  if (!match) return null;
-  const body = argumentsText.slice(match[0]!.length);
-  let output = "";
-  for (let index = 0; index < body.length; index++) {
-    const char = body[index];
-    if (char === '"') break;
-    if (char !== "\\") {
-      output += char;
-      continue;
-    }
-    const escaped = body[index + 1];
-    if (escaped === undefined) break;
-    index += 1;
-    if (escaped === "n") output += "\n";
-    else if (escaped === "t") output += "\t";
-    else if (escaped === "r") output += "\r";
-    else if (escaped === "b") output += "\b";
-    else if (escaped === "f") output += "\f";
-    else if (escaped === "u") {
-      const hex = body.slice(index + 1, index + 5);
-      if (hex.length !== 4 || !/^[0-9a-fA-F]{4}$/.test(hex)) break;
-      output += String.fromCharCode(Number.parseInt(hex, 16));
-      index += 4;
-    } else output += escaped;
-  }
-  return output;
-}
-
 function replaceSseEventName(block: string, type: string): string {
   const newline = block.includes("\r\n") ? "\r\n" : "\n";
   const lines = block.split(/\r?\n/);
@@ -332,21 +293,33 @@ export function createRoutedCustomToolRestoreBlockRewrite(
       openCalls.set(upstreamItemId, open);
       // A helper alias will become JavaScript at completion, never raw patch/JSON.
       if (itemNames.get(upstreamItemId)?.aliased) return [];
-      // Still accumulating toward the compact wrapper, or an unrecognized shape:
-      // suppress progressive emission and let the done event carry input.
-      if (FREEFORM_WRAP_PREFIX.startsWith(open.argumentsText)) return [];
-      const fullInput = partialCustomToolInput(open.argumentsText);
+      const itemName = itemNames.get(upstreamItemId);
+      const ownsFreeformGrammar = itemName?.namespace === undefined
+        || itemName?.namespace === "functions";
+      const fullInput = progressiveFreeformInput(
+        open.argumentsText,
+        ownsFreeformGrammar ? itemName?.name ?? "" : "",
+      );
       if (fullInput === null) return [];
-      // Hold a buffer that could still become a complete patch envelope. The done event
-      // recompiles such a body into an apply_patch helper call, so streaming the envelope
-      // bytes first and replacing them at completion is the rewind this path forbids.
-      // Mirrors the same hold in `src/bridge.ts`.
-      if (
-        declaresCodeModeExec(declaredNames)
-        && itemNames.get(upstreamItemId)?.namespace === undefined
-        && itemNames.get(upstreamItemId)?.name === "exec"
-        && mayBecomePatchEnvelope(fullInput)
-      ) return [];
+      // This routed path historically holds every unrecognized JSON object until done.
+      // The shared decoder streams ordinary raw input, so retain the stricter routed rule
+      // when no recognized wrapper transformed the accumulated object.
+      if (fullInput === open.argumentsText && open.argumentsText.trimStart().startsWith("{")) return [];
+      // Hold a buffer that could still become a complete patch envelope, for either of the two
+      // reasons completion rewrites one. Both are the same rewind this path forbids, and both
+      // mirror `src/bridge/sse.ts`.
+      //
+      // `exec`: the done event recompiles such a body into an apply_patch helper call.
+      // `apply_patch`: `normalizeApplyPatchDelimiters` rewrites a decorated
+      // `*** Begin Patch ***` envelope at completion, so the decorated markers would be
+      // published and then replaced by the normalized ones. Before the shared decoder, this
+      // path held every non-canonical shape and so never reached that case; now that ordinary
+      // raw input streams, the second reason has to be stated explicitly.
+      const mayCompile = declaresCodeModeExec(declaredNames)
+        && itemName?.namespace === undefined
+        && itemName?.name === "exec";
+      const mayNormalize = ownsFreeformGrammar && itemName?.name === "apply_patch";
+      if ((mayCompile || mayNormalize) && mayBecomePatchEnvelope(fullInput)) return [];
       if (!fullInput.startsWith(open.emittedInput) || fullInput.length === open.emittedInput.length) return [];
       const inputDelta = fullInput.slice(open.emittedInput.length);
       open.emittedInput = fullInput;
diff --git a/src/server/responses-undeclared-tool-guard.ts b/src/server/responses-undeclared-tool-guard.ts
index 4cefb22784a..7b2a2a22c1c 100644
--- a/src/server/responses-undeclared-tool-guard.ts
+++ b/src/server/responses-undeclared-tool-guard.ts
@@ -1,4 +1,9 @@
-import { collectAmbiguousDottedAliases, dottedAliasIsUnambiguous, wireToolInnerName } from "../responses/tool-name-aliases";
+import {
+  collectAmbiguousDottedAliases,
+  dottedAliasIsUnambiguous,
+  isSchemaValidResponsesToolName,
+  wireToolInnerName,
+} from "../responses/tool-name-aliases";
 import {
   dottedToolName,
   NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES,
@@ -512,6 +517,31 @@ export function normalizeDefaultNamespaceInItem(
         return { value: { ...item, name: bare }, changed: true };
       }
     }
+    // Authorization and emission were reading two different resolvers for the same question.
+    // `undeclaredNameInItem` resolves an emitted name through `normalizeDeclaredToolName`, which
+    // maps a `default.`-prefixed code-mode helper onto the declared `exec` (#4412) as well as a
+    // `default.`-prefixed bare tool (#4176); the rewrite above learned only the second case. So a
+    // routed Muse turn under a code-mode catalog had `default.view_image` ACCEPTED as `exec` and
+    // then relayed under the name the upstream schema rejects. Codex stored
+    // `{"type":"function_call","name":"default.view_image"}`, answered "unsupported call", and
+    // every later replay of that history — a side chat, a compaction — was refused on
+    // `input[N].name` for the lifetime of the conversation (#5095).
+    //
+    // Emit the name the guard authorized rather than a second, weaker opinion about it. The two
+    // must agree: a name good enough to admit is the name the client has to receive.
+    //
+    // Gated on the name actually being unusable, so this branch cannot touch a name the upstream
+    // accepts whatever the resolver would have said about it. The routed-custom-tool and
+    // namespace restores run earlier in the same chain and already rewrite the shapes they own,
+    // which leaves this as the boundary check for the names no restore claimed.
+    if (!isSchemaValidResponsesToolName(name)) {
+      const authorized = normalizeDeclaredToolName(name, declared, declaredBare);
+      if (
+        authorized !== name
+        && declared.has(authorized)
+        && isSchemaValidResponsesToolName(authorized)
+      ) return { value: { ...item, name: authorized }, changed: true };
+    }
   }
   return { value: item, changed: false };
 }
diff --git a/src/server/responses/adapter-continuation.ts b/src/server/responses/adapter-continuation.ts
index 8ead32049ef..858c76f538a 100644
--- a/src/server/responses/adapter-continuation.ts
+++ b/src/server/responses/adapter-continuation.ts
@@ -338,7 +338,7 @@ export function createAdapterContinuations(
           route.provider = rotated;
           invalidateSameTargetRequest();
           transportState.activeAdapter = resolveSelectionAdapter(
-            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
           bindRouteReasoningReplayScope({
@@ -384,7 +384,7 @@ export function createAdapterContinuations(
             invalidateSameTargetRequest();
             logCtx.provider = formatAnthropicProviderForLog("anthropic", admitted.accountId, config);
             transportState.activeAdapter = resolveSelectionAdapter(
-              resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+              resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
               config.cacheRetention,
             );
             sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
@@ -449,7 +449,7 @@ export function createAdapterContinuations(
             if (applied) {
               invalidateSameTargetRequest();
               transportState.activeAdapter = resolveSelectionAdapter(
-                resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+                resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
                 config.cacheRetention,
               );
               bindRouteReasoningReplayScope({
diff --git a/src/server/responses/adapter-dispatch.ts b/src/server/responses/adapter-dispatch.ts
index c9b04bf9b96..6609d5e28e1 100644
--- a/src/server/responses/adapter-dispatch.ts
+++ b/src/server/responses/adapter-dispatch.ts
@@ -246,7 +246,11 @@ export async function prepareAdapterExchange(
     return new Response(JSON.stringify(json), { headers: { "Content-Type": "application/json" } });
   }
   try {
-    initialRequest = await transportState.activeAdapter.buildRequest(parsed, { headers: requestState.selectedForwardHeaders, translatorBudget });
+    initialRequest = await transportState.activeAdapter.buildRequest(parsed, {
+      headers: requestState.selectedForwardHeaders,
+      translatorBudget,
+      abortSignal: upstream.signal,
+    });
     refreshRequestToolAliases(initialRequest);
     recordAdapterReasoning(logCtx, initialRequest);
     recordAdapterTier(logCtx, initialRequest);
@@ -405,6 +409,7 @@ export async function prepareAdapterExchange(
           retryRequest = await transportState.activeAdapter.buildRequest(parsed, {
             headers: requestState.selectedForwardHeaders,
             translatorBudget,
+            abortSignal: upstream.signal,
             ...(transportState.imageTierBias > 0 ? { imageTierBias: transportState.imageTierBias } : {}),
           });
           recordAdapterReasoning(logCtx, retryRequest);
@@ -581,7 +586,7 @@ export async function prepareAdapterExchange(
         route.provider = refreshedProvider;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -614,7 +619,7 @@ export async function prepareAdapterExchange(
         route.provider = rotated;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -714,7 +719,7 @@ export async function prepareAdapterExchange(
         route.provider = rotated;
         invalidateSameTargetRequest();
         transportState.activeAdapter = resolveSelectionAdapter(
-          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+          resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
           config.cacheRetention,
         );
         bindRouteReasoningReplayScope({
@@ -757,7 +762,7 @@ export async function prepareAdapterExchange(
           invalidateSameTargetRequest();
           logCtx.provider = formatAnthropicProviderForLog("anthropic", admitted.accountId, config);
           transportState.activeAdapter = resolveSelectionAdapter(
-            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
@@ -832,7 +837,7 @@ export async function prepareAdapterExchange(
           }
           invalidateSameTargetRequest();
           transportState.activeAdapter = resolveSelectionAdapter(
-            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+            resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
             config.cacheRetention,
           );
           sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, transportState.activeAdapter.name, logCtx.accountLogLabel);
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index ab16ce31b6e..92e394751bc 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -10,6 +10,7 @@ import { parseRequest } from "../../responses/parser";
 import { buildCompactV1Output, COMPACT_PROMPT, decodeCompactionSummary, extractCompactUserMessages } from "../../responses/compaction";
 import { FORWARD_HEADERS, sanitizeReasoningInputContent } from "../../adapters/openai-responses";
 import { expandPreviousResponseInput, previousResponseProviderState, rememberResponseState } from "../../responses/state";
+import { repairLegacyDottedToolCallNames } from "../../responses/legacy-dotted-tool-name-repair";
 import { NoEligiblePolicyCandidateError, routeCompactionModel } from "../../router";
 import { evidenceFromBody } from "../../routing/request-evidence";
 import {
@@ -124,7 +125,12 @@ import { slugsEquivalent } from "../../providers/slug-codec";
 import { decideTier, tierValueAfterDecision } from "../../providers/fastwire";
 import { fastPolicyForModel } from "../../providers/service-tier";
 import { parseFastOnlyRowId } from "../fast-row";
-import { applyOpenAiVirtualModel, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import { captureOpenAiVirtualWirePolicy, resolveOpenAiCompactModel } from "../../providers/openai-virtual-models";
+import {
+  applyCompactionRoutingOverride,
+  compactionRoutingKeepsProviderIdentity,
+  type CompactionRoutingOverride,
+} from "./compaction-routing";
 import { isUsageDebugEnabled } from "../../usage/debug";
 import {
   readJsonRequestBody,
@@ -271,6 +277,7 @@ function compactHandoffRoute(
 }
 
 export interface HandleResponsesCompactOptions {
+  compactionRoutingOverride?: CompactionRoutingOverride | null;
   nativeMainRefreshDependencies?: NativeMainRefreshDependencies;
   /** Release the listener's idle guard only after the complete request body is accepted. */
   onRequestBodyRead?: () => void;
@@ -603,6 +610,9 @@ export async function handleResponsesCompact(
   if (!body || typeof body !== "object" || Array.isArray(body)) {
     return formatErrorResponse(400, "invalid_request_error", "Invalid compaction request body");
   }
+  if (!options.compactionRoutingOverride) {
+    options = { ...options, compactionRoutingOverride: applyCompactionRoutingOverride(body, req.headers, config, { endpoint: "compact" }) };
+  }
   const raw = body as { model?: unknown; input?: unknown };
   if (typeof raw.model !== "string" || raw.model.length === 0) {
     return formatErrorResponse(400, "invalid_request_error", "compaction request requires a model");
@@ -617,11 +627,12 @@ export async function handleResponsesCompact(
   // The client's own selector, kept for the request log: `raw.model` is rewritten to the
   // base id above, and logCtx.requestedModel is assigned from it further down, so without
   // this the log would lose which id the client actually asked for.
-  const compactRequestedModel = compactFastRow ? compactFastRow.baseId + "--fast" : raw.model;
+  const compactRequestedModel = options.compactionRoutingOverride?.sourceModel
+    ?? (compactFastRow ? compactFastRow.baseId + "--fast" : raw.model);
 
   // Recall the last completed client-visible bare model after a combo switch (#3891).
   // Configured selectors take precedence over this implicit session hint.
-  if (typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
+  if (!options.compactionRoutingOverride && typeof compactModel === "string" && !compactModel.includes("/") && !compactFastRow
     && !resolveComboId(config, compactModel)) {
     const recalledComboId = recallComboForLane(config, sessionLaneIdFromRequest(req.headers), compactModel);
     if (recalledComboId) {
@@ -684,6 +695,7 @@ export async function handleResponsesCompact(
   const virtual = resolveOpenAiCompactModel(route.providerName, selectedModelId);
   if (virtual) {
     route.modelId = virtual.wireModelId;
+    captureOpenAiVirtualWirePolicy(route, virtual);
     logCtx.model = virtual.selectedModelId;
     logCtx.resolvedModel = virtual.wireModelId;
   } else {
@@ -747,7 +759,12 @@ export async function handleResponsesCompact(
   // no budget at all, so `handleResponsesInner` minted a fresh four after the native attempt
   // had already spent some of the first one.
   const sendBudget: RequestExecutionBudget = options.sendBudget ?? createRequestExecutionBudget();
-  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo) {
+  // A manual override onto another backend must not mint ciphertext the conversation model cannot replay.
+  const manualOverrideCrossesProvider = options.compactionRoutingOverride
+    ? !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)
+    : false;
+  if (supportsNativeResponsesCompactEndpoint(route.providerName, route.provider) && !accountGatedCompactWireModel && !route.combo
+    && !manualOverrideCrossesProvider) {
     if (req.signal.aborted) {
       return formatErrorResponse(499, "client_cancelled", "Client cancelled compact request");
     }
@@ -845,7 +862,12 @@ export async function handleResponsesCompact(
     // The regular /v1/responses path applies sanitizeReasoningInputContent via the adapter's
     // buildRequest, but the compact endpoint forwards directly. Apply the same sanitizer here
     // so routed-model reasoning items (reasoning_text content) don't 400 the ChatGPT backend.
-    const compactBody = sanitizeReasoningInputContent(compactBodyRaw) as typeof compactBodyRaw;
+    // #5095: the compact endpoint forwards `raw` directly, so it needs the same legacy dotted
+    // call-name repair the adapter applies. A damaged item here refuses the compaction itself,
+    // which is the request a long task depends on to keep going.
+    const compactBody = repairLegacyDottedToolCallNames(
+      sanitizeReasoningInputContent(compactBodyRaw),
+    ) as typeof compactBodyRaw;
     {
       const binding = conversationStateBindingFromAuth(authCtx, codexPoolAffinityKey(req.headers));
       if (binding) {
@@ -1303,9 +1325,9 @@ export async function handleResponsesCompact(
     // synthetic buffer errors are not upstream bodies and stay uninspected.
     if (buffered.ok) {
       inspectResponseLogJson(logCtx, await buffered.clone().text());
-      forgetCompactHandoffRoute(req, admission);
+      if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
@@ -1368,7 +1390,7 @@ export async function handleResponsesCompact(
   // The routed compaction turn is a handoff inside the same logical request, so it draws the
   // REMAINDER. Minting here is what let a native attempt spend three sends and the routed
   // fallback spend four more.
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, ...(admission ? { admission } : {}) });
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease, sendBudget, compactionRoutingOverride: options.compactionRoutingOverride, ...(admission ? { admission } : {}) });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   if (response.headers.get("content-type")?.includes("text/event-stream")) {
@@ -1438,7 +1460,7 @@ export async function handleResponsesCompact(
     const result = new Response(JSON.stringify({ output: compactionItems }), {
       headers: { "Content-Type": "application/json" },
     });
-    rememberCompactHandoffRoute(req, admission, raw.model);
+    if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
     return result;
   }
   const encrypted = compactionItems[0]!.encrypted_content;
@@ -1449,6 +1471,6 @@ export async function handleResponsesCompact(
   }
   const summary = decoded;
   const output = buildCompactV1Output(extractCompactUserMessages(inputItems), summary);
-  rememberCompactHandoffRoute(req, admission, raw.model);
+  if (!options.compactionRoutingOverride) rememberCompactHandoffRoute(req, admission, raw.model);
   return new Response(JSON.stringify({ output }), { headers: { "Content-Type": "application/json" } });
 }
diff --git a/src/server/responses/compaction-routing.ts b/src/server/responses/compaction-routing.ts
new file mode 100644
index 00000000000..a7d50962db5
--- /dev/null
+++ b/src/server/responses/compaction-routing.ts
@@ -0,0 +1,111 @@
+import type { OcxConfig } from "../../types";
+import { isDeclaredReasoningEffort } from "../../reasoning-effort";
+import { COMPACTION_TRIGGERS } from "../../config/schema/compaction-triggers";
+import { routeConcreteModel, type RouteResult } from "../../router";
+import { resolveComboId } from "../../combos/identifiers";
+import { recallComboForLane } from "./combo-session-recall";
+import { sessionLaneIdFromRequest } from "../request-log-conversation";
+
+/** `sourceModel` is the conversation's own selector before the rewrite. */
+export interface CompactionRoutingOverride {
+  sourceModel: string;
+  /** Combo the lane remembers for a bare `sourceModel` (#3891); the conversation resumes there, not on the bare route. */
+  sourceCombo?: string;
+  /** Combo the configured override resolves to; its children route concretely but stay portable. */
+  targetCombo?: string;
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+/**
+ * Triggers this override covers. Absent means manual only, which is the narrowest
+ * reading of the setting and leaves automatic compaction exactly as it routes today.
+ * A hand-edited value the schema would have rejected disables the override rather
+ * than widening it, so a malformed edit can never route more than it names.
+ */
+function configuredTriggers(value: unknown): readonly string[] | null {
+  if (value === undefined) return ["manual"];
+  if (!Array.isArray(value) || value.length === 0) return null;
+  if (!value.every(entry => typeof entry === "string" && (COMPACTION_TRIGGERS as readonly string[]).includes(entry))) return null;
+  if (new Set(value).size !== value.length) return null;
+  return value as readonly string[];
+}
+
+export interface CompactionRoutingOverrideOptions {
+  /** `responses` requires a `compaction_trigger` input item; the native compact endpoint carries none. */
+  endpoint?: "responses" | "compact";
+  transport?: "websocket";
+}
+
+export function applyCompactionRoutingOverride(
+  body: unknown,
+  headers: Headers,
+  config: OcxConfig,
+  options: CompactionRoutingOverrideOptions = {},
+): CompactionRoutingOverride | null {
+  const override = config.compactionRouting;
+  const raw = record(body);
+  if (!raw || typeof raw.model !== "string" || !raw.model.trim()
+    || typeof override?.model !== "string" || !override.model.trim()) return null;
+  if (override.reasoningEffort !== undefined
+    && (typeof override.reasoningEffort !== "string" || !isDeclaredReasoningEffort(override.reasoningEffort))) return null;
+  const triggers = configuredTriggers(override.triggers);
+  if (!triggers) return null;
+  if (options.endpoint !== "compact"
+    && !(Array.isArray(raw.input) && raw.input.some(item => record(item)?.type === "compaction_trigger"))) return null;
+
+  const metadata: unknown[] = [];
+  const header = headers.get("x-codex-turn-metadata");
+  if (options.transport !== "websocket" && header !== null) metadata.push(header);
+  const client = record(raw.client_metadata);
+  if (client && Object.hasOwn(client, "x-codex-turn-metadata")) metadata.push(client["x-codex-turn-metadata"]);
+  if (metadata.length === 0) return null;
+  let trigger: string | undefined;
+  for (const value of metadata) {
+    if (typeof value !== "string") return null;
+    try {
+      const parsed = record(JSON.parse(value));
+      if (parsed?.request_kind !== "compaction") return null;
+      const carried = record(parsed.compaction)?.trigger;
+      if (typeof carried !== "string" || !triggers.includes(carried)) return null;
+      // Copies that name different triggers are not agreement, and picking either one would
+      // let a caller widen an override by disagreeing with itself.
+      if (trigger !== undefined && trigger !== carried) return null;
+      trigger = carried;
+    } catch {
+      return null;
+    }
+  }
+  if (trigger === undefined) return null;
+
+  const sourceModel = raw.model;
+  const sourceCombo = recallComboForLane(config, sessionLaneIdFromRequest(headers), sourceModel);
+  const targetCombo = resolveComboId(config, override.model.trim()) ?? undefined;
+  raw.model = override.model.trim();
+  if (override.reasoningEffort !== undefined) {
+    raw.reasoning = { ...record(raw.reasoning), effort: override.reasoningEffort };
+  }
+  return { sourceModel, ...(sourceCombo ? { sourceCombo } : {}), ...(targetCombo ? { targetCombo } : {}) };
+}
+
+/** Same provider identity keeps caller auth and may use native compact; its ciphertext replays only there. */
+export function compactionRoutingKeepsProviderIdentity(
+  config: OcxConfig,
+  override: CompactionRoutingOverride,
+  route: RouteResult,
+): boolean {
+  if (route.combo || override.sourceCombo || override.targetCombo || resolveComboId(config, override.sourceModel)) return false;
+  let source: RouteResult;
+  try {
+    source = routeConcreteModel(config, override.sourceModel);
+  } catch {
+    return false;
+  }
+  return source.providerName === route.providerName
+    && source.codexAccountMode === route.codexAccountMode
+    && source.codexAccountNamespace === route.codexAccountNamespace;
+}
diff --git a/src/server/responses/core-codex-account.ts b/src/server/responses/core-codex-account.ts
index c201e7acf36..99796846d8f 100644
--- a/src/server/responses/core-codex-account.ts
+++ b/src/server/responses/core-codex-account.ts
@@ -328,7 +328,8 @@ export interface CodexPoolAccountRetryArgs {
   /** Sanitized caller input, before any selected Pool credential was materialized. */
   callerAuthHeaders: Headers;
   config: OcxConfig;
-  route: { providerName: string; modelId: string; provider: OcxProviderConfig };
+  /** Actual routed result narrowed to the fields this retry consumes. */
+  route: Pick<RouteResult, "providerName" | "modelId" | "provider" | "staticPolicy">;
   parsed: OcxParsedRequest;
   logCtx: RequestLogContext;
   options: {
@@ -681,7 +682,7 @@ export async function retryCodexPoolOnAlternateAccount(
     "pool",
   );
   const retryAdapter = resolveAdapter(
-    resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire),
+    resolveWireProtocolOverride(route.providerName, route.modelId, retryProvider, inboundWire, route.staticPolicy),
     config.cacheRetention,
     route.providerName,
   );
@@ -841,7 +842,11 @@ export async function retryCodexPoolOnAlternateAccount(
         parsed.modelId,
       );
       if (retryModelDenial !== undefined) {
-        recordCodexModelDenialEvidence(retryAuthCtx.accountId, retryModelDenial);
+        recordCodexModelDenialEvidence(
+          retryAuthCtx.accountId,
+          retryModelDenial,
+          retryAuthCtx.kind === "pool" ? retryAuthCtx.generation : undefined,
+        );
       }
       if (!retrySameConfirmedAccount || retrySendCount >= maxRetrySends) break;
       // Caller-owned main is an alternate-account replay and can never enter the bounded
diff --git a/src/server/responses/core-combo.ts b/src/server/responses/core-combo.ts
index 8cb50db8210..7b92529e710 100644
--- a/src/server/responses/core-combo.ts
+++ b/src/server/responses/core-combo.ts
@@ -29,7 +29,6 @@ import {
 import { formatErrorResponse } from "../../bridge";
 import {
   expandPreviousResponseInput,
-  previousResponseScopeMismatch,
   previousResponseReplayFailure,
   previousResponseProviderState,
 } from "../../responses/state";
@@ -201,11 +200,12 @@ export async function executeComboResponses(
   // imageInput is disabled (and so targets see the full replayed input).
   const inboundClientThreadId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
   const body = expandPreviousResponseInput(rawBody, inboundClientThreadId);
-  const scopeMismatch = previousResponseScopeMismatch(body);
-  if (scopeMismatch) {
-    console.warn("[opencodex] dropped a previous_response_id with a mismatched client task scope; continuing fresh");
+  const replayFailure = previousResponseReplayFailure(body);
+  if (replayFailure?.reason === "scope_mismatch") {
+    console.warn("[opencodex] refusing continuation because the client task scope does not match replay state");
   }
-  if (previousResponseReplayFailure(body)) {
+  // Local replay failures require full client replay.
+  if (replayFailure) {
     return formatErrorResponse(
       400,
       "previous_response_not_found",
@@ -235,7 +235,7 @@ export async function executeComboResponses(
     sourceBody: body,
     previousResponseInputExpanded: body !== rawBody
       && typeof (body as { previous_response_id?: unknown }).previous_response_id === "string",
-    providerContinuation: !scopeMismatch && body !== rawBody && requestedPreviousId
+    providerContinuation: body !== rawBody && requestedPreviousId
       ? previousResponseProviderState(requestedPreviousId)
       : undefined,
     recoveredPlaintext: false,
@@ -521,7 +521,7 @@ export async function executeComboResponses(
         // The live config can change while the child is streaming. Never retain credentials.
         const currentCombo = getCombo(config, comboId);
         const provider = config.providers[completedTarget.provider];
-        if (Object.hasOwn(config.providers, completedTarget.provider)
+        if (!options.compactionRoutingOverride && Object.hasOwn(config.providers, completedTarget.provider)
           && provider && provider.disabled !== true
           && currentCombo?.targets.some(target => targetKey(target) === targetKey(completedTarget))) {
           rememberComboForLane(sessionLaneIdFromRequest(req.headers), comboId, completedTarget, model, writerGeneration);
diff --git a/src/server/responses/core-normalize.ts b/src/server/responses/core-normalize.ts
index 40a3949dac2..7da5e9d4028 100644
--- a/src/server/responses/core-normalize.ts
+++ b/src/server/responses/core-normalize.ts
@@ -13,7 +13,6 @@ import { MAIN_CODEX_ACCOUNT_ID } from "../../codex/main-account";
 import type { RequestLogContext } from "../request-log";
 import type { HandleResponsesOptions } from "./core-options";
 import { prepareEffortNormalization } from "../effort-policy";
-import { providerModelResponsesUpstreamStreaming } from "../../providers/registry";
 import { resolveOpenCodeGoTransport } from "../../providers/opencode-go-transport";
 import { getOrAllocateRequestSessionLane } from "../request-log-conversation";
 import { shouldPreparePlaintextV2AgentMessages } from "../../responses/plaintext-v2-agent-messages";
@@ -80,6 +79,7 @@ export function canPassThroughEncryptedV2AgentTask(
     route.modelId,
     provider,
     inboundWire,
+    route.staticPolicy,
   ).adapter === "openai-responses";
 }
 
@@ -126,6 +126,8 @@ export async function applyFinalRouteRequestNormalization(args: {
   const responseModelId = parsed.modelId;
   const preserveAnthropicResponseModel = route.providerName === "anthropic"
     || route.provider.adapter === "anthropic";
+  const finalSelectedModelId = route.modelId;
+  const virtualModel = applyOpenAiVirtualModel(parsed, route, logCtx, inboundWire);
 
   // Apply the routed model id upstream: routing may strip a "<provider>/" namespace.
   if (route.modelId !== parsed.modelId) {
@@ -136,11 +138,7 @@ export async function applyFinalRouteRequestNormalization(args: {
   }
   // Transport-neutral reliability policy (#875): applies to any Responses
   // upstream whose final adapter is openai-responses, not only WS turns.
-  const responsesUpstreamStreaming = providerModelResponsesUpstreamStreaming(
-    route.providerName,
-    route.provider,
-    route.modelId,
-  );
+  const responsesUpstreamStreaming = route.staticPolicy.model.responsesUpstreamStreaming;
 
   // Preserve the routed destination for Go recognition, then settle the wire before
   // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
@@ -150,6 +148,7 @@ export async function applyFinalRouteRequestNormalization(args: {
     route.modelId,
     routedProvider,
     inboundWire,
+    route.staticPolicy,
   );
   route.provider = resolveOpenCodeGoTransport(wireProvider,
     args.claudeGoAffinity ? args.claudeGoAffinity.sessionLane : getOrAllocateRequestSessionLane(req),
@@ -168,7 +167,7 @@ export async function applyFinalRouteRequestNormalization(args: {
       || (!summary && route.provider.showThinkingSummary !== true);
   }
   if (preserveAnthropicResponseModel) parsed._responseModelId = responseModelId;
-  logCtx.model = route.modelId;
+  logCtx.model = virtualModel?.selectedModelId ?? route.modelId;
   logCtx.provider = route.providerName;
   logCtx.providerAdapter = route.provider.adapter;
   logCtx.routeDecision = route.routeDecision;
@@ -194,11 +193,6 @@ export async function applyFinalRouteRequestNormalization(args: {
     (parsed._rawBody as Record<string, unknown>).store = false;
   }
 
-  // Final selected model before virtual wire-model rewriting (Pro aliases).
-  const finalSelectedModelId = route.modelId;
-
-  // Virtual model rewriting: Pro aliases → base model + reasoning.mode="pro".
-  applyOpenAiVirtualModel(parsed, route, logCtx);
   if (parsed._responseModelId !== undefined && parsed._responseModelId !== parsed.modelId) {
     logCtx.resolvedModel = route.modelId;
     logCtx.preserveResolvedModelFromRoute = true;
diff --git a/src/server/responses/core-opaque-recovery.ts b/src/server/responses/core-opaque-recovery.ts
index bc7bbe40a18..03df9766863 100644
--- a/src/server/responses/core-opaque-recovery.ts
+++ b/src/server/responses/core-opaque-recovery.ts
@@ -88,6 +88,7 @@ export function isEncryptedFunctionOutputRejection(bodyText: string): boolean {
   try {
     const payload = JSON.parse(bodyText) as unknown;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+    if (upstreamErrorMessageFromPayload(payload) === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
     const record = payload as { detail?: unknown; message?: unknown; error?: unknown };
     if (record.detail === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
     if (record.message === ENCRYPTED_FUNCTION_OUTPUT_REJECTION) return true;
diff --git a/src/server/responses/core-options.ts b/src/server/responses/core-options.ts
index 4c790fd4984..5334cf4e02d 100644
--- a/src/server/responses/core-options.ts
+++ b/src/server/responses/core-options.ts
@@ -11,6 +11,7 @@ import type { NativeMainRefreshDependencies } from "../../codex/main-account";
 import type { InboundWire } from "../../providers/registry";
 import type { ExplicitOpenAiCallerAuth } from "../../providers/openai-sidecar";
 import type { CallerDirectAuth } from "../../providers/caller-authorization";
+import type { CompactionRoutingOverride } from "./compaction-routing";
 import type { TranslatorBudget } from "../../lib/translator-budget";
 import type { TransientSendBudget } from "../../lib/upstream-retry";
 import type { RequestLogContext } from "../request-log";
@@ -51,6 +52,8 @@ export interface HandleResponsesOptions {
   admission?: DataPlaneAdmission;
   /** Called at most once after the complete client body is read and accepted for dispatch. */
   onRequestBodyRead?: () => void;
+  /** Internal handoff for retry wrappers that must reuse the already-accounted request body. */
+  onRequestBodyParsed?: (body: unknown) => void;
   forceEmptyResponseId?: boolean;
   /** Internal, connection-owned control channel; never reconstructed from headers. */
   nativeControl?: NativeResponseControl;
@@ -105,6 +108,7 @@ export interface HandleResponsesOptions {
   callerDirectAuth?: CallerDirectAuth | null;
   /** Internal recursion guard; callers outside this module must not set it. */
   comboAttempt?: boolean;
+  compactionRoutingOverride?: CompactionRoutingOverride | null;
   /** Internal combo handoff for one parent-validated continuation snapshot. */
   comboReplaySnapshot?: {
     sourceBody: unknown;
diff --git a/src/server/responses/encrypted-payload.ts b/src/server/responses/encrypted-payload.ts
index 0e9efddf999..9835e851cca 100644
--- a/src/server/responses/encrypted-payload.ts
+++ b/src/server/responses/encrypted-payload.ts
@@ -98,6 +98,19 @@ import type { EffectiveSubagentRoster, SpawnAgentSurface } from "../../codex/cat
 
 
 export function looksLikeBackendCiphertext(payload: string): boolean {
+  // Unknown replay history has no authenticity proof. Require the key-independent Fernet wire
+  // structure instead of granting ciphertext authority to any long base64-like model output.
+  // Proven backend bytes still remain opaque and byte-identical; malformed/plaintext slots are
+  // lowered by the compatibility path below rather than poisoning every later native replay.
+  return isStructurallyValidFernetToken(payload);
+}
+
+/**
+ * Pre-route compatibility keeps an encoded-looking unknown slot opaque until the destination is
+ * known. A routed destination strips that slot instead of exposing possible truncated ciphertext;
+ * the canonical backend later applies the stricter structural classifier.
+ */
+function looksLikeUnknownOpaqueSlot(payload: string): boolean {
   return payload.length >= 64 && /^[A-Za-z0-9+/=_-]+$/.test(payload);
 }
 
@@ -480,7 +493,10 @@ function contentWithoutCiphertext(content: unknown[]): unknown[] {
 
 
 
-export function sanitizeEncryptedContentInPlace(input: unknown): number {
+export function sanitizeEncryptedContentInPlace(
+  input: unknown,
+  options: { preserveUnknownOpaqueSlots?: boolean } = {},
+): number {
   if (!Array.isArray(input)) return 0;
   let rewritten = 0;
   const protectedFragments = new WeakSet<object>();
@@ -512,7 +528,9 @@ export function sanitizeEncryptedContentInPlace(input: unknown): number {
         && typeof (child as { encrypted_content?: unknown }).encrypted_content === "string"
       ) {
         const payload = (child as { encrypted_content: string }).encrypted_content;
-        if (!protectedFragments.has(child) && !looksLikeBackendCiphertext(payload)) {
+        const preserveUnknown = options.preserveUnknownOpaqueSlots === true
+          && looksLikeUnknownOpaqueSlot(payload);
+        if (!protectedFragments.has(child) && !looksLikeBackendCiphertext(payload) && !preserveUnknown) {
           const parts = encryptedSlotParts(payload);
           frame.node.splice(frame.index, 1, ...parts);
           rewritten += 1;
diff --git a/src/server/responses/passthrough-delivery.ts b/src/server/responses/passthrough-delivery.ts
index a6252733565..f6cd0009987 100644
--- a/src/server/responses/passthrough-delivery.ts
+++ b/src/server/responses/passthrough-delivery.ts
@@ -35,10 +35,6 @@ import { consumeComboFailure } from "./core-combo-failure";
 import { readDisplaySafeErrorText } from "./core-errors";
 import { streamingContextOverflowResponse, jsonContextOverflowResponse } from "./context-overflow";
 import { formatPassthroughUpstreamError } from "./passthrough-error";
-import {
-  providerModelResponsesTerminalRepair,
-  providerModelResponsesUpstreamStreaming,
-} from "../../providers/registry";
 import {
   resolvePassthroughWebSearchBridgeAuth,
   planPassthroughWebSearchBridge,
@@ -83,7 +79,10 @@ import {
 import { createRoutedCustomToolRestoreBlockRewrite } from "../responses-custom-tool-repair";
 import { createRoutedToolSearchRestoreBlockRewrite } from "../responses-tool-search-repair";
 import { createGithubCopilotResponsesBlockRewrite } from "../github-copilot-responses-repair";
-import { createGrokResponsesControlFrameBlockRewrite } from "../grok-responses-control-frame";
+import {
+  createGrokResponsesControlFrameBlockRewrite,
+  createGrokResponsesTimestampBlockRewrite,
+} from "../grok-responses-control-frame";
 import { createGrokResponsesSparseTerminalBlockRewrite } from "../grok-responses-snapshot-repair";
 import {
   createPlaintextV2AgentMessageCallRestoreRewrite,
@@ -99,6 +98,24 @@ import {
   normalizeDefaultNamespaceInJson,
 } from "../responses-undeclared-tool-guard";
 import { isWin32EagerRewrite, selectEagerPath } from "../../lib/bun-stream-caps";
+
+/**
+ * Platform override for the two relay-path policy calls below. Tests only.
+ *
+ * The eager relay is reachable only on win32 and darwin, so a Linux shard cannot exercise it
+ * without claiming to be one of them. Overwriting `process.platform` globally does that, and a
+ * great deal more: every filesystem, ACL and state-directory decision in the process follows it,
+ * and the spend-ledger owner lowercases its home on win32, which on a case-sensitive filesystem
+ * names a DIFFERENT directory. A row that did that stopped being able to reserve its send and
+ * delivered no terminal at all, reporting as a relay defect. This narrows the claim to the two
+ * calls that actually choose the relay path.
+ */
+let relayPlatformForTests: NodeJS.Platform | undefined;
+
+/** Internal test contract, not operator configuration: no config key reaches this. */
+export function setRelayPlatformForTests(platform: NodeJS.Platform | undefined): void {
+  relayPlatformForTests = platform;
+}
 import { linkAbortSignal, UPSTREAM_JSON_BODY_READ_OPTIONS } from "./core-lifetime";
 import { registerTurn, unregisterTurn, trackStreamLifetime } from "../lifecycle";
 import { relaySseEagerBounded } from "../relay-eager";
@@ -340,11 +357,7 @@ export async function deliverPassthroughResponse(
       // before relay starts. Waiting for SSE completion would retain request state across the whole
       // stream; a later body failure does not undo that this destination accepted and served the turn.
       commitReasoningReplayServingRoute(nativeExchange.request.headers);
-      const terminalRepairPolicy = providerModelResponsesTerminalRepair(
-        route.providerName,
-        route.provider,
-        route.modelId,
-      );
+      const terminalRepairPolicy = route.staticPolicy.model.responsesTerminalRepair;
       // #3761: opt-in hosted-web-search bridge. Codex always declares the hosted web_search tool,
       // and this branch relays that declaration on the assumption the destination executes it.
       // A KEY-auth gateway that does not (Ollama Cloud GLM) answers with a function_call named
@@ -498,6 +511,9 @@ export async function deliverPassthroughResponse(
         grokClientCompatibilityEnabled
           ? createGrokResponsesControlFrameBlockRewrite()
           : undefined,
+        grokClientCompatibilityEnabled
+          ? createGrokResponsesTimestampBlockRewrite()
+          : undefined,
         grokClientCompatibilityEnabled
           ? createGrokResponsesSparseTerminalBlockRewrite(translatorBudget)
           : undefined,
@@ -529,12 +545,13 @@ export async function deliverPassthroughResponse(
         ? composeSseBlockRewrites(...blockRewrites)
         : undefined;
       const needsClientRewrite = clientBlockRewrite !== undefined;
+      const relayPlatform = relayPlatformForTests ?? process.platform;
       // #864: win32 rewrite traffic must never enter the tee()+JS-pull chain
       // (Bun#32111 JS-sink segfault — text frames pass, the terminal block is
       // lost). The eager single reader applies the same rewrites inline.
-      const win32EagerRewrite = isWin32EagerRewrite(process.platform, needsClientRewrite);
+      const win32EagerRewrite = isWin32EagerRewrite(relayPlatform, needsClientRewrite);
       const eagerPath = selectEagerPath(
-        process.platform,
+        relayPlatform,
         needsClientRewrite,
         config.streamMode ?? "auto",
       );
@@ -805,7 +822,7 @@ export async function deliverPassthroughResponse(
       // stream that never closes. Non-streaming clients keep the plain JSON.
       if (clientRequestedStream === true
         && options.inboundTransport !== "websocket"
-        && providerModelResponsesUpstreamStreaming(route.providerName, route.provider, route.modelId) === false
+        && route.staticPolicy.model.responsesUpstreamStreaming === false
         && route.provider.adapter === "openai-responses") {
         let completed: Record<string, unknown> | undefined;
         try {
@@ -852,7 +869,7 @@ export async function deliverPassthroughResponse(
       // WS turns reframe this JSON into events in the bridge, which is the
       // other relay-free path — normalize ids so both bounded-JSON paths agree.
       const outboundJson = options.inboundTransport === "websocket"
-        && providerModelResponsesUpstreamStreaming(route.providerName, route.provider, route.modelId) === false
+        && route.staticPolicy.model.responsesUpstreamStreaming === false
         && hasResponsesItemIdRepair(route.provider.responsesItemIdRepair)
         ? (() => {
           try {
diff --git a/src/server/responses/passthrough-dispatch.ts b/src/server/responses/passthrough-dispatch.ts
index ed8288a9140..6676bbd1d40 100644
--- a/src/server/responses/passthrough-dispatch.ts
+++ b/src/server/responses/passthrough-dispatch.ts
@@ -121,6 +121,7 @@ import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
 import {
+  isOpenCodeGoDestination,
   rateLimitRetryPolicyFor,
   rateLimitRetryDelayMs,
   transientRetryPolicyFor,
@@ -142,6 +143,7 @@ import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
+  isEncryptedFunctionOutputRejection,
   outboundResponsesBodyCarriesEncryptedFunctionOutput,
   resetStreamedOpaqueBlobLogContext,
   consoleGoUploadRejectionBody,
@@ -841,7 +843,15 @@ export async function preparePassthroughExchange(
             // retry wrapper replaces — proves the host was reached (#914 review).
             .then(adoptObservedResponse);
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(request.url), attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends },
+        { abortSignal: upstream.signal, label: safeHostLabel(request.url),
+          attempts: remainingTransientSendBudget(transientSendAttempts()), onSendsConsumed: noteTransientSends,
+          // The OpenCode Go destination stalls-then-drops inference sends (ambiguous
+          // pre-header resets surfacing as refused 429s); its subscription traffic is
+          // inference-only, so a bounded reset replay here absorbs the blip instead of
+          // failing the turn. Recovery legs keep the fail-closed refusal; only this
+          // initial send is replay-eligible. Attempts stay budget-bounded via attempts.
+          replaySafe: isOpenCodeGoDestination(route.provider),
+        },
       );
     } catch (err) {
       return transportFailureResponse(err);
@@ -863,7 +873,7 @@ export async function preparePassthroughExchange(
       recovery: AttemptRecoveryKind,
     ): Promise<Response | { failed: Response }> => {
       const retryAdapter = resolveSelectionAdapter(
-        resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+        resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
         config.cacheRetention,
       );
       if (!("passthrough" in retryAdapter) || !retryAdapter.passthrough) {
@@ -989,7 +999,7 @@ export async function preparePassthroughExchange(
       route.provider = replay.provider;
       requestState.selectedForwardHeaders = withClaudeNativeSession(replay.headers, replay.provider, options.claudeNativeSessionId);
       const replayAdapter = resolveSelectionAdapter(
-        resolveWireProtocolOverride(route.providerName, route.modelId, replay.provider, inboundWire),
+        resolveWireProtocolOverride(route.providerName, route.modelId, replay.provider, inboundWire, route.staticPolicy),
         config.cacheRetention,
       );
       if (!("passthrough" in replayAdapter) || !replayAdapter.passthrough) {
@@ -1110,7 +1120,7 @@ export async function preparePassthroughExchange(
       );
       route.provider = refreshedProvider;
       const refreshedAdapter = resolveSelectionAdapter(
-        resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire),
+        resolveWireProtocolOverride(route.providerName, route.modelId, refreshedProvider, inboundWire, route.staticPolicy),
         config.cacheRetention,
       );
       if (!("passthrough" in refreshedAdapter) || !refreshedAdapter.passthrough) {
@@ -1340,8 +1350,16 @@ export async function preparePassthroughExchange(
       // refusal: whatever the entitlement was when upstream declined, it is not that now. Both
       // ids are cleared because the wire model can differ from the routed one.
       if (upstreamResponse.ok) {
-        clearCodexModelDenialEvidence(admissionState.authCtx.accountId, route.modelId);
-        clearCodexModelDenialEvidence(admissionState.authCtx.accountId, parsed.modelId);
+        clearCodexModelDenialEvidence(
+          admissionState.authCtx.accountId,
+          route.modelId,
+          admissionState.authCtx.kind === "pool" ? admissionState.authCtx.generation : undefined,
+        );
+        clearCodexModelDenialEvidence(
+          admissionState.authCtx.accountId,
+          parsed.modelId,
+          admissionState.authCtx.kind === "pool" ? admissionState.authCtx.generation : undefined,
+        );
       }
       const model400Denial = await codexPoolAccountModel400Denial(
         upstreamResponse,
@@ -1354,7 +1372,11 @@ export async function preparePassthroughExchange(
         // answer about this model, and the roster cache that selection otherwise reads expires
         // five minutes after a catalog sync fills it -- so without remembering this, the next
         // request selects the same account on quota alone and takes the same 400 (#4906).
-        recordCodexModelDenialEvidence(admissionState.authCtx.accountId, model400Denial);
+        recordCodexModelDenialEvidence(
+          admissionState.authCtx.accountId,
+          model400Denial,
+          admissionState.authCtx.kind === "pool" ? admissionState.authCtx.generation : undefined,
+        );
         poolRetryOutcome = 400;
       } else if (!admissionState.authCtx.fixedAccount && await shouldRetryCodexPoolAccountQuota(
         upstreamResponse,
@@ -1453,8 +1475,13 @@ export async function preparePassthroughExchange(
         payload => {
           if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
           const type = (payload as { type?: unknown }).type;
-          return (type === "error" || type === "response.failed" || type === "response.incomplete")
-            && upstreamErrorMessageFromPayload(payload) === ENCRYPTED_FUNCTION_OUTPUT_REJECTION;
+          const decryptRejection = (type === "error" || type === "response.failed" || type === "response.incomplete")
+            && isEncryptedFunctionOutputRejection(JSON.stringify(payload));
+          // `detail` is a real WebSocket error shape but the generic preflight failure projector
+          // intentionally understands only Responses error/message fields. Preserve only this
+          // exact identity so the projected 502 can enter the existing single-shot recovery.
+          if (decryptRejection) preflightLog.upstreamError = ENCRYPTED_FUNCTION_OUTPUT_REJECTION;
+          return decryptRejection;
         }, {
           allowMissingContentType: !recoveryContentType && parsed.stream,
           replayReadErrors: true,
diff --git a/src/server/responses/policy-fallback.ts b/src/server/responses/policy-fallback.ts
index e3b061ed28d..0f910254d1a 100644
--- a/src/server/responses/policy-fallback.ts
+++ b/src/server/responses/policy-fallback.ts
@@ -1,6 +1,5 @@
 import { comboFailureDecision } from "../../combos/failover";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
-import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "../request-decompress";
 import { finishRequestAttempt, type RequestLogContext } from "../request-log";
 import { linkRequestSessionLane } from "../request-log-conversation";
 import type { OcxConfig } from "../../types";
@@ -129,6 +128,7 @@ export async function handleResponsesWithPolicyFallback(
   const runCore = deps.runCore ?? handleResponsesCore;
   let requestBodyReadNotified = false;
   let storedPool401ReplayDispatched = false;
+  let rawBody: Record<string, unknown> | null = null;
   const coreOptions: CoreOptions = {
     ...options,
     openAiSidecarAuth: options.openAiSidecarAuth === undefined
@@ -144,23 +144,15 @@ export async function handleResponsesWithPolicyFallback(
         options.onRequestBodyRead?.();
       },
     } : {}),
+    onRequestBodyParsed: body => {
+      options.onRequestBodyParsed?.(body);
+      if (body && typeof body === "object" && !Array.isArray(body)) rawBody = body as Record<string, unknown>;
+    },
     onStoredPool401ReplayDispatched: () => {
       storedPool401ReplayDispatched = true;
       options.onStoredPool401ReplayDispatched?.();
     },
   };
-  let rawBody: Record<string, unknown> | null = null;
-  try {
-    const parsed = await readJsonRequestBody(
-      req.clone(),
-      undefined,
-      resolveInboundBodyLimitBytes(config.maxInboundBodyBytes),
-    );
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) rawBody = parsed as Record<string, unknown>;
-  } catch {
-    // Core owns the client-facing parse/decompression error.
-  }
-
   let response: Response;
   try {
     response = await runCore(req, config, logCtx, coreOptions);
diff --git a/src/server/responses/request-prepare.ts b/src/server/responses/request-prepare.ts
index 08f001ac078..4d94d6a71ad 100644
--- a/src/server/responses/request-prepare.ts
+++ b/src/server/responses/request-prepare.ts
@@ -41,7 +41,6 @@ import {
 import {
   copyPreviousResponseReplayProvenance,
   expandPreviousResponseInput,
-  previousResponseScopeMismatch,
   previousResponseReplayFailure,
   markBodyNonPersistable,
   previousResponseProviderState,
@@ -56,6 +55,7 @@ import { bindTurnTerminationScope, rememberDeliveredFinalAnswer } from "../../re
 import { requestLogSpeedLabel, readConfiguredCodexServiceTier } from "../request-log";
 import type { RouteResult } from "../../router";
 import {
+  captureRouteStaticPolicy,
   routeConcreteModel,
   routeCompactionModel,
   routeModel,
@@ -119,6 +119,7 @@ import {
   codexLogAccountId,
 } from "./core-codex-account";
 import { acquireUpstreamHostAdmission } from "../../codex/upstream-host-health";
+import { applyCompactionRoutingOverride, compactionRoutingKeepsProviderIdentity } from "./compaction-routing";
 import { codexAuthContextLogLabel } from "../../codex/account-label";
 import {
   conversationStateBindingFromAuth,
@@ -149,6 +150,13 @@ export async function prepareResponsesRequest(
     }
     return decodeRequestErrorResponse(err, "responses");
   }
+  if (!options.comboAttempt && !options.compactionRoutingOverride && inboundWire === "responses") {
+    options.compactionRoutingOverride = applyCompactionRoutingOverride(body, req.headers, config, {
+      endpoint: "responses",
+      transport: options.inboundTransport,
+    });
+  }
+  options.onRequestBodyParsed?.(body);
   // An effort row naming a table-less combo (`combo/x--high`) must reach the combo dispatcher
   // as its base id, so the selector is normalized here, before comboIdFromRawBody reads model.
   const comboRows = !options.comboAttempt && body && typeof body === "object" && !Array.isArray(body)
@@ -180,7 +188,7 @@ export async function prepareResponsesRequest(
   }
   // Compaction may send the last client-visible bare model after a combo switch.
   // Configured selectors take precedence; otherwise recall before combo dispatch (#3891).
-  if (!options.comboAttempt && body && typeof body === "object" && !Array.isArray(body)) {
+  if (!options.comboAttempt && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
     const rawModel = (body as { model?: unknown }).model;
     const rawInput = (body as { input?: unknown }).input;
     const isCompactionTrigger = Array.isArray(rawInput)
@@ -202,7 +210,7 @@ export async function prepareResponsesRequest(
   // hops — which only exist inside that loop — are unreachable (#4129). Rewrite the selector
   // here instead, before comboIdFromRawBody reads `model`, and identify the combo by CONFIG
   // LOOKUP so the check can never observe a one-candidate collapse.
-  if (!options.comboAttempt && body && typeof body === "object" && !Array.isArray(body)) {
+  if (!options.comboAttempt && !options.compactionRoutingOverride && body && typeof body === "object" && !Array.isArray(body)) {
     const shadowIntercept = config.shadowCallIntercept;
     const rawShadowModel = (body as { model?: unknown }).model;
     if (shadowIntercept?.enabled && shadowIntercept.model && typeof rawShadowModel === "string"
@@ -243,10 +251,13 @@ export async function prepareResponsesRequest(
     copyPreviousResponseReplayProvenance(options.comboReplaySnapshot.sourceBody, body);
   } else {
     body = expandPreviousResponseInput(body, inboundClientThreadId);
-    if (previousResponseScopeMismatch(body)) {
-      console.warn("[opencodex] dropped a previous_response_id with a mismatched client task scope; continuing fresh");
+    const replayFailure = previousResponseReplayFailure(body);
+    if (replayFailure?.reason === "scope_mismatch") {
+      // Bounded and content-free: no task scope and nothing about the retained entry.
+      console.warn("[opencodex] refusing continuation because the client task scope does not match replay state");
     }
-    if (previousResponseReplayFailure(body)) {
+    // Local replay failures require full client replay.
+    if (replayFailure) {
       return formatErrorResponse(
         400,
         "previous_response_not_found",
@@ -262,10 +273,14 @@ export async function prepareResponsesRequest(
   // encrypted_content slots as plaintext. Rewrite them to input_text on the RAW body BEFORE
   // parsing so every consumer sees the payload: parseRequest (routed/translated providers read
   // the parsed messages) and the native passthrough (_rawBody is this same object, serialized
-  // verbatim). Genuine backend ciphertext is left byte-identical (looksLikeBackendCiphertext).
+  // verbatim). Structurally valid backend ciphertext stays byte-identical; encoded-looking unknown
+  // slots remain opaque only until final-route handling can preserve or strip them safely.
   {
     const rewritten = sanitizeEncryptedContentInPlace(
       (body as { input?: unknown } | undefined)?.input,
+      // The final destination is not known yet. Keep ambiguous encoded slots opaque until route
+      // selection can either strip them for a third party or apply strict native classification.
+      { preserveUnknownOpaqueSlots: true },
     );
     if (rewritten > 0)
       console.warn(
@@ -378,7 +393,7 @@ export async function prepareResponsesRequest(
   if (!logCtx.conversationId) {
     logCtx.conversationId = resolvedConversationId;
   }
-  logCtx.requestedModel = parsed.modelId;
+  logCtx.requestedModel = options.compactionRoutingOverride?.sourceModel ?? parsed.modelId;
   logCtx.requestedEffort = parsed.options.reasoning;
   // What this request may spend beyond its input, for the durable spend reservation (#4707).
   // Read from the caller rather than from the adapter's serialized body, because the
@@ -396,19 +411,29 @@ export async function prepareResponsesRequest(
 
   let route: RouteResult;
   let credentialDomainWasRewritten = false;
+  const captureInboundRoutePolicy = (candidate: RouteResult): RouteResult => {
+    candidate.staticPolicy = captureRouteStaticPolicy(
+      candidate.providerName,
+      candidate.modelId,
+      candidate.provider,
+      candidate.staticPolicy.effectiveAlias,
+      inboundWire,
+    );
+    return candidate;
+  };
   try {
     // A `compaction_trigger` turn may name a bare native model the operator has
     // no canonical OpenAI route for (#2901). Only the initial compaction route
     // may fall back to the configured default provider; combo attempts and the
     // later fallback/recovery re-routes keep the ordinary reservation.
-    const resolveRoute = (modelId: string) => options.comboAttempt
+    const resolveRoute = (modelId: string) => captureInboundRoutePolicy(options.comboAttempt
       ? routeConcreteModel(config, modelId)
       : parsed._compactionRequest === true
         ? routeCompactionModel(config, modelId, evidenceFromBody(parsed._rawBody))
-        : routeModel(config, modelId, evidenceFromBody(parsed._rawBody));
+        : routeModel(config, modelId, evidenceFromBody(parsed._rawBody)));
     const _sci = config.shadowCallIntercept;
     let shadowRoute: RouteResult | undefined;
-    if (_sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
+    if (!options.compactionRoutingOverride && _sci?.enabled && _sci.model && isShadowSourceModel(parsed.modelId, _sci.sourceModels)) {
       const sourcePrefix = shadowSourceModelPrefix(parsed.modelId, _sci.sourceModels)!;
       let sourceIdentity = { providerName: OPENAI_CODEX_PROVIDER_ID, modelId: sourcePrefix };
       try {
@@ -436,8 +461,17 @@ export async function prepareResponsesRequest(
         shadowRoute = targetRoute;
       }
     }
-    if (parsed._compactionRequest === true) parsed._cursorIsolateConversation = true;
+    if (parsed._compactionRequest === true || options.compactionRoutingOverride) parsed._cursorIsolateConversation = true;
     route = shadowRoute ?? resolveRoute(parsed.modelId);
+    if (options.compactionRoutingOverride && !compactionRoutingKeepsProviderIdentity(config, options.compactionRoutingOverride, route)) {
+      credentialDomainWasRewritten = true;
+      // The destination does not share the conversation's credential domain, so it can neither
+      // verify the source backend's reasoning ciphertext nor decode its native compaction blob.
+      // This is the same condition an account change already reports (account-change-state.ts),
+      // and the serializer turns a stored summary into readable text instead of dropping it.
+      parsed._stripReasoningEncryptedContent = true;
+      if (parsed._compactionRequest === true) parsed._portableCompaction = true;
+    }
     logCtx.routeDecision = route.routeDecision;
   } catch (err) {
     if (err instanceof NoAvailableComboTargetsError) {
@@ -633,7 +667,9 @@ export async function prepareResponsesRequest(
 
     if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
       try {
-        route = routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody));
+        route = captureInboundRoutePolicy(
+          routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+        );
         credentialDomainWasRewritten = true;
         logCtx.routeDecision = route.routeDecision;
       } catch (err) {
@@ -831,7 +867,9 @@ export async function prepareResponsesRequest(
 
           if (fallback?.to && !slugsEquivalent(fallback.to, route.modelId)) {
             try {
-              route = routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody));
+              route = captureInboundRoutePolicy(
+                routeModel(config, fallback.to, evidenceFromBody(parsed._rawBody)),
+              );
               credentialDomainWasRewritten = true;
               logCtx.routeDecision = route.routeDecision;
             } catch (err) {
@@ -857,6 +895,17 @@ export async function prepareResponsesRequest(
 
   if (options.abortSignal?.aborted) return clientCancelledResponse();
 
+  if (inboundWire === "responses" && isCanonicalOpenAiForwardProvider(route.provider)) {
+    const rewritten = sanitizeEncryptedContentInPlace(
+      (body as { input?: unknown } | undefined)?.input,
+    );
+    if (rewritten > 0) {
+      console.warn(
+        `[opencodex] rewrote ${rewritten} non-Fernet encrypted_content part(s) before canonical native replay`,
+      );
+    }
+  }
+
   // Encrypted child tasks may reach the canonical native backend or an explicitly trusted
   // direct Responses route. This runs against the FINAL route so native-only fallback can
   // rescue an incompatible primary without weakening combo behavior.
@@ -902,6 +951,7 @@ export async function prepareResponsesRequest(
       route.modelId,
       route.provider,
       inboundWire,
+      route.staticPolicy,
     );
     if (wireProvider.adapter === "openai-responses" && !isCanonicalOpenAiForwardProvider(wireProvider)) {
       const repaired = stripAgentMessageCiphertextInPlace((body as { input?: unknown } | undefined)?.input);
@@ -925,12 +975,12 @@ export async function prepareResponsesRequest(
     return formatErrorResponse(
       400,
       "previous_response_not_found",
-      "OpenAI forward continuation state is unavailable or expired; resend the full conversation without previous_response_id.",
+      "Continuation state is unavailable or corrupt; resend the full conversation without previous_response_id.",
     );
   }
 
   if (hasUnexpandedPreviousResponse) {
-    const continuationProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+    const continuationProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy);
     // Can the DESTINATION see the history this process failed to restore? Only the native
     // Responses passthrough can: it forwards previous_response_id to a backend that stored the
     // chain. Every translated wire rebuilds the conversation from this request's input alone —
@@ -951,7 +1001,7 @@ export async function prepareResponsesRequest(
       return formatErrorResponse(
         400,
         "previous_response_not_found",
-        "Routed continuation requires unavailable local history; resend the full conversation without previous_response_id.",
+        "Continuation state is unavailable or corrupt; resend the full conversation without previous_response_id.",
       );
     }
   }
diff --git a/src/server/responses/request-send-budget.ts b/src/server/responses/request-send-budget.ts
index 7af8b255988..9250162da26 100644
--- a/src/server/responses/request-send-budget.ts
+++ b/src/server/responses/request-send-budget.ts
@@ -109,8 +109,12 @@ export function createResponsesSendBudget(
   const noteAdapterPhysicalSend = (
     inputTokens: number | undefined,
     send: { ordinal: number; recovery?: AttemptRecoveryKind },
+    options: { readonly includeFirst?: boolean } = {},
   ): void => {
-    if (send.ordinal <= 1) return;
+    // Ordinal 1 is skipped because the caller normally records it before dispatch. An adapter
+    // that reports every send asks for it to be counted here instead, so that the first send is
+    // logged where it actually happens rather than before admission could still refuse it.
+    if (send.ordinal <= 1 && options.includeFirst !== true) return;
     noteAttemptSend(logCtx.activeAttempt, inputTokens, send.recovery);
   };
   /**
diff --git a/src/server/responses/request-sidecar-auth.ts b/src/server/responses/request-sidecar-auth.ts
index 5903cb235e2..f2f8154b55a 100644
--- a/src/server/responses/request-sidecar-auth.ts
+++ b/src/server/responses/request-sidecar-auth.ts
@@ -50,7 +50,7 @@ export async function prepareResponsesSidecarAuth(
   let openAiSidecar: ResolvedOpenAiForwardSidecar | undefined;
   const visionDescribeTerminal = options.visionDescribeTerminal === true;
   const routedCompaction = parsed._compactionRequest === true
-    && !isCanonicalOpenAiForwardProvider(route.provider);
+    && (!isCanonicalOpenAiForwardProvider(route.provider) || parsed._portableCompaction === true);
   const needsOpenAiVision = !visionDescribeTerminal
     && shouldResolveOpenAiVisionSidecar(config, route.provider, route.modelId, parsed, route.providerName);
   const needsOpenAiSearch = !routedCompaction && !transportState.adapter.runTurn
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 604380b4fb1..11354c79497 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -338,7 +338,7 @@ export async function prepareResponsesTransport(
       route.provider = current;
     }
     adapter = activeAdapter = runTurnAdapter = resolveSelectionAdapter(
-      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
     );
     invalidateSameTargetRequest();
     return adapter;
@@ -619,7 +619,7 @@ export async function prepareResponsesTransport(
       ? resolveCopilotApiBaseUrl(sentOAuthSnapshot?.apiBaseUrl)
       : undefined,
   );
-  let adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire);
+  let adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy);
   const stripClaudeMainAuth = options.stripClaudeMainAuthForNoncanonicalForward === true
     && !isCanonicalOpenAiForwardProvider(adapterProvider)
     && ((adapterProvider.adapter === "openai-responses" && adapterProvider.authMode === "forward")
diff --git a/src/server/responses/run-turn-execution.ts b/src/server/responses/run-turn-execution.ts
index 0eda0918797..02f7b7e567c 100644
--- a/src/server/responses/run-turn-execution.ts
+++ b/src/server/responses/run-turn-execution.ts
@@ -79,7 +79,11 @@ export async function executeResponsesRunTurn(
   >,
   sendBudgetState: Pick<
     ResponsesSendBudget,
-    "adapterDispatchBudget" | "reserveCredentialHop" | "pendingHopPermit"
+    | "adapterDispatchBudget"
+    | "noteAdapterPhysicalSend"
+    | "noteAdapterRecoveryWithheld"
+    | "reserveCredentialHop"
+    | "pendingHopPermit"
   >,
   completionPolicy: Pick<ResponsesCompletionPolicy, "emptyCompletionGuardEnabled">,
 ): Promise<Response> {
@@ -100,7 +104,12 @@ export async function executeResponsesRunTurn(
     rememberKiroDeliveredFinalAnswer,
     responseStateOptions,
   } = requestState;
-  const { adapterDispatchBudget, reserveCredentialHop } = sendBudgetState;
+  const {
+    adapterDispatchBudget,
+    noteAdapterPhysicalSend,
+    noteAdapterRecoveryWithheld,
+    reserveCredentialHop,
+  } = sendBudgetState;
   const { emptyCompletionGuardEnabled } = completionPolicy;
   const {
     cancelResponseCompletion,
@@ -146,7 +155,11 @@ export async function executeResponsesRunTurn(
           await waitForProviderRequestSlot(route.providerName, route.provider, route.modelId, runTurnAbort.signal);
         }
         await refreshRunTurnSelection();
-        transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery);
+        // An adapter that reports its own sends accounts for the first one at the boundary that
+        // dispatches it. Logging here would claim a send that the adapter's own budget can still
+        // refuse, which is exactly what happens once earlier recovery has spent the allowance.
+        const reportsOwnSends = transportState.runTurnAdapter.reportsPhysicalSends === true;
+        if (!reportsOwnSends) transportState.noteRoutedAttemptSend(logCtx.usageLogInputTokens, recovery);
         const runTurnProviderFetch = providerFetch(
           route.provider,
           options.codexWsRuntimeIdentity,
@@ -169,6 +182,14 @@ export async function executeResponsesRunTurn(
             // The only way the request budget reaches a transport the adapter owns. Without it
             // a Cursor turn's inner ladder was three physical sends the cap read as one.
             ...(adapterDispatchBudget ? { sendBudget: adapterDispatchBudget } : {}),
+            onPhysicalSend: send => noteAdapterPhysicalSend(
+              logCtx.usageLogInputTokens,
+              // The attempt's own recovery kind still labels its first send when the adapter
+              // does not supply one of its own.
+              { ...send, ...(send.recovery ?? recovery ? { recovery: send.recovery ?? recovery } : {}) },
+              { includeFirst: reportsOwnSends },
+            ),
+            onRecoveryWithheld: noteAdapterRecoveryWithheld,
           },
           targetQueue.push,
         );
@@ -273,6 +294,7 @@ export async function executeResponsesRunTurn(
           route.modelId,
           route.provider,
           inboundWire,
+          route.staticPolicy,
         );
         const rotatedAdapter = resolveSelectionAdapter(rotatedProvider, config.cacheRetention);
         if (!rotatedAdapter.runTurn) {
diff --git a/src/server/responses/sidecar-execution.ts b/src/server/responses/sidecar-execution.ts
index de1156b2225..bab63758574 100644
--- a/src/server/responses/sidecar-execution.ts
+++ b/src/server/responses/sidecar-execution.ts
@@ -17,6 +17,7 @@ import {
   clampImageMaxRounds,
 } from "../../images";
 import type { ProviderAdapter } from "../../adapters/base";
+import type { OcxParsedRequest } from "../../types";
 import { rotateProviderTransportOn429, rateLimitRetryPolicyFor } from "../../providers/key-failover";
 import {
   GENERIC_OAUTH_MAX_FAILOVERS_PER_REQUEST,
@@ -155,6 +156,7 @@ export async function executeResponsesSidecars(
   const rotateSidecarProviderOn429 = async (
     retryAfter: string | null,
     responseHeaders?: Headers,
+    retryParsed?: OcxParsedRequest,
   ): Promise<ProviderAdapter | null> => {
     const rotated = rotateProviderTransportOn429(config, route.providerName, route.provider, {
       retryAfter,
@@ -196,7 +198,7 @@ export async function executeResponsesSidecars(
       try {
         const snapshot = await failoverAccountSnapshot(route.providerName, nextAccountId);
         transportState.genericFailovers += 1;
-        if (!await applyFailoverSnapshot(snapshot)) {
+        if (!await applyFailoverSnapshot(snapshot, retryParsed)) {
           hop.permit?.release();
           return null;
         }
@@ -254,9 +256,22 @@ export async function executeResponsesSidecars(
       return null;
     }
     const rotatedAdapter = resolveSelectionAdapter(
-      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire),
+      resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, inboundWire, route.staticPolicy),
       config.cacheRetention,
     );
+    // The sidecar loops build each attempt from an iteration-local shallow copy of parsed, so a
+    // rebind that lands only on the outer request never reaches the wire: the retry would pair
+    // the new bearer with the previous account's Kiro routing metadata and continuation identity.
+    // Rebind the exact request the rotated adapter will be built from (same pattern as the
+    // continuation loop's nextParsed); when the hook ran without one, the outer bind below stands.
+    if (retryParsed && retryParsed !== parsed) {
+      bindRouteReasoningReplayScope({
+        parsed: retryParsed,
+        providerName: route.providerName,
+        provider: route.provider,
+        adapterName: rotatedAdapter.name,
+      });
+    }
     bindRouteReasoningReplayScope({
       parsed,
       providerName: route.providerName,
diff --git a/src/server/responses/ws-upstream.ts b/src/server/responses/ws-upstream.ts
index 41296bf08d4..4348bd48cf9 100644
--- a/src/server/responses/ws-upstream.ts
+++ b/src/server/responses/ws-upstream.ts
@@ -29,33 +29,14 @@ export { CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_M
 export const MIN_BOUNDED_CODEX_WS_BUN_VERSION = "1.4.0";
 
 /**
- * Dial URL for a request URL. The canonical ChatGPT backend keeps its constant;
- * an operator-opted OpenAI-compatible upstream swaps https for wss on the same
- * path so gateways that serve the Responses WebSocket protocol on their
- * /v1/responses path get the same fast lane. Plain HTTP remains on SSE because
- * a provider WS handshake would otherwise send credentials and request data
- * without transport encryption.
+ * Dial URL for a first-party Responses endpoint. The canonical ChatGPT backend
+ * keeps its constant; the api.openai.com Responses endpoint swaps https for wss
+ * on the same path. No other upstream may enter the WebSocket lane.
  */
 function wsUpstreamUrlFor(httpUrl: string): string {
   if (httpUrl === CODEX_RESPONSES_HTTP_URL) return CODEX_RESPONSES_WS_URL;
-  return httpUrl.replace(/^http(s?):/, "ws$1:");
-}
-
-/**
- * An operator-opted OpenAI-compatible upstream only joins the WS lane for
- * Responses endpoints: the WebSocket path speaks the Responses event protocol,
- * and every downstream consumer (adapter parsers, usage sniffing, SSE relay)
- * assumes that wire. Other paths (chat completions, images, search) stay HTTP.
- */
-function isResponsesWebsocketEligibleUrl(url: string): boolean {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return false;
-  }
-  return parsed.protocol === "https:"
-    && parsed.pathname.endsWith("/responses");
+  if (httpUrl === OPENAI_API_RESPONSES_URL) return httpUrl.replace(/^http(s?):/, "ws$1:");
+  throw new Error("unsupported Codex WebSocket upstream");
 }
 export type BunRuntimeIdentity = {
   version: string;
@@ -108,8 +89,13 @@ export function shouldUseCodexWsUpstream(
 ): boolean {
   if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
   if (socks5ProxyFromEnv()) return false;
-  if (url !== CODEX_RESPONSES_HTTP_URL && !upstreamWebsocketConfigured) return false;
-  if (upstreamWebsocketConfigured && !isResponsesWebsocketEligibleUrl(url)) return false;
+  // Bun's client WebSocket API delivers only fully assembled messages and has
+  // no enforceable inbound payload limit. Keep arbitrary provider endpoints on
+  // bounded HTTP/SSE until the client can reject fragmented text and binary
+  // messages during ingestion rather than after allocation. The first-party
+  // api.openai.com lane still requires the operator opt-in.
+  if (url !== CODEX_RESPONSES_HTTP_URL
+    && !(upstreamWebsocketConfigured && url === OPENAI_API_RESPONSES_URL)) return false;
   if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;
   const body = init?.body;
   if (typeof body !== "string") return false;
@@ -139,7 +125,8 @@ export function codexWsUpstreamFetch(
   const prepared = prepareCodexWsRequest(url, init);
   if (!prepared) return sseFallback(url, prepareCodexHttpInit(url, init));
   init = prepared.httpInit;
-  if (!bunSupportsBoundedCodexWsRelay(runtime)) {
+  if ((url !== CODEX_RESPONSES_HTTP_URL && url !== OPENAI_API_RESPONSES_URL)
+    || !bunSupportsBoundedCodexWsRelay(runtime)) {
     return sseFallback(url, init);
   }
   const signal = init.signal ?? undefined;
diff --git a/src/server/sse-payload-rewrite.ts b/src/server/sse-payload-rewrite.ts
index 0d6b0261d06..5f3a1ad0aa3 100644
--- a/src/server/sse-payload-rewrite.ts
+++ b/src/server/sse-payload-rewrite.ts
@@ -230,7 +230,7 @@ export function replaceSseDataPayload(block: string, payload: string): string {
       continue;
     }
     if (!replaced) {
-      rewritten.push(`data: ${payload}`);
+      rewritten.push(...payload.split(/\r?\n/).map(line => `data: ${line}`));
       replaced = true;
     }
   }
diff --git a/src/tray/windows-tray.ps1 b/src/tray/windows-tray.ps1
index 6e843a66dba..8ebb9c05380 100644
--- a/src/tray/windows-tray.ps1
+++ b/src/tray/windows-tray.ps1
@@ -116,6 +116,88 @@ function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
   }
 }
 
+function Parse-StartupHealthText([string]$Text) {
+  foreach ($line in ($Text -split "\r?\n")) {
+    $trimmed = $line.Trim()
+    if (-not $trimmed) { continue }
+    try {
+      $parsed = $trimmed | ConvertFrom-Json
+      if ($parsed.status -in @("native", "protected", "at-risk") -and ($parsed.rebootSafe -is [bool])) {
+        return $parsed
+      }
+    } catch {
+      # A non-JSON line from the CLI (for example a diagnostic banner) is not a
+      # startup-health payload; keep scanning for the actual JSON result.
+      continue
+    }
+  }
+  return $null
+}
+
+function Start-StartupHealthProbe {
+  # Startup safety is machine-local diagnostic state, so the tray asks the CLI to
+  # collect it directly (ocx __startup-health) instead of poking the management API,
+  # which is admin-token gated. The CLI collects the diagnostic straight from the OS,
+  # so it works without the proxy answering and without any credential.
+  #
+  # The child writes into redirected pipes that the tick reads asynchronously: only
+  # the completed Task<string> is ever touched, so a slow or hung diagnostic can never
+  # block the Windows Forms UI thread, and its lifetime is bounded by a kill in the
+  # tick that lets the next refresh replace it instead of stacking another process.
+  try {
+    $psi = New-Object System.Diagnostics.ProcessStartInfo
+    $psi.FileName = $BunPath
+    $psi.Arguments = ((@($CliPath, "__startup-health") | ForEach-Object { ConvertTo-NativeArgument $_ }) -join " ")
+    $psi.UseShellExecute = $false
+    $psi.CreateNoWindow = $true
+    $psi.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
+    $psi.RedirectStandardOutput = $true
+    $psi.RedirectStandardError = $true
+    $psi.StandardOutputEncoding = [System.Text.Encoding]::UTF8
+    $psi.StandardErrorEncoding = [System.Text.Encoding]::UTF8
+    $psi.EnvironmentVariables["CODEX_HOME"] = $CodexHome
+    $psi.EnvironmentVariables["OPENCODEX_HOME"] = $OpenCodexHome
+    if ($BunRuntimeSource) {
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_SOURCE"] = $BunRuntimeSource
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_PATH"] = $BunPath
+    }
+    $process = [System.Diagnostics.Process]::Start($psi)
+    $script:startupProbeProcess = $process
+    # Drain both pipes asynchronously from the start so neither can fill and stall
+    # the child while the tick is only watching the output task's completion.
+    $script:startupProbeOutputTask = $process.StandardOutput.ReadToEndAsync()
+    $script:startupProbeErrorTask = $process.StandardError.ReadToEndAsync()
+    $script:startupProbeStarted = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+  } catch {
+    Write-ActionLog "startup-health probe launch failed: $($_.Exception.GetType().Name)"
+    if ($null -ne $script:startupProbeProcess) {
+      # Process.Start succeeded but the async pipe setup failed: Dispose alone
+      # would leave the Bun child running, so terminate it before cleanup.
+      try {
+        $script:startupProbeProcess.Kill()
+        [void]$script:startupProbeProcess.WaitForExit(3000)
+      } catch {
+        Write-ActionLog "startup-health probe launch cleanup failed: $($_.Exception.GetType().Name)"
+      }
+    }
+    Complete-StartupHealthProbe
+  }
+}
+
+function Complete-StartupHealthProbe {
+  $process = $script:startupProbeProcess
+  $script:startupProbeProcess = $null
+  $script:startupProbeOutputTask = $null
+  $script:startupProbeErrorTask = $null
+  if ($null -ne $process) {
+    try {
+      $process.Dispose()
+    } catch {
+      Write-ActionLog "startup-health probe dispose failed: $($_.Exception.GetType().Name)"
+    }
+  }
+}
+
 function Read-ListenTarget {
   foreach ($path in @((Join-Path $OpenCodexHome "runtime-port.json"), (Join-Path $OpenCodexHome "config.json"))) {
     try {
@@ -172,6 +254,15 @@ $exitItem = $menu.Items.Add("Exit Tray")
 $script:online = $false
 $script:port = 10100
 $script:proxyPid = $null
+$script:wasOnline = $false
+$script:startupHealth = $null
+$script:startupHealthCheckedAt = 0L
+$script:startupRefreshMs = 20000L
+$script:startupProbeProcess = $null
+$script:startupProbeOutputTask = $null
+$script:startupProbeErrorTask = $null
+$script:startupProbeStarted = 0L
+$script:startupProbeTimeoutMs = 30000L
 $script:pendingAction = $null
 $script:pendingStarted = 0L
 $script:pendingDeadline = 0L
@@ -228,18 +319,66 @@ function Update-TrayState {
   $pidMatches = $null -eq $target.pid -or [int]$target.pid -eq [int]$health.pid
   $script:online = $null -ne $health -and $health.status -eq "ok" -and $health.service -eq "opencodex" -and [int]$health.port -eq $script:port -and $pidMatches
   $script:proxyPid = if ($script:online) { [int]$health.pid } else { $null }
+  $cameOnline = $script:online -and -not $script:wasOnline
+  $script:wasOnline = $script:online
+  $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+  if ($null -ne $script:startupProbeProcess) {
+    $probeExited = $false
+    try {
+      $probeExited = $script:startupProbeProcess.HasExited
+    } catch {
+      $probeExited = $true
+    }
+    $probeTimedOut = ($now - $script:startupProbeStarted) -gt $script:startupProbeTimeoutMs
+    if ($probeExited -and $null -ne $script:startupProbeOutputTask -and $script:startupProbeOutputTask.IsCompleted) {
+      $probeStartup = $null
+      try {
+        $probeStartup = Parse-StartupHealthText $script:startupProbeOutputTask.Result
+      } catch {
+        Write-ActionLog "startup-health probe read failed: $($_.Exception.GetType().Name)"
+      }
+      $script:startupHealth = $probeStartup
+      Complete-StartupHealthProbe
+      $script:startupHealthCheckedAt = $now
+    } elseif ($probeTimedOut) {
+      # A hung diagnostic must not survive its refresh slot: terminate it so the
+      # next refresh cannot stack another orphaned Bun process behind it.
+      Write-ActionLog "startup-health probe timed out; terminating it"
+      try {
+        $script:startupProbeProcess.Kill()
+        [void]$script:startupProbeProcess.WaitForExit(3000)
+      } catch {
+        Write-ActionLog "startup-health probe kill failed: $($_.Exception.GetType().Name)"
+      }
+      $script:startupHealth = $null
+      Complete-StartupHealthProbe
+      $script:startupHealthCheckedAt = $now
+    }
+  }
+  $refreshDue =
+    $script:startupHealthCheckedAt -eq 0 -or
+    ($now - $script:startupHealthCheckedAt -gt $script:startupRefreshMs)
+  if ($script:online -and ($cameOnline -or $refreshDue) -and $null -eq $script:startupProbeProcess) {
+    # Record the attempt so launch failures and invalid results remain throttled.
+    $script:startupHealthCheckedAt = $now
+    Start-StartupHealthProbe
+  }
   if ($script:online) {
     $statusItem.Text = "Proxy: Online (port $($script:port))"
     $notify.Text = "opencodex: Online"
     $startItem.Enabled = $false
     $stopItem.Enabled = $true
     $restartItem.Enabled = $true
-    try {
-      $startup = Read-JsonUrl "$origin/api/startup-health"
+    # The management API is admin-token gated, so the tray must not poke
+    # /api/startup-health for the icon. The probe lifecycle maintenance and the
+    # refresh gate above run on every tick (even while offline) so a hung
+    # diagnostic is cleaned up outside the online-only UI branch.
+    $startup = $script:startupHealth
+    if ($null -ne $startup) {
       $label = if ($startup.status -eq "at-risk") { "At risk" } elseif ($startup.status -eq "protected") { "Protected" } else { "Native routing" }
       $safetyItem.Text = "Restart safety: $label"
       $notify.Icon = if ($startup.status -eq "at-risk") { $warningIcon } else { $onlineIcon }
-    } catch {
+    } else {
       $safetyItem.Text = "Restart safety: unavailable"
       $notify.Icon = $warningIcon
     }
@@ -360,6 +499,19 @@ try {
   if ($null -ne $script:pendingProcess) {
     try { $script:pendingProcess.Dispose() } catch { $null = $_ }
   }
+  if ($null -ne $script:startupProbeProcess) {
+    # A probe still running when the tray shuts down would outlive it: Dispose()
+    # releases the handle but does not terminate the child, so kill the active
+    # probe, wait briefly for exit, then release the probe state.
+    try {
+      Write-ActionLog "terminating active startup-health probe on tray shutdown"
+      $script:startupProbeProcess.Kill()
+      [void]$script:startupProbeProcess.WaitForExit(3000)
+    } catch {
+      Write-ActionLog "startup-health probe shutdown kill failed: $($_.Exception.GetType().Name)"
+    }
+    Complete-StartupHealthProbe
+  }
   $notify.Dispose()
   foreach ($icon in $script:ownedIcons) { $icon.Dispose() }
   $menu.Dispose()
diff --git a/src/types.ts b/src/types.ts
index 9ef3936da97..93390ce6063 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -4,6 +4,7 @@
 export type { OcxTool, OcxToolChoice } from "./types/tools";
 export {
   CODE_MODE_EXEC_TOOL_NAME,
+  CODE_MODE_HELPER_WIRE_NAMES,
   dottedToolName,
   namespacedToolName,
   normalizeDeclaredToolName,
diff --git a/src/types/config.ts b/src/types/config.ts
index 2c38aef8e8e..977bdb266f6 100644
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -403,6 +403,8 @@ export interface OcxConfig {
   client?: OcxClientConnectionConfig;
   /** Operator-facing redaction policy for management and CLI projections. */
   privacy?: OcxPrivacyConfig;
+  /** Opt-in process-local aggregate request metrics on the authenticated management plane. */
+  metricsExport?: { enabled?: boolean };
   /** Opt in to one identical-turn retry when a Responses completion has no text or tool call. */
   emptyCompletionRetry?: boolean;
   /** Suppress allowlisted client-facing Codex transport hints; provider enforcement is unchanged. */
@@ -616,6 +618,12 @@ export interface OcxConfig {
   subagentEffortCap?: string;
   /** Global model effort overrides, after provider model/wide pins; none means omission. */
   modelPinnedEfforts?: Record<string, string>;
+  compactionRouting?: {
+    model: string;
+    reasoningEffort?: string;
+    /** Compaction triggers this override covers; omission means `["manual"]`. */
+    triggers?: ("manual" | "auto")[];
+  };
   /**
    * Models hidden from Codex discovery without blocking direct proxy calls. Routed provider ids
    * are excluded from the catalog + /v1/models entirely. Account-qualified native ids hide only
@@ -753,9 +761,9 @@ export interface OcxConfig {
    * into ALL_PROXY, clear inherited HTTP(S)_PROXY, and use OpenCodex's SOCKS5 transport.
    * Loopback stays in NO_PROXY.
    * The literal `"auto"` reads the Windows WinINET static proxy (`ProxyEnable`/`ProxyServer`)
-   * once at process start; on other platforms, or when the system proxy is off, SOCKS-only,
-   * or unreadable, it degrades to direct egress with one log line (#1525). PAC/WPAD and live
-   * changes are not followed.
+   * once at process start, preserving separate HTTP and HTTPS entries; on other platforms, or
+   * when the system proxy is off, SOCKS-only, or unreadable, it degrades to direct egress with
+   * one log line (#1525). PAC/WPAD and live changes are not followed.
    */
   proxy?: string;
   /**
diff --git a/src/types/provider.ts b/src/types/provider.ts
index 808ad536731..e67041ee5dd 100644
--- a/src/types/provider.ts
+++ b/src/types/provider.ts
@@ -356,6 +356,22 @@ export interface OcxProviderConfig {
    * `ocxr1` envelopes are still stripped because no upstream can decrypt them.
    */
   preserveResponsesReasoningContent?: boolean;
+  /**
+   * Treat this provider's `modelReasoningEfforts` as authoritative at the wire, not only in the
+   * catalog. Adapters that ship their own per-model effort table (currently `command-code`)
+   * otherwise let that table win for models it knows, so a widened row is advertised in the
+   * picker and then stripped on the way out. Opt-in because presets are SEEDED with the shipped
+   * table: without a declared flag there is no way to tell an operator's row from a copy an
+   * older release persisted. A rung the upstream then refuses is returned as that error rather
+   * than silently retried without the effort, since the operator asked for it.
+   */
+  modelReasoningEffortsAuthoritative?: boolean;
+  /**
+   * Drop replayed Responses `reasoning` items from input history before forwarding.
+   * Some OpenAI-compatible Responses upstreams accept tool-call replay but reject
+   * reasoning output items when they are sent back on a continuation.
+   */
+  dropResponsesReasoningItems?: boolean;
   /**
    * Explicit opt-in for a relay that genuinely fronts OpenAI and can decode native
    * compaction blobs. Absent or false degrades foreign blobs to an opaque note.
@@ -901,6 +917,8 @@ export interface OcxProviderConfig {
    * "cloud-code-assist" = Google Antigravity (Cloud Code Assist) OAuth + CCA envelope.
    */
   googleMode?: "ai-studio" | "vertex" | "cloud-code-assist";
+  /** Google tool-schema compatibility policy. Omitted preserves compatible report-only behavior. */
+  googleToolSchemaPolicy?: "compatible" | "reject-lossy";
   /** Vertex AI GCP project id (or GOOGLE_CLOUD_PROJECT / GCLOUD_PROJECT env). */
   project?: string;
   /** Vertex AI location, e.g. "us-central1" or "global" (or GOOGLE_CLOUD_LOCATION env). */
diff --git a/src/types/request.ts b/src/types/request.ts
index a7c319ec403..73bc671c8c2 100644
--- a/src/types/request.ts
+++ b/src/types/request.ts
@@ -126,6 +126,8 @@ export interface OcxParsedRequest {
    * (see src/responses/compaction.ts).
    */
   _compactionRequest?: boolean;
+  /** Manual compaction moved to another provider: summarize portably even on a canonical ChatGPT target. */
+  _portableCompaction?: boolean;
   /**
    * True when the current request newly introduced a stored compaction summary/marker. Historical
    * markers restored by previous_response_id expansion were already acknowledged and do not reset
diff --git a/src/types/tools.ts b/src/types/tools.ts
index 06fe8589e1e..83decd85b14 100644
--- a/src/types/tools.ts
+++ b/src/types/tools.ts
@@ -67,6 +67,20 @@ const CODE_MODE_HELPER_TOOL_NAMES = [
  */
 export const CODE_MODE_EXEC_TOOL_NAME = "exec";
 
+/**
+ * The nested-helper spellings, as a membership view of the same list.
+ *
+ * A code-mode catalog never DECLARES any of them — they exist only as `tools.<helper>(...)` inside
+ * `exec` — so a recorded call under one of these names can only have come from a provider echoing
+ * the helper, which is what makes the set usable as a bounded recovery vocabulary for stored
+ * history (#5095). Kept beside the tuple it is built from so the two can never drift; this is a
+ * different question from `NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES` below, which also covers `exec`
+ * itself because declaring THAT name is what turns normalization on.
+ */
+export const CODE_MODE_HELPER_WIRE_NAMES: ReadonlySet<string> = new Set<string>(
+  CODE_MODE_HELPER_TOOL_NAMES,
+);
+
 /**
  * Spellings that may never be MANUFACTURED as a bare alias for a namespaced tool.
  *
diff --git a/src/vision/eligibility.ts b/src/vision/eligibility.ts
index c8bcb815963..d772c8f9769 100644
--- a/src/vision/eligibility.ts
+++ b/src/vision/eligibility.ts
@@ -35,6 +35,54 @@ import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers-dest
  */
 export type VisionSidecarBackend = "openai" | "anthropic" | "routed";
 
+/**
+ * Input modalities an explicit custom row declares for one routed model.
+ *
+ * A custom row is the operator's own definition of that model, so its declaration outranks the
+ * provider-level hints the predicates below read. Without this the two halves of one config
+ * disagreed in production: the catalog overlay in `src/codex/catalog/routed-gather.ts` copies
+ * `customModels[].inputModalities` onto the row and the dashboard showed "text, image", while
+ * the request path consulted only `providers[].noVisionModels` / `modelInputModalities` and
+ * stripped the image before dispatch. A model the operator had declared image-capable therefore
+ * received an omission marker instead of its attachment.
+ *
+ * Precedence, highest first: `modelCapabilities` (the documented per-model capability
+ * declaration), then this custom-row declaration, then `noVisionModels`, then
+ * `modelInputModalities`, then registry/vendor metadata. `modelCapabilities` stays on top
+ * because it is the dedicated capability axis and the CLI `--text-only` flag writes it; when the
+ * two explicit forms contradict each other the more specific axis wins.
+ *
+ * Matching is exact on the routed identity — provider name and native model id, the pair the
+ * custom-model API keys rows by. A row that declares no modalities returns `undefined` rather
+ * than `["text"]`, so it stays silent instead of turning into a text-only claim.
+ */
+export function customRowInputModalities(
+  config: Pick<OcxConfig, "customModels">,
+  providerName: string,
+  modelId: string,
+): string[] | undefined {
+  for (const row of config.customModels ?? []) {
+    if (row.provider !== providerName || row.modelId !== modelId) continue;
+    if (Array.isArray(row.inputModalities) && row.inputModalities.length > 0) {
+      return [...row.inputModalities];
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The custom row's verdict for one model, in the shape the predicates need:
+ * `true`/`false` when the row declares modalities, `undefined` when it declares none.
+ */
+function customRowAcceptsImageInput(
+  config: Pick<OcxConfig, "customModels">,
+  providerName: string,
+  modelId: string,
+): boolean | undefined {
+  const declared = customRowInputModalities(config, providerName, modelId);
+  return declared === undefined ? undefined : declared.includes("image");
+}
+
 /** The two sides every deployment has; also the empty-auth fallback set. */
 export type UniversalVisionBackend = "openai" | "anthropic";
 
@@ -60,6 +108,14 @@ export interface VisionCandidateModel {
   native?: boolean;
 }
 
+/**
+ * The config slice the capability predicates need. `customModels` is optional so provider-only
+ * callers and unit tests keep compiling; a caller that omits it is simply silent about custom
+ * rows rather than wrong about them.
+ */
+export type VisionCapabilityConfig =
+  Pick<OcxConfig, "providers"> & { customModels?: OcxConfig["customModels"] };
+
 export interface VisionModelOption {
   value: string;
   label: string;
@@ -142,20 +198,31 @@ function enrichedProviderForVision(
 }
 
 function isVisionSidecarConsumerWithCache(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   providerName: string,
   modelId: string,
   cache: EnrichedProviderCache,
 ): boolean {
   const provider = enrichedProviderForVision(config, providerName, cache);
-  return provider !== undefined && isModelVisionSidecarConsumer(provider, modelId);
+  if (provider === undefined) return false;
+  // Documented precedence, highest first: the dedicated per-model capability axis, then the
+  // operator's own custom row, then the provider-level hints. Reading the custom row ahead of
+  // `modelCapabilities` would let it override the more specific axis.
+  const capabilityDeclared = Object.hasOwn(provider.modelCapabilities ?? {}, modelId)
+    ? provider.modelCapabilities?.[modelId]?.inputModalities : undefined;
+  if (capabilityDeclared !== undefined) {
+    return capabilityDeclared.includes("text") && !capabilityDeclared.includes("image");
+  }
+  const customDeclared = customRowInputModalities(config, providerName, modelId);
+  if (customDeclared !== undefined) return customDeclared.includes("text") && !customDeclared.includes("image");
+  return isModelVisionSidecarConsumer(provider, modelId);
 }
 
 /**
  * Is this model listed as one the sidecar describes FOR? Such a model cannot be
  * the describer, and its advertised modalities are untrustworthy.
  */
-export function isVisionSidecarConsumer(config: Pick<OcxConfig, "providers">, providerName: string, modelId: string): boolean {
+export function isVisionSidecarConsumer(config: VisionCapabilityConfig, providerName: string, modelId: string): boolean {
   return isVisionSidecarConsumerWithCache(config, providerName, modelId, new Map());
 }
 
@@ -165,23 +232,30 @@ export function isVisionSidecarConsumer(config: Pick<OcxConfig, "providers">, pr
  * which callers treat as eligible.
  */
 export function modelAcceptsImageInput(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   candidate: VisionCandidateModel,
 ): boolean | undefined {
   return modelAcceptsImageInputWithCache(config, candidate, new Map());
 }
 
 function modelAcceptsImageInputWithCache(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   candidate: VisionCandidateModel,
   cache: EnrichedProviderCache,
 ): boolean | undefined {
   if (candidate.native === true || (candidate.provider === "openai" && SUPPORTED_NATIVE_OPENAI_SLUGS.has(candidate.id))) {
     const nativeProvider = enrichedProviderForVision(config, candidate.provider, cache);
-    if (nativeProvider && isModelVisionSidecarConsumer(nativeProvider, candidate.id)) return false;
     const declared = Object.hasOwn(nativeProvider?.modelCapabilities ?? {}, candidate.id)
       ? nativeProvider?.modelCapabilities?.[candidate.id]?.inputModalities : undefined;
     if (declared !== undefined) return declared.includes("image");
+    // The catalog already lets an explicit custom row replace the native modality list for the
+    // same slug; consult it here too or the row would advertise what the request path ignores.
+    const fromCustomRow = customRowAcceptsImageInput(config, candidate.provider, candidate.id);
+    if (fromCustomRow !== undefined) return fromCustomRow;
+    // The sidecar hints come after both explicit declarations, matching the documented order.
+    // Ahead of them a `noVisionModels` membership would short-circuit to text-only before the
+    // operator's own row was read.
+    if (nativeProvider && isModelVisionSidecarConsumer(nativeProvider, candidate.id)) return false;
     return advertisesImageInput(nativeInputModalities(candidate.id)) ?? true;
   }
   if (isVisionSidecarConsumerWithCache(config, candidate.provider, candidate.id, cache)) return false;
@@ -189,6 +263,11 @@ function modelAcceptsImageInputWithCache(
   const declared = Object.hasOwn(provider?.modelCapabilities ?? {}, candidate.id)
     ? provider?.modelCapabilities?.[candidate.id]?.inputModalities : undefined;
   if (declared !== undefined) return declared.includes("image");
+  // Ahead of the provider's own hints: this row is the operator's definition of this exact model,
+  // and the catalog overlay reads the same field. Behind modelCapabilities, which is the dedicated
+  // capability axis the CLI `--text-only` writes.
+  const fromCustomRow = customRowAcceptsImageInput(config, candidate.provider, candidate.id);
+  if (fromCustomRow !== undefined) return fromCustomRow;
   const configuredModalities = provider ? modelRecordValue(provider.modelInputModalities, candidate.id) : undefined;
   const fromConfiguredModalities = advertisesImageInput(configuredModalities);
   if (fromConfiguredModalities !== undefined) return fromConfiguredModalities;
@@ -206,14 +285,14 @@ function modelAcceptsImageInputWithCache(
 
 /** Eligible = not a sidecar consumer, and not positively known to be text-only. */
 export function isVisionEligibleModel(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   candidate: VisionCandidateModel,
 ): boolean {
   return isVisionEligibleModelWithCache(config, candidate, new Map());
 }
 
 function isVisionEligibleModelWithCache(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   candidate: VisionCandidateModel,
   cache: EnrichedProviderCache,
 ): boolean {
@@ -274,7 +353,7 @@ function baselineCandidate(
  * backend, and only `value` reaches the client, so first-wins costs nothing.
  */
 export function visionEligibleModelOptions(
-  config: Pick<OcxConfig, "providers">,
+  config: VisionCapabilityConfig,
   candidates: readonly VisionCandidateModel[],
   enabledBackends: readonly VisionSidecarBackend[],
   anthropicProviderName?: string,
diff --git a/src/vision/plan.ts b/src/vision/plan.ts
index 166d6bb3b03..1283896959f 100644
--- a/src/vision/plan.ts
+++ b/src/vision/plan.ts
@@ -5,7 +5,11 @@ import type { ResolvedOpenAiForwardSidecar } from "../providers/openai-sidecar";
 import type { CodexAuthPolicyConfig } from "../codex/auth-context";
 import { isCodexReserveRequestEligible } from "../codex/loopback-target";
 import type { DataPlaneAdmission } from "../server/auth-cors";
-import { isModelVisionSidecarConsumer as isModelTextOnly, modelAcceptsImageInput } from "./eligibility";
+import {
+  customRowInputModalities,
+  isModelVisionSidecarConsumer as isModelTextOnly,
+  modelAcceptsImageInput,
+} from "./eligibility";
 import { normalizeVisionReasoningForModel } from "./reasoning";
 import { resolveSidecarAuth } from "../sidecar/auth";
 import { DEFAULT_VISION_TIMEOUT_MS, MAX_VISION_TIMEOUT_MS, MIN_VISION_TIMEOUT_MS } from "./timeout-bounds";
@@ -95,23 +99,40 @@ function messagesHaveImage(parsed: OcxParsedRequest): boolean {
 /**
  * Direct-image admission for a routed target. Returns true when capability evidence proves the
  * target cannot accept image input, so the caller must describe or strip the image first.
- * Explicit text-only config, an explicit per-model modality list without `image`, and
- * proven-negative registry/vendor metadata each require the vision preprocessor. A genuinely
- * unknown custom model is NOT guessed blind: it keeps the established pass-through behaviour.
- * The provider-only fallback keeps legacy unit callers stable; production dispatch always
- * supplies providerName so the complete capability chain is consulted.
+ * Evidence is consulted highest-first: `modelCapabilities` (the dedicated per-model capability
+ * axis), an explicit custom row for the same routed identity, `noVisionModels`, an explicit
+ * per-model modality list without `image`, and finally proven-negative registry/vendor metadata.
+ * Any of them can require the vision preprocessor. A genuinely unknown custom model is NOT
+ * guessed blind: it keeps the established pass-through behaviour. The provider-only fallback
+ * keeps legacy unit callers stable; production dispatch always supplies providerName so the
+ * complete capability chain is consulted.
  */
 export function requiresVisionPreprocessing(
-  config: Pick<OcxConfig, "providers">,
+  config: Pick<OcxConfig, "providers"> & { customModels?: OcxConfig["customModels"] },
   provider: Pick<OcxProviderConfig, "noVisionModels" | "modelInputModalities" | "modelCapabilities">,
   modelId: string,
   providerName?: string,
 ): boolean {
-  if (isModelTextOnly(provider, modelId)) return true;
   const runtimeDeclared = Object.hasOwn(provider.modelCapabilities ?? {}, modelId)
     ? provider.modelCapabilities?.[modelId]?.inputModalities
     : undefined;
+  // `modelCapabilities` is the dedicated per-model capability axis, so it outranks everything
+  // below — including an explicit custom row that disagrees. The CLI `--text-only` flag writes it.
   if (runtimeDeclared !== undefined) return !runtimeDeclared.includes("image");
+  // An explicit custom row outranks the provider-level hints below, mirroring the catalog overlay
+  // in `src/codex/catalog/routed-gather.ts` that already copies this same declaration onto the
+  // advertised row. Without it the dashboard advertised "text, image" from the operator's own row
+  // while this predicate stripped the image before dispatch.
+  const customDeclared = providerName === undefined
+    ? undefined
+    : customRowInputModalities(config, providerName, modelId);
+  // Same rule as the `modelCapabilities` branch above: the declaration answers "can this model
+  // take an image", not "is it a text model". A row that lists only `audio` or `video` excludes
+  // image input just as `["text"]` does, and `modelAcceptsImageInput` already answers "no image"
+  // for it; the narrower `includes("text")` test here made the two predicates disagree and sent
+  // the attachment to a model that cannot read it.
+  if (customDeclared !== undefined) return !customDeclared.includes("image");
+  if (isModelTextOnly(provider, modelId)) return true;
   const runtimeModalities = modelRecordValue(provider.modelInputModalities, modelId);
   if (Array.isArray(runtimeModalities) && runtimeModalities.length > 0) {
     return !runtimeModalities.includes("image");
@@ -129,9 +150,12 @@ function usableRoutedVisionModel(config: OcxConfig): string | undefined {
   if (!routedModel || sep <= 0) return undefined;
   const targetProvider = routedModel.slice(0, sep);
   const targetId = routedModel.slice(sep + 1);
-  const targetProviderConfig = config.providers?.[targetProvider];
+  // `modelAcceptsImageInput` is the one predicate here: it resolves the whole capability chain,
+  // custom row included. The provider-only `isModelTextOnly` that used to be ANDed in could only
+  // subtract — it never saw a custom row, so a describer the operator had declared image-capable
+  // was refused for a provider hint that same row overrides.
   return modelAcceptsImageInput(config, { provider: targetProvider, id: targetId }) !== false
-    && !(targetProviderConfig && isModelTextOnly(targetProviderConfig, targetId)) ? routedModel : undefined;
+    ? routedModel : undefined;
 }
 
 export function shouldResolveOpenAiVisionSidecar(
diff --git a/src/web-search/executor.ts b/src/web-search/executor.ts
index d6514acfd49..33b6a1eb6cc 100644
--- a/src/web-search/executor.ts
+++ b/src/web-search/executor.ts
@@ -3,7 +3,14 @@ import { FORWARD_HEADERS } from "../adapters/openai-responses";
 import { signalWithTimeout, cancelBodyOnAbort } from "../lib/abort";
 import { redactSecretString } from "../lib/redact";
 import { sidecarEnter } from "../lib/sidecar-tracker";
-import { applyUpstreamRecoveryInit, fetchWithResetRetry } from "../lib/upstream-retry";
+import {
+  applyUpstreamRecoveryInit,
+  fetchWithResetRetry,
+  releaseResponseBodyBestEffort,
+  retryBackoffDelayMs,
+  sleepWithAbort,
+  RETRY_AFTER_CEILING_MS,
+} from "../lib/upstream-retry";
 import { withUpstreamHttpVersion } from "../lib/upstream-http-version";
 import { parseSidecarSSE, type WebSearchResult } from "./parse";
 import type { CodexUpstreamOutcome } from "../codex/routing";
@@ -35,6 +42,22 @@ export const IMAGE_INSTRUCTION =
 
 /** A search result, or an `error` string when the search couldn't run (surfaced as a tool result). */
 export type SidecarOutcome = WebSearchResult & { error?: string };
+
+/**
+ * Bounded same-search 429 replays for the sidecar POST.
+ *
+ * The forward backend throttles burst sidecar traffic, and without a replay the 429 becomes a
+ * failed tool result that poisons the query for the whole turn (see failedQueries in loop.ts).
+ * 1 initial send + 2 replays; Retry-After is honored as a lower bound and capped by
+ * RETRY_AFTER_CEILING_MS (an instruction past the ceiling ends with the 429 instead of
+ * parking the search). Each wait releases the unread 429 body first so sockets do not
+ * accumulate under a rate-limit storm. Abort or timeout ends the wait through the existing
+ * catch, exactly like an abort during the SSE parse.
+ */
+const SIDECAR_429_MAX_ATTEMPTS = 3;
+const SIDECAR_429_BASE_DELAY_MS = 1_000;
+const SIDECAR_429_MAX_DELAY_MS = 10_000;
+
 export type SidecarOutcomeRecorder = (outcome: CodexUpstreamOutcome) => void;
 
 /**
@@ -79,7 +102,7 @@ export async function runWebSearch(
   const sidecarExit = sidecarEnter("web-search");
   const t0 = Date.now();
   try {
-    const res = await fetchWithResetRetry(
+    const sendOnce = () => fetchWithResetRetry(
       // Recovery nests INSIDE the version helper: applyUpstreamRecoveryInit then always receives a
       // defined init, and withUpstreamHttpVersion spreads the result, so `protocol` and the
       // recovery fields (`connection: close` + Bun's transport-level `keepalive: false`) survive
@@ -96,6 +119,22 @@ export async function runWebSearch(
       }, recovery), forwardProvider)),
       { replaySafe: true, abortSignal: linkedSignal.signal, label: "web-search-sidecar" },
     );
+    let res = await sendOnce();
+    for (let attempt = 0; res.status === 429 && attempt + 1 < SIDECAR_429_MAX_ATTEMPTS; attempt++) {
+      const delay = retryBackoffDelayMs(attempt, {
+        baseDelayMs: SIDECAR_429_BASE_DELAY_MS,
+        maxDelayMs: SIDECAR_429_MAX_DELAY_MS,
+        headers: res.headers,
+        retryAfterIsLowerBound: true,
+      });
+      // A deadline, not a clamp: an instruction past the ceiling ends the search with the
+      // 429 instead of parking it at a provider that already said it would refuse.
+      if (delay > RETRY_AFTER_CEILING_MS) break;
+      console.warn(`[web-search] sidecar HTTP 429 — retrying (${attempt + 2}/${SIDECAR_429_MAX_ATTEMPTS}) after ${delay}ms`);
+      await releaseResponseBodyBestEffort(res.body, linkedSignal.signal);
+      await sleepWithAbort(delay, linkedSignal.signal);
+      res = await sendOnce();
+    }
     // Attach the body guard before ANY branch reads it. The success path guarded itself below,
     // but the failure branch's `res.text()` runs first, so a cancel landing between fetch
     // resolution and reader attach orphaned the internal rejection (found investigating #1419).
diff --git a/src/web-search/loop.ts b/src/web-search/loop.ts
index 48a5cdc8cd3..76f5748130a 100644
--- a/src/web-search/loop.ts
+++ b/src/web-search/loop.ts
@@ -333,10 +333,15 @@ export interface WebSearchLoopDeps {
    * 429 states the window's reset epoch even when it omits Retry-After -- and a rotation that
    * cannot see it cools the drained account for the short default instead of until the window
    * actually reopens. Optional so existing callers keep compiling.
+   *
+   * `retryParsed` is the exact iteration-local request the retry will be built from. The loop
+   * sends a shallow copy of the outer parsed request, so a rotation that rebinds only the outer
+   * object never reaches the wire. Optional so existing callers keep compiling.
    */
   on429?: (
     retryAfterHeader: string | null,
     responseHeaders?: Headers,
+    retryParsed?: OcxParsedRequest,
   ) => ProviderAdapter | null | Promise<ProviderAdapter | null>;
   /** Opt-in same-target 429 policy (key-auth providers). When present, 429 replays on the SAME key before on429 rotation. */
   retryOn429Policy?: Required<RateLimitRetryPolicy> | null;
@@ -558,7 +563,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       // 429 key-failover parity with the normal routed path: rotate pool keys until one responds
       // or the pool is exhausted (deps.on429 returns null — cooldown map guarantees termination).
       while (prepared.response.status === 429 && deps.on429) {
-        const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers);
+        const rotated = await deps.on429(prepared.response.headers.get("retry-after"), prepared.response.headers, iterParsed);
         if (!rotated) break;
         // Never let a broken body's cancel promise outlive the cumulative header deadline. Observe
         // it, but proceed immediately to the rotated fetch under the SAME deadline signal.
diff --git a/structure/AGENTS.md b/structure/AGENTS.md
index bcab24189b7..8856d5219cc 100644
--- a/structure/AGENTS.md
+++ b/structure/AGENTS.md
@@ -46,8 +46,10 @@ the inverse.
   the Responses transport doc and the Images doc. An earlier revision of this folder demanded exactly
   one owner per area, and that rule was simply false here — a false rule is worse than none, because
   the gate reports green while the map sends a maintainer to the wrong doc.
-- **Changing an area obliges the same change to update every doc listed for it.** Not a follow-up,
-  not a later cleanup pass.
+- **Changing an area obliges the same change to review every doc listed for it.** Review fan-out is
+  unchanged by contract authority: update the authority when the shared contract changes, and update
+  a dependent only when its local explanation or consequence changes. A reviewed document whose
+  content remains accurate does not need copied unchanged prose.
 - Describing an area means naming a path inside it. If a doc explains a subsystem without ever citing
   a path, the map cannot see it, and the area lands in `grace.undocumentedSourceAreas` instead — which
   is a signal to add the path reference, not a place to park work.
@@ -62,6 +64,16 @@ What the map still does not do: it cannot tell you that two docs describe the sa
 contradictory words. Avoiding that is a review judgement. Prefer one statement and a link over two
 statements that will drift apart.
 
+Cross-cutting authority is declared by the optional versioned `contracts` object in
+[`manifest.json`](manifest.json). Each entry has a stable kebab-case `id`, one `owner` with a
+manifest-declared document and heading anchor, and a `dependents` array of manifest-declared
+documents. Every dependent links the exact owner anchor. The registry supplements the source map;
+it never narrows which documents a source change requires review of.
+
+The gate proves declared topology: identifiers are unique, files and anchors exist, and each
+dependent carries the declared link. It does not compare prose or prove that the owner statement is
+behaviorally correct. Those remain review judgements.
+
 ## Decision records
 
 `decisions/ADR-NNNN-<slug>.md` holds the reasoning: intent, prior constraints, alternatives, the
@@ -103,8 +115,10 @@ violated is worse than admitting the gap: it converts an open question into fals
 
 1. Write or move the file.
 2. Add or update its `manifest.json` entry: `path`, `tier`, `title`, `scope`, `documents`.
-3. `bun run structure:index` to regenerate [`INDEX.md`](INDEX.md).
-4. `bun run structure:check` until it is green.
+3. Add or update any affected contract authority and dependent links in `manifest.json`; review every
+   document mapped to the changed source area even when its text remains accurate.
+4. `bun run structure:index` to regenerate [`INDEX.md`](INDEX.md).
+5. `bun run structure:check` until it is green.
 
 ## What the gate checks
 
@@ -128,12 +142,17 @@ verifies that:
 - every bound invariant names an existing test that names the id back, and every unbound one is
   recorded with a reason;
 - every `src/` directory and top-level module is described by a doc or recorded as undescribed;
+- contract ids are unique, owner and dependent documents exist in the manifest, owner anchors exist,
+  and every dependent links its declared authority without listing the owner as a dependent;
 - the manifest itself parses and has the shape the gate expects, reported as a failure rather than a
   stack trace;
 - `overview.md` exists, because its absence would otherwise silence every invariant check at once;
 - `INDEX.md` matches what the manifest generates, compared after newline normalisation so a CRLF
   checkout is not a failure.
 
+Contract checks establish declared authority and links only. They make no automatic claim that an
+owner's prose is semantically complete or that a dependent's explanation is behaviorally correct.
+
 Checks are scanned with fenced code blocks removed, so an example inside a fence does not trip a rule
 it is only illustrating.
 
diff --git a/structure/INDEX.md b/structure/INDEX.md
index eb711acb5c3..cd101960def 100644
--- a/structure/INDEX.md
+++ b/structure/INDEX.md
@@ -85,8 +85,7 @@ Background service, docs, release, and design discipline.
 ## Which doc describes which source
 
 A source area can be described by more than one doc, because these docs are organised by topic and
-`src/` is organised by module. Changing an area obliges the same change to update every doc listed
-for it; see [`AGENTS.md`](AGENTS.md).
+`src/` is organised by module. Changing an area requires review of every listed document. Edit only the documents whose local explanation changes; named cross-cutting authorities and dependents are listed below.
 
 | Source path | Described by |
 | --- | --- |
@@ -124,6 +123,7 @@ for it; see [`AGENTS.md`](AGENTS.md).
 | `src/router.ts` | [`runtime.md`](runtime.md) |
 | `src/routing/` | [`catalog.md`](catalog.md) |
 | `src/server/` | [`runtime.md`](runtime.md)<br>[`catalog.md`](catalog.md)<br>[`subagents.md`](subagents.md)<br>[`transports/byte-accounting.md`](transports/byte-accounting.md)<br>[`transports/responses.md`](transports/responses.md)<br>[`transports/streaming-health.md`](transports/streaming-health.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`data-planes/images.md`](data-planes/images.md)<br>[`data-planes/inbound-compat.md`](data-planes/inbound-compat.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md)<br>[`adapters/registry.md`](adapters/registry.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
+| `src/server/index.ts` | [`adapters/compatibility-lab.md`](adapters/compatibility-lab.md) |
 | `src/service.ts` | [`runtime.md`](runtime.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `src/service/` | [`runtime.md`](runtime.md) |
 | `src/stall-timeout.ts` | [`runtime.md`](runtime.md) |
@@ -146,6 +146,16 @@ for it; see [`AGENTS.md`](AGENTS.md).
 | `src/sidecar/` | no doc names a path here; ops/service-and-sidecars.md describes sidecar behavior in prose only |
 | `src/types/` | shared declarations plus the tool-name and wire-pin resolvers, which no doc currently describes |
 
+## Cross-cutting contracts
+
+Source review remains defined by the source-to-doc map above. This registry names each authoritative statement and the documents that review it. Link validation proves declared topology, not behavioral correctness.
+
+| Contract | Authority | Review dependents |
+| --- | --- | --- |
+| `paginated-history-writer` | [`codex-home.md#paginated-history-writer-boundary`](codex-home.md#paginated-history-writer-boundary) | [`catalog.md`](catalog.md)<br>[`config.md`](config.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md)<br>[`providers/openai-tiers.md`](providers/openai-tiers.md)<br>[`runtime.md`](runtime.md)<br>[`subagents.md`](subagents.md) |
+| `request-copy-accounting` | [`transports/byte-accounting.md#request-copy-accounting`](transports/byte-accounting.md#request-copy-accounting) | [`adapters/registry.md`](adapters/registry.md)<br>[`catalog.md`](catalog.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`data-planes/images.md`](data-planes/images.md)<br>[`data-planes/inbound-compat.md`](data-planes/inbound-compat.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md)<br>[`overview.md`](overview.md)<br>[`providers/chat-compat.md`](providers/chat-compat.md)<br>[`providers/cursor.md`](providers/cursor.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md)<br>[`runtime.md`](runtime.md)<br>[`subagents.md`](subagents.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`transports/streaming-health.md`](transports/streaming-health.md) |
+| `stream-buffer-accounting` | [`transports/byte-accounting.md#stream-buffer-accounting`](transports/byte-accounting.md#stream-buffer-accounting) | [`adapters/registry.md`](adapters/registry.md)<br>[`catalog.md`](catalog.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`data-planes/images.md`](data-planes/images.md)<br>[`data-planes/inbound-compat.md`](data-planes/inbound-compat.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md)<br>[`overview.md`](overview.md)<br>[`providers/chat-compat.md`](providers/chat-compat.md)<br>[`providers/cursor.md`](providers/cursor.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md)<br>[`runtime.md`](runtime.md)<br>[`subagents.md`](subagents.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`transports/streaming-health.md`](transports/streaming-health.md) |
+
 ## Decision records
 
 Superseded reasoning lives in `decisions/` as numbered records. A doc states the contract that holds now and
diff --git a/structure/adapters/compatibility-lab.md b/structure/adapters/compatibility-lab.md
index a1633860a0e..840e00007db 100644
--- a/structure/adapters/compatibility-lab.md
+++ b/structure/adapters/compatibility-lab.md
@@ -1,5 +1,23 @@
 # Compatibility Lab
 
+## Core isolation and synchronous activation
+
+The protected core request-path files carry no load-time import chain into Lab runtime code:
+the guard in `tests/lab/core-lab-boundary.test.ts` walks static imports, side-effect imports,
+and re-exports transitively from the guard-owned `PROTECTED` list and prints the offending
+chain on failure. A dynamic `import()` is a deferred edge the walk deliberately does not
+follow, because lazy loading behind a namespace or activation check is the sanctioned remedy —
+so the same guard separately forbids a protected file from naming Lab even in a direct dynamic
+import. The ordinary no-Lab path therefore executes no Lab code, while the management plane can
+still route `/api/lab` lazily through a non-Lab module without weakening the rule.
+
+`src/server/index.ts` is deliberately exempt as the composition root: Lab activation stays
+behind `labActivationRequired`, and the window from `Bun.serve` through the `startServer`
+return contains no suspension, so a policy route can never be evaluated before its evidence
+provider is registered and the subagent fallback chain keeps the operator-configured model.
+This contract is [INV-LAB-01](../overview.md#non-negotiable-invariants), bound to the same
+guard test.
+
 ## CL-03 live-route execution boundary
 
 CL-03 live-route evidence is generated only for an exact `RouteSubjectV1` and remains separate from protocol-conformance and task-effectiveness evidence.
diff --git a/structure/adapters/registry.md b/structure/adapters/registry.md
index 34d04d9eb66..28a464e3e03 100644
--- a/structure/adapters/registry.md
+++ b/structure/adapters/registry.md
@@ -39,6 +39,9 @@ Some adapters share another adapter's routed-tool semantics while retaining inde
   does not. `devin-cli` survives only as a deprecated alias — `ocx login devin-cli` routes to
   `devin`, and a startup merge migration rewrites any saved row still keyed under the old
   provider id, so the registry carries one Devin provider, not two.
+  Its `GetChatMessage` inference POSTs, including the two bounded pre-output stated-reset
+  replays, pass through the request's provider executor and shared physical-send budget.
+  Catalog and JWT RPCs remain adapter support traffic rather than inference sends.
   `AdapterFactoryContext.providerId` still tells the shared adapter which configured row it is
   serving: the Cognition tenant is recorded on the credential, not in the registry, so the
   adapter has to know the row before it can resolve a host. That adapter advertises bare local
@@ -49,14 +52,28 @@ Some adapters share another adapter's routed-tool semantics while retaining inde
   adapter accepts them on return. One tool's canonical identity can be another tool's advertised
   local name, and resolving that name to either owner would dispatch the call to a tool the caller
   may not have named, so it is treated as ambiguous and fails before dispatch too.
+  Assistant reasoning replay likewise follows the Cognition wire shape. One history prompt carries
+  a single thinking/signature pair, so every block with text is replayed at #11 and #12 is attached
+  only when the text being replayed is the text that signature attests — the single-block case.
+  Several independently signed blocks send the joined chain unsigned rather than pairing one
+  block's attestation with another block's words, and rather than dropping reasoning the turn
+  produced to keep a pair. A signature-only block carries encrypted thinking that is not replayed,
+  so it contributes neither the text nor the signature. The signature is replayed only when the
+  source envelope actually carried one: the serialized reasoning item the Responses parser parks
+  on unsigned thinking parts is provider state, not an attestation, and
+  `isProviderIssuedThinkingSignature` in `src/responses/reasoning-envelope.ts` denies that one
+  shape beside the code that writes it. It is a deny-list rather than a guess at what an opaque
+  token looks like; the stricter base64 allow-list in `src/adapters/anthropic.ts` is a fact about
+  Anthropic's wire and is not assumed of Cognition's.
 
   There is no second Devin transport. An Agent Client Protocol adapter that spawned a local
   `devin acp` child once existed under the `devin-cli` adapter id and was removed: the CLI's
   credential turned out to be the ordinary cloud token, so the child process bought nothing that
   importing the token did not, and it cost a placeholder `buildRequest`, a disabled
   `parseStream`, an identity-only `baseUrl`, and a subprocess running in the operator's tree.
-  `projectDevinCliAuthMode` rewrites any saved row that still names the retired adapter id,
-  alongside the merge migration that retires the `devin-cli` provider id itself.
+  The merge migration rewrites the canonical `devin-cli` provider id. A custom-named row that
+  still names the retired adapter is left on that unknown id so requests fail closed until the
+  operator explicitly selects `devin` and configures Devin authentication.
 
   Before spending a chat roundtrip the adapter runs a catalog pre-flight:
   `src/adapters/devin/cloud-direct/catalog.ts` fetches `GetCascadeModelConfigs` and preserves
@@ -102,6 +119,10 @@ Do not add a second switch/list of adapter factories in request routing. Focused
 
 This decision does not change routed `apply_patch` behavior, Cursor structured-edit conversion, Azure/MiMo request construction, or provider wire selection. Those behaviors remain owned by their existing modules and focused tests. The registry exposes the universe and semantic relationships; the next stack layer consumes that metadata for generic conformance.
 
+Registry selection neither derives nor consumes Google's endpoint-scoped
+[tool-schema loss report](../providers/google.md#google-tool-schema-loss-reporting). That report is
+owned by the selected adapter's final compiler and cannot affect adapter selection.
+
 The shared Responses path follows the [bounded multipart recovery contract](../subagents.md#multipart-encrypted-task-recovery); credential admission and retry policy remain unchanged.
 
 ## Moonshot `$ref`-with-siblings normalization
@@ -156,7 +177,7 @@ Combo child requests normalize effort and thinking controls against the selected
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
@@ -206,3 +227,9 @@ Native steering generation overrides, explicit public-API eligibility and the co
 Unicode pattern normalization uses [copy-on-write traversal](../transports/byte-accounting.md#unicode-pattern-normalization) while preserving the existing schema and wire semantics.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+## Devin image boundary
+
+The registered Devin implementation in `src/adapters/devin.ts` maps data URLs to its native image field. Its textual fallback accepts only bounded HTTPS references and emits a fixed-size omission marker for unsupported or oversized values.
+
+A [compaction routing override](../transports/responses.md#compaction-routing-overrides) selects its target before adapter resolution and uses the existing registry factory.
diff --git a/structure/catalog.md b/structure/catalog.md
index 0e3fe224dd6..e74edcb8adb 100644
--- a/structure/catalog.md
+++ b/structure/catalog.md
@@ -22,6 +22,25 @@ validation-pending. Import alone supplies no entitlement evidence for the model
 
 ## Shared catalog
 
+Static policy and observed catalog evidence are separate authorities.
+`src/providers/resolved-model-policy.ts` resolves and freezes only registry/operator static facts,
+hard wire pins, aliases, and explicit false/empty declarations. Discovery responses, generated
+metadata, cache freshness, availability, credentials, account state, quota and health never enter
+that result. A catalog consumer may pass observed context, max-input, or max-output values to the
+resolver's call-local limit projection; the lower observed/static value wins, and an observed value
+may fill an absent static one only inside that call-local projection — the frozen static policy is
+unchanged and never widened — max input never exceeds the resolved context window, and the
+projection mutates neither input. Gather admission freezes an enriched provider
+snapshot before discovery; per-model hint projection resolves from that snapshot, so no post-admission
+registry read can change a running gather flight.
+
+Policy is keyed by the final upstream wire model. Public alias and virtual-model identities remain
+diagnostic/catalog provenance and must be resolved before policy capture. Exact nonempty explicit
+input-modality declarations outrank the registry/config modality map; an empty declaration
+falls through to that map.
+Anthropic numeric point releases inherit the nearest configured family context window before the
+provider-wide fallback. Exact model output limits precede the provider default output limit.
+
 `src/codex/catalog.ts` builds a shared Codex-shaped catalog for CLI, TUI, App, and SDK. It:
 
 - preserves native OpenAI entries from the live catalog or static fallback, and emits
@@ -86,6 +105,14 @@ keeps a combo's advertised intersection aligned with the final custom row withou
 provider-native row or inventing capabilities for other models. Public custom-row materialization
 and routed-slug deduplication remain the final catalog owner's responsibility.
 Codex's native `ultra` mode is preserved and is not a literal API wire promise.
+
+Selector decode hints are identity evidence and nothing else. `knownModelIdsForProvider` unions
+the configured models, the registry's static list, the native ids the registry's classified
+model-keyed maps name (`src/providers/registry/model-ids.ts`), the last-known-good discovery
+cache and custom model ids, so an id declared only in a policy map still round-trips through an
+encoded selector. A hint publishes no catalog row, grants no availability or entitlement and
+confers no transport authority: the registry transport identity is checked before hints are
+read, and an ambiguous selector is still rejected rather than guessed.
 When account selectors are enabled, the sync path may also observe exact, visible, API-supported
 OpenAI-family ids from Codex's user-owned catalog/cache. Only rows with native catalog provenance
 are trusted; unknown ids are carried through startup cache invalidation as hidden observations and
@@ -177,9 +204,18 @@ Each `startServer` invocation owns a private, one-shot readiness gate created be
 binds. `handleStart` supplies its gate and transitions it only after the shared catalog sync and
 best-effort Claude Code roster reconciliation have both settled. The catalog sync remains the
 authority for ready versus failed; a roster warning does not make an otherwise healthy proxy fail.
-Calls without a supplied gate receive a fresh private gate that intentionally remains pending. Only
-`ok: true` with no nonempty warning becomes ready; `null`, a throw, `ok !== true`, or a nonempty
-warning becomes failed. State is isolated per server instance.
+Calls without a supplied gate receive a fresh private gate that intentionally remains pending.
+`ok: true` becomes ready; `null`, a throw, or `ok !== true` becomes failed. State is isolated per
+server instance.
+
+A nonempty catalog-sync `warning` does not become failed. `ok` is the sync's verdict on the
+essential work (write admission and config injection); `warning` names a degradation of artifacts
+in the local Codex home that the sync deliberately continued past — no catalog source, omitted
+combos, a conversation-history relabel left to Codex's own writer, or a caught catalog-refresh
+exception after which injection still runs. None of those stops the process from serving HTTP or
+routing to a provider. Treating them as terminal is what #5181 reported: a single-replica
+Kubernetes deployment lost its only Service endpoint while every non-Codex route stayed healthy.
+This is the same boundary the Claude roster reconciliation already has, applied to the catalog sync.
 
 Exact unauthenticated `GET /readyz` returns sanitized identity fields plus pending, ready, or failed:
 `200` for ready, or `503` with `Retry-After: 1` for pending and terminal failed. The full CLI syntax
@@ -448,9 +484,7 @@ its defaults and exclusions are owned by [Responses transport](transports/respon
 
 Provider `showThinkingSummary` is a Responses request default; it does not rewrite catalog summary defaults or client configuration. See [Google summaries](providers/google.md).
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Codex pool settings and their consumers follow the [reset-first ordering contract](providers/openai-tiers.md#reset-first-account-ordering), including independent-quota fallback, preserved affinity, strategy-specific threshold summaries, and shared short-observation freshness for switch warnings.
 
@@ -485,3 +519,6 @@ Native steering retains fixed phase deadlines and reconciled replay output; see
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](gui-and-management-api.md#fast-selector-rows-setting).
+
+Compaction routing selects its configured model at Responses ingress under the
+[compaction routing contract](transports/responses.md#compaction-routing-overrides). Catalog selection remains conversation-owned.
diff --git a/structure/clients/claude-desktop.md b/structure/clients/claude-desktop.md
index e7edb67892c..3aec2c2d3cc 100644
--- a/structure/clients/claude-desktop.md
+++ b/structure/clients/claude-desktop.md
@@ -190,3 +190,5 @@ Native steering retains fixed phase deadlines and reconciled replay output; see
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](../transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+The [compaction routing override](../transports/responses.md#compaction-routing-overrides) is scoped to Codex Responses metadata and original Responses ingress; Claude Messages replay retains its own routing.
diff --git a/structure/clients/integrations.md b/structure/clients/integrations.md
index bbdd23646d4..402a60e07f0 100644
--- a/structure/clients/integrations.md
+++ b/structure/clients/integrations.md
@@ -22,7 +22,8 @@ parsing and ownership rules below.
 | `src/integrations/state.ts` | The single `absent` / `current` / `stale` / `conflict` / `unsafe` classifier used by status and every writer operation. |
 | `src/integrations/ownership.ts` | Durable ownership records: file, generated contribution, protected contribution, exact fragment paths, and operation identity. |
 | `src/integrations/ownership-policy.ts` | Client-scoped declarations for fields a client is documented to derive after apply. It must never contain a broad format-wide exemption. |
-| `src/integrations/writer.ts` | Apply, refresh, disable, and restore transactions, including snapshot-first ordering, compare-before-commit, and compensation. |
+| `src/integrations/writer.ts` | Apply, refresh, disable, and restore transactions, including snapshot-first ordering, compare-before-commit, and compensation. Freezing an input copies the proxy configuration and the model roster as plain data before the first await, so the plan a revalidation approves and the document that follows it read one input; an input that cannot be copied is refused rather than read twice. Aside captures the same configuration copy when its context is created, because its preference write edits the live configuration between the check and the profile writes. |
+| `src/integrations/mutation-plan.ts` | The shared observation both a preview and a mutation read, and the value-free plan an operator confirms. It owns no IO of its own, takes no lock, and must never import `writer.ts`. |
 | `src/integrations/store.ts` / `journal.ts` | One-root persistence for ownership records, operation history, snapshots, and retention maintenance. |
 
 ## Data Flow
@@ -43,6 +44,60 @@ Status and mutation must use the same classifier. A special case added only to a
 would be misleading because refresh or disable could still reject the same file; a special case
 added only to a writer would let a mutation bypass the state users saw.
 
+## Read-only mutation plans
+
+An operator confirming apply, overwrite, disable or undo is agreeing to consequences they were
+never shown. A plan is what shows them, and it is only trustworthy if it describes the operation
+that will actually run.
+
+One observation serves both. `mutation-plan.ts` owns the read, parse, contribution build, record
+selection and classification that the writer used to perform itself, so a preview and the mutation
+it authorizes cannot disagree. The direction is strict: state, ownership and merge feed the plan;
+the plan feeds the writer and the preview routes. The plan module must never import the writer.
+
+Preview and mutation differ in exactly two ways, and both are declared rather than implied.
+Pending-prune maintenance and client transaction recovery each write, so they are explicit options
+with no default that a preview passes as false. And a preview takes its model roster from the
+retained export snapshot instead of gathering one, because discovery refreshes credentials and
+writes the provider cache. With no usable snapshot the request is refused, which covers a cold
+process and equally a snapshot retired because the configuration or the provider cache moved. The
+roster is gathered and projected from a detached copy of the configuration
+(`src/config/admitted-identity.ts`) taken before the gather, so an edit that lands mid-load changes
+neither half of the result; the same admission is revalidated against the resident object and the
+configuration file before anything is retained, so such an edit leaves no snapshot rather than one
+recorded under a state its rows never had. The identity a caller carries between a preview and the
+mutation that confirms it is process-local and opaque, and describes nothing about the
+configuration. The
+Integrations collection read populates one when discovery succeeds and the configuration can be
+identified, so the page an operator opens before confirming anything is the usual way back rather
+than a guarantee.
+
+Each operation is decided the way that operation decides it. Apply checks installation and
+admission before the classifier and reports a conflict ahead of unsafe; disable asks neither,
+because removing what we wrote from a file that still exists is meaningful regardless of
+installation; restore reads the journal row and the target's bytes and never parses, so a file
+that is readable but unparseable is still restorable. An operation that would write nothing says
+so and names no places.
+
+Published paths are declared, not inferred. Every client states where its managed fragments live,
+a path is emitted only on an exact template match, and the string emitted is the template rather
+than the observed path, so a dynamic position renders as a wildcard and a value cannot leak. A
+path outside the declaration is refused rather than described: an ownership record accepts
+arbitrary strings and is not a validation authority.
+
+The fingerprint covers every input the decision rests on, including the roster, the observed
+install kind and the admission predicate, and for restore the snapshot's actual bytes rather than
+only its operation id. A confirmed mutation re-plans the coordinator's frozen input with the lock
+held, before any snapshot, write or journal row, and separately checks that the snapshot it
+captured is still current; the roster and that identity are read together so the check cannot
+validate one snapshot while the mutation writes another. Aside is the exception that proves the
+placement: it persists preferences and imports journal rows before any writer lock, so its check
+runs once profile and path selection is frozen and before those writes.
+
+The fingerprint is an optimistic token, never authorization. Management authentication and every
+ownership rule still decide whether a mutation may happen, and the writer's own
+compare-before-commit guard is unchanged.
+
 Gajae export and managed refresh share the loopback-only provider builder. It writes the
 non-secret `LOOPBACK_API_KEY_PLACEHOLDER` as `apiKey`, so the client can activate the provider
 without a separately populated environment variable. The managed contribution owns only the
diff --git a/structure/codex-home.md b/structure/codex-home.md
index 940aa57afeb..c7a6ef5248f 100644
--- a/structure/codex-home.md
+++ b/structure/codex-home.md
@@ -311,7 +311,7 @@ management read degrades instead of returning an error page.
 
 ## Paginated history writer boundary
 
-`src/codex/history-provider.ts` rejects provider-history changes with `history_paginated_requires_native_writer` when a target begins with an ordinal-bearing record, later contains a paginated record after a legacy start (#4311), or declares `history_mode=paginated`. The first line alone is not sufficient: a rollout that started unnumbered and was later migrated is also refused. Apply, manifest-backed restore, and explicit legacy recovery preflight all selected targets before changing database rows or manifests. The append boundary checks again. Codex owns ordinal allocation and the live projection cursor; reading the last ordinal and appending N+1 is not safe concurrent coordination. Legacy unnumbered rollouts retain their existing behavior. This guard prevents the observed stable-format corruption; it does not implement native-writer integration.
+`src/codex/history-provider.ts` rejects provider-history changes with `history_paginated_requires_native_writer` when a target begins with an ordinal-bearing record, later contains a paginated record after a legacy start (#4311), or declares `history_mode=paginated`. The first line alone is not sufficient: a rollout that started unnumbered and was later migrated is also refused. Apply, manifest-backed restore, and explicit legacy recovery preflight all selected targets before changing database rows or manifests. The append boundary checks again. Codex owns ordinal allocation and the live projection cursor; reading the last ordinal and appending N+1 is not safe concurrent coordination. Legacy unnumbered rollouts retain their existing behavior. History Worker targets resolve the canonical manifest first and an existing pre-normalization Windows filename second, so passing an explicit target cannot bypass upgrade recovery. This guard prevents the observed stable-format corruption; it does not implement native-writer integration.
 
 Injection preflights affected history using the normalized config candidate before writing config/profile/journal, then checks again after the complete artifact write. Native restore also rechecks after successful journal restoration or fallback removal, while exact config/profile/journal preimages and any coordinated remove transaction remain available for compensation.
 
diff --git a/structure/config.md b/structure/config.md
index 04520f2cd07..5d68a5ad766 100644
--- a/structure/config.md
+++ b/structure/config.md
@@ -28,6 +28,11 @@ deduplication and credential storage separately from Codex config injection.
 
 ## Config surface
 
+Google providers may persist `googleToolSchemaPolicy` as `compatible` or `reject-lossy`.
+`ocx provider add --google-tool-schema-policy` is one authoring path and is accepted only when the
+effective adapter is `google`. Omission remains absent in `config.json`; the adapter resolves it to
+`compatible` in memory.
+
 ### OpenCodex home and live process state
 
 `initializePersistedConfigIfMissing` in `src/config.ts` is the create-only path consumed by
@@ -79,9 +84,10 @@ matters for maintainers is which groups exist and who resolves them:
 | --- | --- | --- |
 | Listener | `port`, `hostname` | The listener owns the port; `runtime-port.json` reports where it actually landed. |
 | Routing | `defaultProvider`, `providers`, per-provider `selectedModels`, `combos` | Explicit `provider/model` wins over `defaultProvider`; combo dispatch uses the selected target's existing capability ladder and does not create a second catalog authority. |
+| Compaction routing | `compactionRouting.model`, optional `compactionRouting.reasoningEffort`, optional `compactionRouting.triggers` | Explicit Codex compaction metadata whose `compaction.trigger` is one the block names activates a request-local override; `triggers` defaults to `["manual"]`. See [Responses compaction](transports/responses.md#compaction-routing-overrides). Invalid hand edits disable the block with a load warning without discarding providers; candidate writes reject invalid blocks. |
 | Catalog | `disabledModels`, `customModels`, `modelCacheTtlMs`, `providerContextCaps`, `contextCapValue`, per-provider `modelDisplayNames`, `codexAccountNamespaces`, `codexAccountPickerEnabled` | Catalog state is derived; config only records intent. Exact provider model display names are durable display only overlays. The picker flag is an explicit visibility override, while selector mappings remain the durable exact-routing contract. |
 | Retained state | `appOwnedMemoryBudgetMb` | Process-wide eviction target for app-owned logs, caches, blobs, and continuation payloads. Default 256 MiB, valid 64..4096; pinned state may temporarily exceed the target, but every pin-capable store has a finite local cap and their documented aggregate stays below `APP_OWNED_WORST_CASE_PINNED_BYTES` (512 MiB). Neither value caps RSS or native runtime memory. |
-| Spend | `spend.root`, `spend.identity`, `spend.pool`, `spend.retentionDays` | Durable token ceilings for the spend-reservation ledger. Absent is the default and means observe-only accounting: spend is journaled and nothing is refused. There is no default figure for any scope — the ledger is on by default, so a shipped ceiling would refuse real traffic on upgrade against a number nobody chose. Strictly validated and positive-integer only, because 0 would read as a budget and refuse everything; a malformed section degrades to no ceiling, which is why the write path rejects it and load diagnostics report it. Resolution and application live in `src/lib/spend-reservation-ledger.ts`; see [`transports/responses.md`](transports/responses.md). |
+| Spend | `spend.root`, `spend.identity`, `spend.pool`, `spend.retentionDays` | Durable token ceilings for the spend-reservation ledger. Absent is the default and means observe-only accounting: spend is still journaled and nothing is refused, so observe-only and enforced servers take the same state-directory writer lease. One live process may write one directory; explicit sibling instances need separate `OPENCODEX_HOME` directories. There is no default figure for any scope — the ledger is on by default, so a shipped ceiling would refuse real traffic on upgrade against a number nobody chose. Strictly validated and positive-integer only, because 0 would read as a budget and refuse everything; a malformed section degrades to no ceiling, which is why the write path rejects it and load diagnostics report it. Resolution and application live in `src/lib/spend-reservation-ledger.ts`; see [`transports/responses.md`](transports/responses.md). |
 | Transport | stream mode, timeouts, proxy settings, `websockets`, `emptyCompletionRetry` | `streamMode` persists in config.json; Windows services need a persisted input, and macOS uses it for explicit eager-relay opt-in. Empty-completion replay is an explicit top-level opt-in because its second upstream request may be billable. |
 | Credentials | `apiKeys` | Data-plane only; never admitted to `/api/*`. |
 | Lifecycle | `codexAutoStart`, shim/start behavior, resume-history sync, storage cleanup | Startup safety reads these; see [`gui-and-management-api.md`](gui-and-management-api.md). |
@@ -191,7 +197,7 @@ that prefix hashed to a different backup filename before the normalization, so t
 (`history-provider.ts` for mutation, `native-residue.ts` for observation) fall back to the
 legacy filename when no canonical manifest exists. When both names exist the canonical manifest
 wins and the legacy file is left in place; a conflict is never resolved by silently replacing
-either file.
+either file. History Worker job targets use that same canonical-first lookup rather than passing a canonical-only filename that would bypass the provider's legacy fallback.
 
 `history-provider.ts` remains the strict mutation owner and maps shared validation failures to its
 restore/no-op integrity states. `native-residue.ts` remains a read-only observer and maps the same
@@ -221,6 +227,12 @@ describes a store that may be relabelable on the next attempt, so those keep the
 and the compensating rollback. Recording them as a stand-down would mark the transition
 converged and suppress the relabel permanently.
 
+That stand-down applies only when the provider tags left in place still resolve through the
+resulting configuration. A provider-table transition that finds a paginated `openai` row returns
+`history_paginated_openai_requires_native_writer` and refuses the artifact transaction: removing
+the root `openai_base_url` without relabeling that row would route a resumed conversation through
+Codex's built-in OpenAI provider instead of this proxy.
+
 Rows this home tagged `opencodex` resolve through a `[model_providers.opencodex]` table.
 Apply retains that existing definition before building the candidate witness, even when
 history preflight passes. The root-override form still selects the built-in provider for new
@@ -309,6 +321,38 @@ Both fields must stay positive finite integers at disk-config and management val
 Registry entries may seed them through `providerConfigSeed`, key-login derivation, OAuth reconcile,
 and `routeModel`, but user config overrides registry defaults per field/key.
 
+`src/providers/resolved-model-policy.ts` is the detached static-policy authority for this merge
+contract. It preserves each field's existing rule rather than assigning one global priority:
+operator scalars and explicit booleans fill over registry defaults, per-model maps fill per key,
+restriction lists form a stable union, and hard wire pins precede valid operator overrides and
+registry wire defaults. Only the canonical `openai-apikey` provider merges
+`modelContextWindows` and `modelMaxInputTokens` by taking the lower positive value; other
+providers use ordinary operator-per-key fill. Its output is recursively
+frozen and carries field/model provenance. It never persists resolved policy and excludes API keys,
+account selection, quota, health, cooldowns, discovered availability, and request-owned evidence.
+Observed context/input/output values are combined only in a call-local projection that can narrow a
+captured static cap but cannot write observations into the static result.
+The resolver's model id is the post-alias, post-virtual-rewrite wire identity. An exact nonempty
+`modelCapabilities[model].inputModalities` declaration outranks the legacy per-model modality map;
+an empty declaration is non-authoritative and falls through. OAuth/key override admission remains a
+live caller decision: the resolver accepts only its credential-free effective auth mode and records
+that provenance, never the key, reference, or usability evidence that produced it.
+Canonical static catalogs force live discovery off, narrowly recognized generated reasoning shapes
+are repaired before freezing only for a matched registry transport, and same-named custom
+destinations keep their operator-owned values. Key-auth service-tier defaults apply only to a
+captured key authority; exact-model provenance comes from the merged key/registry map, then falls
+back to the resolved provider capability provenance. A model max-input value is bounded by its
+resolved context window.
+Legacy model maps resolve exact id, then the base before a colon suffix, then case-folded exact id;
+the separately captured explicit capability row remains exact-only. Per-model provenance is assigned
+from the key that wins that same merged lookup, not from an independent source search.
+Provider seed/enrichment and request routing consume the same field-level resolver. Persisted config
+still stores operator intent rather than the frozen result; registry-only policy is applied at
+capture/route time and explicit false or empty declarations retain their field-specific meaning.
+
+
+
+
 ## Provider validation ownership
 
 `src/config/provider-validation.ts` owns the pure provider payload checks shared by persisted config,
@@ -317,6 +361,9 @@ and re-exports them as a compatibility facade; it must not grow a second copy. V
 ordering, and cross-field rules are part of the write/load contract because management requests and
 hand-edited `config.json` must accept and reject the same provider shapes.
 
+The Google tool-schema policy uses a closed enum at this boundary. Unknown values fail config load,
+management admission, and command-line creation rather than silently degrading to compatible mode.
+
 > Decision record: [ADR-0020](decisions/ADR-0020-provider-validation-ownership.md)
 
 ## Provider relative send paths
@@ -408,9 +455,7 @@ so any not-served-here answer stays legible rather than printing a bare token. `
 `src/cli/models-runtime.ts` narrows the opposite case: only a 404 without those keys is the
 management handler's own unknown-id answer, and it names the id and `ocx models list-custom`.
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates detected migration. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. See the [history writer contract](codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Private pool credential metadata follows the [quota-history publication identity contract](providers/openai-tiers.md#quota-history-publication-identity); credential-only and account DTO projections omit it.
 
@@ -441,10 +486,37 @@ Display-name validation retains prototype-shaped model IDs as data; reviewer-tar
 
 The text-only consumer reads exact inputModalities declarations before legacy hints. CLI add/edit `--text-only` targets one model and preserves sibling declarations; `src/vision/eligibility.ts` routes declared text-only models into existing image-description or explicit-omission handling. Positive routed image declarations override stale candidate metadata, while native catalog authority retains its existing legacy policy.
 
+An explicit custom row is the operator's own definition of one routed model, so its
+`customModels[].inputModalities` outranks the provider-level vision hints
+(`noVisionModels`, `modelInputModalities`) for that exact `provider`/`modelId` identity.
+`modelCapabilities` keeps the top slot as the dedicated capability axis, including for the
+`ocx provider edit --text-only` write. The catalog overlay in
+`src/codex/catalog/routed-gather.ts` copies that declaration onto the advertised row directly,
+and the request-path predicates in `src/vision/eligibility.ts` and `src/vision/plan.ts` read the
+same field through `customRowInputModalities`, so an advertised row and the dispatch decision can
+no longer disagree about one model. A custom row that declares no modalities stays silent rather
+than becoming a text-only claim.
+
+Every consumer that answers "can this model take an image" applies one rule to the declaration:
+image is absent from the list. A row declaring only `audio` or `video` therefore counts as
+image-incapable in both `requiresVisionPreprocessing` and `modelAcceptsImageInput`, rather than
+being treated as a text model by one and an image target by the other.
+
 ## Catalog auto-refresh
 
 `catalogAutoRefresh` on `src/types/config.ts` stores an optional `enabled` / `intervalMinutes` section that defaults off: an absent key, an explicit false, and a malformed value all leave the scheduler dormant. `src/config/feature-flags.ts` resolves the cadence; an explicit `intervalMinutes: 0` keeps the unref'd timer idle, and any other value is clamped up to 15 minutes because upstream `/models` caches have not moved below that and a shorter tick only multiplies rate-limit exposure. `src/codex/catalog-auto-refresh.ts` is the module-singleton interval `src/server/background-lifecycle.ts` starts beside the quota reset poller; a tick that is enabled and non-dormant drives the same catalog-only converge funnel management mutations drive. The last-outcome record lives in `src/codex/catalog-refresh-status.ts` (when the tick finished, the normalized `CatalogDisposition`, whether the served model set changed, consecutive failures) and carries no provider or account detail.
 
+## Aggregate request metrics export
+
+`metricsExport` on `src/types/config.ts` is an optional strict object with one optional boolean,
+`enabled`. `src/config/feature-flags.ts` treats only literal `true` as enabled; absence, false, or a
+malformed persisted value is off. `src/config/schema/config-schema.ts` degrades a malformed hand edit
+to absence so an optional monitoring typo cannot discard providers or credentials. The live-write
+boundary runs `metricsExportConfigError` in `src/config/diagnostics.ts` before the degrading schema,
+so wrong types and unknown nested fields are rejected rather than silently saved. Activation is read
+when the server process creates its serve options and therefore requires restart; it adds no setting
+to the live `/api/settings` mutation surface.
+
 Stored Direct substitution follows the [credential identity contract](providers/openai-tiers.md#sidecars-management-and-ui): both synchronous and asynchronous materializers discard the caller account header before applying the stored credential; ordinary native Direct passthrough is unchanged.
 
 ## SOCKS5 activation owner
diff --git a/structure/data-planes/images.md b/structure/data-planes/images.md
index b01790ff752..691b629bdc3 100644
--- a/structure/data-planes/images.md
+++ b/structure/data-planes/images.md
@@ -133,3 +133,6 @@ Native steering retains fixed phase deadlines and reconciled replay output; see
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](../transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+Image-bearing Codex history follows the selected model's existing compaction handling after a
+[compaction routing override](../transports/responses.md#compaction-routing-overrides).
diff --git a/structure/data-planes/inbound-compat.md b/structure/data-planes/inbound-compat.md
index f0e5ce5c656..e6171845efa 100644
--- a/structure/data-planes/inbound-compat.md
+++ b/structure/data-planes/inbound-compat.md
@@ -250,7 +250,7 @@ Account quota surfaces use [safe probe diagnostics](../transports/inventory.md#a
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
@@ -292,6 +292,10 @@ never fetched.
 
 ## Translated Chat control fidelity
 
+Translated Chat ingress does not reshape schemas for Google's
+[endpoint-scoped loss report](../providers/google.md#google-tool-schema-loss-reporting). The report
+is produced only at the final Google adapter boundary and does not alter the ingress body.
+
 A translated Chat turn keeps the controls the caller sent. The Chat ingress pins
 `store:false` for every `openai-responses` route and strips nothing else: the
 sampling and output-cap restrictions that the canonical ChatGPT backend requires are
@@ -346,3 +350,5 @@ Native steering generation overrides, explicit public-API eligibility and the co
 Unicode pattern normalization uses [copy-on-write traversal](../transports/byte-accounting.md#unicode-pattern-normalization) while preserving the existing schema and wire semantics.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+The [compaction routing override](../transports/responses.md#compaction-routing-overrides) requires original Responses ingress; translated Chat and Messages calls retain their own routing.
diff --git a/structure/decisions/ADR-5236-responses-http-sse.md b/structure/decisions/ADR-5236-responses-http-sse.md
new file mode 100644
index 00000000000..68bf4243e79
--- /dev/null
+++ b/structure/decisions/ADR-5236-responses-http-sse.md
@@ -0,0 +1,12 @@
+# ADR-5236 — decision recorded under "Responses HTTP/SSE"
+
+- Contract owner: [transports/responses.md](../transports/responses.md#responses-httpsse)
+
+## Decision record
+
+- 목적과 의도: Agent-generated text must not poison later native replay as trusted ciphertext.
+- 기존 구현 및 제약 조건: The proxy cannot authenticate backend Fernet tokens after full-history replay, but must preserve genuine opaque bytes byte-for-byte.
+- 검토한 주요 대안: Trust every encoded-looking string; strip every encrypted slot; require canonical Fernet structure and retain bounded rejection recovery.
+- 선택한 방식: Use Fernet structure as the unknown-history floor and one guarded recovery for the exact backend rejection.
+- 다른 대안 대신 이 방식을 선택한 이유: Loose shape grants authority to plaintext, while unconditional stripping destroys valid backend state.
+- 장점, 단점 및 영향: False positives stop before dispatch and poisoned history self-recovers once; structurally valid unauthenticated text may still need the bounded backend rejection path.
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index f5340bcfad0..5ba41a3575d 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -115,6 +115,11 @@ be treated as implemented:
 
 ## API ownership
 
+The provider editor admits `googleToolSchemaPolicy` as an editor-safe, non-secret field. Its value
+is validated as `compatible` or `reject-lossy` before live adoption and persistence; an invalid
+value changes neither state. Omission remains absent and is resolved by the Google adapter rather
+than materialized by the management API.
+
 `src/server/index.ts` authenticates and routes `/api/*`, then delegates to
 `src/server/management-api.ts`, which composes the route modules under `src/server/management/`.
 Codex account routes live in `src/codex/auth-api/routes.ts` because they own the credential store, not
@@ -138,7 +143,8 @@ this document owns is which module holds which area and what invariant that area
 | V2 / Multi-agent mode | `GET/PUT /api/v2` — reports/sets the codex `multi_agent_v2` feature flag, the 3-state `multiAgentMode` override (`v1`/`default`/`v2`), the `keepNativeChatGptOnV1` hybrid pin, and the logical maximum thread count. Selecting `v2` normally enables the native flag; with the hybrid pin it disables that global override so native rows can resolve to v1 while routed rows resolve to v2. Selecting `v1` disables the flag; `default` leaves it unchanged. PUT rejects an explicit enabled flag that conflicts with the selected mode or hybrid pin. Every transition preserves the logical thread limit, is rollback-safe, and resyncs the catalog. GET and successful PUT also return stored `multiAgentModeHintText` plus response-only `multiAgentModeHintRecommendation: { text, revision }`; the recommendation is not a writable or persisted config field. Both also return response-only `multiAgentSurfaceAdvisory: { required, mode, recommended, version, docsUrl }`, true while the resolved mode is not v1 and the stored acknowledgement version is behind; PUT accepts `multiAgentSurfaceAdvisoryAcknowledged`, where only `true` stores the current version and `false` is an explicit no-op, and it composes with a `multiAgentMode` write in the same body so the dialog's recommended answer is one request. |
 | Logs & Debug | One sidebar entry (`/#logs`) with two tabs. Logs tab: request/runtime logs for local diagnosis. `LogsFilterBar` owns controls over the shared `LogFilterState`; `filterLogs` composes filters over the loaded ring. The logs envelope adds `generatedAt` (proxy epoch milliseconds); the page advances that sample with monotonic elapsed time and retains a browser-clock fallback for older proxies. Reset returns focus to the stable All surface radio. Provider/model options include attempts, model choices match normalized complete identities, and relative-time filtering refreshes every 30 seconds while the Logs tab is active, independently of network auto-refresh. Debug tab (`/#logs/debug`; legacy `/#debug` deep links redirect there): provider + usage toggles, refresh/follow log viewer. `GET/PUT /api/debug`; `GET /api/debug/logs` and `GET /api/debug/usage-logs` (monotonic `after` cursor, legacy `since` accepted). CLI: `ocx debug provider|usage …` (both streams via running proxy API). |
 | Usage | `GET /api/usage` read-only aggregates of readable rows from `~/.opencodex/usage.jsonl`; the ledger is streamed in fixed 1 MiB chunks, so the former read-byte and parsed-row caps cannot omit its prefix. Oversized skipped rows produce positive `usageIncomplete` metadata. The response includes measured / reported / unreported / unsupported / estimated counts, a daily zero-filled grid, and model and provider breakdowns. Never exposes prompts. |
-| System | `POST /api/system/restart` restarts the proxy in place. Local CLI/tray callers first attest the exact runtime PID and port, then send a process-scoped HMAC capability bound to that method, path, PID, and port; the capability authorizes no other management route and is invalid after replacement. The caller observes one absolute deadline and accepts success only after a different runtime PID is healthy on the same port. `GET /api/system/health` is the authenticated scalar-only identity used by shared-plane Dashboard status and restart reconnect polling; it does not widen a Remote Hub management ingress to unauthenticated `/healthz`. `GET /api/system/memory` — service-process runtime/memory identity (pid, Bun version/revision, optional `bunRuntimeSource` provenance, platform, RSS/heap/external/ArrayBuffers scalars, observed memory = max(RSS, external, ArrayBuffers), `bun:jsc` heap context, streamMode + eager-relay gate decision, watchdog snapshot sliced to the last 60 samples) plus privacy-safe `appOwnedBytes` retained-store totals/counters under static store ids. Its response-state block also reports spill-write `initial`/`healthy`/`degraded` status, a consecutive-failure streak, fixed error class, and failure/success timestamps. A successful publication clears the streak in the same process; raw error text and paths never enter this surface. Scalar-only payload; dashboard/admin callers use the standard management gate, while `ocx doctor` may use only the exact process-scoped local-read capability. It must never move to unauthenticated `/healthz`. |
+| Request metrics | `GET /api/metrics` exposes process-local Prometheus text format v0.0.4 only when `metricsExport.enabled` was true at startup. The ordinary management gate applies; data-plane credentials do not grant access, and disabled mode is 404. `src/server/request-metrics.ts` owns fixed counters/histograms and receives a narrow final-request fact from `src/server/request-log.ts`; `src/server/index/serve-options.ts` creates one owner and injects the recorder and read-only snapshot into the request and management paths. |
+| System | `POST /api/system/restart` restarts the proxy in place. Local CLI/tray callers first attest the exact runtime PID and port, then send a process-scoped HMAC capability bound to that method, path, PID, and port; the capability authorizes no other management route and is invalid after replacement. The caller observes one absolute deadline and accepts success only after a different runtime PID is healthy on the same port. `GET /api/system/health` is the authenticated scalar-only identity used by shared-plane Dashboard status and restart reconnect polling; its `spendLedger` block reports only ownership held/unheld, initialized/configured/degraded booleans and bounded persistence/corruption counters. Reading it never constructs, replays or prunes the ledger. Paths, scopes, accounts and request ids are absent, and the block never moves to unauthenticated `/healthz`. `GET /api/system/memory` — service-process runtime/memory identity (pid, Bun version/revision, optional `bunRuntimeSource` provenance, platform, RSS/heap/external/ArrayBuffers scalars, observed memory = max(RSS, external, ArrayBuffers), `bun:jsc` heap context, streamMode + eager-relay gate decision, watchdog snapshot sliced to the last 60 samples) plus privacy-safe `appOwnedBytes` retained-store totals/counters under static store ids. Its response-state block also reports spill-write `initial`/`healthy`/`degraded` status, a consecutive-failure streak, fixed error class, and failure/success timestamps. A successful publication clears the streak in the same process; raw error text and paths never enter this surface. Scalar-only payload; dashboard/admin callers use the standard management gate, while `ocx doctor` may use only the exact process-scoped local-read capability. It must never move to unauthenticated `/healthz`. |
 | Stop | `POST /api/stop` — restore native Codex, stop any installed service, and exit the proxy. |
 | Diagnostics/sync | `src/server/management/config-routes.ts` — `GET /api/diagnostics/project-config` reports project-level Codex config that bypasses managed routing; `POST /api/sync` re-runs catalog/config sync. The diagnostic reports the bypass; it does not rewrite the project file. |
 | Sidecar/shadow-call settings | `src/server/management/config-routes.ts` — `GET/PUT /api/sidecar-settings` and `GET/PUT /api/shadow-call-settings`. PUT accepts model and backend (web-search union: openai/anthropic/xai/gemini/exa; xAI is live through stored Grok OAuth, while Gemini/Exa remain inert until their executors ship) plus validated `webSearch.xSearch`, optional `webSearch.exaApiKey` (write/clear only — never echoed by GET or the PUT response; redact.ts strips it from logs), `webSearch.reasoning`, `vision.reasoning`, `vision.enabled`, `vision.maxDescriptionsPerTurn`, and `vision.timeoutMs`; the read and PUT-response payload reports model, backend, reasoning, enabled, the vision per-turn limit, and timeout. `timeoutMs` is validated against the runtime integer bounds in `src/vision/timeout-bounds.ts`. Provider/OAuth credentials live in their stores; `exaApiKey` is the one sidecar-owned secret and follows the write-only contract above. Both shadow-call responses also report the resolved `sourceModels` — the prefixes the runtime actually intercepts (`src/lib/shadow-call.ts`, default `gpt-5.6-luna`; the retired `gpt-5.4-mini` stays available as an explicit `sourceModels` entry for 0.144.x clients), so no client hard-codes a helper slug that a Codex release can invalidate. |
@@ -147,6 +153,7 @@ this document owns is which module holds which area and what invariant that area
 | Models and visibility | `src/server/management/model-routes.ts` — `GET /api/models`, `PUT /api/disabled-models`, `PUT /api/model-visibility`, `PUT /api/selected-models`, `GET/POST /api/custom-models`. Visibility writes trigger catalog sync through the owning server path. |
 | Effort and fallback | `src/server/management/agent-settings-routes.ts` — `GET/PUT /api/effort-caps`, `/api/subagent-models`, `/api/subagent-model-fallback`. Caps clamp; they do not reject. |
 | Grok and Claude integrations | `src/server/management/agent-settings-routes.ts` — `GET /api/grok`, `PUT /api/grok/selection`, `POST /api/grok/apply`, `GET/PUT /api/claude-desktop`, `POST /api/claude-desktop/apply`, `GET /api/claude-desktop/status`, `GET/PUT /api/claude-code`. Apply writes an external app's profile, so its status probe must read the same resolved path it writes (see [`responses.md`](transports/responses.md)). |
+| File-integration plans | `src/server/management/integration-routes.ts` and `aside-profile-routes.ts` — `POST /api/client-integrations/preview`, `POST /api/client-integrations/restore/preview`, and `POST /api/client-integrations/aside/profiles/{profileId}/preview`. Management-authenticated, declared non-mutating, and they write nothing: no snapshot, no lock, no maintenance, no recovery. They answer `409 integration_preview_unavailable` rather than gathering a model roster, because discovery refreshes credentials and writes the provider cache. Responses carry only declared managed schema paths, closed change kinds and an opaque fingerprint; no value, filesystem location or selected member identity appears. Mutation routes accept `operation` and `planFingerprint` together or not at all, reject a half-bound request and an operation that disagrees with the change, and answer `409 integration_preview_stale` with a freshly computed plan. Binding is an optimistic token, never authorization. [The integration contract](clients/integrations.md) owns the ordering. |
 | Grok reset coupons | `src/server/management/grok-coupon-routes.ts` — `GET /api/grok/reset-coupons`, `POST /api/grok/reset-coupons/consume`. The dashboard owner is `gui/src/hooks/useGrokResetCoupons.ts` with `gui/src/components/provider-workspace/GrokResetCoupons.tsx`, wired into the xAI OAuth rows of `ProviderAuthPanel`. Redemption truth is the settled ledger `code`, not the HTTP status: a replayed failure returns 200 with `replayed: true`. See [`providers/xai-grok.md`](providers/xai-grok.md). |
 | Combos | `src/server/management/combo-routes.ts` — `GET/PUT/DELETE /api/combos` own provider combination and failover definitions. |
 | Workflow budget | `src/server/management/workflow-budget-routes.ts` — `GET /api/workflow-budget` reads the tracked roots or one root, and `POST /api/workflow-budget/clear` clears exactly one. The clear moves the windowed send ring and the child map and nothing else: `active` belongs to turns still in flight, the spend ledger is a token budget an operator did not ask to forgive, and the lifetime send total survives so a clear cannot launder the record. A refusal event carries `spendScope` and `spendLimit` when a token ceiling fired, so the reason is readable without the config open beside it; no scope id is ever attached, because root ids are client thread headers and identity ids are credentials. Both are `deferred-verb` in the route registry — they are owed CLI verbs, and because the ledger is process memory there is no local projection the CLI could read instead. See [`../devlog/_plan/260915_workflow_budget_window/030_wfc_diff_plan.md`](../devlog/_plan/260915_workflow_budget_window/030_wfc_diff_plan.md). |
@@ -442,10 +449,10 @@ observations separate from token or API-equivalent cost totals.
 
 `src/server/hub-usage.ts` serves `GET /v1/usage` on hubs for an explicit configured data key. The authenticated key selects the aggregate; query parameters cannot select an API-key identity. Unscoped environment/admin credentials and loopback bypass are not admitted. The response projects only this client's numeric totals, provider/model/day rows and incomplete-history metadata through `src/remote/hub-usage.ts`; accounts, raw records and key IDs are omitted. Unknown fields are stripped at every object boundary and the serialized body is capped at 1 MiB.
 
-Custom usage windows are immutable bounds on the streaming accumulator, applied to each
-ledger entry before attribution and daily aggregation. The filtered aggregate cache includes
-both inclusive millisecond bounds in its identity and retains the existing ledger revision,
-overlay-version and timezone checks. Preset warming never consumes custom summaries.
+Custom usage windows are immutable bounds on the streaming accumulator, applied before attribution and daily
+aggregation. The filtered cache includes both inclusive millisecond bounds in its identity and retains the existing ledger revision, overlay-version and timezone checks.
+At most four distinct filtered scans may run concurrently; identical requests share one scan and excess distinct
+work fails closed. Preset warming never consumes custom summaries.
 The response retains its preset range discriminator for compatibility and explicitly marks
 `customWindow`, `since`, and `until`; the chart uses the window's local calendar days with
 the existing 366-day cap. GUI custom reports bypass the held preset/session cache.
@@ -602,6 +609,25 @@ scan reports `false`, `0`, `false`, and `0`; clients must not interpret those fi
 
 > Decision record: [ADR-0079](decisions/ADR-0079-usage-accounting.md)
 
+## Opt-in aggregate request metrics
+
+`metricsExport.enabled` is default-off and fixed for one process lifetime. When enabled,
+`src/server/index/serve-options.ts` creates one `src/server/request-metrics.ts` owner before the
+shared fetch closure, so every listener spread records into the same bounded cells. Request logging
+calls the injected recorder once from `addFinalRequestLog`; the management route receives only a
+snapshot capability. There is no module-global active registry, timer, outbound connection, scrape-time
+log scan, or persistence. Restart creates a fresh owner, resets every counter/histogram, and changes
+`opencodex_metrics_process_start_time_seconds`.
+
+The label vocabularies are closed: protocol is `responses`, `chat`, `messages`, or `unknown`; result
+is `completed`, `failed`, `incomplete`, or `aborted`; recovery is one of eight coarse classes. A
+logical request increments once, physical sends sum the finalized attempt counts, and each distinct
+recovery kind already retained on an attempt contributes once to its coarse class. HTTP 200 never
+overrides a failed terminal event. Duration observes every valid finalized duration; TTFT observes
+only finite nonnegative first-output values, while `opencodex_ttft_missing_total` is the complementary
+denominator. No request, credential, account, provider, model, conversation, raw error, prompt, tool,
+body, header, or URL value enters a label or sample.
+
 For diagnosing upstream-shape / usage-extraction issues run `ocx debug usage on` (or set
 `OPENCODEX_USAGE_DEBUG=1` before start). The proxy then writes a rolling debug record per finalized
 request to `~/.opencodex/usage-debug.jsonl` (mode `0o600`, auto-trimmed to the most-recent 100 lines
@@ -683,9 +709,7 @@ its defaults and exclusions are owned by [Responses transport](transports/respon
 
 The provider editor field policy exposes `showThinkingSummary` as a boolean provider option; it controls Responses summary defaults without a dashboard rendering change. See [Google provider](providers/google.md).
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Codex pool settings and their consumers follow the [reset-first ordering contract](providers/openai-tiers.md#reset-first-account-ordering), including independent-quota fallback, preserved affinity, strategy-specific threshold summaries, and shared short-observation freshness for switch warnings. Codex account DTOs and cards expose the routing-plan exclusion separately from credential health; the [plan exclusion contract](providers/openai-tiers.md#automatic-pool-plan-exclusions) also governs CLI projection. Private pool credential metadata follows the [quota-history publication identity contract](providers/openai-tiers.md#quota-history-publication-identity); credential-only and account DTO projections omit it.
 
@@ -716,3 +740,12 @@ Shared response-log retention and native SSE inspection pacing follow the [bound
 Native steering retains fixed phase deadlines and reconciled replay output; see the [steering stability contract](transports/streaming-health.md#steering-deadlines-and-replay-completeness).
 
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
+
+`compactionRouting` is a persisted configuration setting. Its model and optional effort follow the
+[Responses trigger contract](transports/responses.md#compaction-routing-overrides). Dashboard Overview
+provides model and effort selectors with an explicit Save action, a standing note that the selected
+model's provider receives the entire conversation, and a warning naming that provider once a model
+is chosen; for a combo selector the warning lists the combo's target providers from `GET /api/combos`
+and states that failover targets receive the conversation too. `GET /api/settings` returns
+the override or null; `PUT /api/settings` accepts a complete validated object or null to clear it.
+Save failure restores live settings and deletion provenance; the dashboard retains the draft for retry.
diff --git a/structure/manifest.json b/structure/manifest.json
index 29efddd156e..cbd3c7da0fc 100644
--- a/structure/manifest.json
+++ b/structure/manifest.json
@@ -310,13 +310,14 @@
       ]
     },
     {
-      "path": "adapters/compatibility-lab.md",
-      "tier": 4,
-      "title": "Compatibility Lab",
-      "scope": "Optional Lab evidence, automation, and its core-runtime isolation boundary.",
-      "documents": [
-        "src/lab/"
-      ]
+    "path": "adapters/compatibility-lab.md",
+    "tier": 4,
+    "title": "Compatibility Lab",
+    "scope": "Optional Lab evidence, automation, and its core-runtime isolation boundary.",
+    "documents": [
+      "src/lab/",
+      "src/server/index.ts"
+    ]
     },
     {
       "path": "gui-and-management-api.md",
@@ -400,6 +401,77 @@
       ]
     }
   ],
+  "contracts": {
+    "version": 1,
+    "entries": [
+      {
+        "id": "paginated-history-writer",
+        "owner": {
+          "document": "codex-home.md",
+          "anchor": "paginated-history-writer-boundary"
+        },
+        "dependents": [
+          "catalog.md",
+          "config.md",
+          "gui-and-management-api.md",
+          "ops/docs-and-release.md",
+          "providers/openai-tiers.md",
+          "runtime.md",
+          "subagents.md"
+        ]
+      },
+      {
+        "id": "request-copy-accounting",
+        "owner": {
+          "document": "transports/byte-accounting.md",
+          "anchor": "request-copy-accounting"
+        },
+        "dependents": [
+          "adapters/registry.md",
+          "catalog.md",
+          "clients/claude-desktop.md",
+          "clients/integrations.md",
+          "data-planes/images.md",
+          "data-planes/inbound-compat.md",
+          "ops/docs-and-release.md",
+          "ops/service-and-sidecars.md",
+          "overview.md",
+          "providers/chat-compat.md",
+          "providers/cursor.md",
+          "providers/xai-grok.md",
+          "runtime.md",
+          "subagents.md",
+          "transports/inventory.md",
+          "transports/streaming-health.md"
+        ]
+      },
+      {
+        "id": "stream-buffer-accounting",
+        "owner": {
+          "document": "transports/byte-accounting.md",
+          "anchor": "stream-buffer-accounting"
+        },
+        "dependents": [
+          "adapters/registry.md",
+          "catalog.md",
+          "clients/claude-desktop.md",
+          "clients/integrations.md",
+          "data-planes/images.md",
+          "data-planes/inbound-compat.md",
+          "ops/docs-and-release.md",
+          "ops/service-and-sidecars.md",
+          "overview.md",
+          "providers/chat-compat.md",
+          "providers/cursor.md",
+          "providers/xai-grok.md",
+          "runtime.md",
+          "subagents.md",
+          "transports/inventory.md",
+          "transports/streaming-health.md"
+        ]
+      }
+    ]
+  },
   "grace": {
     "undocumentedSourceAreas": [
       {
diff --git a/structure/ops/docs-and-release.md b/structure/ops/docs-and-release.md
index 5062cd7e310..89fe8db595a 100644
--- a/structure/ops/docs-and-release.md
+++ b/structure/ops/docs-and-release.md
@@ -31,16 +31,32 @@ lists its required source/registry paths and preview/apply flags.
 
 ## Public docs
 
+The provider configuration reference and provider guide own the public Google tool-schema policy:
+the persisted values/default, initial refusal, non-direct repair withholding, direct no-repair
+behavior, and content-free diagnostics. English and all translated copies change together.
+
 The public documentation site lives in `docs-site/` and is built with Astro + Starlight. English is
 served at the site root, with Korean under `/ko`, Simplified Chinese under `/zh-cn`, Traditional Chinese under `/zh-tw`, Russian under `/ru`, and Japanese under `/ja`. `docs-site/astro.config.mjs` is the locale source of truth.
 
+Server-configuration credential rows in English and every locale copy distinguish data-plane `apiKeys` from the independent management admin credential and link the matching locale management reference. Credential setup instructions themselves stay in the management reference; the rows only name the separation.
+
+Proxy-format, adapter, and provider documentation distinguishes server-level SOCKS5 configured outbound fetch from scheme-specific HTTP(S) routing, and every locale copy carrying that claim stays aligned. The public pages own the runtime detail rather than duplicating it here.
+
 Manual navigation is defined in `docs-site/astro.config.mjs`. When adding a public page, update the
 sidebar and either add localized copies or intentionally accept Starlight fallback behavior.
 
-Provider preset totals are recounted from the current registry when a preset lands. With Crusoe the
-documented split is 94 total: 78 key-based, 12 OAuth, three local, and one default ChatGPT-forward
-preset. The English provider guide and all seven translated copies carry the same counts and the
-same fixed-host discovery limits.
+Provider preset totals are recounted from the current registry when a preset lands. The
+documented split is 95 total: 79 key-based, 12 OAuth, three local, and one default
+ChatGPT-forward preset. The English provider guide, all seven translated copies, and all eight
+quickstarts carry the same counts, and the guides carry the same fixed-host discovery limits.
+
+That recount is no longer a manual obligation. Seventeen places restate these numbers and sixteen
+of them drifted once already — the English guide reached 95 while every translation and every
+quickstart, the English one included, still said 94. Both numbers read as plausible, so nothing
+caught it. `tests/ci-workflows/docs-provider-preset-counts.test.ts` now derives the total and the
+key-based split from `PROVIDER_REGISTRY` and asserts them against each page, so the next preset
+fails every locale at once instead of drifting. Each page is located by a locale-specific phrase
+rather than by its number, so rewording a sentence fails the check and asks to be re-anchored.
 
 Native retirement keeps active model/quota instructions aligned across locales with the
 [catalog contract](../catalog.md#shared-catalog). Historical records and other providers
@@ -163,6 +179,12 @@ invariants belong in `structure/`, not the README.
 manual. When an investigation graduates into a maintained invariant, summarize it here under
 `structure/` and link public workflows from `docs-site/`.
 
+Cross-cutting structure contracts are maintained by editing `structure/manifest.json`, the authority
+statement, and any dependent whose local explanation changes. Regenerate `structure/INDEX.md` with
+the owning command and require the structure check in hosted CI. The
+[structure rules](../AGENTS.md#the-source-to-doc-map) retain review of every document mapped to a
+changed source area even when no text edit is needed.
+
 ## Branch and devlog policy
 
 [`AGENTS.md`](../../AGENTS.md) and [`MAINTAINERS.md`](../../MAINTAINERS.md) are authoritative; this section
@@ -410,9 +432,7 @@ its defaults and exclusions are owned by [Responses transport](../transports/res
 
 Provider configuration documents distinguish actual summaries from raw reasoning content. The test layout registers the summary-default contract cases and removes the obsolete content-rewrite test with its implementation.
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](../codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](../codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Private pool credential metadata follows the [quota-history publication identity contract](../providers/openai-tiers.md#quota-history-publication-identity); credential-only and account DTO projections omit it.
 
@@ -432,7 +452,7 @@ Account quota surfaces use [safe probe diagnostics](../transports/inventory.md#a
 
 Combo child requests normalize effort and thinking controls against the selected target while retaining reasoning summaries; strict unknown targets preserve caller controls. The [Responses transport owner](../transports/responses.md) documents this boundary, and native Chat removes effort only for an explicit empty declaration or no-reasoning model.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 OpenCode launcher verification distinguishes the local management catalog request from the inference child. Its transport regressions cover proxy environment, redirects, endpoint validation, credential precedence and child-env separation on hosted CI.
 
@@ -447,3 +467,6 @@ Renamed fixed-key providers receive [missing reasoning metadata](../catalog.md#r
 Shared response-log retention and native SSE inspection pacing follow the [bounded inspection contract](../transports/byte-accounting.md#response-log-inspection); other subsystem behavior remains unchanged.
 
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](../transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
+
+The public server configuration reference documents the optional
+[compaction routing override](../transports/responses.md#compaction-routing-overrides). Its regression file is registered in both test-layout inventories.
diff --git a/structure/ops/service-and-sidecars.md b/structure/ops/service-and-sidecars.md
index e2957c84734..d293a286dfb 100644
--- a/structure/ops/service-and-sidecars.md
+++ b/structure/ops/service-and-sidecars.md
@@ -194,3 +194,7 @@ Native steering retains fixed phase deadlines and reconciled replay output; see
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](../transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+The service loads the optional `compactionRouting` block from persisted configuration.
+[Responses ingress](../transports/responses.md#compaction-routing-overrides) applies it to individual compaction
+requests whose trigger the block names.
diff --git a/structure/overview.md b/structure/overview.md
index 3e2c7395683..c0627e2dd7f 100644
--- a/structure/overview.md
+++ b/structure/overview.md
@@ -108,6 +108,12 @@ still cover the rule, which is a judgement only review makes.
 - **INV-AUTH-01** — The management plane (`/api/*`) and the data plane (`/v1/*`) never share an
   admission credential.
   Enforced by `tests/server/server-management-auth.test.ts`.
+- **INV-LAB-01** — The protected core entrypoints carry no load-time import chain into optional
+  Lab code (static, side-effect, and re-export edges are walked transitively) and never name
+  Lab even in a direct dynamic import; deferred lazy edges through non-Lab modules behind
+  activation checks are the sanctioned pattern. Gated Lab activation also stays synchronous
+  until `startServer` returns; see [`compatibility-lab.md`](adapters/compatibility-lab.md).
+  Enforced by `tests/lab/core-lab-boundary.test.ts`.
 - **INV-RESTORE-01** — `ocx restore` restores native Codex from the pristine catalog with
   retired bare/account-qualified native rows omitted from the output; the original backup stays
   unchanged. The service-stop and uninstall paths of the same promise are covered
@@ -134,6 +140,11 @@ processes are one logical runner, while each process still installs its own isol
 guards. The workflow contract and process bounds live in
 [`ops/docs-and-release.md`](ops/docs-and-release.md#cross-platform-ci).
 
+`structure/manifest.json` declares both source-review coverage and cross-cutting contract authority.
+`scripts/structure-ssot.ts` validates that topology, and generated `structure/INDEX.md` publishes it.
+The [structure rules](AGENTS.md#the-source-to-doc-map) define when review requires a content edit;
+contract authority never reduces the source map's many-to-many review fan-out.
+
 Two invariants are stated here without a binding, and `grace.unboundInvariants` in
 [`manifest.json`](manifest.json) carries the reason for each. They are true statements about the system;
 no test in this repository currently pins them, and saying so is more useful than naming a test that
@@ -172,7 +183,7 @@ Pool quota producers and account commands follow the [bounded raw-observation co
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
@@ -183,3 +194,7 @@ Shared response-log retention and native SSE inspection pacing follow the [bound
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](gui-and-management-api.md#fast-selector-rows-setting).
+
+Codex compaction can select a request-local model through the
+[existing Responses handlers](transports/responses.md#compaction-routing-overrides) for the configured
+manual and automatic triggers, while subsequent turns keep their conversation settings.
diff --git a/structure/providers-and-adapters.md b/structure/providers-and-adapters.md
index 1bc9a86aaf4..0121fb76e40 100644
--- a/structure/providers-and-adapters.md
+++ b/structure/providers-and-adapters.md
@@ -7,16 +7,20 @@ the [bounded ingestion contract](transports/inventory.md#bounded-response-ingest
 | Path | Responsibility |
 | --- | --- |
 | `src/providers/registry.ts` | Compatibility facade; canonical provider presets for CLI, dashboard, OAuth, key providers, and metadata live in `src/providers/registry/entries-core.ts` and `entries-extended.ts`, with model seeds in `model-seeds.ts`. |
+| `src/providers/registry/model-ids.ts` | Classifies every `ProviderRegistryEntry` field by what its KEYS mean for selector decoding, and derives the native model ids an entry names. The classification is exhaustive by construction: a new registry field fails typecheck until its keys are given a meaning, which is what stops an identity-bearing map from being silently left out of decoding. Imported directly rather than through the facade, which is at its file-size cap. |
 | `src/providers/derive.ts` | Enrichment from provider presets into user config. |
+| `src/providers/resolved-model-policy.ts`, `src/providers/resolved-model-policy-merge.ts` | Static provider/model policy resolution for the final upstream wire model, plus its pure clone/merge/URL/family helpers. The resolver detaches and freezes registry defaults, operator overrides, exact explicit input-modality declarations, hard wire pins, aliases, and explicit false/empty values with field-level provenance. Provider derivation, routing, catalog hints, gather admission, and adapter selection consume its detached frozen result. Callers supply transport match, the exact capability row, and a credential-free effective auth decision; credential bytes, usability evidence, account/quota/health state, and observed limits remain outside the result. |
+
 | `src/oauth/` | OAuth providers, token storage, refresh, and auth-token resolution. The login callback listener binds a per-provider FIXED loopback port, so consecutive logins reuse the same number; every response it sends ends its connection (`Connection: close`, including non-callback paths such as a stray `/favicon.ico` 404). Stopping the listener does not close an established socket, so without that a pooled client would deliver the next login's callback to the retired flow, which rejects the unknown state as a CSRF mismatch while the live flow waits. Kiro add-account identity prefers same-session `whoami` over a leftover SQLite state profile, and never persists the Builder ID service profile ARN as `accountId`. |
 | `src/combos/request.ts` | Clones each selected combo target request and applies the existing target capability ladder: adaptive unknown targets and explicit empty ladders receive no unsupported reasoning/thinking controls, while known ladders retain per-target resolution. |
 | `src/adapters/openai-responses.ts` | Native OpenAI/ChatGPT Responses passthrough. |
 | `src/responses/muse-tool-name-alias.ts` | Host-gated Meta Muse 64-char tool-name alias/restore used by the Responses passthrough. |
 | `src/adapters/openai-chat.ts`, `src/adapters/openai-chat/` | OpenAI-compatible Chat Completions bridge, split into leaves (`wire.ts`, `messages.ts`, `response-events.ts`, `passthrough.ts`, `tool-call-validation.ts`, `tool-schema.ts`, `errors.ts`). Its client delivery shapes in `src/chat/outbound.ts` and `src/server/chat-native-sse.ts` relay the upstream `service_tier` echo on non-stream, folded-stream, and synthesized-SSE bodies, never inventing the key when the upstream omits it. |
 | `src/adapters/anthropic.ts` | Anthropic Messages bridge. A `refusal` or `content_filter` stop reason yields an explicit `incomplete` event with `retryable: false` rather than `done` with that stopReason (#4312); `max_tokens` remains `done`. |
-| `src/adapters/google.ts` | Gemini bridge. |
+| `src/adapters/google.ts` | Gemini bridge. The final wire compiler owns [endpoint-scoped tool-schema loss policy](providers/google.md#google-tool-schema-loss-reporting): compatible mode changes no request bytes, strict initial loss creates no physical send, and strict non-direct repair creates no changed repair send. |
 | `src/adapters/azure.ts` | Azure OpenAI bridge. |
 | `src/adapters/cursor.ts`, `src/adapters/cursor/` | Cursor protobuf transport: discovery, request builder, event decoding, MCP, thread continuity, native-exec policy. |
+| `src/adapters/devin.ts`, `src/adapters/devin/cloud-direct/` | Devin runTurn transport over Cognition Connect-RPC. `GetChatMessage` uses the Responses provider executor and shared physical-send budget; catalog and JWT support RPCs remain outside inference-send accounting. |
 | `src/adapters/kiro.ts` and `src/adapters/kiro/` | Kiro event/tool/thinking/truncation/retry handling. The original path is a facade over leaves for wire identity, reasoning, conversation state, token estimation, payload assembly, streaming, and the adapter. |
 | `src/adapters/mimo-free.ts` | Mimo Free transport (client identity + JWT). |
 | `src/adapters/image.ts`, `src/adapters/anthropic-image-guard.ts`, `src/adapters/anthropic-image-normalize.ts`, `src/adapters/anthropic-image-codec.ts` | Image conversion for adapter ingress and Anthropic-specific normalization/limits. An image's ladder position is pinned to its own identity (content hash + media type), so appending a newer image cannot re-encode older ones and bust Anthropic's prompt prefix cache (#4532). |
@@ -56,10 +60,44 @@ Provider-scoped capability hints remain authoritative when discovery returns an
 capabilities. In particular, `src/providers/registry/entries-core.ts` assigns OpenCode Go's live
 `deepseek-v4.1-flash` route the official 1,048,576-token window instead of the conservative 128k
 routed-model fallback.
+Meta's two direct surfaces keep separate reasoning contracts: `meta-model` remains capped at
+`xhigh`, while `meta-muse` advertises `max` and sends the transparent Muse compatibility
+User-Agent required by that credential surface. The existing registry header merge keeps an
+operator-supplied User-Agent authoritative.
 The same registry declares the first-party `deepseek-flash` model with `text` and `image` input,
 so it bypasses the vision sidecar by default; explicit `noVisionModels` or text-only declarations
 remain authoritative. First-party `deepseek-chat`, `deepseek-reasoner`, and `deepseek-v4-flash`
-remain sidecar-backed by default. Zen routes are unchanged and unprobed in this update.
+remain sidecar-backed by default.
+
+OpenCode Go's `deepseek-v4.1-flash` joined them on 2026-09-19: probed against
+`https://opencode.ai/zen/go/v1/chat/completions` with this proxy's headers, the route accepts an
+`image_url` part and the model reads it, so it left `noVisionModels` and gained a positive
+`modelInputModalities` declaration. Its sibling `deepseek-v4-flash` on the same gateway still
+answers HTTP 400 "Model only supports text input" and stays sidecar-backed. The Zen tiers
+(`opencode-zen`, `opencode-free`) were not measurable (HTTP 402) and keep their existing
+classification — an unverified tier is not evidence.
+
+Because `enrichProviderFromRegistry` fills `noVisionModels` all-or-nothing and fills
+`modelInputModalities` per-key beneath the saved value, both halves of a stale classification are
+frozen into any config saved while it was current. `src/providers/stale-vision-classification-migration.ts`
+repairs exactly those two saved values and runs inside the shared startup repair pass in
+`src/providers/model-rename-startup.ts`. Correcting the registry alone fixes new installs only.
+
+It covers both states that reach a running process, because the sidecar predicate reads
+`noVisionModels` before `modelInputModalities`: the full stale pair (modalities still the stale
+declaration and the id listed, both rewritten) and the half-repaired row (modalities already
+corrected but the id still listed, where removing the name is what stops the image from being
+stripped). The paired modality declaration is the guard in both cases, which is why a name listed
+without one is left alone — that row is either a half-finished repair or a deliberate operator
+entry, and the projection does not guess which. The row must also still be the registry's own:
+identity resolves through `providerMatchesRegistryTransport`, the rule `enrichProviderFromRegistry`
+applies before it writes registry metadata, plus the entry's adapter. `opencode-go` is a pinned
+key preset without `preserveCustomDestination`, so its id alone claims a row — exactly as it does
+for enrichment — and an entry that opts into destination preservation narrows the projection with
+it. `modelCapabilities` is never written: it is the
+axis that outranks every source here, so it is where a deliberate text-only override belongs
+(`ocx provider edit <provider> --model <id> --text-only` writes it) and the one declaration a
+restart cannot take back.
 
 The BigModel Coding Plan Responses preset uses the separately documented
 `https://open.bigmodel.cn/api/v1` transport and a static catalog. Its provider row
@@ -79,6 +117,36 @@ not an authentication or entitlement decision.
 
 Routed Responses continuations whose local replay state is missing resolve their recovery decision from the selected wire protocol, not the model name; the contract lives in [Responses transport](transports/responses.md).
 
+Volcengine Ark Coding Plan is a native Responses preset at `/api/coding/v3/responses`. Validated
+tool continuations there reject the reasoning item the previous turn returned, so its registry
+entry sets `dropResponsesReasoningItems`, which removes replayed Responses `reasoning` items from
+continuation input before forwarding. That is lossy — summaries, item ids and `encrypted_content`
+go with the item — and an explicit `false` on the provider turns it off. The flag belongs to the
+DESTINATION rather than to the provider-wide wire, so `routedProviderConfig` fills it on the
+early-return path too: a row saved on Chat still reaches the Responses adapter when one model
+opts in through `modelAdapters`, and would otherwise forward the rejected item. Because it changes
+the continuation body, it is part of the compatibility behavior record and two routes that
+disagree about it are not the same subject.
+
+A row already saved on `openai-chat` keeps that wire. The entry is
+`preserveCustomDestination` with key auth, so `providerMatchesRegistryTransport` refuses the
+adapter mismatch and the request path returns the stored row unchanged, and the retired Chat
+destination stays an alias so that row keeps this entry's metadata. There is deliberately no
+startup config migration: the Z.AI one (`src/providers/zai-responses-migration.ts`) is
+behavior-preserving only because it gates on `providerMatchesRegistryTransport` and therefore
+rewrites rows the router already canonicalizes, which a Volcengine Chat row is not.
+
+Command Code ships its own per-model `reasoning_effort` table in
+`src/providers/command-code-efforts.ts`, and that table decides the wire effort. Configuration can
+take precedence, but only when the provider declares `modelReasoningEffortsAuthoritative`:
+`providerConfigSeed` copies the shipped table into every materialized preset and both enrichment
+and routing keep a persisted row over the current seed, so neither the presence of a configured
+row nor its difference from today's table establishes that a human wrote it. With the flag the
+ladder resolves through `configuredReasoningEfforts`, the same function that advertises the Codex
+picker, so the catalog and the wire agree; a rung the upstream then refuses is returned as that
+error rather than replayed without the effort, because the operator asked for it. The flag is part
+of the compatibility behavior record for the same reason as above.
+
 The shared Responses path follows the [bounded multipart recovery contract](subagents.md#multipart-encrypted-task-recovery); credential admission and retry policy remain unchanged.
 
 ## Hosted-search continuation binding
diff --git a/structure/providers/chat-compat.md b/structure/providers/chat-compat.md
index f6d4349cf2f..6fe286bd76d 100644
--- a/structure/providers/chat-compat.md
+++ b/structure/providers/chat-compat.md
@@ -26,6 +26,10 @@ Shared parsing and streaming follow the [request-copy](../transports/byte-accoun
 
 ## Reasoning and tool-result compatibility
 
+Google tool-declaration narrowing is observed by the Google final compiler, not this shared Chat
+compatibility layer. Its endpoint profile and privacy boundary are specified in the
+[Google provider contract](google.md#google-tool-schema-loss-reporting).
+
 Chat models sometimes return a freeform call body under a common alternate field or wrap the whole
 body in a Markdown fence. Restoration in `src/responses/apply-patch-envelope.ts` is deliberately
 narrow: only bare `exec` and `apply_patch` accept one recognized alternate field or one complete
@@ -378,7 +382,7 @@ byte-limit boundaries.
 
 Canonical Spark Lite metadata follows the final serialized model and surviving nonempty Lite tool catalog; see [Responses transport](../transports/responses.md).
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 ## Anthropic parallel tool use
 
 `options.parallelToolCalls === false` maps onto Anthropic's nested
diff --git a/structure/providers/cursor.md b/structure/providers/cursor.md
index 8be236cd916..3f047315203 100644
--- a/structure/providers/cursor.md
+++ b/structure/providers/cursor.md
@@ -60,6 +60,12 @@ effort variants the roster carries. That is deliberate — Cursor advertises ids
 variant-level quarantine exist for — so a new family is admitted by adding its capability row,
 not by relaxing the filter.
 
+Synthetic ultra rows (`<base>-1m` markers such as `kimi-k3-1m`, kept in `configured` by legacy
+pins or retain lists) clear that base-availability check and one more: the live roster must flag
+Max Mode for the base (`GetUsableModels.maxMode`), or the row stays hidden. Base availability
+alone is not enough — an account on a plan without Max Mode would otherwise see a row whose
+ultra request it cannot serve.
+
 A seeded ladder carries only rungs supported by vendor evidence. `muse-spark-1.3` is seeded at
 `minimal` through `xhigh` even though Cursor's roster also advertises `muse-spark-1.3-max`:
 Meta publishes no `max` rung for Muse Spark and an independent probe rejected it, both already
@@ -135,6 +141,9 @@ on the freeform path.
 Namespaced tools do not acquire bare-shell behavior. Regression coverage lives in
 `tests/providers/cursor/cursor-tool-definitions.test.ts`.
 
+Google's [tool-schema loss report](google.md#google-tool-schema-loss-reporting) is confined to the
+Google final compiler and does not change Cursor's advertised or normalized schema ownership.
+
 Canonical Spark Lite metadata follows the final serialized model and surviving nonempty Lite tool catalog; see [Responses transport](../transports/responses.md).
 
 Shared raw-reasoning events retain content-channel presentation; provider-authored thinking keeps its existing summary path. See [bridge contract](chat-compat.md).
@@ -179,7 +188,7 @@ classifies as overflow. Coverage lives in
 
 An incomplete client-tool stream is fail-closed for the current turn: `finalizeTurnEvents` emits the prefix owned by `CURSOR_INCOMPLETE_TOOL_CALL_MESSAGE_PREFIX` and does not retry that send. After the error is streamed, eligible non-isolated turns remint the Cursor conversation id, persist the thread override, and invalidate the inherited checkpoint so the next turn does not resume a conversation left waiting for `mcpResult`. `src/adapters/cursor/thread-continuity.ts` permits three such rotations per retained identity-scoped thread owner in a separate bounded counter; exhaustion keeps reusing the conversation and records an `incomplete-tool-remint-exhausted` diagnostic, while a clean completed turn clears that scope's counter. This allowance never consumes or replenishes the overflow resend budget. Isolated helper and compaction turns neither remint nor change the parent's allowance or checkpoint. Native Composer replay synthesizes `[missing tool_result for this tool_use in history]` for unpaired `toolCallStep` history; external wire models skip native `mcpToolCall` replay, so conversation remint is their recovery path.
 
-Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](../transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 ## Mid-stream envelope echo
 
@@ -219,3 +228,34 @@ Canonical Responses identity sanitation and narrowly scoped pre-output combo rec
 Upstream API-key usage follows the [physical-attempt account attribution contract](../gui-and-management-api.md#upstream-key-account-attribution), independently of subscription quota observations.
 
 Unicode pattern normalization uses [copy-on-write traversal](../transports/byte-accounting.md#unicode-pattern-normalization) while preserving the existing schema and wire semantics.
+
+## Inbound stream-health clock ownership
+
+The T04 inbound stream-health watchdog in `src/adapters/cursor/live-transport.ts` fails a turn that
+received its first frame and then went silent for `CURSOR_STREAM_SILENCE_FAIL_MS` (30s) or
+produced only liveness frames for `CURSOR_STREAM_HEARTBEAT_ONLY_FAIL_MS` (90s), instead of waiting
+out the 300s bridge stall watchdog. One timer covers both thresholds and re-arms on every
+decoded frame, so the deadline is always recomputed from the newest frame.
+
+Those two budgets are the production contract and a test does not move them to make itself
+pass. What a test may replace is the watchdog's time source: `streamHealthClock` on
+`CursorTransportFactoryInput` supplies `now`, `setTimeout` and `clearTimeout`, defaulting to the
+globals, and the seam is deliberately scoped to T04 alone — the first-frame timer, the
+turn-ended close grace, the client-tool finalize grace and the outbound heartbeat all stay on
+the global timers, as does the `elapsedMs` diagnostic, whose `turnStartedAt` is stamped on the
+wall clock.
+
+The seam exists because the re-arming half of the contract cannot be stated against real
+timers without also asserting that the machine keeps up: showing that a deadline did NOT expire
+means keeping a synthetic server ahead of the silence budget for several multiples of it, which
+is what failed in the unsharded macOS lane while the watchdog was correct. Scaling the budget
+lengthens the window rather than shrinking the exposure. Every claim of that shape therefore lives
+under the seam in `tests/providers/cursor/cursor-stream-health.test.ts`: that meaningful frames
+re-arm both clocks, that liveness-only frames refresh the silence clock while the progress clock
+still expires, and that the silence deadline is the one that fires when it is the earlier of the
+two. That last one is load-bearing: a watchdog that dropped the `min()` and read only the progress
+deadline would relax silence detection from 30s to 90s while every real-timer case stayed green,
+because a later deadline still produces the same message. The firing half needs no seam and stays
+on real timers in the same file: silence after the first frame, the progress budget alone failing a
+turn when the silence budget is out of reach, and `turnEnded` cancelling the watchdog while the
+server holds the stream open.
diff --git a/structure/providers/google.md b/structure/providers/google.md
index 21d22fc15c6..5582a356d9f 100644
--- a/structure/providers/google.md
+++ b/structure/providers/google.md
@@ -72,3 +72,81 @@ a claim about what the upstream can do); an image-capable model, whose `response
 configuration contradicts JSON-constrained text; and a `json_schema` format carrying
 no schema, which would otherwise downgrade to bare JSON mode. An image-capable model
 with no structured-output request keeps its existing `responseModalities` behavior.
+
+## Google tool-schema loss reporting
+
+`src/adapters/google-tool-schema.ts` compiles tool declarations against an explicit `ai-studio`,
+`vertex`, or `cloud-code-assist` endpoint profile. All three profiles currently use the same
+conservative documented subset. Compilation returns the compatible parameters plus a versioned
+loss report with exactly six fields: `version`, `endpointClass`, `lossy`, `truncated`,
+`uncertainComparisons`, and `categories`. Category values and the content-free uncertainty count
+saturate at 255; saturation beyond either cap sets `truncated`. Bounded structural comparisons that
+exhaust their 24-level or 1,024-node allowance increment `uncertainComparisons` rather than
+`lossy` or a proven-loss category. The report never retains tool or property names, paths, descriptions,
+schema or enum values, references, hashes, request ids, project ids, or account ids.
+Every sanitizer branch that widens or drops an accepted-value constraint has a closed category,
+including type unions and unsupported types, conditional and tuple constraints, reference-overlay
+replacement, and root object coercion. Lossless normalization does not set `lossy`: accepted type
+case folding, duplicate enum/required removal, nullable-union collapse, and string-const conversion
+preserve the accepted value set. Annotation-only fields such as title, default, examples, comments,
+deprecated, read-only/write-only, external documentation and examples are omitted without loss.
+Local-reference siblings use 2020-12-style conjunctive semantics for loss accounting, while the
+wire transform retains its implemented overlay-wins merge; enum reports compare that intersection
+with the post-filter set actually emitted.
+
+This layer observes loss and does not reject it. The emitted request body remains the same as
+before reporting. The existing limits remain 24 schema levels, 16 local-reference dereferences,
+and 1,024 visited nodes; reporting stops with those limits and does not inspect omitted content.
+`src/adapters/google-wire-compiler.ts` aggregates reports across declarations, and
+`src/adapters/google.ts` emits a `google-tool-schema-loss` provider diagnostic only when provider
+debug is enabled. `generationConfig.responseMimeType` and `generationConfig.responseJsonSchema`
+are output-schema fields and never enter tool-schema sanitation or loss accounting.
+
+`googleToolSchemaPolicy` is provider-scoped. Omission and `compatible` retain the report-only body
+and existing repair replay. `reject-lossy` refuses an initially lossy or comparison-indeterminate
+compilation before `buildRequest` returns, so no physical send exists. Vertex and Cloud Code Assist carry the same
+resolved policy into their 400 compatibility repair: indexed repair reports one opened declaration,
+unindexed repair reports every declaration it would open, and strict policy returns the original
+400 without a changed repair send. The `google-tool-schema-repair` diagnostic inherits the complete
+bounded report shape — version, endpoint class, `lossy`, `uncertainComparisons`, truncation flag,
+and saturating fixed category counts — and adds only the `repair` phase, the declaration count, and whether the changed
+send was allowed.
+AI Studio direct mode continues to disable 400 repair entirely. Output schemas remain outside both
+initial and repair policy.
+
+## Google wire-shape projection
+
+`src/adapters/google-wire-shape.ts` describes a compiled Google request without carrying any of
+it. `summarizeGoogleWireShape` reads the body after `compileGoogleWireBody` and after Antigravity
+replay and signature adjustment, which is the object the envelope sends, and returns per-role turn
+counts, function call and response counts and their pairing, the position and class of the first
+ordering violation, signature presence and sentinel-only signing, the session anchor class, and a
+bounded upstream error class. Tool-call identity survives only as a request-internal ordinal in
+first-appearance order.
+
+What it must never retain is the point of the module: prompt or system text, tool arguments and
+results, tool and function names, original or wire call ids, signature text or any hash of it,
+inline file bytes, project and account identifiers, the request id, the Cloud Code Assist session
+id, Codex thread and session ids, and the first user message. Totals stay exact for the whole
+request while per-turn detail stops at a fixed ceiling and sets `truncated`, so a long agentic
+session still reports its real counts.
+
+It is a projection, not a validator. Nothing in the request path consults its output.
+`antigravitySessionAnchor` in `google-antigravity-wire.ts` is the matching content-free read of
+the session boundary: it reports which of the four anchor classes produced the session id without
+reporting the id, and it reads the same decision the id derivation reads, so the two cannot
+disagree about which regime a request is in.
+
+The adapter passes a builder to `debugProviderDiagnosticLazy`, never a built object. That gates
+before invoking it, so a request with provider debug off never pays the walk, and it evaluates
+the projection inside the logger's own try/catch, so a throw in a diagnostic cannot turn a built
+request into a rejected one. With provider debug ON the projection runs synchronously on the
+dispatch path before the request is sent, and its cost is linear in history length — largest for
+exactly the long sessions it exists to describe. Observing the real outbound body rather than a
+reconstruction is what that buys.
+
+Two ceilings bound the output, and both are needed. The item ceilings cap retained turns and the
+per-turn ordinal lists; the serialized ceiling, held at half `MAX_DEBUG_LINE_BYTES`, then trims
+turn detail from the tail until the summary fits. Without the second, a worst case inside the
+first serializes past the debug buffer's per-line cap, and the buffer truncates at a byte
+boundary: the consumer gets unparseable JSON whose retained prefix still reads `truncated: false`.
diff --git a/structure/providers/openai-tiers.md b/structure/providers/openai-tiers.md
index 9ef2da5fa63..c9479b1b051 100644
--- a/structure/providers/openai-tiers.md
+++ b/structure/providers/openai-tiers.md
@@ -599,8 +599,7 @@ Listener startup diagnostics follow [the runtime lifecycle contract](../runtime.
 `src/codex/routing/selection.ts` applies optional `codexPool.excludedPlans` to both candidate selection and existing active/affined accounts. An all-excluded pool returns no automatic candidate, including preview and configured-account fallback. Native main remains exempt and unknown plans remain eligible. Explicit account-qualified routes retain pause, credential and entitlement checks while bypassing only this automatic policy.
 
 `src/codex/auth-api/account-list.ts` projects `selectionExcludedReason: "plan_excluded"` and `selectionExcludedPlan` from the routing config, even when a newer display-only WHAM plan could not be persisted. The dashboard and account CLI show the policy reason separately from credential health; renewal clears the derived fields. The automatic next-session action and badge are omitted for excluded rows.
-## Paginated history writer boundary
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](../codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](../codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
diff --git a/structure/providers/xai-grok.md b/structure/providers/xai-grok.md
index 37815ed04d1..4dfa27723f0 100644
--- a/structure/providers/xai-grok.md
+++ b/structure/providers/xai-grok.md
@@ -1,5 +1,7 @@
 # xAI Grok Provider
 
+The Grok client picker forwards the `meta-muse` catalog's `max` effort through its existing managed-block export; this follows the [Muse provider contract](../providers-and-adapters.md).
+
 Native result continuations and function-result injection follow [the mode-specific result and control contract](../transports/streaming-health.md#experimental-native-function-result-injection); this surface does not infer upstream support or alter its defaults.
 
 Native steering follows [the shared WebSocket contract](../transports/streaming-health.md#experimental-native-mid-turn-steering); this surface's defaults remain unchanged.
@@ -61,6 +63,9 @@ The shared Responses path follows the [bounded multipart recovery contract](../s
   force-refresh once (singleflight, generation-checked) and replay OAuth-backed xAI requests
   exactly once with a re-resolved transport; API-key/BYOK paths are excluded
   (`src/server/responses/core.ts`).
+- **Generic pool threshold:** xAI's generic OAuth fill-first selector in
+  `src/oauth/generic-account-failover.ts` treats a non-positive threshold as disabling proactive
+  usage-based account changes; reactive recovery remains independent.
 - **Header parity:** per-attempt `x-grok-req-id` (fresh UUID inside the transport fetch
   wrapper), stable session/conv affinity headers, always-set User-Agent, and a single
   compatibility profile const for the Grok client version (`src/providers/xai-transport.ts`);
@@ -77,6 +82,11 @@ snapshot. It never promotes locally synthesized or merely repaired items. Unmark
 to treat an explicit empty array as authoritative. Within this marked client-facing repair,
 malformed, gapped, oversized, contradictory, failed, or incomplete streams stay fail-closed.
 
+The same marked client-facing chain normalizes lexical floating-point `response.created_at` and
+`response.completed_at` values to their JSON integer spelling only for `response.*` events whose
+nested values are nonnegative safe integers. Missing, malformed, fractional, negative, unsafe, and
+byte-identical payloads pass through unchanged.
+
 > Decision record: [ADR-0059](../decisions/ADR-0059-xai-grok-hardening-official-grok-build-contract.md)
 
 ### Grok Reset Coupons (Billing API Parity)
@@ -123,7 +133,10 @@ transport behavior.
 The first-party DeepSeek `deepseek-flash` native `text`/`image` declaration is likewise scoped to
 the DeepSeek provider and does not alter xAI metadata or transport behavior; explicit capability
 overrides remain authoritative. First-party `deepseek-chat`, `deepseek-reasoner`, and
-`deepseek-v4-flash` remain sidecar-backed by default. Zen routes are unchanged and unprobed here.
+`deepseek-v4-flash` remain sidecar-backed by default. The Zen tiers (`opencode-zen`, `opencode-free`) could not be measured (HTTP 402) and keep their existing classifications.
+OpenCode Go's `deepseek-v4.1-flash` was reclassified as native vision on 2026-09-19 (probed on
+that gateway); its sibling `deepseek-v4-flash` stays sidecar-backed. None of this alters xAI
+metadata or routing.
 The Crusoe fixed-key registry row, discovery predicate, effort ladder, and input-modality map are
 also provider-scoped and do not alter xAI model metadata, OAuth routing, or wire behavior.
 
@@ -177,3 +190,7 @@ Native steering generation overrides, explicit public-API eligibility and the co
 Shared startup provider-id migration preserves the account binding between configuration and OAuth credentials; see the [runtime contract](../runtime.md).
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+Routed Grok compaction uses the existing adapter and summary contract after a same-provider
+[compaction routing model override](../transports/responses.md#compaction-routing-overrides); a
+cross-provider override runs the portable summarizer on the selected provider instead.
diff --git a/structure/runtime.md b/structure/runtime.md
index fc99bb89ded..130ab5d4bfe 100644
--- a/structure/runtime.md
+++ b/structure/runtime.md
@@ -1,5 +1,21 @@
 # Runtime
 
+## Resolved static model policy
+
+`src/router.ts` attaches one frozen `ResolvedModelPolicy` to every `RouteResult`. Policy/combo
+route spreads retain that object. Every initial, fallback, and recovery route is recaptured for the
+request's original inbound protocol before route-dependent normalization, and all adapter rebuilds
+consume its recorded adapter. A translated Chat or Anthropic replay therefore cannot inherit a
+Responses-only default. Credential, account, quota, health, cooldown, and observed transport
+evidence remain late and cannot widen a captured static limit.
+
+Virtual models are the sole model-identity transition: the ordinary and compact paths preserve the
+selected public id in diagnostics, rewrite `route.modelId` to the upstream wire id, and atomically
+replace `route.staticPolicy` before adapter or capability decisions continue. Model aliases are
+resolved before the route result is built, so their policy is already keyed by the native wire id.
+
+Routed Meta Muse requests use the registry-owned [Muse effort and header contract](providers-and-adapters.md); `max` reaches the provider through the existing reasoning mapper.
+
 Native result continuations and function-result injection follow [the mode-specific result and control contract](transports/streaming-health.md#experimental-native-function-result-injection); this surface does not infer upstream support or alter its defaults.
 
 Native steering follows [the shared WebSocket contract](transports/streaming-health.md#experimental-native-mid-turn-steering); this surface's defaults remain unchanged.
@@ -87,6 +103,7 @@ does not perform OAuth, and runtime credential resolution rereads the owned sour
 | --- | --- |
 | `bin/ocx.mjs` | Published npm `bin` entry (Node shim). Resolves the bundled or explicit Bun binary before project dotenv can load, stamps its runtime provenance plus a proof-bound Anthropic parent-env snapshot, lazy-runs `bun/install.js` if only the placeholder stub is present, then execs `src/cli/index.ts` under Bun. Lets `npm install -g` work without a separately-installed Bun. The exact `system codex-cli-update` inspection namespace skips both boot repair and lazy Bun installation; missing runtime support fails closed instead of mutating state. |
 | `src/lib/bun-runtime.ts` | Bundled-Bun resolution: `isRealBunBinary()` (size gate vs the ~450-byte placeholder stub), `bundledBunPath()`, and `durableBunPath()` (path baked into service/shim artifacts). Durable selection accepts only the source/path pair already stamped for the running executable; it never re-reads a project-dotenv `OPENCODEX_BUN_PATH`. |
+| `src/lib/plain-data.ts` | Detached copies for a consumer that must not observe later edits. Descriptor-based reads, including array elements, so an accessor is refused rather than invoked; refuses cycles, functions, class instances and anything else JSON could not have produced, and returns a copy-or-refusal union rather than degrading silently. Symbol-keyed process bookkeeping is skipped. |
 | `src/cli/index.ts` | `ocx` / `opencodex` CLI. Lifecycle: init, start, stop, restart, status, sync, restore/eject, gui, service, update. `restart` refuses an in-place restart requested by a CLI whose version differs from the attested `/healthz` version, because the replacement respawns from the live installation; placeholder versions (unknown/0.0.0) stay incomparable and keep the restart path. Configuration: provider, account, models, combo/route, access, integrations, v2. Client launchers: Claude, OpenCode, MiniMax Code, and MiniMax CLI text. The MMX launcher owns a child-lifetime loopback path bridge from the client's hard-coded `/anthropic/v1/messages` path to the canonical `/v1/messages` data plane; the server does not expose an extra auth surface. Diagnostics: doctor, debug, observe, health. Windows adds tray. The full command surface is `src/cli/help.ts`; this table names the groups, not every verb. After help/version early exits, ordinary commands run the bounded best-effort Codex-shim auto-restore policy before dispatch. `system codex-cli-update` is the deliberate read-only exception and suppresses auto-restore for its whole namespace, including malformed invocations. Keeps the `#!/usr/bin/env bun` shebang for from-source dev (`bun run src/cli/index.ts`). |
 | `src/server/index.ts` | Bun server entrypoint: `startServer`, `/v1/responses` HTTP + WebSocket routing (compact handled before generic Responses), exact `POST /v1/images/generations` and `POST /v1/images/edits` routing, `/v1/models`, the Anthropic-shaped `/v1/messages` and OpenAI-shaped `/v1/chat/completions` compatibility surfaces, the Live/Realtime surface, the hosted-search relay, artifact serving, `/healthz`, the `/api/*` auth gate, the `/v1/*` JSON 404 guard, GUI fallback, the opt-in loopback-only hub-management listener, and facade re-exports for split server modules. The route table itself is built by `src/server/index/serve-options.ts`; this entry file owns the listener and the startup transaction. |
 | `src/server/images.ts` | Standalone Images data plane: default OpenAI or explicit custom-provider selection, Codex account affinity, bounded opaque request relay, single-attempt upstream fetch, pool health recording, and safe response/cancellation relay. |
@@ -96,6 +113,7 @@ does not perform OAuth, and runtime credential resolution rereads the owned sour
 | `src/config/paths.ts` | Resolves `OPENCODEX_HOME`, `config.json`, and owner-only directory hardening. |
 | `src/config/atomic-write.ts` | Shared synchronous/asynchronous temp-harden-rename writer and residual-temp failure contract. The temp is ACL-hardened before it holds a byte and again before the rename, both `required: true`; the second call is a memo hit rather than a second icacls sequence because the writer re-asserts descriptor/path identity after the content write and re-attributes the harden through `reattributeHardenedSecretPath`. Windows takes no `chmod` on that path — it sets the read-only attribute, not the DACL, and its ChangeTime bump is what used to retire the memo. |
 | `src/config/process-state.ts` | Owns `ocx.pid`, `runtime-port.json`, cheap liveness, full command-line identity verification, and snapshot-guarded cleanup. |
+| `src/config/admitted-identity.ts` | Which configuration a derived artifact was built from. Detaches the resident configuration as plain data so one pass cannot gather under one state and project under another, and records the complete structure beside the configuration file's bytes. Refuses an accessor, a cycle, a value JSON could not produce, an unreadable file and a file the loader would have had to salvage; a callable `providers[name].fetch` is the one non-data field, held and compared by reference, while a written one is ordinary data on both sides, as the outbound transport also reads it. It does NOT require the resident configuration to equal the file: the proxy routes by what it holds, and live reconciliation retains live changes and the active listener binding on purpose. Evidence stays in a module WeakMap, never on the config and never in a response. |
 | `src/server/ports.ts` | Owns bind availability and ephemeral-port selection. Temporary probes dispose accepted peers and wait for listener close before reporting success. |
 | `src/cli/status.ts` / `src/cli/status-probes.ts` | Status snapshot assembly and the shared read-only health/stale-process probes used by status and doctor. Probe evidence keeps recorded-port choice, before/after snapshots and per-call timer cleanup together. |
 | `src/cli/doctor.ts` | Read-only environment diagnostics. Sections print through `console.log`; each is a `collect*` helper above `runDoctor` so it is testable without the command. Only a `FAIL`-level condition records a doctor failure — a degraded-but-working install must not break a green pipeline. `collectDefaultModelExposure` compares Codex's root `model` pin against the exposed set, which it READS rather than recomputes: the running proxy's `/v1/models` when one answers, otherwise the on-disk catalog's `visibility: "list"` slugs. It reports exposed, not exposed, or undeterminable, and never the second when it could not read either surface. |
@@ -106,6 +124,10 @@ does not perform OAuth, and runtime credential resolution rereads the owned sour
 | `src/codex/shim.ts` | Codex autostart shim: replaces the `codex` binary with a wrapper that auto-starts the proxy on demand. It skips startup for management subcommands even when value-taking global flags precede the subcommand, and transactionally restores complete, stable external launcher replacements without a watcher or PATH rediscovery. |
 | `src/service.ts` | OS service manager (macOS launchd, Linux systemd, Windows schtasks): always-on proxy with crash restart. Facade over the `src/service/` leaves — `src/service/launchd.ts`, `src/service/systemd.ts`, `src/service/windows-ops.ts`, `src/service/windows-scheduler.ts`, `src/service/windows-taskxml.ts`, `src/service/state.ts`, `src/service/guards.ts`, `src/service/health.ts`, `src/service/repair.ts`, `src/service/orchestration.ts`, `src/service/diagnostics.ts`, `src/service/cli.ts`. |
 
+`src/cli/provider.ts` accepts the Google-only `--google-tool-schema-policy` creation flag and rejects
+an unknown value or non-Google effective adapter before persistence. The persisted field and default
+are owned by the [config contract](config.md#config-surface).
+
 The `src/` root stays thin: process entry (`src/cli.ts`, `src/index.ts`), shared config/types,
 router, bridge, service manager, reasoning-effort definitions, and the stall-timeout budget live
 there. Feature code is grouped by responsibility:
@@ -162,6 +184,18 @@ is reported as such rather than called foreign, because an identity probe cannot
 foreign server from an unreachable one. An explicit `--port` still never hops — it waits for the
 pin through `src/server/port-reclaim.ts` — and a configured `port: 0` still means "ask the OS".
 
+Every `startServer` invocation acquires the `src/lib/spend-ledger-owner.ts` SQLite writer lease
+for its resolved OpenCodex state directory before loading configuration or binding a listener.
+References share one lease only inside one process and one directory; a different directory in
+that process is refused while the lease is held, because the shared ledger is process-wide. The
+refusal is about two directories owned at once, not forever: releasing the final reference
+discards the singleton with its binding, so the same process may then own a different directory
+and build a ledger by replaying that directory's own journal. A second process on the same
+directory is refused even for observe-only spend configuration, while a separate directory is
+independent. Ordinary stop releases the final reference after listener teardown, and every thrown
+startup path releases its reference. SQLite and the OS release a crashed owner; no PID, timestamp,
+TTL or lock-file deletion participates in recovery.
+
 An explicit Codex integration OFF skips startup cache invalidation before the user-scoped catalog
 serialization lock is resolved. Explicit `sync` and `sync-cache` retain their catalog-only override.
 
@@ -355,9 +389,7 @@ The relay is transparent in both directions, and that includes the close: a down
 
 `OCX_LIVE_FRAME_LOG` records both frame metadata and sideband lifecycle stages (`upstream-open`, `upstream-failed`, `relay-attached`, `relay-closed`) in one JSONL, content-free in both shapes. The lifecycle half is what separates a join that never reached this proxy from one whose upstream handshake was refused and from a live relay that carried nothing; frame records alone leave all three as an empty file. `tests/server/server-live-realtime-fixtures.test.ts` drives each sideband stage against de-identified Frameless v3 fixtures in `tests/fixtures/realtime-voice-sideband/` so a failure names the stage.
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Codex pool settings and their consumers follow the [reset-first ordering contract](providers/openai-tiers.md#reset-first-account-ordering), including independent-quota fallback, preserved affinity, strategy-specific threshold summaries, and shared short-observation freshness for switch warnings.
 
@@ -382,9 +414,9 @@ The account history response can include a [low-confidence effective capacity es
 
 Account quota surfaces use [safe probe diagnostics](transports/inventory.md#account-quota-failure-diagnostics) separately from quota validity, credential health and routing authority.
 
-Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](transports/streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
-OpenCode catalog discovery in `src/cli/opencode.ts` uses the local admin credential and a validated numeric-loopback management origin. It dials through `src/server/direct-local-http.ts`, rejects redirects and preserves the request/body deadline. Hub ingress selection stays separate from exported inference settings.
+OpenCode catalog discovery in `src/cli/opencode.ts` derives a catalog-only bearer from the local admin credential and uses a validated numeric-loopback management origin. `src/server/management-auth.ts` accepts that derived bearer only for the exact `GET /api/models` read, so a spoofed listener cannot capture reusable administrator authority; that read can still finalize a pending initial model selection, so the bearer is catalog-scoped rather than strictly read-only. The launcher dials through `src/server/direct-local-http.ts`, rejects redirects and preserves the request/body deadline. Hub ingress selection stays separate from exported inference settings.
 
 The [explicit model-capability contract](config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture. Vision dispatch consumes those declarations together with registry/vendor metadata before any image-bearing upstream send.
 
@@ -396,7 +428,7 @@ declare `modelInputModalities: ["text", "image"]` per model for the nine Claude
 explicit operator overrides; unknown models receive no new declaration. Client eligibility filters
 and Anthropic image wire handling remain unchanged.
 
-`src/vision/plan.ts` prevents raw image bytes from reaching any target whose effective capability is positively known to exclude image input. Evidence from the resolved runtime provider and explicit operator declarations takes precedence, followed by backend-specific/registry/vendor metadata. A proven text-only target is preprocessed through the configured Vision Sidecar; a positively image-capable target receives the image directly. Genuinely unknown custom models retain the existing compatibility path rather than being guessed text-only.
+`src/vision/plan.ts` prevents raw image bytes from reaching any target whose effective capability is positively known to exclude image input. Evidence is consulted highest-first: `modelCapabilities`, an explicit custom row for the same routed identity, `noVisionModels`, an explicit per-model modality list without `image`, then backend-specific/registry/vendor metadata. A proven text-only target is preprocessed through the configured Vision Sidecar; a positively image-capable target receives the image directly. Genuinely unknown custom models retain the existing compatibility path rather than being guessed text-only.
 
 Canonical ChatGPT Codex forwarding uses the generated `openai-codex` capability bundle rather than the public `openai` bundle. This matters when the two backends differ: for example, the vendored metadata records `gpt-5.3-codex-spark` as text-only on `openai-codex` while the public OpenAI row lists image input. The native Chat fast path and web-search image verbalization consume the same effective-capability decision.
 
@@ -411,11 +443,15 @@ Renamed fixed-key providers receive [missing reasoning metadata](catalog.md#rena
 Translated audio/file admission follows the [final-adapter input contract](adapters/registry.md#untranslated-input-media); native raw passthrough remains separate.
 ## Request-local target compatibility
 
+Google's final adapter compiler may emit an opt-in, content-free
+[tool-schema loss diagnostic](providers/google.md#google-tool-schema-loss-reporting). It observes
+adapter-local narrowing only and changes neither provider routing nor the serialized request body.
+
 `src/adapters/openai-responses.ts` omits only top-level `user` at the canonical ChatGPT Codex forward destination. Claude translation retains its original identity and prompt-cache key; public API and noncanonical gateways retain their `user` field. Input roles, tool-schema properties, safety identifiers and original replay bodies are not changed.
 
-`src/combos/failover.ts` treats three intact HTTP 400 invalid-request envelopes as request-local incompatibilities: exactly `Unsupported parameter: user`; `unsupported_value` naming `reasoning.effort` or `reasoning_effort` with an explicit unsupported-value message; and `param: input` with a bounded model-scoped `does not support image inputs` message. A null provider code is accepted only for that observed image envelope. Only the exact proxy wrapper is unwrapped, within three envelopes and 16,384 characters; conflicting codes, malformed/truncated envelopes and reflected JSON do not gain hop permission.
+`src/combos/failover.ts` treats four intact HTTP 400 invalid-request envelopes as request-local incompatibilities: exactly `Unsupported parameter: user`; `unsupported_value` naming `reasoning.effort` or `reasoning_effort` with an explicit unsupported-value message; `param: input` with a bounded model-scoped `does not support image inputs` message; and the exact null-code `gpt-6-astra` function-tool routing mismatch that tells an existing Responses request to use `/v1/responses`, allowing only the bare model name or its strict `YYYY-MM-DD` deployment suffix. A null provider code is accepted only for the two observed envelopes that require it. Only the exact proxy wrapper is unwrapped, within three envelopes and 16,384 characters; conflicting codes, malformed/truncated envelopes and reflected JSON do not gain hop permission.
 
-A `response_format` capability refusal is a fourth envelope, kept separate because it needs one code and one frame the three above do not admit. The refusal must name `response_format` AND state that it is unavailable or unsupported; a message that merely names the field, such as an invalid-schema complaint, stays terminal, because replaying a malformed request at every later target is the outcome this distinction exists to avoid. `param` may be absent or explicitly null and a param naming another field fails closed. Its code set is the shared generic one plus `invalid_parameter_error`, held separately so the `user` and image branches are not widened by it. It also unwraps a single `data:` SSE frame on a one-line body — the reported gateway answers on the stream, so the error object is never extracted and the structured code arrives undefined — while a multi-event body is left alone. The next target receives the same request with `response_format` intact: no field is dropped and the output contract the caller asked for is unchanged. Traversal stays finite because combo excludes each attempted target. This verdict records no cooldown, and cancellation, origin/cyber-policy rejection and the non-replayable post-send codes are all tested before it (#4903).
+A `response_format` capability refusal is a fifth envelope, kept separate because it needs one code and one frame the four above do not admit. The refusal must name `response_format` AND state that it is unavailable or unsupported; a message that merely names the field, such as an invalid-schema complaint, stays terminal, because replaying a malformed request at every later target is the outcome this distinction exists to avoid. `param` may be absent or explicitly null and a param naming another field fails closed. Its code set is the shared generic one plus `invalid_parameter_error`, held separately so the `user` and image branches are not widened by it. It also unwraps a single `data:` SSE frame on a one-line body — the reported gateway answers on the stream, so the error object is never extracted and the structured code arrives undefined — while a multi-event body is left alone. The next target receives the same request with `response_format` intact: no field is dropped and the output contract the caller asked for is unchanged. Traversal stays finite because combo excludes each attempted target. This verdict records no cooldown, and cancellation, origin/cyber-policy rejection and the non-replayable post-send codes are all tested before it (#4903).
 
 The combo may advance to its next eligible unattempted target before output commitment. It records no target/provider cooldown for these request-local mismatches and does not silently drop reasoning controls or raise `none` to a supported rung. Cancellation, origin/cyber-policy rejection, non-replayable post-send errors and the existing streaming commit boundary stay authoritative. Apart from the definite context overflow below, other invalid requests remain terminal.
 
@@ -452,3 +488,6 @@ Native steering retains fixed phase deadlines and reconciled replay output; see
 Native steering generation overrides, explicit public-API eligibility and the consent-gated wire probe follow the [shared control contract](transports/streaming-health.md#steering-settings-public-api-and-diagnostic-probe); this owner does not change routing or execute diagnostic tools.
 
 Unicode pattern normalization uses [copy-on-write traversal](transports/byte-accounting.md#unicode-pattern-normalization) while preserving the existing schema and wire semantics.
+
+Codex compaction uses a request-local model override for the configured triggers; the
+[Responses compaction contract](transports/responses.md#compaction-routing-overrides) owns its trigger and replay boundaries.
diff --git a/structure/subagents.md b/structure/subagents.md
index 527b2b37523..cf52d556baf 100644
--- a/structure/subagents.md
+++ b/structure/subagents.md
@@ -149,10 +149,13 @@ featured or picker rank. Canonical `opencode-go` rows retain their configured re
 and provider-scoped context metadata both when generated and when merged from retained catalog
 state; `deepseek-v4.1-flash` therefore keeps its 1,048,576-token window, while synthetic max/ultra
 choices are not added to that provider's declared ladder.
+`meta-muse` declares `max` for both seeded models under the [Muse provider contract](providers-and-adapters.md), so routed-client catalogs can expose it without extending OpenCode Go's ladder.
 The first-party DeepSeek `deepseek-flash` row declares native `text` and `image` input and therefore
 does not require the vision sidecar by default; explicit `noVisionModels` or text-only declarations
 remain authoritative. First-party `deepseek-chat`, `deepseek-reasoner`, and `deepseek-v4-flash`
-remain sidecar-backed by default. Zen routes are unchanged and unprobed in this update.
+remain sidecar-backed by default. OpenCode Go's `deepseek-v4.1-flash` was reclassified as native
+vision on 2026-09-19 (probed on that gateway); its sibling `deepseek-v4-flash` stays sidecar-backed,
+and the Zen tiers keep their classification because they could not be measured.
 
 Full derivation with per-line citations: `devlog/_plan/260816_codexrs_multiagent_v2_and_history_perf/013_five_cap_v1_vs_v2.md`.
 
@@ -361,9 +364,7 @@ its defaults and exclusions are owned by [Responses transport](transports/respon
 
 Final-route summary visibility is recomputed after fallback from the original Responses preference; an earlier provider opt-in does not carry into a later provider. See [reasoning presentation](providers/chat-compat.md).
 
-## Paginated history writer boundary
-
-`src/codex/history-provider.ts` refuses external writes to paginated or migration-capable history. `src/codex/inject.ts` checks affected rows and manifest-owned restore targets before and after config/profile/journal changes, including successful journal and fallback restores, and compensates refused restore/removal transitions. Failed config restore stops later catalog/history work and rolls back a coordinated remove transition. Apply retains an existing provider definition before candidate admission even when history preflight passes, so migration after artifact commit or during worker startup cannot leave earlier conversations without their provider. See the [history writer contract](codex-home.md#paginated-history-writer-boundary) for guarantees and concurrent-writer limits.
+Paginated and migration-capable history follows the [authoritative writer contract](codex-home.md#paginated-history-writer-boundary); this document adds no independent writer guarantee.
 
 Codex pool settings and their consumers follow the [reset-first ordering contract](providers/openai-tiers.md#reset-first-account-ordering), including independent-quota fallback, preserved affinity, strategy-specific threshold summaries, and shared short-observation freshness for switch warnings.
 
@@ -411,3 +412,5 @@ Native steering generation overrides, explicit public-API eligibility and the co
 Startup provider-id migration preserves the account binding between configuration and OAuth credentials; see the [runtime contract](runtime.md).
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](gui-and-management-api.md#fast-selector-rows-setting).
+
+The [compaction routing override](transports/responses.md#compaction-routing-overrides) uses explicit request-kind and trigger metadata, independently of spawned-child markers.
diff --git a/structure/transports/byte-accounting.md b/structure/transports/byte-accounting.md
index 97b8268e726..5b44a2032d7 100644
--- a/structure/transports/byte-accounting.md
+++ b/structure/transports/byte-accounting.md
@@ -4,6 +4,8 @@ Native result continuations and function-result injection follow [the mode-speci
 
 Native steering follows [the shared WebSocket contract](streaming-health.md#experimental-native-mid-turn-steering); this surface's defaults remain unchanged.
 
+Translated Chat inline-image normalization keeps retained wire bytes in its aggregate budget while process-wide native-decode admission and a decoded-pixel ceiling bound memory outside that byte accounting.
+
 Responses body-reader limits and lifetime handling follow the
 [core module ownership](responses.md#core-module-ownership). Raised HTTP concurrency follows the separate admission contract below.
 
@@ -13,6 +15,10 @@ the translator budget, which is why so many documents link here rather than rest
 
 ## Request-copy accounting
 
+The Google tool-schema loss report retains fixed categories, bounded counts, and endpoint class
+only. It copies no request content and adds no bytes to the upstream wire; see the
+[Google provider contract](../providers/google.md#google-tool-schema-loss-reporting).
+
 `src/server/request-decompress.ts` observes the UTF-8 sizes of decoded text and reserialized JSON
 without allocating encoded byte arrays solely to count them. Parsed-body accounting still uses
 `JSON.stringify(parsed)`: numeric normalization can make it larger than the input text. These
@@ -64,6 +70,12 @@ maintaining a second implementation. Empty byte results across the relay and
 `src/server/sse-frame-buffer.ts` reuse one immutable zero-length view; non-empty frame ownership,
 frame limits, cancellation, terminal detection, and wire bytes are unchanged.
 
+`src/server/responses-custom-tool-repair.ts` continues to own retained routed argument bytes and
+their charge/release lifecycle while it asks the pure progressive decoder in
+`src/responses/progressive-freeform-input.ts` which prefix is safe to publish. The decoder neither
+charges nor releases translator budget; extracting it from `src/bridge/sse.ts` does not create a
+second retention owner or change terminal, failure, incomplete, or disposal release behavior.
+
 `src/adapters/openai-responses.ts` counts new compaction fragments, including surrogate pairs formed
 across deltas, while retaining snapshot/done/delta precedence and existing terminal ownership.
 Serialized request and buffered-response observations use byte counts without measurement arrays.
@@ -157,3 +169,5 @@ Schema size still determines traversal work and the cost of copying a changed br
 `tests/responses/openai-responses-passthrough.test.ts` covers the existing wire contract.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+The [compaction routing override](responses.md#compaction-routing-overrides) changes model and effort scalars on the already-read request body, before parsing, within the existing body-reader budget.
diff --git a/structure/transports/inventory.md b/structure/transports/inventory.md
index b63b0f23a25..e81ec55dc57 100644
--- a/structure/transports/inventory.md
+++ b/structure/transports/inventory.md
@@ -1,5 +1,7 @@
 # Transport Inventory
 
+Meta Muse's registry-owned compatibility User-Agent takes precedence over an incoming client User-Agent; explicit provider headers still win. See the [Muse provider contract](../providers-and-adapters.md).
+
 Native result continuations and function-result injection follow [the mode-specific result and control contract](streaming-health.md#experimental-native-function-result-injection); this surface does not infer upstream support or alter its defaults.
 
 Native steering follows [the shared WebSocket contract](streaming-health.md#experimental-native-mid-turn-steering); this surface's defaults remain unchanged.
@@ -25,8 +27,9 @@ surface is listed here so a maintainer can find the owner without grepping:
 | Transport | Owner | Invariant worth knowing |
 | --- | --- | --- |
 | Azure OpenAI Responses | `src/adapters/azure.ts` | Deployment-shaped URLs on top of the Responses contract. |
+| Responses custom-tool preview | `src/bridge/sse.ts`, `src/server/responses-custom-tool-repair.ts`, `src/responses/progressive-freeform-input.ts`, `src/responses/freeform-wrapper-scan.ts` | Direct adapter events and routed function restoration share one progressive wrapper decoder over one bounded JSON classification of the prefix, so property order and escaped key spellings preview as the wrapper completion unwraps them. Fence-shaped `exec`/`apply_patch` prefixes stay held until authoritative completion normalization, while each caller retains its own patch-envelope and byte-budget policy. |
 | Meta Muse Responses tool names | `src/responses/muse-tool-name-alias.ts`, `src/adapters/openai-responses.ts` | `api.meta.ai` only: function names over 64 characters or containing characters outside `[a-zA-Z0-9_-]` become collision-safe wire aliases and are restored before the client sees them. |
-| Google / Vertex / Antigravity | `src/adapters/google.ts`, `src/adapters/google-http.ts`, `src/adapters/google-wire-compiler.ts`, `src/adapters/google-tool-schema.ts`, `src/adapters/google-truncation.ts`, `src/adapters/google-errors.ts`, `src/adapters/google-antigravity-wire.ts`, `src/adapters/google-antigravity-replay.ts` | Vertex and Antigravity install a Google-family `fetchResponse` and so own their retry policy, while AI Studio Gemini leaves it undefined and uses the default server fetch path. The Google-family wrapper reuses the shared abort/deadline helpers (`src/lib/upstream-retry.ts`), wire-body repair, and upstream error normalization. |
+| Google / Vertex / Antigravity | `src/adapters/google.ts`, `src/adapters/google-http.ts`, `src/adapters/google-wire-compiler.ts`, `src/adapters/google-tool-schema.ts`, `src/adapters/google-truncation.ts`, `src/adapters/google-errors.ts`, `src/adapters/google-antigravity-wire.ts`, `src/adapters/google-antigravity-replay.ts`, `src/adapters/google-wire-shape.ts` | Vertex and Antigravity install a Google-family `fetchResponse` and so own their retry policy, while AI Studio Gemini leaves it undefined and uses the default server fetch path. The Google-family wrapper reuses shared abort/deadline helpers, upstream error normalization, and policy-aware wire-body repair: strict initial schema loss sends nothing, while strict repair withholding returns the original 400 without a changed send. The final compiler produces the [content-free tool-schema loss contract](../providers/google.md#google-tool-schema-loss-reporting). `google-wire-shape.ts` remains diagnostic-only. |
 | Mimo Free | `src/adapters/mimo-free.ts` | Client identity and JWT handling are transport-local; the per-install client id lives in the opencodex state root. |
 | Anthropic image ingress | `src/adapters/anthropic-image-guard.ts`, `src/adapters/anthropic-image-normalize.ts`, `src/adapters/anthropic-image-codec.ts` | Oversized or unsupported images are normalized or rejected before reaching upstream. An image's ladder position is pinned to its own identity (content hash + media type) rather than recomputed from recency each request (#4532); appending a newer image therefore cannot demote and re-encode older images and bust Anthropic's prompt prefix cache. Unseen images still take the age-tier pyramid's first position, the total byte budget still binds, and a 413 `tierBias` retry still applies. Recorded positions only move down the ladder, so the store is monotonic. |
 | Adapter execution support | `src/adapters/run-turn-queue.ts`, `src/adapters/tool-catalog-nudge.ts`, `src/adapters/identity.ts`, `src/adapters/image.ts`, `src/adapters/upstream-http-error.ts` | Shared machinery: turn ordering, tool-catalog nudging, client fingerprinting, image conversion, upstream error normalization. |
@@ -37,7 +40,7 @@ surface is listed here so a maintainer can find the owner without grepping:
 | Image/video generation loop | `src/images/loop.ts`, `src/images/plan.ts`, `src/images/fulfill.ts`, `src/images/xai-client.ts`, `src/images/xai-video-client.ts`, `src/images/artifacts.ts` | A provider-returned image URL is downloaded into a local artifact once, then served locally; warnings stay URL-free because provider CDN URLs may embed credentials. |
 | GitHub Copilot | `src/providers/xai-transport.ts` (`resolveProviderTransport`), `src/providers/github-copilot-transport.ts` | `resolveProviderTransport` selects the Copilot transport when the routed provider name is `github-copilot`; the Copilot module then resolves its headers and base URL, and the registry seeds the provider row and model fallback. |
 | API-key pools | `src/providers/api-key-selection.ts`, `src/providers/key-failover.ts` | A configured `apiKeyPoolStrategy` plus a cooling committed key rotates before the first send (`selectProactiveApiKeyTransport`); a 429 still rotates after the send and records a cooldown. `provider.apiKey` keeps mirroring the active entry so routing stays single-key. The pick is inert without a strategy or while the committed key is healthy. |
-| OAuth account failover | `src/oauth/generic-account-failover.ts`, `src/oauth/anthropic-routing.ts` | Reactive pre-output 429 recovery is presence-driven with 2+ eligible accounts. Pool and `oauthAccountFailover` flags govern proactive routing, not the reactive retry: a disabled Anthropic pool recovers through quota ordering rather than its dormant strategy, and a per-provider `enabled` beats the global default in either direction. |
+| OAuth account failover | `src/oauth/generic-account-failover.ts`, `src/oauth/anthropic-routing.ts` | Reactive pre-output 429 recovery is presence-driven with 2+ eligible accounts. Pool and `oauthAccountFailover` flags govern proactive routing, not the reactive retry: a disabled Anthropic pool recovers through quota ordering rather than its dormant strategy, a per-provider `enabled` beats the global default in either direction, and a non-positive fill-first threshold disables proactive usage-based rotation. |
 | OAuth login callback (inbound) | `src/oauth/callback-server.ts` | Every response, including non-callback 404s, closes its connection so a pooled socket cannot deliver a later login to a retired flow on the same callback port. |
 | Alibaba regions | `src/providers/alibaba-region-backup.ts`, `src/providers/alibaba-region-migration.ts`, `src/providers/alibaba-region-startup.ts` | Region migration backs up before rewriting and is idempotent across restarts. |
 | Discovery and quota | `src/providers/model-discovery.ts`, `src/providers/quota.ts`, `src/providers/registry.ts` | Discovery rejects a response over 4 MiB or past 2,000 raw rows before caching it. Provider-scoped hints fill capabilities omitted by live rosters; OpenCode Go's `deepseek-v4.1-flash` keeps its 1,048,576-token context window. The fixed-key Opper preset uses the shared OpenAI Chat adapter at `https://api.opper.ai/v3/compat`, discovers models through its conventional authenticated `/models` path, preserves an older same-named custom destination, and falls back to bare pool ids while passing vendor-prefixed ids through unchanged. Codex quota DTOs suppress retired Spark evidence under the [OpenAI scope contract](../providers/openai-tiers.md#public-provider-contract), retaining ordinary custom windows. |
@@ -45,7 +48,9 @@ surface is listed here so a maintainer can find the owner without grepping:
 The registry's first-party `deepseek-flash` row declares native `text` and `image` input, so image
 requests bypass the vision sidecar by default; explicit `noVisionModels` or text-only declarations
 remain authoritative. First-party `deepseek-chat`, `deepseek-reasoner`, and `deepseek-v4-flash`
-remain sidecar-backed by default. Zen routes are unchanged and unprobed in this update. Zen `mimo-v2.5-free` and `longcat-2.0-free` now carry positive `modelInputModalities` image evidence rather than relying on absence from the text-only list.
+remain sidecar-backed by default. The Zen tiers (`opencode-zen`, `opencode-free`) could not be measured in this update (HTTP 402) and keep their existing classifications. Zen `mimo-v2.5-free` and `longcat-2.0-free` now carry positive `modelInputModalities` image evidence rather than relying on absence from the text-only list.
+OpenCode Go's `deepseek-v4.1-flash` was reclassified as native vision on 2026-09-19 (probed on
+that gateway); its sibling `deepseek-v4-flash` stays sidecar-backed.
 
 > Decision record: [ADR-0072](../decisions/ADR-0072-transport-inventory.md)
 
@@ -115,6 +120,10 @@ invalid-JSON message described above.
 
 ## Provider diagnostic outbound safety
 
+Google tool-schema loss diagnostics follow the same outbound boundary. The compiler retains only
+an endpoint class, closed category counts, and bounded flags; provider debug controls emission,
+and the diagnostic adds no field or byte to the upstream request.
+
 Provider connection tests and live model discovery share the GET-only provider outbound wrapper.
 Direct HTTP(S) resolves once and pins the validated address; HTTPS preserves the original Host/SNI
 and always verifies certificates. HTTP(S)-proxy requests stay on Bun fetch; configured SOCKS5
@@ -123,6 +132,14 @@ only a typed DNS-resolution failure degrades to proxy resolution; every literal,
 resolved-address policy error still rejects. Proxy mode logs once that the proxy-selected peer
 cannot be pinned. Private destinations additionally require allowPrivateNetwork plus NO_PROXY.
 
+Every request through this wrapper is proxy-originated, so it fills a default
+`User-Agent: opencodex` when the request headers name no User-Agent of their own; registry
+static headers, provider `headers` values, and vendor-specific client fingerprints keep their
+value and are never given a second User-Agent. The value survives, not its spelling: the pinned
+and SOCKS transports rebuild the header set through `new Headers()`, which lowercases every name.
+Inference traffic never uses this wrapper, so client fingerprints on proxied traffic are
+unaffected (#5104).
+
 Two fake-IP DNS accommodations exist, both for resolved answers only (a literal address in the URL
 still rejects). The IANA benchmark range (198.18/15 and its IPv4-mapped IPv6 spellings) is admitted
 whenever any outbound proxy applies to the host, because the range itself marks the answer synthetic.
@@ -188,7 +205,7 @@ Antigravity account quota probes expose only a closed `quotaFailure` category wh
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
@@ -234,12 +251,22 @@ The tunnel reader keeps incomplete framing separate from queued socket bytes,
 waits for new input, and caps headers even when the terminating delimiter arrives
 in the same chunk. Cancellation removes the exact queued waiter; socket errors
 remain errors on later reads rather than turning into clean EOF. Buffered body
-reads pause the socket at the local high-water mark, and upload errors are observed
-before the response reader takes ownership. `tests/lib/socks5-fetch.test.ts` covers
+reads pause the socket at the local high-water mark, and an upload failure is observed
+by the caller rather than lost behind the answer. `tests/lib/socks5-fetch.test.ts` covers
 fragmented framing, header limits and explicit-route snapshot preservation.
 Explicit `http2` / `h2` pins reject before network I/O: this HTTP/1.1 tunnel cannot
 honor them and must not silently downgrade the provider contract.
 
+The upload and the answer are read together. One reader consumes the socket for the whole
+exchange, starting before the request body is finished, because a peer may answer a request it
+has not finished receiving and a caller's body stream may stall. Each body read and drain wait
+races the caller's abort and that pending answer, so an abort settles the fetch with its own
+reason rather than leaving a read the transport does not own, an early final response ends the
+upload without writing a terminating chunk into a finished conversation, and a socket failure
+during a stalled read surfaces as the failure instead of a promise that never settles. The
+request body is cancelled without being awaited, since a caller's cancel algorithm may itself
+never settle. `tests/lib/socks5-upload-lifecycle.test.ts` covers these four outcomes.
+
 Content-coding is this transport's own obligation. `fetch` decodes a coded body below the
 Response constructor; this tunnel assembles the body from a socket, so a response wrapped with
 its upstream headers hands the coded bytes to whatever parses them. The request therefore asks
@@ -247,4 +274,36 @@ for `identity` unless the caller chose an `accept-encoding` itself, a `gzip` or
 response is decoded and stops advertising the coding and the coded length, and any other coding
 is refused by name rather than surfaced as bytes no caller can read.
 
+## Raw transport null-body statuses
+
+`src/lib/http-response-semantics.ts` holds the null-body status set both raw outbound transports
+have to honor. `fetch` applies it below the Response constructor; `src/lib/pinned-http.ts` and
+`src/lib/socks5-fetch.ts` build a Response from a socket, so each one applied the rule on its own
+and the two disagreed — the SOCKS helper excluded 204 and the pinned helper excluded nothing.
+204, 205 and 304 resolve with a null body and release the connection instead of waiting for a
+peer that is entitled to keep it alive, and their representation headers are preserved as they
+arrived rather than decoded or refused, because there are no coded bytes to act on.
+`tests/lib/transport-null-body.test.ts` covers both transports against a keep-alive peer.
+
+## Raw transport content coding
+
+Content coding is each raw transport's own obligation, and the pinned direct helper now carries
+the same one the tunnel does. Provider outbound picks between these two routes, so decoding on
+only one of them made the same gzip JSON readable or unreadable depending on operator egress
+configuration. Both ask for `identity` unless the caller chose an `accept-encoding` itself,
+decode `gzip` and `deflate`, drop the coding and the coded length once the bytes no longer match
+them, and refuse any other coding by name instead of surfacing bytes no caller can parse. Only
+the coding the response actually carries decides this; a preference list that mentions an
+alternative this code cannot undo is not a refusal.
+
+The pinned helper's `maxBytes` binds both sides of that decode: the bytes that arrive on the
+socket keep their existing meaning, and the decoded bytes are bounded by the same ceiling, so a
+small coded response cannot expand past the limit a caller set to bound what it holds. A decoder
+failure surfaces as a named `PinnedHttpError`. Connection teardown belongs to the responses that
+end early — a decode failure, an exceeded ceiling, a cancelled read; a response that completed
+is left to the HTTP agent, which may pool or destroy it.
+`tests/lib/pinned-http-content-coding.test.ts` covers both routes on the same payload.
+
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+The [compaction routing override](responses.md#compaction-routing-overrides) selects a target before the existing native compact or routed Responses transport is resolved.
diff --git a/structure/transports/responses.md b/structure/transports/responses.md
index 811d819bbf8..09bf0d1ccb7 100644
--- a/structure/transports/responses.md
+++ b/structure/transports/responses.md
@@ -125,6 +125,45 @@ Function-call wrappers around freeform bodies are restored by
 is recoverable because the wrapper is otherwise unusable; two alternate fields are ambiguous and
 therefore remain untouched. Foreign freeform grammars never receive that compatibility rewrite.
 
+Progressive preview for those wrappers is decoded by
+`src/responses/progressive-freeform-input.ts` in both the adapter-event bridge and routed
+function-call restoration, over the classification in `src/responses/freeform-wrapper-scan.ts`.
+A prefix that can still become a complete outer fence stays held so completion never removes
+bytes already published in a delta; a body that is not shaped like a wrapper object remains
+progressive, and JSON escapes emit only complete decoded units.
+
+Which wrapper applies is decided by scanning the prefix as JSON rather than matching it against
+a literal opening. `JSON.parse` decides the completed input, and it cares about neither property
+order nor how a name is spelled, so a canonical key arriving after other properties or written
+with an escape is the same wrapper and has to preview as one (#5151). The buffering policy that
+follows is: an own `input` with a string value streams progressively, because completion gives
+it precedence over everything else in the object whatever its position; an `input` with a
+non-string value, a text that is not an object, and an object `JSON.parse` can no longer accept
+all publish their own bytes, because that is what completion returns for them; every other
+object HOLDS until it parses, because a key that has not arrived yet can still change the
+answer. Fallback fields fall out of that last rule rather than being recognized separately:
+they only unwrap as the single string field, so no prefix decides them. Classification is
+bounded to `MAX_FREEFORM_WRAPPER_SCAN_CHARS`, which keeps the work per delta from growing with
+the arguments. Past the bound nothing is previewed at all: the authoritative parse still
+unwraps the wrapper at completion, so the bound costs preview and never agreement. The parse
+that releases a held object therefore runs only where the scan SAW the object close, which is
+what keeps a buffer whose deltas happen to end on a brace from being re-read on every one of
+them.
+
+What that policy costs is worth stating plainly, because it is a real narrowing. A body that IS
+a parseable JSON object but not a wrapper — `{"code":1}` or `{"code":"a","script":"b"}` — now
+reaches the direct bridge in one delta when the object closes, where it previously streamed as
+it arrived. That is not a tuning choice: `input` can still arrive after any property, so any
+prefix published before the object closes is a prefix that completion may unwrap away. Routed
+restoration has held exactly these bodies since #5047 and this is the two paths agreeing, not a
+new restriction invented for one of them. Bodies that are not objects, which is what an `exec`
+program or an `apply_patch` envelope actually looks like, are unaffected and still stream.
+
+Routed restoration additionally keeps its existing hold for an unrecognized JSON object and its
+separate code-mode patch-envelope hold. Duplicate `input` keys and wrappers that become invalid
+only after a valid prefix was emitted remain bounded exceptions: completion is authoritative
+because preserving progressive canonical input leaves no rewind mechanism.
+
 Codex-private tool fields are removed at the same boundary from one table
 (`CANONICAL_ONLY_TOOL_FIELDS`) rather than one bespoke pass each: `external_web_access` on either
 web-search variant, and `defer_loading` on any declaration, which `activateDeferredTool` clears only
@@ -294,6 +333,18 @@ including the compaction turn the proxy itself drives. With `store: false`, requ
 strips ids from every input item, including compact-wire items, matching codex-rs
 (`core/src/client.rs:918-925`). Compact-wire items remain exempt from response-side field backfill.
 
+For replayed `encrypted_content` slots whose minting provenance is unavailable after a restart or
+full-history resend, the plaintext-compatibility boundary requires canonical key-independent Fernet
+structure (version byte, timestamp, IV, block-aligned ciphertext and HMAC layout). A long
+base64-like agent message does not gain ciphertext authority from its spelling. Structure is not
+authentication: it is only the minimum legacy fallback needed to avoid corrupting genuine opaque
+history. If the canonical backend still rejects an encrypted function or agent output, the exact
+decrypt/decode identity enters one request-budgeted sanitize-and-rebuild attempt for HTTP and
+pre-commit SSE/WebSocket terminal envelopes; the single-shot guard remains armed on the rebuilt
+send.
+
+> Decision record: [ADR-5236](../decisions/ADR-5236-responses-http-sse.md)
+
 Codex pool account changes are a separate portability question from destination serving identity.
 `src/codex/routing.ts` remembers, in process memory and keyed like thread affinity, which pool
 account minted a conversation's carried state (`previous_response_id`, encrypted reasoning, and
@@ -480,7 +531,12 @@ receive `previous_response_not_found` before upstream dispatch and must resend c
 without `previous_response_id`. That refusal is not specific to the stateless flag: it covers every
 destination that cannot see the prefix this process failed to restore, which is every destination
 except the native Responses passthrough. The passthrough forwards the id and keeps its
-upstream-owned state. `PROVIDER_OWNED_CONTINUATION_WIRES` in
+upstream-owned state. A task-scope mismatch uses the same generic refusal even when the supplied
+input appears complete, because the proxy cannot prove that it contains the full conversation.
+The internal mismatch reason, stored scope and state contents never enter the client response;
+the caller retries explicitly with complete history and no `previous_response_id`. Matching
+normalized scopes replay, and two absent or blank scopes remain the legacy unscoped cohort.
+`PROVIDER_OWNED_CONTINUATION_WIRES` in
 `src/responses/continuation-ownership.ts` is deliberately empty and records why the three
 candidates do not qualify: devin re-sends the whole conversation each turn, cursor reads its
 `checkpointRef` out of the same expired store and otherwise falls back to `full-replay`, and kiro
@@ -538,6 +594,11 @@ Arguments, user text, and schema property names are never rewritten.
 
 ### Declared-tool membership by inbound wire
 
+Inbound declaration membership and schemas remain unchanged by Google's
+[tool-schema loss report](../providers/google.md#google-tool-schema-loss-reporting). Only the final
+Google wire compiler observes and reports compatibility narrowing; the Responses bridges neither
+derive nor consume that report.
+
 `declaredToolNames` carries the request's tool catalog into both bridges, and it does two separate
 jobs that are separately controlled.
 
@@ -547,6 +608,37 @@ declared bare tool and to rewrite code-mode helper names into the declared `exec
 input unchanged when the set is absent, so the set reaches the bridge on every wire and enforcement
 is expressed by a separate flag rather than by withholding it.
 
+The passthrough guard resolves an emitted name through that same `normalizeDeclaredToolName`, so
+whatever it admits it must also EMIT under the resolved name. The two halves disagreed once:
+`normalizeDefaultNamespaceInItem` implemented only the bare-tool case (#4176), so a
+`default.`-prefixed code-mode helper was admitted as `exec` (#4412) and then relayed verbatim.
+`default.view_image` is not a legal Responses tool name, and Codex stores what it receives, so the
+one relayed item was refused by `^[a-zA-Z0-9_-]+$` on every later replay of that conversation and
+the task could not be compacted or continued (#5095). The rewrite now falls back to the resolver
+whenever `isSchemaValidResponsesToolName` (`src/responses/tool-name-aliases.ts`) rejects the emitted
+name, and only then, so a name the upstream accepts is never reshaped by this branch. A name that
+resolves to nothing declared stays refused by the #1700 guard, which is the pre-existing and
+intended outcome: an invalid name that cannot be resolved must end the turn visibly rather than
+reach stored history.
+
+Stopping the emission is only half of it, because Codex stores what it received. A conversation
+that already contains one `default.`-prefixed call name is refused on every later turn that
+replays it, so the task cannot be compacted or continued at all and no upgrade reaches it.
+`repairLegacyDottedToolCallNames` (`src/responses/legacy-dotted-tool-name-repair.ts`) repairs the
+replayed item on the way out, in `buildRequest` beside `backfillWebSearchQueries` and again in
+`src/server/responses/compact.ts`, which forwards the caller's body directly. It runs before the
+canonical-destination split because the reported failure was a side chat on a plain OpenAI model
+inheriting history a routed provider had damaged.
+
+What it will resolve is bounded on purpose, and only replayed `input` items are eligible — the
+caller's tool catalog is never rewritten. A dotted spelling the catalog itself declares is a real
+tool identity and is left alone; a suffix claimed by two declared identities is ambiguous and is
+left alone; a suffix that names exactly one declared tool, or one of the code-mode helper spellings
+in `CODE_MODE_HELPER_WIRE_NAMES` (which a code-mode catalog never declares), resolves to that name.
+There is no rule that strips whatever precedes the first dot: a legitimate tool name may contain
+one in another provider's vocabulary, and a replayed item names a call that already happened, which
+is the worst place to guess.
+
 Membership enforcement is that flag, `enforceDeclaredToolNames`, and only the `responses` inbound
 wire enforces. A routed provider that names a tool the request never declared ends the turn there:
 `src/bridge/sse.ts` emits `response.failed` and `src/bridge/response-json.ts` returns a failed
@@ -601,6 +693,16 @@ Native passthrough SSE has TWO shapes, selected per request in
 Both client readers also retain a bounded, redacted message from a bare upstream
 `error` event. If EOF arrives without a real Responses terminal, they synthesize
 one `response.failed` with that message instead of replacing it with `adapter_eof`.
+That synthesized terminal also carries the upstream's own verdict. Codex classifies
+a `response.failed` by `error.code` alone and retries every code outside its fatal
+set, so a refusal stamped `upstream_server_error` reached the client as a retryable
+disconnect and drove a reconnect loop (#5176). The readers now read a refusal code
+and the message from the same candidate precedence, taking the first code present so
+a refusal nested below a transient one cannot overrule it, and fall back to
+recognized refusal copy only when the event carried no code at all. A refusal code
+with no message still produces a terminal, and a read that fails after a refusal was
+captured reports the refusal rather than a generic reset. Request-log accounting is
+unchanged: a row that ends on a refusal still records the transport-level status.
 The delivering reader owns this evidence; an asynchronous tee inspection branch
 cannot reliably supply it before EOF. Inspection independently applies the same
 bare-error rule when EOF arrives, so account health records failure instead of
@@ -696,6 +798,11 @@ terminal observer. Native Responses, Chat Completions, Claude Messages, and WebS
 request logs must therefore finalize through the context-aware terminal mapper; recognized
 `cyber_policy` terminals stay `400 / cyber_policy` rather than collapsing to a generic 502.
 
+Raw SSE inspection remains upstream-first: client-facing block rewrites run after the original
+bytes are observed. The Grok-only `response.created_at` and `response.completed_at` compatibility
+rewrite is limited to `response.*` events with nonnegative safe integer values and leaves invalid or
+byte-identical payloads unchanged.
+
 The client-facing boundary treats the first Responses terminal as authoritative in both relay
 shapes. High-confidence policy errors carried as `response.incomplete`, `response.failed`, or a
 top-level `error` are normalized to one `response.failed / cyber_policy` event without changing the
@@ -841,12 +948,58 @@ Pool quota producers and account commands follow the [bounded raw-observation co
 
 Live sideband admission and its bounded upstream handshake follow the [runtime contract](../runtime.md#live-sideband-handshake); the ordinary Responses WebSocket exchange remains separate.
 
-Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached.
+Translated Chat request construction uses the [inline-image budget](streaming-health.md#translated-chat-inline-image-budget); the shared normalizer counts retained bytes even when a wire-specific drop callback keeps the image attached, rejects inputs above the safe decoded-pixel ceiling, caps native decode work process-wide, and stops queued work when the request is cancelled.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
 Provider-scoped approval reviewer settings are projected by the [catalog owner](../catalog.md#provider-scoped-approval-reviewer); this surface retains its existing routing, transport and account-selection behavior. Translated audio/file admission follows the [final-adapter input contract](../adapters/registry.md#untranslated-input-media); native raw passthrough remains separate. Unicode pattern normalization uses [copy-on-write traversal](byte-accounting.md#unicode-pattern-normalization) while preserving the existing schema and wire semantics.
 
+## Compaction routing overrides
+
+`src/server/responses/compaction-routing.ts` applies `compactionRouting` before model routing in
+both `request-prepare.ts` and `compact.ts`. It requires explicit `request_kind: "compaction"` in
+`x-codex-turn-metadata`, supplied as a header or embedded in Responses `client_metadata`, and on
+`/v1/responses` a `compaction_trigger` input item as well, so metadata alone cannot move an
+ordinary turn. Every supplied metadata copy must agree, both that the request is a compaction and
+on which trigger it carries; copies that name different triggers are rejected rather than reconciled.
+Malformed, absent, and ordinary-turn metadata leave the request unchanged. WebSocket requests use
+only per-frame metadata; handshake headers can describe an earlier request.
+
+`compactionRouting.triggers` names the `compaction.trigger` values the override covers, drawn
+from Codex's own `manual` and `auto`. Omission means `["manual"]`, so a block that does not
+mention triggers routes manual `/compact` only and leaves automatic compaction exactly where it
+routes today. `["auto"]` or `["manual", "auto"]` is the opt-in for #5012: an automatic
+pre-sampling compaction on a routed thread otherwise stays bound to the canonical `openai`
+reservation in `routeCompactionModel`, because that reservation releases only when no enabled
+canonical `openai` provider exists (#2901), not when its quota is exhausted. A hand-edited
+`triggers` the schema would reject disables the whole block instead of widening it, so a
+malformed edit can never route more than it names.
+
+The override changes only the model and optional reasoning effort. Existing native forwarding,
+routed summaries, capability handling, and retry budgets remain authoritative; native compact
+still removes reasoning before sending. Internal handoffs carry the override record (with the
+conversation's source model) as a recursion guard so combo children and fallback attempts
+retain their selected targets. Overrides bypass shadow interception and conversation
+combo recall, and do not publish replacement combo/handoff recall. They never change the
+conversation's configured model or any compaction request outside the configured triggers.
+
+`compactionRoutingKeepsProviderIdentity` compares the source model's concrete route with the
+selected route (provider name, Codex account mode and namespace; combos on either side never
+match, and a bare source model the lane remembers as a combo target counts as a combo source,
+recorded as `sourceCombo` when the override is applied, and a configured combo target is recorded as
+`targetCombo` so its concretely routed children stay portable too). A matching identity keeps the caller's credential and may use the native compact
+endpoint. A mismatch marks the credential domain as rewritten, exactly like a shadow
+intercept, and forces the portable summarizer even for a native-capable target: `compact.ts`
+skips `/responses/compact`, and `request-prepare.ts` sets `parsed._portableCompaction`, which
+`request-sidecar-auth.ts` (`routedCompaction`) and the passthrough adapter's compaction body
+build both honor for canonical ChatGPT destinations. Native ciphertext is replayable only by the
+backend that minted it; the conversation model would otherwise resume with an omission marker
+in place of its history.
+
+`tests/responses/responses-compaction-override.test.ts` covers trigger selection, config validation,
+native and routed handlers, same-provider credential retention, cross-provider portable summaries
+and their replay, combo failover, and subsequent conversation settings.
+
 ## Core module ownership
 
 `src/server/responses/core.ts` is the public ingress and compatibility-export surface.
@@ -910,14 +1063,23 @@ The hop pays for a replay that some *other* layer dispatches, so which layer set
 reservation follows the dispatcher, not the ladder. A helper-routed replay reports the same
 physical send back through `onSendsConsumed`; that is what `countedExternally: true` names, and the
 reporter's first send settles the pending booking instead of adding a second charge. An adapter
-that owns its transport — Kiro's reset ladder, Cursor's transport ladder — reserves once per
-physical send instead, so no reporter ever arrives. Those ladders are handed
+that owns its transport — Kiro's reset ladder, Cursor's transport ladder, or Devin's bounded
+pre-output stated-reset replay — reserves once per physical send instead, so no reporter ever
+arrives. Those ladders are handed
 `adapterDispatchBudget`, a live delegating view of the same budget that spends a permit passed down
 through `pendingHopPermit` on the adapter's first reservation and closes the booking through
 `permit.assumeCharge()`. Letting both charge is how one physical send became two charges, and how a
 spent allowance answered a 429 with a synthetic error instead of the rate limit it was recovering
 from (#4709).
 
+`run-turn-execution.ts` passes the same physical-send and recovery-withheld observers used by the
+request-building adapter path. Devin builds one `createAdapterPhysicalSend` for the whole
+`GetChatMessage` invocation, so its initial POST and at most two same-target replays report ordinals
+1, 2, and 3. The outer runTurn attempt already records ordinal 1, and the shared observer therefore
+adds only ordinals above 1 to `sendCount`; the execution budget still reserves every ordinal. A
+replay reserves only after its server-stated wait. If admission is refused, no inference I/O occurs,
+`retry-send-budget` is recorded, and the preceding provider 429 remains the returned error.
+
 Confirmation happens at the dispatch boundary rather than at the rotation. `adapter-dispatch.ts`
 passes an `onDispatch` callback that the rebuild invokes immediately before the wire, and skips it
 when the adapter owns dispatch: settling there first would hand that adapter a dead permit, which
@@ -1002,6 +1164,27 @@ default, so a shipped ceiling would start refusing real traffic on the first upg
 it, against a number nobody chose. Absent, empty and all-scopes-absent sections are the same
 thing -- observe only.
 
+The shared journal has one live writer per state directory. `startServer` acquires the
+`src/lib/spend-ledger-owner.ts` SQLite lease before configuration and before any listener binds;
+`sharedSpendLedger` asserts that lease before construction because replay can append `lost`
+records, and `configureSharedSpendLedger` asserts it before changing a live singleton. This applies
+identically with and without configured ceilings: observe-only still appends, settles and compacts.
+Two servers in one process and one directory share a reference-counted lease; that process cannot
+hold two directories at once. Sequential ownership is allowed and concurrent ownership is not:
+releasing the final reference discards the singleton, so a later directory replays its own
+journal instead of inheriting figures. A ledger records the ownership it was built under and
+proves that exact identity on every accounting read and change, so a handle kept across a release
+and a reacquire of the same directory is refused rather than resuming over writes another owner
+may have made. File-backed journal and salt writers are owner-bound at construction, and a
+directory entry that is a link -- including one whose target does not exist -- is refused instead
+of followed. A separate process may use a separate directory. SQLite crash release permits the
+next owner without stale-PID or TTL reclamation.
+
+The journal survives an ordinary process restart once its writes reached the filesystem. It does
+not claim host power-loss durability: the append path does not fsync each record, so power loss can
+drop recently acknowledged filesystem writes. A torn final line remains the only replay corruption
+that may be discarded quietly.
+
 Applying a policy to a ledger that already exists reconfigures it rather than rebuilding it.
 Every figure already accounted survives, so raising, lowering or clearing a ceiling changes what
 is refused from here on and never what was spent. A rebuild would replay the journal into a
diff --git a/structure/transports/streaming-health.md b/structure/transports/streaming-health.md
index ca5ce00455f..9246b1e9695 100644
--- a/structure/transports/streaming-health.md
+++ b/structure/transports/streaming-health.md
@@ -159,6 +159,8 @@ once the server observes the client disconnect (Bun propagates it asynchronously
 cancelled with 499 before any replay; because the propagation is async, a replay may precede
 the cancel if the interval elapses first (bounded by the same `attempts` budget).
 
+OpenCode Go (`https://opencode.ai/zen/go/v1`, serving subscription traffic such as Muse Spark) ships a patient same-target fallback when no explicit `retryOn429` is configured: same-key wait-and-replay with a 10s interval and a 60s cap, `Retry-After` honored. Replays draw from the shared per-request send budget, so a burst typically absorbs a couple of paced sends before the 429 surfaces — without this, a single-key pool surfaced the first 429 immediately and the client’s own retry budget aborted the goal (`exceeded retry limit, last status: 429`). An explicit `retryOn429` — including `enabled: false` — always overrides the fallback; every other provider without the knob keeps fail-fast behavior.
+
 Provider-level `requestPacing` is the proactive companion to `retryOn429`. It reserves outbound
 request-start slots before transport work begins, so a known RPM ceiling does not have to fail once
 before the proxy reacts. One provider-wide lane enforces the aggregate ceiling. Exact model lanes
@@ -286,7 +288,7 @@ Live sideband admission and its bounded upstream handshake follow the [runtime c
 
 ## Translated Chat inline-image budget
 
-`src/adapters/openai-chat-images.ts` reuses the shared image normalization ladder for translated Chat bodies above a 3.5 MiB base64-image budget. This is best effort, not a whole-request ceiling. Remote URLs are not fetched; unprocessable and terminal images remain attached, and retained bytes continue to count during demotion. Under-budget construction stays synchronous; delegating MiMo awaits conditional asynchronous construction. Native Chat passthrough and Anthropic-only 413 retry policy retain their existing behavior.
+`src/adapters/openai-chat-images.ts` reuses the shared image normalization ladder for translated Chat bodies above a 3.5 MiB base64-image budget. This is best effort, not a whole-request ceiling. Remote URLs are not fetched; unprocessable and terminal images remain attached, and retained bytes continue to count during demotion. Under-budget construction stays synchronous; delegating MiMo awaits conditional asynchronous construction. Native decoding is admitted through a process-wide four-operation gate, guarded by a 16-million-pixel ceiling confirmed from codec metadata, and request cancellation stops queued and subsequent normalization work. Native Chat passthrough and Anthropic-only 413 retry policy retain their existing behavior.
 
 The [explicit model-capability contract](../config.md#explicit-per-model-capability-declarations) preserves operator declarations through provider storage and catalog capture; it does not infer upstream capability or change this surface's routing behavior.
 
@@ -511,3 +513,5 @@ cover effective wire settings, immutable-route refusals, policy preservation,
 independent API credentials, unavailable-mode diagnostics and safe probe outcomes.
 
 Dashboard Fast-row persistence and client refresh follow the [Fast selector rows setting contract](../gui-and-management-api.md#fast-selector-rows-setting).
+
+WebSocket [compaction routing selection](responses.md#compaction-routing-overrides) uses per-frame metadata; handshake metadata cannot supply a later frame's trigger.
diff --git a/tests/adapters/abort-race.test.ts b/tests/adapters/abort-race.test.ts
index 33a6da1ab4b..7843e1c0871 100644
--- a/tests/adapters/abort-race.test.ts
+++ b/tests/adapters/abort-race.test.ts
@@ -1,6 +1,7 @@
 import { afterEach, describe, expect, mock, test } from "bun:test";
 import type { ProviderAdapter } from "../../src/adapters/base";
 import type { AdapterEvent, OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const actualResolver = await import("../../src/server/adapter-resolve");
 let adapterFactory: ((provider: OcxProviderConfig) => ProviderAdapter) | undefined;
@@ -13,8 +14,15 @@ mock.module("../../src/server/adapter-resolve", () => ({
 }));
 
 const { handleResponses } = await import("../../src/server/responses");
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 afterEach(() => {
+  // Release first so a failed dispatch cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   adapterFactory = undefined;
 });
 
@@ -63,6 +71,7 @@ describe("Responses abort guards", () => {
       },
     });
 
+    takeSpendHome();
     const response = await post("test-run-turn", false);
     const body = await response.text();
 
@@ -107,6 +116,7 @@ describe("Responses abort guards", () => {
         },
       });
 
+      takeSpendHome();
       const response = await post("test-fetch", true, clientAbort.signal);
       await response.text();
       await new Promise<void>(resolve => setImmediate(resolve));
@@ -175,6 +185,7 @@ describe("Responses abort guards", () => {
         },
       });
 
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/adapters/adapter-inner-send-budget-wiring.test.ts b/tests/adapters/adapter-inner-send-budget-wiring.test.ts
index 4b86734113b..c5341a759fa 100644
--- a/tests/adapters/adapter-inner-send-budget-wiring.test.ts
+++ b/tests/adapters/adapter-inner-send-budget-wiring.test.ts
@@ -9,8 +9,11 @@ import {
 } from "../../src/adapters/cursor/thread-continuity";
 import type { CursorTransport } from "../../src/adapters/cursor/transport";
 import { createKiroAdapter } from "../../src/adapters/kiro";
+import { createDevinAdapter, DEVIN_API_SERVER } from "../../src/adapters/devin";
+import { setCachedCatalogForTests } from "../../src/adapters/devin/cloud-direct/catalog";
 import { resetKiroThrottleStateForTests } from "../../src/adapters/kiro-retry";
 import type { AdapterFetchContext } from "../../src/adapters/base";
+import { SendBudgetExhaustedError } from "../../src/lib/upstream-retry";
 import { encodeMessage } from "../../src/lib/eventstream-decoder";
 import { createRequestExecutionBudget, type RequestExecutionBudgetPolicy } from "../../src/lib/request-execution-budget";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../src/types";
@@ -122,6 +125,127 @@ describe("Cursor runTurn and the request send budget", () => {
   });
 });
 
+describe("Devin runTurn execution wiring", () => {
+  test("forwards the provider executor, shared budget, and physical-send observer", async () => {
+    const previousHome = process.env.OPENCODEX_HOME;
+    const previousJwtFlag = process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const home = mkdtempSync(join(tmpdir(), "devin-send-wiring-"));
+    process.env.OPENCODEX_HOME = home;
+    delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const apiKey = "devin-test-key";
+    setCachedCatalogForTests({
+      apiKey,
+      host: DEVIN_API_SERVER,
+      fetchedAt: Date.now(),
+      byUid: new Map([["swe-2", { modelUid: "swe-2", label: "SWE-2", disabled: false }]]),
+    });
+    const budget = budgetOf(1);
+    const observed: Array<{ ordinal: number; recovery?: string }> = [];
+    const urls: string[] = [];
+    const events: AdapterEvent[] = [];
+    const adapter = createDevinAdapter({
+      adapter: "devin", baseUrl: DEVIN_API_SERVER, apiKey,
+    } as unknown as OcxProviderConfig);
+
+    try {
+      await adapter.runTurn?.(
+        {
+          modelId: "swe-2", stream: true, options: {},
+          context: { messages: [{ role: "user", content: "hi" }] },
+        } as unknown as OcxParsedRequest,
+        {
+          headers: new Headers(),
+          translatorBudget: createTestTranslatorBudget(),
+          sendBudget: budget,
+          providerFetch: (async input => {
+            urls.push(String(input));
+            return new Response("busy", { status: 500 });
+          }) as typeof fetch,
+          onPhysicalSend: send => { observed.push(send); },
+        },
+        event => events.push(event),
+      );
+    } finally {
+      setCachedCatalogForTests(null);
+      if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousHome;
+      if (previousJwtFlag === undefined) delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+      else process.env.OPENCODEX_DEVIN_SEND_USER_JWT = previousJwtFlag;
+      removeTreeWithRetry(home);
+    }
+
+    expect(urls).toHaveLength(1);
+    expect(urls[0]).toContain("GetChatMessage");
+    expect(budget.used).toBe(1);
+    expect(observed).toEqual([{ ordinal: 1 }]);
+    expect(events.at(-1)).toMatchObject({ type: "error", status: 500 });
+  });
+
+  test("a first send the budget refuses makes no request and reports no send", async () => {
+    // The accounting defect this pins: the caller used to log this turn's first send before the
+    // adapter ran, so an allowance already spent by earlier recovery produced a logged send the
+    // wire never made. Nothing is dispatched here, so nothing may be observed either.
+    const previousHome = process.env.OPENCODEX_HOME;
+    const previousJwtFlag = process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const home = mkdtempSync(join(tmpdir(), "devin-send-denied-"));
+    process.env.OPENCODEX_HOME = home;
+    delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const apiKey = "devin-denied-key";
+    setCachedCatalogForTests({
+      apiKey,
+      host: DEVIN_API_SERVER,
+      fetchedAt: Date.now(),
+      byUid: new Map([["swe-2", { modelUid: "swe-2", label: "SWE-2", disabled: false }]]),
+    });
+    // Nothing left to spend: the same state an earlier combo fan-out or empty-response recovery
+    // leaves behind before this turn starts.
+    const budget = budgetOf(0);
+    const observed: Array<{ ordinal: number; recovery?: string }> = [];
+    const urls: string[] = [];
+    const events: AdapterEvent[] = [];
+    const adapter = createDevinAdapter({
+      adapter: "devin", baseUrl: DEVIN_API_SERVER, apiKey,
+    } as unknown as OcxProviderConfig);
+
+    let refusal: unknown;
+    try {
+      await adapter.runTurn?.(
+        {
+          modelId: "swe-2", stream: true, options: {},
+          context: { messages: [{ role: "user", content: "hi" }] },
+        } as unknown as OcxParsedRequest,
+        {
+          headers: new Headers(),
+          translatorBudget: createTestTranslatorBudget(),
+          sendBudget: budget,
+          providerFetch: (async input => {
+            urls.push(String(input));
+            return new Response("busy", { status: 500 });
+          }) as typeof fetch,
+          onPhysicalSend: send => { observed.push(send); },
+        },
+        event => events.push(event),
+      ).catch((error: unknown) => { refusal = error; });
+    } finally {
+      setCachedCatalogForTests(null);
+      if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousHome;
+      if (previousJwtFlag === undefined) delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+      else process.env.OPENCODEX_DEVIN_SEND_USER_JWT = previousJwtFlag;
+      removeTreeWithRetry(home);
+    }
+
+    // The refusal escapes the adapter for the caller to map, and WHICH error escapes is the
+    // contract: a bare catch here passed even when the adapter threw something else entirely,
+    // which would have left the turn reported as an ordinary upstream failure instead of a
+    // budget refusal.
+    expect(refusal).toBeInstanceOf(SendBudgetExhaustedError);
+    expect(urls.filter(url => url.includes("GetChatMessage"))).toHaveLength(0);
+    expect(observed).toEqual([]);
+    expect(budget.used).toBe(0);
+  });
+});
+
 const kiroProvider = {
   adapter: "kiro",
   baseUrl: "https://runtime.us-east-1.kiro.dev",
diff --git a/tests/adapters/adapter-inner-send-budget.test.ts b/tests/adapters/adapter-inner-send-budget.test.ts
index 09406cb506b..2da2597c03a 100644
--- a/tests/adapters/adapter-inner-send-budget.test.ts
+++ b/tests/adapters/adapter-inner-send-budget.test.ts
@@ -6,6 +6,8 @@ import type { CursorRunRequest, CursorServerMessage } from "../../src/adapters/c
 import type { CursorTransport } from "../../src/adapters/cursor/transport";
 import { createRequestExecutionBudget, type RequestExecutionBudgetPolicy } from "../../src/lib/request-execution-budget";
 import { SendBudgetExhaustedError } from "../../src/lib/upstream-retry";
+import { CloudChatError, type CloudChatEvent, type CloudChatRequest } from "../../src/adapters/devin/cloud-direct";
+import { streamChatEventsWithResetRetry } from "../../src/adapters/devin/cloud-direct/stated-reset-retry";
 
 /**
  * Adapters that retry INSIDE one adapter call are the layer a per-request cap cannot see from
@@ -145,3 +147,22 @@ describe("Cursor inner retries and the request send budget", () => {
     expect(observed.map(send => send.recovery)).toEqual([undefined, "connection-reset"]);
   });
 });
+
+describe("Devin inner retries and the request send budget", () => {
+  test("an exhausted initial send escapes as the local budget error", async () => {
+    const request = {
+      apiKey: "test", apiServerUrl: "https://example.invalid", modelUid: "swe-2", messages: [],
+    } as unknown as CloudChatRequest;
+    const stream = (req: CloudChatRequest) => (async function* (): AsyncGenerator<CloudChatEvent> {
+      await req.executor!("https://example.invalid/GetChatMessage");
+      throw new CloudChatError("must not replace the budget refusal", undefined, undefined, 429);
+    })();
+
+    await expect((async () => {
+      for await (const _event of streamChatEventsWithResetRetry(request, {
+        stream,
+        execution: { sendBudget: budgetOf(0) },
+      })) { /* drain */ }
+    })()).rejects.toBeInstanceOf(SendBudgetExhaustedError);
+  });
+});
diff --git a/tests/adapters/anthropic/anthropic-image-normalize.test.ts b/tests/adapters/anthropic/anthropic-image-normalize.test.ts
index 1cb37e72346..99decc4f483 100644
--- a/tests/adapters/anthropic/anthropic-image-normalize.test.ts
+++ b/tests/adapters/anthropic/anthropic-image-normalize.test.ts
@@ -398,6 +398,86 @@ describe("bounded parallel first pass (WP170)", () => {
     expect(g.stats().arrivals).toBe(10);
   });
 
+  test("the decoder concurrency limit is shared across simultaneous requests", async () => {
+    const g = gatedEncoder();
+    const first = normalizeAnthropicImages(
+      [userMsg(distinctImages(8).map(b64 => imageBlock(b64)))],
+      { encode: g.encode },
+    );
+    const second = normalizeAnthropicImages(
+      [userMsg(distinctImages(8).map(b64 => imageBlock(b64)))],
+      { encode: g.encode },
+    );
+
+    await g.waitForArrivals(IMAGE_NORMALIZE_CONCURRENCY);
+    expect(g.stats().active).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+    await Bun.sleep(10);
+    expect(g.stats().arrivals).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+
+    g.release();
+    await Promise.all([first, second]);
+    expect(g.stats().peak).toBe(IMAGE_NORMALIZE_CONCURRENCY);
+  });
+
+  test("a pre-aborted request rejects before any decode starts", async () => {
+    const controller = new AbortController();
+    controller.abort(new Error("client disconnected"));
+    let encodeCalls = 0;
+    await expect(normalizeAnthropicImages(
+      [userMsg([imageBlock(fakePngBase64(2100, 1500, 8192))])],
+      {
+        abortSignal: controller.signal,
+        encode: async () => {
+          encodeCalls++;
+          return { data: "unexpected", mediaType: "image/webp" };
+        },
+      },
+    )).rejects.toThrow("client disconnected");
+    expect(encodeCalls).toBe(0);
+  });
+
+  test("a request cancelled between dequeue and decode-start never begins decoding", async () => {
+    // Admission removes the waiter's abort listener, so an abort landing after the
+    // gate hands over a slot is only caught by the re-check before processAt. The
+    // blocker request parks every slot; the queued request is aborted from the
+    // blocker's replace callback — after admission, before its continuation runs.
+    const g = gatedEncoder();
+    const controller = new AbortController();
+    const images = distinctImages(IMAGE_NORMALIZE_CONCURRENCY + 1);
+    const blockerTargets: NormalizeTarget[] = images.slice(0, IMAGE_NORMALIZE_CONCURRENCY).map(b64 => ({
+      base64: b64,
+      mediaType: "image/png",
+      replace: () => controller.abort(new Error("client disconnected")),
+      drop: () => {},
+    }));
+    let queuedEncodes = 0;
+    const queuedTargets: NormalizeTarget[] = [{
+      base64: images[IMAGE_NORMALIZE_CONCURRENCY],
+      mediaType: "image/png",
+      replace: () => {},
+      drop: () => {},
+    }];
+
+    const blocker = normalizeImageTargets(blockerTargets, { encode: g.encode });
+    await g.waitForArrivals(IMAGE_NORMALIZE_CONCURRENCY);
+    const queued = normalizeImageTargets(queuedTargets, {
+      encode: async () => {
+        queuedEncodes++;
+        return { data: "unexpected", mediaType: "image/webp" };
+      },
+      abortSignal: controller.signal,
+    });
+    // Let the queued request's worker reach the decode queue before the gate releases.
+    await Bun.sleep(10);
+    g.release();
+    await blocker;
+    // Construct .rejects only once queued has settled: an unawaited .rejects on a
+    // still-pending promise starves the event loop (Bun busy-waits the assertion),
+    // so Bun.sleep/g.release() would never run — a deadlock, not an assertion failure.
+    await expect(queued).rejects.toThrow("client disconnected");
+    expect(queuedEncodes).toBe(0);
+  });
+
   test("a thrown target callback rejects the call, settles in-flight work, and stops new pulls", async () => {
     // processAt swallows encode/validate throws into {kind:"failed"} (its own catch),
     // so the production escape hatch is a throwing target callback (drop/replace).
diff --git a/tests/adapters/anthropic/anthropic-quota-dispatch.test.ts b/tests/adapters/anthropic/anthropic-quota-dispatch.test.ts
index 19eeed80a17..3e641d93713 100644
--- a/tests/adapters/anthropic/anthropic-quota-dispatch.test.ts
+++ b/tests/adapters/anthropic/anthropic-quota-dispatch.test.ts
@@ -1,5 +1,6 @@
 /** Physical response attribution through the real adapter and response/search loops. */
 import { afterEach, beforeEach, expect, mock, test } from "bun:test";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -37,6 +38,7 @@ const originalHome = process.env.OPENCODEX_HOME;
 let originalFetch: typeof globalThis.fetch;
 let unexpectedGlobalFetches = 0;
 let home: string;
+let releaseSpendHome: (() => void) | undefined;
 let sent: { authorization: string | null; apiKey: string | null; body: Record<string, unknown> }[];
 
 beforeEach(() => {
@@ -57,9 +59,14 @@ beforeEach(() => {
   clearAccountQuotaCache();
   resetProviderQuotaReconcileStateForTests();
   clearResponseStateForTests();
+  // Dispatching without starting a server means taking the spend-journal lease here, and
+  // releasing it before this case's directory is removed.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   adapterRequestsFollow = false;
   try {
     // Provider code may catch the guard's rejection; the attempted network call still fails the test.
diff --git a/tests/adapters/anthropic/anthropic-sidecar-account-failover.test.ts b/tests/adapters/anthropic/anthropic-sidecar-account-failover.test.ts
index 8d094db631b..7328d081f42 100644
--- a/tests/adapters/anthropic/anthropic-sidecar-account-failover.test.ts
+++ b/tests/adapters/anthropic/anthropic-sidecar-account-failover.test.ts
@@ -15,9 +15,11 @@ import { getAccountSet, saveCredential, setActiveAccount } from "../../../src/oa
 import { clearAccountQuotaCache, getCachedProviderAccountQuota, resetProviderQuotaReconcileStateForTests } from "../../../src/providers/quota";
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 
 const previousHome = process.env.OPENCODEX_HOME;
 let testHome = "";
+let releaseSpendHome: (() => void) | undefined;
 let handleResponses: typeof import("../../../src/server/responses")["handleResponses"];
 let observedKeys: string[] = [];
 let sidecarMode = false;
@@ -100,9 +102,14 @@ beforeEach(() => {
   clearGenericFailoverHealth();
   clearAccountQuotaCache();
   resetProviderQuotaReconcileStateForTests();
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(() => {
+  // Released before the directory below is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   clearAnthropicAccountPoolState();
   clearGenericFailoverHealth();
   clearAccountQuotaCache();
diff --git a/tests/adapters/bridge.test.ts b/tests/adapters/bridge.test.ts
index 9b51a25c5a1..3737538a442 100644
--- a/tests/adapters/bridge.test.ts
+++ b/tests/adapters/bridge.test.ts
@@ -1786,8 +1786,10 @@ describe("fallback freeform wrappers stream one stable representation (#5047)",
     expect(inputView(await streamExec([wrapper])))
       .toEqual({ concatenated: wrapper, done: wrapper, itemInput: wrapper });
 
-    // A non-string value is not a wrapper either, and it never matched `{"code":"`, so it was
-    // never held: this pins that ordinary bodies keep streaming immediately.
+    // A non-string value is not a wrapper either. Since #5151 an object-shaped body is held
+    // until it parses, because a canonical `input` can still arrive after any property, so
+    // what this pins is the bytes rather than when they leave: the object reaches the client
+    // byte-exact and unrepaired. Bodies that are not objects still stream as they arrive.
     const numeric = JSON.stringify({ code: 1 });
     expect(inputView(await streamExec([numeric])))
       .toEqual({ concatenated: numeric, done: numeric, itemInput: numeric });
diff --git a/tests/adapters/empty-tool-output-annotation.test.ts b/tests/adapters/empty-tool-output-annotation.test.ts
index d0acc8213b6..7114836bd42 100644
--- a/tests/adapters/empty-tool-output-annotation.test.ts
+++ b/tests/adapters/empty-tool-output-annotation.test.ts
@@ -5,6 +5,7 @@ import { getProviderRegistryEntry } from "../../src/providers/registry";
 import { routedProviderConfig } from "../../src/router";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig, OcxMessage, OcxParsedRequest, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const ANNOTATION =
   "[ocx] empty tool output: the tool ran but produced no stdout or return value; do not treat this as success, failure, or user-provided input.";
@@ -148,7 +149,13 @@ describe("openai-chat empty tool output annotation", () => {
 
 describe("openai-responses empty tool output annotation", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  let releaseSpendHome: (() => void) | undefined;
+  afterEach(() => {
+    // Release first so a failed dispatch cannot leak writer ownership into the next case.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   async function drive(config: OcxConfig, input: unknown[]): Promise<{ body: Record<string, unknown> }> {
     const requests: Array<{ body: Record<string, unknown> }> = [];
@@ -156,7 +163,9 @@ describe("openai-responses empty tool output annotation", () => {
       requests.push({ body: JSON.parse(String(init?.body ?? "{}")) as Record<string, unknown> });
       return Response.json({ id: "resp_test", object: "response", status: "completed", output: [] });
     }) as typeof fetch;
-    await handleResponses(
+    // Direct dispatch needs the writer lease to prevent spend-ledger ownership failures.
+    releaseSpendHome = acquireOwnedSpendHome();
+    const turn = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -165,6 +174,9 @@ describe("openai-responses empty tool output annotation", () => {
       config,
       { model: "", provider: "" },
     );
+    // The turn's body is a live stream. Releasing it here means no reader is still attached
+    // when the lease is dropped, which is what turns a finished case into a pending one.
+    await turn.body?.cancel();
     return requests[0] ?? { body: {} };
   }
 
diff --git a/tests/adapters/google/google-tool-schema-contract.test.ts b/tests/adapters/google/google-tool-schema-contract.test.ts
new file mode 100644
index 00000000000..a8f4256683c
--- /dev/null
+++ b/tests/adapters/google/google-tool-schema-contract.test.ts
@@ -0,0 +1,1009 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createGoogleAdapter as createGoogleAdapterProduction } from "../../../src/adapters/google";
+import type { AdapterRequest } from "../../../src/adapters/base";
+import {
+  fetchAntigravityWithRetry,
+  fetchDirectGeminiWithRetry,
+  fetchVertexWithRetry,
+} from "../../../src/adapters/google-http";
+import {
+  GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT,
+  sanitizeGeminiToolParametersWithReport,
+  type GoogleToolSchemaEndpointClass,
+} from "../../../src/adapters/google-tool-schema";
+import { compileGoogleWireBody, GoogleToolSchemaPolicyError } from "../../../src/adapters/google-wire-compiler";
+import { getDebugLogEntries, resetDebugLogBufferForTests } from "../../../src/lib/debug-log-buffer";
+import { resetDebugSettingsForTests, setDebugSettings } from "../../../src/lib/debug-settings";
+import type { OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
+import { withTestTranslatorBudget } from "../../helpers/translator-budget";
+
+const createGoogleAdapter = (...args: Parameters<typeof createGoogleAdapterProduction>) =>
+  withTestTranslatorBudget(createGoogleAdapterProduction(...args));
+
+const ENDPOINTS: GoogleToolSchemaEndpointClass[] = ["ai-studio", "vertex", "cloud-code-assist"];
+const ENDPOINT_CASES: Array<{
+  endpointClass: GoogleToolSchemaEndpointClass;
+  provider: OcxProviderConfig;
+}> = [
+  {
+    endpointClass: "ai-studio",
+    provider: {
+      adapter: "google",
+      baseUrl: "https://generativelanguage.googleapis.com",
+      apiKey: "test-key",
+      googleMode: "ai-studio",
+    } as OcxProviderConfig,
+  },
+  {
+    endpointClass: "vertex",
+    provider: {
+      adapter: "google",
+      baseUrl: "https://aiplatform.googleapis.com",
+      apiKey: "test-key",
+      googleMode: "vertex",
+    } as OcxProviderConfig,
+  },
+  {
+    endpointClass: "cloud-code-assist",
+    provider: {
+      adapter: "google",
+      baseUrl: "https://daily-cloudcode-pa.googleapis.com",
+      apiKey: "test-token",
+      googleMode: "cloud-code-assist",
+      project: "test-project",
+    } as OcxProviderConfig,
+  },
+];
+
+function sanitize(parameters: unknown, endpointClass: GoogleToolSchemaEndpointClass = "ai-studio") {
+  return sanitizeGeminiToolParametersWithReport(parameters, { endpointClass });
+}
+
+function nestedObject(depth: number): Record<string, unknown> {
+  let node: Record<string, unknown> = { type: "string" };
+  for (let index = 0; index < depth; index++) {
+    node = { type: "object", properties: { child: node } };
+  }
+  return node;
+}
+
+function dereferenceChain(length: number): Record<string, unknown> {
+  const defs: Record<string, unknown> = {};
+  for (let index = length - 1; index >= 0; index--) {
+    defs[`Node${index}`] = index === length - 1
+      ? { type: "string" }
+      : { $ref: `#/$defs/Node${index + 1}` };
+  }
+  return {
+    type: "object",
+    properties: { value: { $ref: "#/$defs/Node0" } },
+    $defs: defs,
+  };
+}
+
+function endpointRequestUncertain(): OcxParsedRequest {
+  const values = Array.from({ length: 1_100 }, (_, index) => `value-${index}`);
+  return {
+    modelId: "gemini-test-model",
+    stream: false,
+    options: {},
+    context: {
+      messages: [{ role: "user", content: "use the tool", timestamp: 0 }],
+      tools: [{
+        name: "ENDPOINT_TOOL_CANARY_5112",
+        description: "endpoint profile fixture",
+        parameters: {
+          type: "object",
+          properties: {
+            ENDPOINT_PROPERTY_CANARY_5112: {
+              $ref: "#/$defs/Value",
+              enum: [...values.slice(0, -1), "value-late-difference"],
+            },
+          },
+          $defs: { Value: { type: "string", enum: [...values] } },
+        },
+      }],
+    },
+  } as unknown as OcxParsedRequest;
+}
+
+function endpointRequest(lossy: boolean): OcxParsedRequest {
+  return {
+    modelId: "gemini-test-model",
+    stream: false,
+    options: {
+      textFormat: {
+        type: "json_schema",
+        schema: {
+          type: "object",
+          properties: { OUTPUT_SCHEMA_CANARY_5112: { type: "integer", minimum: 1 } },
+        },
+      },
+    },
+    context: {
+      messages: [{ role: "user", content: "use the tool", timestamp: 0 }],
+      tools: [{
+        name: "ENDPOINT_TOOL_CANARY_5112",
+        description: "endpoint profile fixture",
+        parameters: {
+          type: "object",
+          properties: {
+            ENDPOINT_PROPERTY_CANARY_5112: {
+              type: "string",
+              enum: lossy ? ["ENDPOINT_VALUE_CANARY_5112", 7] : ["ENDPOINT_VALUE_CANARY_5112"],
+            },
+          },
+        },
+      }],
+    },
+  } as OcxParsedRequest;
+}
+
+function stableWireBody(body: string, endpointClass: GoogleToolSchemaEndpointClass): string {
+  const parsed = JSON.parse(body) as Record<string, unknown>;
+  if (endpointClass === "cloud-code-assist") parsed.requestId = "<generated-request-id>";
+  return JSON.stringify(parsed);
+}
+
+function compiledRequest(body: string, endpointClass: GoogleToolSchemaEndpointClass): Record<string, unknown> {
+  const parsed = JSON.parse(body) as Record<string, unknown>;
+  return endpointClass === "cloud-code-assist"
+    ? parsed.request as Record<string, unknown>
+    : parsed;
+}
+
+function repairRequest(enveloped = false): AdapterRequest {
+  const request = {
+    contents: [{ role: "user", parts: [{ text: "REPAIR_PROMPT_CANARY_5112" }] }],
+    tools: [{ functionDeclarations: [
+      {
+        name: "REPAIR_TOOL_ONE_CANARY_5112",
+        parameters: {
+          type: "object",
+          properties: { REPAIR_PROPERTY_ONE_CANARY_5112: { type: "string", enum: ["REPAIR_VALUE_ONE_CANARY_5112"] } },
+        },
+      },
+      {
+        name: "REPAIR_TOOL_TWO_CANARY_5112",
+        parameters: {
+          type: "object",
+          properties: { REPAIR_PROPERTY_TWO_CANARY_5112: { type: "integer", minimum: 1 } },
+        },
+      },
+    ] }],
+  };
+  return {
+    url: "https://google.example.test/generate",
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(enveloped ? { request } : request),
+  };
+}
+
+function responseSequence(responses: Response[]): { calls: string[]; executor: typeof fetch } {
+  const calls: string[] = [];
+  let index = 0;
+  const executor = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+    calls.push(typeof init?.body === "string" ? init.body : "");
+    return responses[index++] ?? responses[responses.length - 1]!;
+  }) as typeof fetch;
+  return { calls, executor };
+}
+
+function googleError(message: string): Response {
+  return new Response(JSON.stringify({
+    error: { code: 400, status: "INVALID_ARGUMENT", message },
+  }), { status: 400, headers: { "content-type": "application/json" } });
+}
+
+afterEach(() => {
+  resetDebugSettingsForTests();
+  resetDebugLogBufferForTests();
+});
+
+describe("Google tool-schema loss report", () => {
+  test("uses an explicit endpoint profile without changing compatible wire bytes", () => {
+    const input = {
+      tools: [{ functionDeclarations: [{
+        name: "calculate",
+        parameters: {
+          type: "object",
+          properties: { amount: { type: "integer", enum: [1, 2, "other"] } },
+        },
+      }] }],
+    };
+    const compiled = ENDPOINTS.map(endpointClass => compileGoogleWireBody(input, { endpointClass }));
+    const bytes = compiled.map(result => JSON.stringify(result.body));
+    expect(new Set(bytes).size).toBe(1);
+    expect(compiled.map(result => result.toolSchemaLossReport)).toEqual(ENDPOINTS.map(endpointClass => ({
+      version: 1,
+      endpointClass,
+      lossy: true,
+      truncated: false,
+      uncertainComparisons: 0,
+      categories: { "enum-value-filtered": 2 },
+    })));
+  });
+
+  test("reports filtered enum members and dropped numeric and size bounds", () => {
+    const result = sanitize({
+      type: "object",
+      properties: {
+        amount: { type: "number", enum: [1, "fixed", 2], minimum: 0, exclusiveMaximum: 10 },
+        label: { type: "string", minLength: 1, maxLength: 20 },
+        list: { type: "array", minItems: 1, maxItems: 3, items: { type: "string" } },
+      },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: {
+        amount: { type: "number", enum: ["fixed"] },
+        label: { type: "string" },
+        list: { type: "array", items: { type: "string" } },
+      },
+    });
+    expect(result.lossReport.categories).toEqual({
+      "numeric-bound-dropped": 2,
+      "enum-value-filtered": 2,
+      "size-bound-dropped": 4,
+    });
+  });
+
+  test("reports a mixed union only when it widens the node", () => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { anyOf: [{ type: "string" }, { type: "number" }] } },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: { value: {} },
+    });
+    expect(result.lossReport.categories).toEqual({ "union-widened": 1 });
+  });
+
+  test("reports when nullable anyOf resolution replaces an explicit sibling type", () => {
+    const result = sanitize({
+      type: "object",
+      properties: {
+        value: { type: "number", anyOf: [{ type: "string" }, { type: "null" }] },
+      },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: { value: { type: "string", nullable: true } },
+    });
+    expect(result.lossReport.categories).toEqual({ "union-sibling-replaced": 1 });
+  });
+
+  test("classifies type unions and unsupported type values", () => {
+    const result = sanitize({
+      type: "object",
+      properties: {
+        union: { type: ["string", "number"] },
+        unknown: { type: "future-type" },
+        empty: { type: [] },
+        nullConflict: { type: ["string", "null"], nullable: false },
+      },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: {
+        union: { type: "string" },
+        unknown: {},
+        empty: {},
+        nullConflict: { type: "string", nullable: false },
+      },
+    });
+    expect(result.lossReport.categories).toEqual({
+      "type-union-collapsed": 1,
+      "unsupported-type-widened": 2,
+      "nullability-overridden": 1,
+    });
+  });
+
+  test("classifies conditionals, tuple prefixes, and closed-list semantic constraints", () => {
+    const result = sanitize({
+      type: "object",
+      properties: {
+        conditional: {
+          type: "string",
+          if: { const: "a" },
+          then: { minLength: 2 },
+          else: { maxLength: 4 },
+        },
+        tuple: { type: "array", prefixItems: [{ type: "string" }] },
+        patterned: { type: "string", pattern: "^[a-z]+$" },
+      },
+    });
+    expect(result.lossReport.categories).toEqual({
+      "conditional-dropped": 3,
+      "tuple-prefix-dropped": 1,
+      "unsupported-constraint-dropped": 1,
+    });
+  });
+
+  test("does not classify inert annotations or lossless normalization as loss", () => {
+    const result = sanitize({
+      type: "object",
+      title: "annotation",
+      default: {},
+      examples: [{}],
+      $comment: "annotation",
+      contentEncoding: "base64",
+      contentMediaType: "application/json",
+      readOnly: true,
+      properties: {
+        normalized: { type: "STRING", const: "fixed", enum: ["fixed", "fixed"] },
+        constOnly: { type: "string", const: "fixed" },
+        nullable: { anyOf: [{ type: "string" }, { type: "null" }] },
+      },
+      required: ["normalized", "normalized"],
+    });
+    expect(result.lossReport).toEqual({
+      version: 1,
+      endpointClass: "ai-studio",
+      lossy: false,
+      truncated: false,
+      uncertainComparisons: 0,
+      categories: {},
+    });
+  });
+
+  test("classifies root object coercion and malformed supported constraints", () => {
+    const root = sanitize({ type: "string" });
+    expect(root.parameters).toEqual({ type: "object", properties: {} });
+    expect(root.lossReport.categories).toEqual({ "root-object-coerced": 1 });
+
+    const malformed = sanitize({
+      type: "object",
+      properties: {
+        value: { type: "string", enum: [], format: 7 },
+      },
+      required: "value",
+    });
+    expect(malformed.lossReport.categories).toEqual({
+      "invalid-schema-widened": 2,
+      "enum-constraint-dropped": 1,
+    });
+  });
+
+  test("reports recursive-reference widening without losing an ordinary sibling", () => {
+    const result = sanitize({
+      type: "object",
+      properties: { tree: { $ref: "#/$defs/Tree" } },
+      $defs: {
+        Tree: {
+          type: "object",
+          properties: {
+            left: { $ref: "#/$defs/Tree" },
+            label: { type: "string" },
+          },
+        },
+      },
+    });
+    const tree = (result.parameters.properties as Record<string, Record<string, unknown>>).tree;
+    expect(tree).toEqual({ type: "object", properties: { left: {}, label: { type: "string" } } });
+    expect(result.lossReport.categories).toEqual({ "recursive-ref-widened": 1 });
+  });
+
+  test("counts a numeric const inside a local reference exactly once", () => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/NumericConst" } },
+      $defs: { NumericConst: { type: "integer", const: 7 } },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: { value: { type: "integer" } },
+    });
+    expect(result.lossReport.categories).toEqual({ "const-value-filtered": 1 });
+  });
+
+  test("reports when a reference sibling replaces a target constraint", () => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/Value", type: "number" } },
+      $defs: { Value: { type: "string" } },
+    });
+    expect(result.parameters).toEqual({
+      type: "object",
+      properties: { value: { type: "number" } },
+    });
+    expect(result.lossReport.categories).toEqual({ "ref-overlay-replaced": 1 });
+  });
+
+  test("separately allocated equal ref overlays are not classified as loss", () => {
+    const result = sanitize({
+      type: "object",
+      properties: {
+        enumValue: { $ref: "#/$defs/EnumValue", enum: ["b", "a", "a"] },
+        typeValue: { $ref: "#/$defs/TypeValue", type: "STRING" },
+        objectValue: {
+          $ref: "#/$defs/ObjectValue",
+          properties: { name: { type: "string" } },
+        },
+        requiredValue: { $ref: "#/$defs/RequiredValue", required: ["other", "name", "name"] },
+      },
+      $defs: {
+        EnumValue: { type: "string", enum: ["a", "b"] },
+        TypeValue: { type: "string" },
+        ObjectValue: { type: "object", properties: { name: { type: "string" } } },
+        RequiredValue: {
+          type: "object",
+          properties: { name: { type: "string" }, other: { type: "string" } },
+          required: ["name", "other"],
+        },
+      },
+    });
+    expect(result.lossReport).toEqual({
+      version: 1,
+      endpointClass: "ai-studio",
+      lossy: false,
+      truncated: false,
+      uncertainComparisons: 0,
+      categories: {},
+    });
+  });
+
+  test.each([
+    {
+      name: "target filtering excluded by overlay",
+      target: ["a", 1],
+      overlay: ["a"],
+      expectedEnum: ["a"],
+      expectedCategories: {},
+    },
+    {
+      name: "same filtered value in both schemas",
+      target: ["a", 1],
+      overlay: ["a", 1],
+      expectedEnum: ["a"],
+      expectedCategories: { "enum-value-filtered": 1 },
+    },
+    {
+      name: "overlay-only filtered value",
+      target: ["a"],
+      overlay: ["a", 1],
+      expectedEnum: ["a"],
+      expectedCategories: {},
+    },
+    {
+      name: "overlay widens beyond target",
+      target: ["a"],
+      overlay: ["a", "b"],
+      expectedEnum: ["a", "b"],
+      expectedCategories: { "ref-overlay-replaced": 1 },
+    },
+  ] as const)("enum ref overlay uses effective intersection: $name", ({ target, overlay, expectedEnum, expectedCategories }) => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/Value", enum: [...overlay] } },
+      $defs: { Value: { enum: [...target] } },
+    });
+    const value = (result.parameters.properties as Record<string, Record<string, unknown>>).value;
+    expect(value.enum).toEqual(expectedEnum);
+    expect(result.lossReport.categories).toEqual(expectedCategories);
+    expect(result.lossReport.uncertainComparisons).toBe(0);
+  });
+
+  test("a referenced enum without an overlay keeps its existing filtered-loss report", () => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/Value" } },
+      $defs: { Value: { enum: ["a", 1] } },
+    });
+    const value = (result.parameters.properties as Record<string, Record<string, unknown>>).value;
+    expect(value.enum).toEqual(["a"]);
+    expect(result.lossReport.categories).toEqual({ "enum-value-filtered": 1 });
+    expect(result.lossReport.uncertainComparisons).toBe(0);
+  });
+
+  test.each([
+    [
+      "enum",
+      { type: "string", enum: ["a"] },
+      { enum: ["b"] },
+    ],
+    [
+      "properties",
+      { type: "object", properties: { name: { type: "string" } } },
+      { properties: { name: { type: "number" } } },
+    ],
+    [
+      "required",
+      {
+        type: "object",
+        properties: { name: { type: "string" }, other: { type: "string" } },
+        required: ["name"],
+      },
+      { required: ["other"] },
+    ],
+  ] as const)("a genuinely different %s ref overlay reports exactly one loss", (_name, target, overlay) => {
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/Value", ...overlay } },
+      $defs: { Value: target },
+    });
+    expect(result.lossReport.categories).toEqual({ "ref-overlay-replaced": 1 });
+  });
+
+  test("comparison budget exhaustion is unknown and is not counted as proven loss", () => {
+    // The overlay differs only AFTER the bounded comparison budget: identical prefixes exhaust
+    // the cap, so the late difference is indeterminate rather than proven loss.
+    const values = Array.from({ length: 1_100 }, (_, index) => `value-${index}`);
+    const overlayValues = [...values.slice(0, -1), "value-late-difference"];
+    const result = sanitize({
+      type: "object",
+      properties: { value: { $ref: "#/$defs/Value", enum: [...overlayValues] } },
+      $defs: { Value: { type: "string", enum: [...values] } },
+    });
+    expect(result.lossReport).toEqual({
+      version: 1,
+      endpointClass: "ai-studio",
+      lossy: false,
+      truncated: false,
+      uncertainComparisons: 1,
+      categories: {},
+    });
+    // Compatible mode keeps the overlay bytes, which genuinely differ from the target.
+    // The stacked strict child must refuse uncertainty.
+    const value = (result.parameters.properties as Record<string, Record<string, unknown>>).value;
+    expect(value.enum).toEqual(overlayValues);
+    expect(value.enum).not.toEqual(values);
+    const compiled = compileGoogleWireBody({
+      tools: [{ functionDeclarations: [{
+        name: "uncertain_comparison",
+        parameters: {
+          type: "object",
+          properties: { value: { $ref: "#/$defs/Value", enum: [...overlayValues] } },
+          $defs: { Value: { type: "string", enum: [...values] } },
+        },
+      }] }],
+    }, { endpointClass: "ai-studio" });
+    expect(compiled.toolSchemaLossReport.uncertainComparisons).toBe(1);
+    expect(compiled.toolSchemaLossReport.lossy).toBe(false);
+    const declaration = (compiled.body.tools as Array<{
+      functionDeclarations: Array<{ parameters: Record<string, unknown> }>;
+    }>)[0]!.functionDeclarations[0]!;
+    expect(declaration.parameters).toEqual(result.parameters);
+  });
+
+  test("default-equivalent constraints are neutral", () => {
+    const result = sanitize({
+      type: "object",
+      additionalProperties: true,
+      minProperties: 0,
+      properties: {
+        text: { type: "string", minLength: 0 },
+        list: { type: "array", minItems: 0, uniqueItems: false, prefixItems: [] },
+      },
+    });
+    expect(result.lossReport).toEqual({
+      version: 1,
+      endpointClass: "ai-studio",
+      lossy: false,
+      truncated: false,
+      uncertainComparisons: 0,
+      categories: {},
+    });
+  });
+
+  test("reports depth and dereference ceilings at their existing boundaries", () => {
+    const depth = sanitize(nestedObject(25));
+    expect(depth.lossReport.categories).toEqual({ "depth-limit-widened": 1 });
+
+    const dereference = sanitize(dereferenceChain(18));
+    expect(dereference.lossReport.categories).toEqual({ "dereference-limit-widened": 1 });
+  });
+
+  test("reports node-budget widening without reading the first omitted property", () => {
+    const properties = Object.fromEntries(Array.from(
+      { length: 1_024 },
+      (_, index) => [`field_${index}`, { type: "string" }],
+    ));
+    let readPastBudget = false;
+    Object.defineProperty(properties, "field_1023", {
+      enumerable: true,
+      configurable: true,
+      get() {
+        readPastBudget = true;
+        throw new Error("read past node budget");
+      },
+    });
+    const result = sanitize({ type: "object", properties });
+    expect(readPastBudget).toBe(false);
+    expect(Object.keys(result.parameters.properties as object)).toHaveLength(1_023);
+    expect(result.lossReport.categories).toEqual({ "node-budget-widened": 1 });
+  });
+
+  test("saturates aggregate category counts across declarations", () => {
+    const declarations = Array.from({ length: GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT + 2 }, (_, index) => ({
+      name: `tool_${index}`,
+      parameters: { type: "object", pattern: `value-${index}` },
+    }));
+    const compiled = compileGoogleWireBody(
+      { tools: [{ functionDeclarations: declarations }] },
+      { endpointClass: "vertex" },
+    );
+    expect(compiled.toolSchemaLossReport).toEqual({
+      version: 1,
+      endpointClass: "vertex",
+      lossy: true,
+      truncated: true,
+      uncertainComparisons: 0,
+      categories: { "unsupported-constraint-dropped": GOOGLE_TOOL_SCHEMA_LOSS_COUNT_LIMIT },
+    });
+  });
+
+  test("preserves the current body and never treats native output schemas as tool input", () => {
+    const outputCanary = "OUTPUT_SCHEMA_CANARY_5112";
+    const compiled = compileGoogleWireBody({
+      tools: [{ functionDeclarations: [{
+        name: "lookup",
+        parameters: { type: "object", properties: { count: { type: "integer", enum: [1, 2] } } },
+      }] }],
+      generationConfig: {
+        responseMimeType: "application/json",
+        responseJsonSchema: {
+          type: "object",
+          properties: { [outputCanary]: { type: "integer", minimum: 1 } },
+        },
+      },
+    }, { endpointClass: "ai-studio" });
+    expect(JSON.stringify(compiled.body)).toBe(JSON.stringify({
+      tools: [{ functionDeclarations: [{
+        name: "lookup",
+        parameters: { type: "object", properties: { count: { type: "integer" } } },
+      }] }],
+      generationConfig: {
+        responseMimeType: "application/json",
+        responseJsonSchema: {
+          type: "object",
+          properties: { [outputCanary]: { type: "integer", minimum: 1 } },
+        },
+      },
+    }));
+    expect(compiled.toolSchemaLossReport.categories).toEqual({ "enum-value-filtered": 2 });
+  });
+
+  test("retains no tool, property, description, enum, reference, or constraint value", () => {
+    const canaries = {
+      tool: "TOOL_CANARY_5112",
+      property: "PROPERTY_CANARY_5112",
+      description: "DESCRIPTION_CANARY_5112",
+      enumValue: "ENUM_CANARY_5112",
+      reference: "REFERENCE_CANARY_5112",
+      constraint: "CONSTRAINT_CANARY_5112",
+    };
+    const compiled = compileGoogleWireBody({
+      tools: [{ functionDeclarations: [{
+        name: canaries.tool,
+        description: canaries.description,
+        parameters: {
+          type: "object",
+          properties: {
+            [canaries.property]: {
+              type: "string",
+              description: canaries.description,
+              enum: [canaries.enumValue, 7],
+              pattern: canaries.constraint,
+            },
+            recursive: { $ref: `#/$defs/${canaries.reference}` },
+          },
+          $defs: {
+            [canaries.reference]: {
+              type: "object",
+              properties: { next: { $ref: `#/$defs/${canaries.reference}` } },
+            },
+          },
+        },
+      }] }],
+    }, { endpointClass: "cloud-code-assist" });
+    const report = JSON.stringify(compiled.toolSchemaLossReport);
+    for (const canary of Object.values(canaries)) expect(report).not.toContain(canary);
+    expect(compiled.toolSchemaLossReport).toEqual({
+      version: 1,
+      endpointClass: "cloud-code-assist",
+      lossy: true,
+      truncated: false,
+      uncertainComparisons: 0,
+      categories: {
+        "unsupported-constraint-dropped": 1,
+        "enum-value-filtered": 1,
+        "recursive-ref-widened": 1,
+      },
+    });
+  });
+
+  test.each(ENDPOINT_CASES)("reject-lossy refuses initial $endpointClass loss before any send", async ({ endpointClass, provider }) => {
+    const adapter = createGoogleAdapter({ ...provider, googleToolSchemaPolicy: "reject-lossy" });
+    let sends = 0;
+    const executor = (async () => {
+      sends++;
+      return new Response("unexpected send");
+    }) as typeof fetch;
+    let caught: unknown;
+    try {
+      const built = await adapter.buildRequest(endpointRequest(true));
+      await adapter.fetchResponse?.(built, { executor });
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(GoogleToolSchemaPolicyError);
+    const policyError = caught as GoogleToolSchemaPolicyError;
+    expect(policyError.phase).toBe("initial");
+    expect(policyError.endpointClass).toBe(endpointClass);
+    expect(policyError.categories).toEqual({ "enum-value-filtered": 1 });
+    expect(sends).toBe(0);
+    for (const canary of [
+      "ENDPOINT_TOOL_CANARY_5112",
+      "ENDPOINT_PROPERTY_CANARY_5112",
+      "ENDPOINT_VALUE_CANARY_5112",
+      "OUTPUT_SCHEMA_CANARY_5112",
+    ]) {
+      expect(policyError.message).not.toContain(canary);
+    }
+  });
+  test.each(ENDPOINT_CASES)("reject-lossy refuses indeterminate $endpointClass compilation before any send", async ({ endpointClass, provider }) => {
+    const adapter = createGoogleAdapter({ ...provider, googleToolSchemaPolicy: "reject-lossy" });
+    let sends = 0;
+    const executor = (async () => {
+      sends++;
+      return new Response("unexpected send");
+    }) as typeof fetch;
+    let caught: unknown;
+    try {
+      const built = await adapter.buildRequest(endpointRequestUncertain());
+      await adapter.fetchResponse?.(built, { executor });
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(GoogleToolSchemaPolicyError);
+    const policyError = caught as GoogleToolSchemaPolicyError;
+    expect(policyError.phase).toBe("initial");
+    expect(policyError.endpointClass).toBe(endpointClass);
+    expect(policyError.indeterminate).toBe(true);
+    expect(policyError.categories).toEqual({});
+    expect(policyError.message).toContain("indeterminate");
+    expect(sends).toBe(0);
+  });
+
+  test.each(ENDPOINT_CASES)("reject-lossy accepts lossless $endpointClass tools and native output schemas", async ({ endpointClass, provider }) => {
+    const built = await createGoogleAdapter({ ...provider, googleToolSchemaPolicy: "reject-lossy" })
+      .buildRequest(endpointRequest(false));
+    const request = compiledRequest(built.body, endpointClass);
+    const generationConfig = request.generationConfig as Record<string, unknown>;
+    expect(generationConfig.responseMimeType).toBe("application/json");
+    expect(generationConfig.responseJsonSchema).toEqual({
+      type: "object",
+      properties: { OUTPUT_SCHEMA_CANARY_5112: { type: "integer", minimum: 1 } },
+    });
+  });
+
+  test.each(ENDPOINT_CASES)("omitted and compatible policy keep $endpointClass request bytes identical", async ({ endpointClass, provider }) => {
+    const omitted = await createGoogleAdapter(provider).buildRequest(endpointRequest(true));
+    const compatible = await createGoogleAdapter({ ...provider, googleToolSchemaPolicy: "compatible" })
+      .buildRequest(endpointRequest(true));
+    expect(stableWireBody(compatible.body, endpointClass)).toBe(stableWireBody(omitted.body, endpointClass));
+  });
+
+  test("reject-lossy withholds indexed Vertex repair and reports only content-free facts", async () => {
+    const rawError = "tools.1.custom.input_schema: JSON schema is invalid REPAIR_ERROR_CANARY_5112";
+    const fixture = responseSequence([googleError(rawError), new Response("unexpected repair")]);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      const response = await fetchVertexWithRetry(repairRequest(), {
+        executor: fixture.executor,
+        timeoutMs: 5_000,
+      }, { toolSchemaPolicy: "reject-lossy" });
+      expect(response.status).toBe(400);
+      const responseText = await response.text();
+      expect(responseText).toContain("Vertex AI invalid request");
+      // The withheld repair returns the ORIGINAL upstream 400 through the pre-existing
+      // normalization (safeGoogleHttpErrorMessage classification + credential/path redaction),
+      // which preserves ordinary upstream detail text. The canary exclusion applies to the NEW
+      // diagnostic record below, not to the preserved original response.
+      expect(responseText).toBe("Vertex AI invalid request: " + rawError);
+      expect(fixture.calls).toHaveLength(1);
+      const lines = getDebugLogEntries().map(entry => entry.line)
+        .filter(line => line.includes("google-tool-schema-repair"));
+      expect(lines).toHaveLength(1);
+      expect(lines[0]).toContain('"endpointClass":"vertex"');
+      expect(lines[0]).toContain('"repair-opened-schema":1');
+      expect(lines[0]).toContain('"declarationCount":1');
+      expect(lines[0]).toContain('"changedSendAllowed":false');
+      for (const canary of ["REPAIR_", "input_schema", "JSON schema", "CANARY_5112"]) {
+        expect(lines[0]).not.toContain(canary);
+      }
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  test("reject-lossy withholds unindexed Cloud Code Assist repair for every declaration", async () => {
+    const rawError = "function declarations contain an invalid schema REPAIR_ERROR_CANARY_5112";
+    const fixture = responseSequence([
+      googleError(rawError),
+      new Response("unexpected repair"),
+    ]);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      const response = await fetchAntigravityWithRetry(repairRequest(true), {
+        executor: fixture.executor,
+        timeoutMs: 5_000,
+        returnRawErrors: true,
+      }, { toolSchemaPolicy: "reject-lossy" });
+      expect(response.status).toBe(400);
+      // The returned body is the original upstream 400 payload, not a replacement.
+      expect(await response.json()).toEqual({
+        error: { code: 400, status: "INVALID_ARGUMENT", message: rawError },
+      });
+      expect(fixture.calls).toHaveLength(1);
+      const line = getDebugLogEntries().map(entry => entry.line)
+        .find(entry => entry.includes("google-tool-schema-repair"));
+      expect(line).toContain('"endpointClass":"cloud-code-assist"');
+      expect(line).toContain('"repair-opened-schema":2');
+      expect(line).toContain('"declarationCount":2');
+      expect(line).toContain('"changedSendAllowed":false');
+      expect(line).not.toContain("REPAIR_ERROR_CANARY_5112");
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  test.each([
+    ["indexed", "tools.1.custom.input_schema: JSON schema is invalid", 1],
+    ["unindexed", "function declarations contain an invalid schema", 2],
+  ] as const)("compatible mode preserves the %s changed repair send", async (_name, message, count) => {
+    const fixture = responseSequence([googleError(message), new Response("ok", { status: 200 })]);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      const response = await fetchVertexWithRetry(repairRequest(), {
+        executor: fixture.executor,
+        timeoutMs: 5_000,
+      }, { toolSchemaPolicy: "compatible" });
+      expect(response.status).toBe(200);
+      expect(fixture.calls).toHaveLength(2);
+      const repaired = JSON.parse(fixture.calls[1]!) as { tools: Array<{ functionDeclarations: Array<{ parameters: unknown }> }> };
+      const declarations = repaired.tools[0]!.functionDeclarations;
+      expect(declarations.filter(item => JSON.stringify(item.parameters) === '{"type":"object","properties":{}}'))
+        .toHaveLength(count);
+      const line = getDebugLogEntries().map(entry => entry.line)
+        .find(entry => entry.includes("google-tool-schema-repair"));
+      expect(line).toContain(`"repair-opened-schema":${count}`);
+      expect(line).toContain('"changedSendAllowed":true');
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  test("direct mode never repairs or emits a repair diagnostic under reject-lossy", async () => {
+    const rawError = "tools.0.custom.input_schema: JSON schema is invalid";
+    const fixture = responseSequence([
+      googleError(rawError),
+      new Response("unexpected repair"),
+    ]);
+    setDebugSettings({ debug: true });
+    const response = await fetchDirectGeminiWithRetry(repairRequest(), {
+      executor: fixture.executor,
+      timeoutMs: 5_000,
+    }, { toolSchemaPolicy: "reject-lossy", toolSchemaProfile: { endpointClass: "ai-studio" } });
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: { code: 400, status: "INVALID_ARGUMENT", message: rawError },
+    });
+    expect(fixture.calls).toHaveLength(1);
+    expect(getDebugLogEntries().some(entry => entry.line.includes("google-tool-schema-repair"))).toBe(false);
+  });
+
+  test("thinking-only repair is policy-independent and carries no tool-schema report", async () => {
+    const request = repairRequest();
+    request.body = JSON.stringify({
+      contents: [{ role: "user", parts: [{ text: "hi" }] }],
+      generationConfig: { thinkingConfig: { thinkingLevel: "high" }, maxOutputTokens: 100 },
+    });
+    const fixture = responseSequence([
+      googleError("thinking_config.thinking_level is unsupported"),
+      new Response("ok", { status: 200 }),
+    ]);
+    setDebugSettings({ debug: true });
+    const response = await fetchVertexWithRetry(request, {
+      executor: fixture.executor,
+      timeoutMs: 5_000,
+    }, { toolSchemaPolicy: "reject-lossy" });
+    expect(response.status).toBe(200);
+    expect(fixture.calls).toHaveLength(2);
+    expect(getDebugLogEntries().some(entry => entry.line.includes("google-tool-schema-repair"))).toBe(false);
+  });
+
+  test.each(ENDPOINT_CASES)("derives and consumes the $endpointClass profile at the adapter boundary", async ({ endpointClass, provider }) => {
+    const adapter = createGoogleAdapter(provider);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      resetDebugLogBufferForTests();
+      await adapter.buildRequest(endpointRequest(false));
+      expect(getDebugLogEntries().some(entry => entry.line.includes("google-tool-schema-loss"))).toBe(false);
+
+      resetDebugLogBufferForTests();
+      setDebugSettings({ debug: false });
+      const off = await adapter.buildRequest(endpointRequest(true));
+      expect(getDebugLogEntries().some(entry => entry.line.includes("google-tool-schema-loss"))).toBe(false);
+
+      setDebugSettings({ debug: true });
+      const on = await adapter.buildRequest(endpointRequest(true));
+      const lines = getDebugLogEntries().map(entry => entry.line)
+        .filter(entry => entry.includes("google-tool-schema-loss"));
+      expect(lines).toHaveLength(1);
+      const line = lines[0]!;
+      expect(stableWireBody(on.body, endpointClass)).toBe(stableWireBody(off.body, endpointClass));
+      expect(on.url).toBe(off.url);
+      expect(on.headers).toEqual(off.headers);
+      for (const canary of [
+        "ENDPOINT_TOOL_CANARY_5112",
+        "ENDPOINT_PROPERTY_CANARY_5112",
+        "ENDPOINT_VALUE_CANARY_5112",
+        "OUTPUT_SCHEMA_CANARY_5112",
+      ]) {
+        expect(getDebugLogEntries().map(entry => entry.line).join("\n")).not.toContain(canary);
+      }
+      expect(line).toContain(`"endpointClass":"${endpointClass}"`);
+      expect(line).toContain('"enum-value-filtered":1');
+
+      const request = compiledRequest(on.body, endpointClass);
+      const declarations = (request.tools as Array<{ functionDeclarations: Array<Record<string, unknown>> }>)[0]!
+        .functionDeclarations;
+      expect(declarations[0]!.parameters).toEqual({
+        type: "object",
+        properties: {
+          ENDPOINT_PROPERTY_CANARY_5112: {
+            type: "string",
+            enum: ["ENDPOINT_VALUE_CANARY_5112"],
+          },
+        },
+      });
+      const generationConfig = request.generationConfig as Record<string, unknown>;
+      expect(generationConfig.responseMimeType).toBe("application/json");
+      expect(generationConfig.responseJsonSchema).toEqual({
+        type: "object",
+        properties: { OUTPUT_SCHEMA_CANARY_5112: { type: "integer", minimum: 1 } },
+      });
+   } finally {
+     console.error = realError;
+   }
+ });
+
+  test.each(ENDPOINT_CASES)("report-only mode emits one content-free $endpointClass diagnostic for an indeterminate comparison", async ({ endpointClass, provider }) => {
+    const adapter = createGoogleAdapter(provider);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      resetDebugLogBufferForTests();
+      const built = await adapter.buildRequest(endpointRequestUncertain());
+      const lines = getDebugLogEntries().map((entry) => entry.line)
+        .filter((entry) => entry.includes("google-tool-schema-loss"));
+      expect(lines).toHaveLength(1);
+      expect(lines[0]!).toContain(`"uncertainComparisons":1`);
+      expect(lines[0]!).toContain(`"lossy":false`);
+      expect(lines[0]!).toContain(`"endpointClass":"` + `${endpointClass}` + `"`);
+      expect(built.body).toBeDefined();
+      for (const canary of [
+        "ENDPOINT_TOOL_CANARY_5112",
+        "ENDPOINT_PROPERTY_CANARY_5112",
+        "value-late-difference",
+      ]) {
+        expect(getDebugLogEntries().map((entry) => entry.line).join("\n")).not.toContain(canary);
+      }
+    } finally {
+      console.error = realError;
+    }
+  });
+});
diff --git a/tests/adapters/google/google-wire-shape.test.ts b/tests/adapters/google/google-wire-shape.test.ts
new file mode 100644
index 00000000000..82ac7eca358
--- /dev/null
+++ b/tests/adapters/google/google-wire-shape.test.ts
@@ -0,0 +1,622 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { createGoogleAdapter as createGoogleAdapterProduction } from "../../../src/adapters/google";
+import { antigravitySessionAnchor, antigravitySessionId } from "../../../src/adapters/google-antigravity-wire";
+import {
+  classifyGoogleWireUpstreamError,
+  GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES,
+  GOOGLE_WIRE_SHAPE_TURN_CEILING,
+  summarizeGoogleWireShape,
+} from "../../../src/adapters/google-wire-shape";
+import { debugProviderDiagnosticLazy } from "../../../src/lib/debug";
+import { getDebugLogEntries, MAX_DEBUG_LINE_BYTES, resetDebugLogBufferForTests } from "../../../src/lib/debug-log-buffer";
+import { resetDebugSettingsForTests, setDebugSettings } from "../../../src/lib/debug-settings";
+import { createRequestExecutionBudget, type RequestExecutionBudgetPolicy } from "../../../src/lib/request-execution-budget";
+import type { OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
+import {
+  callId,
+  compactedToolSession,
+  compiledWireBody,
+  longToolSession,
+  modelCallTurn,
+  modelTextTurn,
+  THOUGHT_SIGNATURE_SENTINEL,
+  toolResultTurn,
+  toolRoundTrip,
+  unidentifiedCallTurn,
+  userTurn,
+  WIRE_MARKERS,
+  type WireTurn,
+} from "../../fixtures/google-wire-shape-cases";
+import { withTestTranslatorBudget } from "../../helpers/translator-budget";
+
+const createGoogleAdapter = (...args: Parameters<typeof createGoogleAdapterProduction>) =>
+  withTestTranslatorBudget(createGoogleAdapterProduction(...args));
+
+const provider = {
+  adapter: "google",
+  baseUrl: "https://daily-cloudcode-pa.googleapis.com",
+  googleMode: "cloud-code-assist",
+  project: "proj-123",
+  apiKey: "ya29.token",
+} as OcxProviderConfig;
+
+/** Exactly `sends` physical sends allowed, with no reserve and no alternate target. */
+function budgetOf(sends: number) {
+  const policy: RequestExecutionBudgetPolicy = {
+    maxTotalModelSends: sends,
+    baseSendAllowance: sends,
+    finalRecoveryAllowance: 0,
+    maxAlternateTargetSends: 0,
+    maxTargetTransitions: 0,
+  };
+  return createRequestExecutionBudget(policy, "lr-google-wire-shape-test");
+}
+
+function parsedToolSession(rounds: number, threads: { parent?: string; own?: string } = {}): OcxParsedRequest {
+  const messages: unknown[] = [{ role: "user", content: "opening turn" }];
+  for (let round = 1; round <= rounds; round++) {
+    messages.push({
+      role: "assistant",
+      content: [{ type: "toolCall", id: `call-${round}`, name: "search", arguments: { q: "x" } }],
+    });
+    messages.push({ role: "toolResult", toolCallId: `call-${round}`, toolName: "search", content: "ok" });
+  }
+  messages.push({ role: "user", content: "next turn" });
+  return {
+    modelId: "gemini-3-pro",
+    stream: false,
+    context: { messages, systemPrompt: [], tools: [] },
+    options: {},
+    ...(threads.parent === undefined ? {} : { _clientThreadId: threads.parent }),
+    ...(threads.own === undefined ? {} : { _codexOwnThreadId: threads.own }),
+  } as unknown as OcxParsedRequest;
+}
+
+function parsedWithThreads(threads: { parent?: string; own?: string }, firstText = "opening turn"): OcxParsedRequest {
+  return {
+    modelId: "gemini-3-pro",
+    stream: false,
+    context: { messages: [{ role: "user", content: firstText }], systemPrompt: [], tools: [] },
+    options: {},
+    ...(threads.parent === undefined ? {} : { _clientThreadId: threads.parent }),
+    ...(threads.own === undefined ? {} : { _codexOwnThreadId: threads.own }),
+  } as unknown as OcxParsedRequest;
+}
+
+/** Every marker the fixtures plant, so one assertion can prove none of them survives. */
+const ALL_MARKERS = [...Object.values(WIRE_MARKERS), callId(1), callId(2), callId(3)];
+
+afterEach(() => {
+  resetDebugSettingsForTests();
+  resetDebugLogBufferForTests();
+});
+
+// The projection is a diagnostic. If it can move a byte, a send, or a signature, it is worse
+// than the missing information it exists to supply — so this runs before anything about shape.
+describe("google wire shape projection is inert", () => {
+  test("summarizing does not mutate the body it reads", () => {
+    const body = compiledWireBody(longToolSession(5, { signature: WIRE_MARKERS.signature }), {
+      toolDeclarations: 3,
+    });
+    const before = JSON.stringify(body);
+    summarizeGoogleWireShape(body, { sessionAnchor: "parent-and-own", sendOrdinal: 1 });
+    expect(JSON.stringify(body)).toBe(before);
+  });
+
+  test("provider debug changes neither the compiled request nor the headers", async () => {
+    const adapter = createGoogleAdapter(provider);
+    const request = parsedToolSession(4, { parent: "tp-9f31", own: "tc-4a02" });
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: false });
+      const off = await adapter.buildRequest(request);
+      setDebugSettings({ debug: true });
+      const on = await adapter.buildRequest(request);
+      const offEnvelope = JSON.parse(off.body) as Record<string, unknown>;
+      const onEnvelope = JSON.parse(on.body) as Record<string, unknown>;
+      expect(JSON.stringify(onEnvelope.request)).toBe(JSON.stringify(offEnvelope.request));
+      expect(on.url).toBe(off.url);
+      expect(on.method).toBe(off.method);
+      expect(JSON.stringify(on.headers)).toBe(JSON.stringify(off.headers));
+      // The envelope requestId is a fresh uuid per build and is the only difference allowed.
+      expect(onEnvelope.requestId).not.toBe(offEnvelope.requestId);
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  // buildRequest never calls fetch, so counting fetches around it proves nothing about the
+  // diagnostic. The send count worth pinning is the one the budget and the physical-send
+  // observer see on the real dispatch path, with the request the diagnostic just described.
+  test("provider debug changes neither the physical send count nor the bytes dispatched", async () => {
+    const adapter = createGoogleAdapter(provider);
+    const parsedRequest = parsedToolSession(4, { parent: "tp-9f31", own: "tc-4a02" });
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      const run = async (debug: boolean) => {
+        setDebugSettings({ debug });
+        const built = await adapter.buildRequest(parsedRequest);
+        const sends: number[] = [];
+        const dispatched: string[] = [];
+        const executor = (async (_input: unknown, init?: { body?: unknown }) => {
+          dispatched.push(typeof init?.body === "string" ? init.body : "");
+          return new Response(JSON.stringify({ response: { candidates: [] } }), {
+            status: 200, headers: { "content-type": "application/json" },
+          });
+        }) as unknown as typeof globalThis.fetch;
+        const response = await adapter.fetchResponse!(built, {
+          executor,
+          sendBudget: budgetOf(3),
+          onPhysicalSend: send => { sends.push(send.ordinal); },
+          timeoutMs: 5_000,
+        });
+        expect(response.status).toBe(200);
+        const envelope = JSON.parse(dispatched[0]!) as Record<string, unknown>;
+        const requestId = envelope.requestId;
+        // The envelope request id is a fresh uuid per build and has nothing to do with debug;
+        // normalizing it lets the rest of the dispatched body be compared byte for byte.
+        envelope.requestId = "<per-build uuid>";
+        return { sends, requestId, body: JSON.stringify(envelope) };
+      };
+      const off = await run(false);
+      const on = await run(true);
+      // Exactly one physical send either way, and the budget saw the same single dispatch.
+      expect(off.sends).toEqual([1]);
+      expect(on.sends).toEqual(off.sends);
+      // And every byte that actually left is identical apart from that uuid — not merely the
+      // bytes that were built.
+      expect(on.body).toBe(off.body);
+      expect(on.requestId).not.toBe(off.requestId);
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  // Proven by execution, not asserted: the exact expression google.ts hands to the lazy logger,
+  // given a body that throws when the projection reads it.
+  test("a projection that throws is swallowed and emits nothing", () => {
+    const hostile = {
+      get contents(): never { throw new Error("projection boom"); },
+    };
+    setDebugSettings({ debug: true });
+    resetDebugLogBufferForTests();
+    expect(() => debugProviderDiagnosticLazy(
+      "google", "antigravity-wire-shape", () => summarizeGoogleWireShape(hostile),
+    )).not.toThrow();
+    expect(getDebugLogEntries()).toEqual([]);
+  });
+
+  test("the builder is never invoked while provider debug is off", () => {
+    let built = 0;
+    setDebugSettings({ debug: false });
+    debugProviderDiagnosticLazy("google", "antigravity-wire-shape", () => {
+      built += 1;
+      return {};
+    });
+    expect(built).toBe(0);
+  });
+
+  test("the emitted diagnostic carries no prompt, argument, result, id or signature", async () => {
+    const adapter = createGoogleAdapter(provider);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      resetDebugLogBufferForTests();
+      await adapter.buildRequest(parsedToolSession(3, { parent: "tp-9f31", own: "tc-4a02" }));
+      const line = getDebugLogEntries().map(entry => entry.line).find(l => l.includes("antigravity-wire-shape"));
+      expect(line).toBeDefined();
+      const emitted = line as string;
+      for (const secret of ["opening turn", "next turn", "search", "call-1", "call-2", "proj-123", "ya29.token", THOUGHT_SIGNATURE_SENTINEL, "tp-9f31", "tc-4a02"]) {
+        expect(emitted).not.toContain(secret);
+      }
+      expect(emitted).toContain("\"sessionAnchor\":\"parent-and-own\"");
+    } finally {
+      console.error = realError;
+    }
+  });
+
+  test("provider debug off emits nothing at all", async () => {
+    const adapter = createGoogleAdapter(provider);
+    setDebugSettings({ debug: false });
+    resetDebugLogBufferForTests();
+    await adapter.buildRequest(parsedToolSession(3, { parent: "tp-9f31", own: "tc-4a02" }));
+    expect(getDebugLogEntries()).toEqual([]);
+  });
+});
+
+describe("google wire shape projection describes structure", () => {
+  test("a well-formed tool round trip projects its roles, counts and pairing", () => {
+    const summary = summarizeGoogleWireShape(
+      compiledWireBody([userTurn(), ...toolRoundTrip(1), userTurn()], { toolDeclarations: 37 }),
+      { sessionAnchor: "parent-and-own" },
+    );
+    expect(summary.turns).toBe(4);
+    expect(summary.roles).toEqual({ user: 3, model: 1, other: 0 });
+    expect(summary.functionCalls).toBe(1);
+    expect(summary.functionResponses).toBe(1);
+    expect(summary.distinctCallIds).toBe(1);
+    expect(summary.unansweredCalls).toBe(0);
+    expect(summary.unmatchedResponses).toBe(0);
+    expect(summary.toolDeclarations).toBe(37);
+    expect(summary.hasSystemInstruction).toBe(true);
+    expect(summary.hasSessionId).toBe(true);
+    expect(summary.orderingViolations).toBe(0);
+    expect(summary.firstOrderingViolation).toBeNull();
+    expect(summary.truncated).toBe(false);
+    expect(summary.turnShapes[1]).toEqual({
+      index: 1,
+      role: "model",
+      parts: 1,
+      kinds: ["functionCall"],
+      calls: [1],
+      responses: [],
+      signedCalls: 0,
+      sentinelCalls: 0,
+    });
+    expect(summary.turnShapes[2]?.responses).toEqual([1]);
+  });
+
+  test("call ids become request-internal ordinals, so unrelated ids project identically", () => {
+    const first = compiledWireBody([
+      userTurn("first conversation"),
+      modelCallTurn(["alpha-7f3c", "beta-1"]),
+      toolResultTurn(["beta-1", "alpha-7f3c"]),
+    ]);
+    const second = compiledWireBody([
+      userTurn("an entirely different conversation"),
+      modelCallTurn(["toolu_01QqRz", "fc_9928"]),
+      toolResultTurn(["fc_9928", "toolu_01QqRz"]),
+    ]);
+    expect(summarizeGoogleWireShape(first)).toEqual(summarizeGoogleWireShape(second));
+    const summary = summarizeGoogleWireShape(first);
+    expect(summary.turnShapes[1]?.calls).toEqual([1, 2]);
+    // Responses keep their own order, and the ordinals show the answers were transposed.
+    expect(summary.turnShapes[2]?.responses).toEqual([2, 1]);
+    expect(JSON.stringify(summary)).not.toContain("alpha-7f3c");
+  });
+
+  test("a call turn that opens the request is flagged with its position", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      modelCallTurn([callId(1)]),
+      toolResultTurn([callId(1)]),
+    ]));
+    expect(summary.firstOrderingViolation).toEqual({ index: 0, kind: "call-turn-opens-request" });
+    expect(summary.orderingViolations).toBe(1);
+  });
+
+  // The reporter's case A. It is flagged because the upstream error names this relationship,
+  // and it returned 200 upstream — which is why this projection reports rather than judges.
+  test("a call turn after a model text turn is flagged as such", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      userTurn(),
+      modelTextTurn(),
+      modelCallTurn([callId(1)]),
+      toolResultTurn([callId(1)]),
+    ]));
+    expect(summary.firstOrderingViolation).toEqual({ index: 2, kind: "call-turn-after-model-turn" });
+    expect(summary.roles).toEqual({ user: 2, model: 2, other: 0 });
+  });
+
+  test("a response turn with no call turn before it is flagged", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      userTurn(),
+      toolResultTurn([callId(1)]),
+    ]));
+    expect(summary.firstOrderingViolation).toEqual({ index: 1, kind: "response-turn-without-call-turn" });
+    expect(summary.unmatchedResponses).toBe(1);
+    expect(summary.unansweredCalls).toBe(0);
+  });
+
+  test("a model tail is flagged, which is what the (continue) nudge exists to prevent", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([userTurn(), modelTextTurn()]));
+    expect(summary.firstOrderingViolation).toEqual({ index: 1, kind: "request-ends-with-model-turn" });
+  });
+
+  test("a call turn after an unrecognized role is not blamed on a model turn", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      userTurn(),
+      { role: "function", parts: [{ text: WIRE_MARKERS.prompt }] },
+      modelCallTurn([callId(1)]),
+      toolResultTurn([callId(1)]),
+    ]));
+    expect(summary.roles).toEqual({ user: 2, model: 1, other: 1 });
+    expect(summary.firstOrderingViolation).toEqual({ index: 2, kind: "call-turn-after-unknown-turn" });
+  });
+
+  // The exhaustive leak oracle: every marker the fixtures plant, checked against one projection.
+  test("no marker the fixture plants survives into a summary", () => {
+    const summary = summarizeGoogleWireShape(
+      compiledWireBody([
+        userTurn(),
+        ...toolRoundTrip(1, { signature: WIRE_MARKERS.signature }),
+        ...toolRoundTrip(2),
+        modelCallTurn([callId(3)]),
+        toolResultTurn([callId(3)]),
+      ], { toolDeclarations: 4 }),
+      { sessionAnchor: "parent-and-own", historySignedCalls: 1, replayScopeBound: true, sendOrdinal: 1, errorClass: "turn-adjacency" },
+    );
+    const serialized = JSON.stringify(summary);
+    for (const marker of ALL_MARKERS) expect(serialized).not.toContain(marker);
+    // The projection is not vacuous: it did describe the request it refused to quote.
+    expect(summary.functionCalls).toBe(3);
+    expect(summary.toolDeclarations).toBe(4);
+    expect(summary.hasSessionId).toBe(true);
+    expect(summary.signature.present).toBe(true);
+  });
+
+  test("an unanswered call and an id-less call are counted separately", () => {
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      userTurn(),
+      modelCallTurn([callId(1), callId(2)]),
+      toolResultTurn([callId(1)]),
+      unidentifiedCallTurn(),
+      userTurn(),
+    ]));
+    expect(summary.functionCalls).toBe(3);
+    expect(summary.callsWithoutId).toBe(1);
+    expect(summary.unansweredCalls).toBe(1);
+    expect(summary.distinctCallIds).toBe(2);
+  });
+
+  test("a long session keeps exact totals and truncates only its per-turn detail", () => {
+    const rounds = 60;
+    const summary = summarizeGoogleWireShape(compiledWireBody(longToolSession(rounds)));
+    expect(summary.turns).toBe(2 + rounds * 2);
+    expect(summary.functionCalls).toBe(rounds);
+    expect(summary.functionResponses).toBe(rounds);
+    expect(summary.distinctCallIds).toBe(rounds);
+    expect(summary.unansweredCalls).toBe(0);
+    expect(summary.orderingViolations).toBe(0);
+    expect(summary.truncated).toBe(true);
+    // Two ceilings bind, and the tighter one wins: the turn ceiling caps the retained detail,
+    // then the serialized budget trims further if the kept turns still do not fit a debug line.
+    expect(summary.turnShapes.length).toBeLessThanOrEqual(GOOGLE_WIRE_SHAPE_TURN_CEILING);
+    expect(summary.turnShapes.length).toBeGreaterThan(0);
+    expect(new TextEncoder().encode(JSON.stringify(summary)).length)
+      .toBeLessThanOrEqual(GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES);
+    // The retained detail is still the head of the request, where a first-send violation lives.
+    expect(summary.turnShapes[0]?.index).toBe(0);
+  });
+
+  test("a parallel batch wider than the ordinal ceiling truncates the list, not the count", () => {
+    const ids = Array.from({ length: 20 }, (_unused, i) => callId(i + 1));
+    const summary = summarizeGoogleWireShape(compiledWireBody([
+      userTurn(),
+      modelCallTurn(ids),
+      toolResultTurn(ids),
+    ]));
+    expect(summary.functionCalls).toBe(20);
+    expect(summary.distinctCallIds).toBe(20);
+    expect(summary.turnShapes[1]?.calls).toHaveLength(16);
+    expect(summary.truncated).toBe(true);
+  });
+
+  // The item ceilings alone are not enough: 64 retained turns carrying 16 ordinals each serialize
+  // past the debug buffer's per-line cap, and the buffer cuts at a byte boundary. This drives the
+  // worst case through the REAL buffer and parses what comes back out of it.
+  test("the worst case inside the item ceilings still parses out of the real debug buffer", () => {
+    const contents: WireTurn[] = [userTurn()];
+    for (let round = 0; round < 32; round++) {
+      const ids = Array.from({ length: 16 }, (_unused, i) => callId(round * 16 + i + 1));
+      contents.push(modelCallTurn(ids, { signature: WIRE_MARKERS.signature }), toolResultTurn(ids));
+    }
+    const summary = summarizeGoogleWireShape(compiledWireBody(contents, { toolDeclarations: 37 }), {
+      sessionAnchor: "parent-and-own", historySignedCalls: 32, replayScopeBound: true,
+    });
+    expect(summary.turns).toBe(65);
+    expect(summary.functionCalls).toBe(512);
+    expect(summary.truncated).toBe(true);
+    // The size budget bit before the turn ceiling did, which is the whole point.
+    expect(summary.turnShapes.length).toBeLessThan(GOOGLE_WIRE_SHAPE_TURN_CEILING);
+    expect(new TextEncoder().encode(JSON.stringify(summary)).length)
+      .toBeLessThanOrEqual(GOOGLE_WIRE_SHAPE_MAX_SERIALIZED_BYTES);
+
+    setDebugSettings({ debug: true });
+    resetDebugLogBufferForTests();
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      debugProviderDiagnosticLazy("google", "antigravity-wire-shape", () => summary);
+    } finally {
+      console.error = realError;
+    }
+    const entries = getDebugLogEntries();
+    expect(entries).toHaveLength(1);
+    const line = entries[0]!.line;
+    expect(new TextEncoder().encode(line).length).toBeLessThanOrEqual(MAX_DEBUG_LINE_BYTES);
+    // Parseable, and still honest about having been cut. A buffer-truncated line would fail the
+    // parse, and its retained prefix would still have read truncated:false.
+    const roundTripped = JSON.parse(line.slice(line.indexOf("] ") + 2)) as
+      { truncated: boolean; turns: number; functionCalls: number; turnShapes: unknown[] };
+    expect(roundTripped.truncated).toBe(true);
+    expect(roundTripped.turns).toBe(65);
+    expect(roundTripped.functionCalls).toBe(512);
+    expect(roundTripped.turnShapes.length).toBe(summary.turnShapes.length);
+  });
+
+  test("compaction shortens the request without changing what the projection reports about a turn", () => {
+    const full = summarizeGoogleWireShape(compiledWireBody(longToolSession(20)));
+    const compacted = summarizeGoogleWireShape(compiledWireBody(compactedToolSession(20, 4)));
+    expect(full.functionCalls).toBe(20);
+    expect(compacted.functionCalls).toBe(4);
+    expect(compacted.orderingViolations).toBe(0);
+    expect(compacted.turnShapes[1]).toEqual({ ...full.turnShapes[1]!, index: 1 });
+  });
+
+  test("signature presence, sentinel-only signing and the two signing sources stay separable", () => {
+    const unsigned = summarizeGoogleWireShape(compiledWireBody([userTurn(), ...toolRoundTrip(1)]));
+    expect(unsigned.signature).toEqual({
+      present: false,
+      sentinelOnly: false,
+      signedCalls: 0,
+      sentinelCalls: 0,
+      historySignedCalls: 0,
+      sessionCacheSignedCalls: 0,
+      replayScopeBound: false,
+    });
+
+    const signed = summarizeGoogleWireShape(
+      compiledWireBody([userTurn(), ...toolRoundTrip(1, { signature: WIRE_MARKERS.signature })]),
+      { historySignedCalls: 1, replayScopeBound: true },
+    );
+    expect(signed.signature).toEqual({
+      present: true,
+      sentinelOnly: false,
+      signedCalls: 1,
+      sentinelCalls: 0,
+      historySignedCalls: 1,
+      sessionCacheSignedCalls: 0,
+      replayScopeBound: true,
+    });
+    expect(JSON.stringify(signed)).not.toContain(WIRE_MARKERS.signature);
+
+    // A signature the translator did not supply is attributed to the Antigravity session cache.
+    const fromCache = summarizeGoogleWireShape(
+      compiledWireBody([userTurn(), ...toolRoundTrip(1, { signature: WIRE_MARKERS.signature })]),
+      { historySignedCalls: 0, replayScopeBound: true },
+    );
+    expect(fromCache.signature.historySignedCalls).toBe(0);
+    expect(fromCache.signature.sessionCacheSignedCalls).toBe(1);
+
+    // Sentinel-only is the shape a lookup miss reaches the wire as: signed, but by us.
+    const sentinel = summarizeGoogleWireShape(
+      compiledWireBody([userTurn(), ...toolRoundTrip(1, { signature: THOUGHT_SIGNATURE_SENTINEL })]),
+      { historySignedCalls: 0, replayScopeBound: true },
+    );
+    expect(sentinel.signature.present).toBe(true);
+    expect(sentinel.signature.sentinelOnly).toBe(true);
+    expect(sentinel.signature.sessionCacheSignedCalls).toBe(0);
+    expect(sentinel.signature.replayScopeBound).toBe(true);
+  });
+
+  test("send facts are carried only when the caller has them", () => {
+    const body = compiledWireBody([userTurn(), ...toolRoundTrip(1)]);
+    expect(summarizeGoogleWireShape(body).send).toBeNull();
+    expect(summarizeGoogleWireShape(body, { sendOrdinal: 1, errorClass: "turn-adjacency" }).send)
+      .toEqual({ ordinal: 1, errorClass: "turn-adjacency" });
+    expect(summarizeGoogleWireShape(body, { sendOrdinal: 3 }).send).toEqual({ ordinal: 3, errorClass: null });
+    expect(summarizeGoogleWireShape(body).sessionAnchor).toBe("unknown");
+  });
+
+  test("a body that is not a Google request degrades to an empty description", () => {
+    for (const input of [undefined, null, 42, "text", [], {}, { contents: "not-an-array" }]) {
+      const summary = summarizeGoogleWireShape(input);
+      expect(summary.turns).toBe(0);
+      expect(summary.turnShapes).toEqual([]);
+      expect(summary.truncated).toBe(false);
+      expect(summary.hasSessionId).toBe(false);
+    }
+  });
+});
+
+describe("google wire upstream error classification", () => {
+  test("the reported 400 classifies as a turn-adjacency rejection", () => {
+    expect(classifyGoogleWireUpstreamError(
+      "Antigravity invalid request: Please ensure that function call turn comes immediately after a user turn or after a function response turn.",
+    )).toBe("turn-adjacency");
+  });
+
+  test("the neighbouring Google 400 classes stay distinct", () => {
+    expect(classifyGoogleWireUpstreamError("Requests ending with a model turn are not supported")).toBe("turn-adjacency");
+    expect(classifyGoogleWireUpstreamError("Invalid thought_signature: TYPE_BYTES decoding failed")).toBe("thought-signature");
+    expect(classifyGoogleWireUpstreamError("tools[2].custom.input_schema is invalid")).toBe("tool-schema");
+    expect(classifyGoogleWireUpstreamError("Unsupported thinkingLevel for this model")).toBe("thinking-config");
+    expect(classifyGoogleWireUpstreamError("quota exceeded")).toBe("other");
+  });
+
+  test("classification is bounded and never returns upstream text", () => {
+    expect(classifyGoogleWireUpstreamError(undefined)).toBe("other");
+    expect(classifyGoogleWireUpstreamError("")).toBe("other");
+    // Past the scan limit the marker is not read, so a huge payload cannot be walked in full.
+    expect(classifyGoogleWireUpstreamError(`${"x".repeat(4096)} function call turn`)).toBe("other");
+  });
+});
+
+// The session boundary is the other half of #5008: the reporter's hypothesis is that the
+// upstream session diverged from what the proxy replays. The anchor class says which stability
+// regime a request is in without naming the conversation.
+describe("antigravity session anchor classification", () => {
+  test("the four anchor classes are distinguished", () => {
+    expect(antigravitySessionAnchor(parsedWithThreads({ parent: "p1", own: "c1" }))).toBe("parent-and-own");
+    expect(antigravitySessionAnchor(parsedWithThreads({ parent: "p1" }))).toBe("parent-only");
+    expect(antigravitySessionAnchor(parsedWithThreads({}))).toBe("text");
+    expect(antigravitySessionAnchor(parsedWithThreads({}, ""))).toBe("none");
+  });
+
+  test("a direct HTTP client with no Codex headers lands on the text anchor", () => {
+    const direct = parsedToolSession(2);
+    expect(antigravitySessionAnchor(direct)).toBe("text");
+  });
+
+  test("an own-thread anchor keeps its class and its id when the first message is compacted", () => {
+    const before = parsedWithThreads({ parent: "p1", own: "c1" }, "the original first user message");
+    const after = parsedWithThreads({ parent: "p1", own: "c1" }, "a compaction summary that replaced it");
+    expect(antigravitySessionAnchor(before)).toBe(antigravitySessionAnchor(after));
+    expect(antigravitySessionId(before)).toBe(antigravitySessionId(after));
+  });
+
+  test("the text anchor keeps its class while its id moves under compaction", () => {
+    const before = parsedWithThreads({}, "the original first user message");
+    const after = parsedWithThreads({}, "a compaction summary that replaced it");
+    expect(antigravitySessionAnchor(before)).toBe("text");
+    expect(antigravitySessionAnchor(after)).toBe("text");
+    // The instability the anchor class exists to make visible.
+    expect(antigravitySessionId(before)).not.toBe(antigravitySessionId(after));
+  });
+
+  test("the same own id under two parents stays one class and two sessions", () => {
+    const underP1 = parsedWithThreads({ parent: "p1", own: "shared-child" });
+    const underP2 = parsedWithThreads({ parent: "p2", own: "shared-child" });
+    expect(antigravitySessionAnchor(underP1)).toBe("parent-and-own");
+    expect(antigravitySessionAnchor(underP2)).toBe("parent-and-own");
+    expect(antigravitySessionId(underP1)).not.toBe(antigravitySessionId(underP2));
+  });
+
+  test("two overlapping children of one parent are one class and two sessions", () => {
+    const childA = parsedWithThreads({ parent: "p1", own: "c1" });
+    const childB = parsedWithThreads({ parent: "p1", own: "c2" });
+    expect(antigravitySessionAnchor(childA)).toBe(antigravitySessionAnchor(childB));
+    expect(antigravitySessionId(childA)).not.toBe(antigravitySessionId(childB));
+  });
+
+  test("a restarted proxy re-derives the same class and the same id", () => {
+    // Both values come from Codex ids and message text alone; nothing process-random enters,
+    // which is what lets durable replay state survive a restart.
+    for (const threads of [{ parent: "p1", own: "c1" }, { parent: "p1" }, {}]) {
+      const first = parsedWithThreads(threads);
+      const second = parsedWithThreads(threads);
+      expect(antigravitySessionAnchor(first)).toBe(antigravitySessionAnchor(second));
+      expect(antigravitySessionId(first)).toBe(antigravitySessionId(second));
+    }
+  });
+
+  test("the anchorless request is the one whose id does not survive a second look", () => {
+    const first = parsedWithThreads({}, "");
+    expect(antigravitySessionAnchor(first)).toBe("none");
+    expect(antigravitySessionId(first)).not.toBe(antigravitySessionId(parsedWithThreads({}, "")));
+  });
+
+  test("the adapter reports the anchor class it actually used", async () => {
+    const adapter = createGoogleAdapter(provider);
+    const realError = console.error;
+    console.error = () => {};
+    try {
+      setDebugSettings({ debug: true });
+      for (const [threads, expected] of [
+        [{ parent: "p1", own: "c1" }, "parent-and-own"],
+        [{ parent: "p1" }, "parent-only"],
+        [{}, "text"],
+      ] as const) {
+        resetDebugLogBufferForTests();
+        await adapter.buildRequest(parsedToolSession(1, threads));
+        const line = getDebugLogEntries().map(entry => entry.line).find(l => l.includes("antigravity-wire-shape"));
+        expect(line).toContain(`"sessionAnchor":"${expected}"`);
+      }
+    } finally {
+      console.error = realError;
+    }
+  });
+});
diff --git a/tests/adapters/openai/openai-chat-image-normalization.test.ts b/tests/adapters/openai/openai-chat-image-normalization.test.ts
index 5fefeaed4ac..11176e99ab5 100644
--- a/tests/adapters/openai/openai-chat-image-normalization.test.ts
+++ b/tests/adapters/openai/openai-chat-image-normalization.test.ts
@@ -12,8 +12,11 @@ import {
   TIER_SPECS,
   type EncodeFn,
 } from "../../../src/adapters/anthropic-image-normalize";
+import { bunImageEncode, bunImageValidate } from "../../../src/adapters/anthropic-image-codec";
+import { sniffImageDimensions } from "../../../src/adapters/anthropic-image-guard";
 import type { OcxMessage, OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
 import { createTestTranslatorBudget } from "../../helpers/translator-budget";
+import { phaseTimer } from "../../helpers/phase-timing";
 
 // Issue #4112 follow-up: chat-completions providers such as GitHub Copilot reject a body
 // over roughly 5.2MB with a bare 413 and no diagnostic content. Nothing downstream of the
@@ -40,8 +43,30 @@ async function realPngB64(width: number, height: number): Promise<string> {
  * A flat-colour PNG compresses to almost nothing, so budget behaviour needs incompressible
  * pixels. Deterministic noise is written as an uncompressed BMP and converted, which keeps
  * the fixture in-repo and the encoded size realistic.
+ *
+ * Built once per size and shared, for #4997. Seven cases in this file ask for the same 1000x1000
+ * noise PNG, and producing one is a million-iteration fill followed by a PNG encode of pixels that
+ * are incompressible by construction. For every one of those cases that is preparation: none
+ * asserts anything about how the fixture was produced, only about what the normalizer does to it.
+ * Two of them overran the lane's 60s ceiling in the unsharded control while passing in the shards
+ * that ran the same file, and this build sat inside the window that was being measured.
+ *
+ * Sharing is safe because nothing writes to the result. The normalizer mutates freshly built wire
+ * objects rather than the base64 itself, and the one case that needs a truncated copy uses slice,
+ * which allocates. Per-case isolation is enforced by resetNormalizeStateForTests, not by fixture
+ * identity. The promise rather than the string is cached so two callers cannot both start a build.
  */
-async function noisyPngB64(width: number, height: number): Promise<string> {
+const noisyPngCache = new Map<string, Promise<string>>();
+function noisyPngB64(width: number, height: number): Promise<string> {
+  const key = width + "x" + height;
+  const cached = noisyPngCache.get(key);
+  if (cached !== undefined) return cached;
+  const built = buildNoisyPngB64(width, height);
+  noisyPngCache.set(key, built);
+  return built;
+}
+
+async function buildNoisyPngB64(width: number, height: number): Promise<string> {
   const rowSize = width * 3 + ((4 - ((width * 3) % 4)) % 4);
   const pixelBytes = rowSize * height;
   const bmp = Buffer.alloc(54 + pixelBytes);
@@ -68,6 +93,30 @@ async function noisyPngB64(width: number, height: number): Promise<string> {
   return Buffer.from(png).toString("base64");
 }
 
+function headerOnlyPngB64(width: number, height: number, base64Length: number): string {
+  const bytes = Buffer.alloc(Math.ceil(base64Length / 4) * 3);
+  Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]).copy(bytes);
+  bytes.writeUInt32BE(13, 8);
+  bytes.write("IHDR", 12);
+  bytes.writeUInt32BE(width, 16);
+  bytes.writeUInt32BE(height, 20);
+  return bytes.toString("base64");
+}
+
+/** BMP header claiming the given dimensions; sniffImageDimensions has no BMP branch. */
+function headerOnlyBmpB64(width: number, height: number): string {
+  const bytes = Buffer.alloc(54);
+  bytes.write("BM", 0);
+  bytes.writeUInt32LE(bytes.length, 2);
+  bytes.writeUInt32LE(54, 10);
+  bytes.writeUInt32LE(40, 14);
+  bytes.writeInt32LE(width, 18);
+  bytes.writeInt32LE(height, 22);
+  bytes.writeUInt16LE(1, 26);
+  bytes.writeUInt16LE(24, 28);
+  return bytes.toString("base64");
+}
+
 
 /** Wrap raw base64 as a data URL, the only image form this wire normalizes. */
 function dataUrl(b64: string, mediaType = "image/png"): string {
@@ -222,6 +271,63 @@ describe("openai-chat inline image normalization", () => {
     expect(getNormalizeStatsForTests().encodeCalls).toBe(0);
   });
 
+  test("a highly compressed 100 megapixel image never reaches the decoder", async () => {
+    const bomb = headerOnlyPngB64(10_000, 10_000, OPENAI_CHAT_IMAGE_BASE64_BUDGET + 4);
+    const original = dataUrl(bomb);
+    const messages = [{
+      role: "user",
+      content: [{ type: "image_url", image_url: { url: original } }],
+    }];
+    let encodeCalls = 0;
+    await normalizeOpenAIChatImages(messages, {
+      encode: async () => {
+        encodeCalls++;
+        return { data: "unexpected", mediaType: "image/jpeg" };
+      },
+    });
+    expect(encodeCalls).toBe(0);
+    expect(imageParts(messages as ChatMsg[])[0]?.image_url?.url).toBe(original);
+  });
+
+  test("an oversized image whose header cannot be sniffed is rejected by the decode metadata bound", async () => {
+    // sniffImageDimensions reads only PNG/JPEG/GIF/WebP headers, so this header-only
+    // BMP claiming 5000x4000 (20MPx > MAX_INPUT_PIXELS) clears the pre-decode gates
+    // unsized. The bound that stops it is the metadata check inside the decode path
+    // itself: bunImageValidate on the pass-through branch, bunImageEncode elsewhere.
+    const bmp = headerOnlyBmpB64(5_000, 4_000);
+    expect(sniffImageDimensions(bmp)).toBeNull();
+    const input = Uint8Array.from(Buffer.from(bmp, "base64"));
+    await expect(bunImageValidate(input)).rejects.toThrow("image dimensions exceed the safe decode limit");
+    await expect(bunImageEncode(input, TIER_SPECS[0], 80)).rejects.toThrow("image dimensions exceed the safe decode limit");
+
+    // End to end the normalizer drops it after one rejected decode attempt, and this
+    // wire retains the original bytes on drop.
+    const original = dataUrl(bmp, "image/bmp");
+    const messages = [{
+      role: "user",
+      content: [{ type: "image_url", image_url: { url: original } }],
+    }];
+    await normalizeOpenAIChatImages(messages);
+    expect(getNormalizeStatsForTests().encodeCalls).toBe(1);
+    expect(imageParts(messages as ChatMsg[])[0]?.image_url?.url).toBe(original);
+  });
+
+  test("an already-cancelled oversized build does not start normalization", async () => {
+    const big = headerOnlyPngB64(1000, 1000, OPENAI_CHAT_IMAGE_BASE64_BUDGET + 4);
+    const controller = new AbortController();
+    controller.abort(new Error("client disconnected"));
+    const built = createOpenAIChatAdapter(provider).buildRequest(
+      parsedWith([imageMessage([dataUrl(big)])]),
+      {
+        headers: new Headers(),
+        translatorBudget: createTestTranslatorBudget(),
+        abortSignal: controller.signal,
+      },
+    );
+    await expect(built as Promise<unknown>).rejects.toThrow("client disconnected");
+    expect(getNormalizeStatsForTests().encodeCalls).toBe(0);
+  });
+
   test("a remote https image is left untouched", async () => {
     const messages = [{
       role: "user",
@@ -233,30 +339,37 @@ describe("openai-chat inline image normalization", () => {
   });
 
   test("an image this wire cannot drop keeps counting toward the budget", async () => {
+    // Instrumented for #4997: this case and imageTierBias below both overran the lane's 60s
+    // ceiling in the unsharded control while passing in every shard that ran the same file. The
+    // probe is the normalizer's own encode counter, so a tick can tell a contended-but-advancing
+    // ladder walk apart from one that has stopped doing work.
+    const timing = phaseTimer("openai-chat non-droppable", () => getNormalizeStatsForTests().encodeCalls);
     // The drop callback here is a no-op, so an undecodable image stays on the wire. The
     // shared core normally stops counting a dropped target, which is only correct when
     // the bytes actually leave. If those bytes stopped counting, the demotion loop would
     // stop early and still ship an oversized body — the exact failure this file exists
     // to prevent.
-    const big = await noisyPngB64(1000, 1000);
-    // Truncated PNG: sniffs as an image, so it reaches the ladder, but cannot decode.
-    const corrupt = big.slice(0, 3_000_000);
-    const messages = [{
-      role: "user",
-      content: [
-        { type: "image_url", image_url: { url: dataUrl(corrupt) } },
-        ...Array.from({ length: 3 }, () => ({ type: "image_url", image_url: { url: dataUrl(big) } })),
-      ],
-    }];
+    const prepared = await timing.phase("prepare", async () => {
+      const big = await noisyPngB64(1000, 1000);
+      // Truncated PNG: sniffs as an image, so it reaches the ladder, but cannot decode.
+      const corrupt = big.slice(0, 3_000_000);
+      return { corrupt, messages: [{
+        role: "user",
+        content: [
+          { type: "image_url", image_url: { url: dataUrl(corrupt) } },
+          ...Array.from({ length: 3 }, () => ({ type: "image_url", image_url: { url: dataUrl(big) } })),
+        ],
+      }] };
+    });
 
     resetNormalizeStateForTests();
-    await normalizeOpenAIChatImages(messages);
+    await timing.phase("execute", () => normalizeOpenAIChatImages(prepared.messages));
 
-    const parts = imageParts(messages as ChatMsg[]);
+    const parts = imageParts(prepared.messages as ChatMsg[]);
     const total = parts.reduce((sum, p) => sum + (p.image_url?.url.split(",")[1]?.length ?? 0), 0);
     expect(parts).toHaveLength(4);
     // The undecodable image is retained, unchanged.
-    expect(parts[0]?.image_url?.url).toBe(dataUrl(corrupt));
+    expect(parts[0]?.image_url?.url).toBe(dataUrl(prepared.corrupt));
     // And the turn as a whole still lands under budget.
     expect(total).toBeLessThanOrEqual(OPENAI_CHAT_IMAGE_BASE64_BUDGET);
   });
@@ -330,12 +443,12 @@ describe("openai-chat inline image normalization", () => {
   });
 
   test("imageTierBias from incoming meta reaches the normalizer", async () => {
-    const big = await noisyPngB64(1000, 1000);
+    const timing = phaseTimer("openai-chat imageTierBias", () => getNormalizeStatsForTests().encodeCalls);
+    const big = await timing.phase("prepare", () => noisyPngB64(1000, 1000));
     const urls = Array.from({ length: 4 }, () => dataUrl(big));
     const adapter = createOpenAIChatAdapter(provider);
 
     const build = async (imageTierBias?: number) => {
-      resetNormalizeStateForTests();
       const built = adapter.buildRequest(parsedWith([imageMessage(urls)]), {
         headers: new Headers(),
         translatorBudget: createTestTranslatorBudget(),
@@ -346,7 +459,15 @@ describe("openai-chat inline image normalization", () => {
         .reduce((sum, part) => sum + (part.image_url?.url.length ?? 0), 0);
     };
 
-    expect(await build(3)).toBeLessThan(await build());
+    // Two cold walks of the ladder over four megapixel images: this is the contract, and the
+    // `execute` figure is what a disposition has to be argued against.
+    // The reset stays outside the measured segment: it zeroes the encode counter the ticks read,
+    // and a probe that drops to zero mid-phase reports movement that did not happen.
+    resetNormalizeStateForTests();
+    const biased = await timing.phase("execute-biased", () => build(3));
+    resetNormalizeStateForTests();
+    const unbiased = await timing.phase("execute-default", () => build());
+    expect(biased).toBeLessThan(unbiased);
   });
 
 });
diff --git a/tests/adapters/openai/openai-chat-native-policy.test.ts b/tests/adapters/openai/openai-chat-native-policy.test.ts
index 9357cf22154..d5ef745abee 100644
--- a/tests/adapters/openai/openai-chat-native-policy.test.ts
+++ b/tests/adapters/openai/openai-chat-native-policy.test.ts
@@ -15,13 +15,25 @@ import { clearKeyCooldowns } from "../../../src/providers/key-failover";
 import { fastPolicyForModel } from "../../../src/providers/service-tier";
 import { handleChatCompletions } from "../../../src/server/chat-completions";
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
 
 const PROVIDER_NAME = "native-tier-fixture";
 const MODEL_ID = "model";
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => {
+  // Taken only for direct Chat dispatches so pure policy cases do not open the journal.
+  releaseSpendHome ??= acquireOwnedSpendHome();
+};
+const dropSpendHome = (): void => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+};
 
 afterEach(() => {
+  // Released first so a failed assertion cannot leave the active home lease live.
+  dropSpendHome();
   globalThis.fetch = originalFetch;
   clearKeyCooldowns(PROVIDER_NAME);
 });
@@ -219,6 +231,7 @@ describe("native Chat passthrough service-tier policy", () => {
       providers: { [PROVIDER_NAME]: target },
     } as OcxConfig;
 
+    takeSpendHome();
     const response = await handleChatCompletions(
       new Request("http://localhost/v1/chat/completions", {
         method: "POST",
@@ -233,9 +246,13 @@ describe("native Chat passthrough service-tier policy", () => {
       { model: "", provider: "" },
     );
 
-    expect(response.status).toBe(200);
-    expect(captured).toHaveLength(1);
-    expect(captured[0]).not.toHaveProperty("service_tier");
+    try {
+      expect(response.status).toBe(200);
+      expect(captured).toHaveLength(1);
+      expect(captured[0]).not.toHaveProperty("service_tier");
+    } finally {
+      await response.body?.cancel();
+    }
   });
 
   test("forced Fast injects the policy wire value and forced default drops the caller tier", () => {
@@ -250,6 +267,8 @@ describe("native Chat passthrough service-tier policy", () => {
     const previousHome = process.env.OPENCODEX_HOME;
     const home = mkdtempSync(join(tmpdir(), "ocx-native-tier-failover-"));
     process.env.OPENCODEX_HOME = home;
+    // Taken after this case installs its home so key-failover dispatch owns that journal.
+    takeSpendHome();
     const captured: Array<{ authorization: string | null; body: Record<string, unknown> }> = [];
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
       captured.push({
@@ -301,11 +320,17 @@ describe("native Chat passthrough service-tier policy", () => {
         { model: "", provider: "" },
       );
 
-      expect(response.status).toBe(200);
-      expect(captured.map(entry => entry.authorization)).toEqual(["Bearer key-one", "Bearer key-two"]);
-      expect(captured).toHaveLength(2);
-      for (const entry of captured) expect(entry.body).not.toHaveProperty("service_tier");
+      try {
+        expect(response.status).toBe(200);
+        expect(captured.map(entry => entry.authorization)).toEqual(["Bearer key-one", "Bearer key-two"]);
+        expect(captured).toHaveLength(2);
+        for (const entry of captured) expect(entry.body).not.toHaveProperty("service_tier");
+      } finally {
+        await response.body?.cancel();
+      }
     } finally {
+      // Released before this case restores and removes its home so no live database is unlinked.
+      dropSpendHome();
       if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousHome;
       removeTreeWithRetry(home);
@@ -420,6 +445,7 @@ describe("main and native Chat tier authorization parity", () => {
     const target = provider({
       modelCapabilities: { [MODEL_ID]: { inputModalities: ["text", "image"] } },
     });
+    takeSpendHome();
     const response = await handleChatCompletions(
       new Request("http://localhost/v1/chat/completions", {
         method: "POST",
@@ -439,15 +465,19 @@ describe("main and native Chat tier authorization parity", () => {
       { model: "", provider: "" },
     );
 
-    expect(response.status).toBe(200);
-    expect(captured).toHaveLength(1);
-    const parts = (JSON.parse(captured[0]!) as { messages: Array<{ content: unknown }> })
-      .messages.flatMap(m => (Array.isArray(m.content) ? m.content : []))
-      .filter((p): p is { type: string; image_url: { url: string } } =>
-        typeof p === "object" && p !== null && (p as { type?: unknown }).type === "image_url");
-    // Well over the 3.5MiB image budget, and still byte-identical on the wire.
-    expect(parts).toHaveLength(4);
-    for (const part of parts) expect(part.image_url.url).toBe(url);
+    try {
+      expect(response.status).toBe(200);
+      expect(captured).toHaveLength(1);
+      const parts = (JSON.parse(captured[0]!) as { messages: Array<{ content: unknown }> })
+        .messages.flatMap(m => (Array.isArray(m.content) ? m.content : []))
+        .filter((p): p is { type: string; image_url: { url: string } } =>
+          typeof p === "object" && p !== null && (p as { type?: unknown }).type === "image_url");
+      // Well over the 3.5MiB image budget, and still byte-identical on the wire.
+      expect(parts).toHaveLength(4);
+      for (const part of parts) expect(part.image_url.url).toBe(url);
+    } finally {
+      await response.body?.cancel();
+    }
   });
 });
 
diff --git a/tests/adapters/openai/openai-provider-option-e2e.test.ts b/tests/adapters/openai/openai-provider-option-e2e.test.ts
index 903d85c82a3..707cde1ccdb 100644
--- a/tests/adapters/openai/openai-provider-option-e2e.test.ts
+++ b/tests/adapters/openai/openai-provider-option-e2e.test.ts
@@ -17,6 +17,8 @@ import { homedir, tmpdir } from "node:os";
 import { join, relative } from "node:path";
 
 import { watchdogMs } from "../../helpers/ci-watchdog";
+import { ownedServiceHomeInspection } from "../../helpers/owned-service-home-inspection";
+import { phaseTimer } from "../../helpers/phase-timing";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
 import { repoPath } from "../../helpers/repo-root";
 type Capture = {
@@ -121,6 +123,14 @@ function responsesLifecycle(body: Record<string, unknown>): string {
 
 describe("OpenAI provider-option integration spine", () => {
   test("keeps Pool, Direct, and API ownership stable across transports and management", async () => {
+    // Instrumented for #4997. This case missed its own 30s bound by 29ms in one control run and
+    // by 1.8s in another, and passes in the sharded lanes that run the same file, so the question
+    // is which part grew rather than whether the whole is too slow. The segments separate fixture
+    // setup, the server bind, the ownership assertions that are the actual contract, the migration
+    // child, and teardown including the reap. `captures` counts upstream requests this case has
+    // observed, which is the monotonic signal that tells a slow transport apart from a stalled one.
+    const timing = phaseTimer("openai provider-option ownership spine", () => captures.length);
+    timing.split("prepare");
     const root = mkdtempSync(join(tmpdir(), "ocx-provider-option-e2e-"));
     const opencodexHome = join(root, "opencodex");
     const codexHome = join(root, "codex");
@@ -141,6 +151,11 @@ describe("OpenAI provider-option integration spine", () => {
     let principalSeamCalls = 0;
     let loopbackOrigin: string | null = null;
     let server: { url: URL; stop(closeActiveConnections?: boolean): Promise<void> } | null = null;
+    // Hoisted so the outer finally can release them on the failure path too. Both used to be
+    // reachable only from the success path, so a case that threw mid-spine left a live socket and
+    // an unreaped child behind in a process that still had hundreds of files to run.
+    let openWebSocket: { close(): void } | null = null;
+    let migrationChild: { kill(): void; exited: Promise<number> } | null = null;
 
     const loopbackTuples = new Set([
       "GET /healthz",
@@ -350,8 +365,18 @@ describe("OpenAI provider-option integration spine", () => {
       expect(deriveModule.deriveProviderPresets().map(entry => entry.id)).not.toContain("openai-multi");
       expect(sidecar.listOpenAiForwardSidecarCandidates(config).map(row => row.providerName)).toEqual(["openai"]);
 
-      server = serverModule.startServer(0);
+      timing.split("server-start");
+      // Without this seam startup asks the host's real service manager who owns these homes, which
+      // on macOS means up to four synchronous `launchctl print` children across two domains, each
+      // carrying a two-second subprocess budget (src/service-manager-probe.ts). That is machine
+      // interrogation, not provider-option ownership, and it lands inside a 30s bound this case
+      // missed by 29ms. The verdict is unchanged: `owned` means no persistent service claim was
+      // observed, which is what a runner with no installed service reports anyway.
+      server = serverModule.startServer(0, {
+        inspectNativeCodexOwnership: ownedServiceHomeInspection("provider-option spine fixture"),
+      });
       loopbackOrigin = new URL(server.url).origin;
+      timing.split("execute");
       const local = (path: string, init?: RequestInit) => fetch(new URL(path, server!.url), init);
       const post = (path: string, body: unknown, headers: HeadersInit = {}) => local(path, {
         method: "POST",
@@ -405,13 +430,19 @@ describe("OpenAI provider-option integration spine", () => {
       const ws = new savedWebSocket(expectedWsUrl, {
         headers: { authorization: "Bearer fixture-caller-main" },
       } as unknown as string[]);
+      openWebSocket = ws;
       await new Promise<void>((resolve, reject) => {
         ws.addEventListener("open", () => resolve(), { once: true });
         ws.addEventListener("error", () => reject(new Error("fixture websocket failed to open")), { once: true });
       });
       const wsTurn = (model: string) => new Promise<Capture>((resolve, reject) => {
         const before = captures.length;
-        const timer = setTimeout(() => reject(new Error(`fixture websocket timeout: ${model}`)), watchdogMs(2_000));
+        // Detaching on the timeout matters as much as rejecting: a turn that gives up while still
+        // subscribed leaves a listener that can resolve a later turn's capture count.
+        const timer = setTimeout(() => {
+          ws.removeEventListener("message", onMessage);
+          reject(new Error(`fixture websocket timeout: ${model}`));
+        }, watchdogMs(2_000));
         const onMessage = (event: MessageEvent) => {
           if (!String(event.data).includes('"type":"response.completed"')) return;
           clearTimeout(timer);
@@ -533,6 +564,7 @@ describe("OpenAI provider-option integration spine", () => {
       const closed = new Promise<void>(resolve => ws.addEventListener("close", () => resolve(), { once: true }));
       ws.close();
       await closed;
+      openWebSocket = null;
 
       const selected = "openai-apikey/gpt-5.6-sol-pro";
       expect((await put("/api/disabled-models", { models: [selected] })).status).toBe(200);
@@ -574,6 +606,7 @@ describe("OpenAI provider-option integration spine", () => {
       ]) expect(usageLines.some(row => Object.entries(expected).every(([key, value]) => row[key] === value))).toBe(true);
 
       const migrationRoot = mkdtempSync(join(tmpdir(), "ocx-provider-option-migration-"));
+      timing.split("migration-child");
       try {
         const child = Bun.spawn([
           process.execPath,
@@ -581,6 +614,7 @@ describe("OpenAI provider-option integration spine", () => {
           join(migrationRoot, "opencodex"),
           join(migrationRoot, "codex"),
         ], { stdout: "pipe", stderr: "pipe", env: { ...process.env } });
+        migrationChild = child;
         const [stdout, stderr, exitCode] = await Promise.all([
           new Response(child.stdout).text(),
           new Response(child.stderr).text(),
@@ -621,8 +655,16 @@ describe("OpenAI provider-option integration spine", () => {
           expect(receipt.principalSeamCalls).toBeGreaterThan(0);
         }
       } finally {
+        // Reap before the tree goes: a child still holding a descriptor under migrationRoot turns
+        // removal into a retry loop, and an orphan survives into whatever file runs next.
+        if (migrationChild !== null) {
+          migrationChild.kill();
+          await migrationChild.exited;
+          migrationChild = null;
+        }
         removeTreeWithRetry(migrationRoot);
       }
+      timing.split("execute-tail");
 
       expect(new Set(blockedUpstreamWebSocketUrls)).toEqual(new Set([
         "wss://chatgpt.com/backend-api/codex/responses",
@@ -651,7 +693,13 @@ describe("OpenAI provider-option integration spine", () => {
         }, null, 2) + "\n", { mode: 0o600 });
       }
     } finally {
+      timing.split("teardown");
       try {
+        try { openWebSocket?.close(); } catch { /* already closed or never opened */ }
+        if (migrationChild !== null) {
+          migrationChild.kill();
+          await migrationChild.exited;
+        }
         if (server) await server.stop(true);
       } finally {
         globalThis.fetch = savedFetch;
@@ -663,6 +711,7 @@ describe("OpenAI provider-option integration spine", () => {
         removeTreeWithRetry(root);
         expect(hashTree(realClaudeDir)).toBe(realClaudeHashBefore);
       }
+      timing.end();
     }
   }, 30_000);
 });
diff --git a/tests/adapters/terminal-continuation-owner-rotation.test.ts b/tests/adapters/terminal-continuation-owner-rotation.test.ts
index 458f8237b61..69ce097aca4 100644
--- a/tests/adapters/terminal-continuation-owner-rotation.test.ts
+++ b/tests/adapters/terminal-continuation-owner-rotation.test.ts
@@ -16,6 +16,7 @@ import type {
   OcxParsedRequest,
   OcxProviderConfig,
 } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 interface BuildObservation {
@@ -110,18 +111,24 @@ describe("terminal continuation provider-owner rotation", () => {
   let originalFetch: typeof fetch;
   let previousHome: string | undefined;
   let testHome = "";
+  let releaseSpendHome: (() => void) | undefined;
 
   beforeEach(() => {
     originalFetch = globalThis.fetch;
     previousHome = process.env.OPENCODEX_HOME;
     testHome = mkdtempSync(join(tmpdir(), "ocx-terminal-owner-"));
     process.env.OPENCODEX_HOME = testHome;
+    // Take the writer lease after this case installs its home so direct handler dispatch can open the spend journal.
+    releaseSpendHome = acquireOwnedSpendHome();
     builds = [];
     clearKeyCooldowns();
     clearResponseStateForTests();
   });
 
   afterEach(() => {
+    // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
     if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
     else process.env.OPENCODEX_HOME = previousHome;
diff --git a/tests/ci-workflows/cold-spawn-warmup.test.ts b/tests/ci-workflows/cold-spawn-warmup.test.ts
index 1cd9a933de3..7e969d8cf2a 100644
--- a/tests/ci-workflows/cold-spawn-warmup.test.ts
+++ b/tests/ci-workflows/cold-spawn-warmup.test.ts
@@ -11,9 +11,14 @@ import {
 } from "../helpers/cold-spawn-warmup";
 import { repoPath, repoRoot } from "../helpers/repo-root";
 import { SPAWN_BUDGET_MS } from "../helpers/test-budget";
+import {
+  analyzeWarmupRegistration,
+  dispositionComplaints,
+  type WarmupDisposition,
+} from "../helpers/warmup-registration";
 
 /**
- * Two things are checked here, and they answer different questions.
+ * Three things are checked here, and they answer different questions.
  *
  * The scan answers "did anyone add another one". A test that hands `INTERNAL_DEADLINE_MS` to a child
  * process timeout is measuring that child's cold module-graph load inside the assertion, which is
@@ -22,6 +27,17 @@ import { SPAWN_BUDGET_MS } from "../helpers/test-budget";
  * appear below with a disposition, so the next one is classified when it lands rather than after it
  * fails on a Windows shard.
  *
+ * The dispositions answer "is the file recorded as warmed still warmed". That used to be a
+ * substring test for the helper's path, which #5060 showed accepts an unused import, a comment or a
+ * string literal as proof — each of them survives deleting the beforeAll call that did the work, so
+ * the measured child pays the cold load again with a green guard in front of it.
+ * tests/helpers/warmup-registration.ts replaces the substring with a judge that recognises four
+ * shapes exactly and refuses every other construct by name; its own regression set is
+ * tests/ci-workflows/warmup-registration.test.ts. A refused shape is not a blocked file: a
+ * disposition records the construct in `unmodeled` and the refusal itself stays under test. The
+ * judge reads shape, not execution — the execution oracle is the [cold-spawn-warmup] completion
+ * line the helper prints on every hosted run.
+ *
  * The unit tests answer "does the warm-up still warm the right thing". A warm-up that names its
  * modules by hand decays silently, so `moduleGraphSpecifiers` derives them from the child's own
  * source instead. These cases pin the properties that makes that derivation trustworthy: it follows
@@ -29,7 +45,7 @@ import { SPAWN_BUDGET_MS } from "../helpers/test-budget";
  * it fails closed when it finds nothing.
  */
 
-type Disposition = Readonly<{ warmed: boolean; why: string }>;
+type Disposition = WarmupDisposition;
 
 /**
  * Every test file that bounds a spawned child with `INTERNAL_DEADLINE_MS`.
@@ -99,24 +115,30 @@ function filesBoundingASpawnWithTheDeadline(): string[] {
     .sort();
 }
 
+function judgeWarmup(path: string) {
+  const file = repoPath(path);
+  return analyzeWarmupRegistration(file, readFileSync(file, "utf8"));
+}
+
 describe("cold-spawn warm-up coverage", () => {
   test("every file that times a spawned child against the deadline has a disposition", () => {
     expect(filesBoundingASpawnWithTheDeadline()).toEqual(Object.keys(DISPOSITIONS).sort());
   });
 
-  test("a file recorded as warmed consumes the shared warm-up", () => {
-    const missing = Object.entries(DISPOSITIONS)
-      .filter(([, disposition]) => disposition.warmed)
-      .filter(([path]) => !readFileSync(repoPath(path), "utf8").includes("helpers/cold-spawn-warmup"))
-      .map(([path]) => path);
-    expect(missing).toEqual([]);
+  test("every disposition still describes the file it is recorded against", () => {
+    // Warmed means one of the four accepted shapes is here and nothing on the binding path was
+    // refused; unwarmed means the file does not reach the helper at all, which is asked of the
+    // whole file rather than of its bindings, because a namespace import or a barrel binds no name
+    // this judge follows and would otherwise read as an absence.
+    const wrong = Object.entries(DISPOSITIONS)
+      .flatMap(([path, disposition]) => dispositionComplaints(path, disposition, judgeWarmup(path)));
+    expect(wrong).toEqual([]);
   });
 
-  test("a file recorded as unwarmed says why, and does not quietly become warmed", () => {
+  test("anything other than a plainly warmed file says why, at length", () => {
     for (const [path, disposition] of Object.entries(DISPOSITIONS)) {
-      if (disposition.warmed) continue;
-      expect(disposition.why.length).toBeGreaterThan(80);
-      expect(readFileSync(repoPath(path), "utf8")).not.toInclude("helpers/cold-spawn-warmup");
+      if (disposition.warmed && disposition.unmodeled === undefined) continue;
+      expect({ path, reason: disposition.why.length > 80 }).toEqual({ path, reason: true });
     }
   });
 });
diff --git a/tests/ci-workflows/docs-provider-preset-counts.test.ts b/tests/ci-workflows/docs-provider-preset-counts.test.ts
new file mode 100644
index 00000000000..a849660065b
--- /dev/null
+++ b/tests/ci-workflows/docs-provider-preset-counts.test.ts
@@ -0,0 +1,89 @@
+/**
+ * The preset totals in the docs must be recounted from the registry, not restated by hand.
+ *
+ * Eight pages carry the number and seven of them are translations, so a preset landing in the
+ * registry updates the English guide and silently leaves the rest behind. That is exactly what
+ * happened: the English guide reached 95 (79 key-based) while ja, ko, fr, ru, tr, zh-CN and
+ * zh-TW — and every quickstart including the English one — still said 94 (78 key-based). Nothing
+ * failed, because both numbers read as plausible and no check compared them to the registry.
+ *
+ * AGENTS.md calls this class out directly: prefer deriving a count from the thing it describes
+ * over restating it. The counts here are derived from PROVIDER_REGISTRY, so the next preset that
+ * lands fails this test in every locale at once instead of drifting.
+ *
+ * Each page is anchored by a locale-specific fragment rather than a number, so a reworded
+ * sentence fails loudly and asks to be re-anchored. That is the intended behavior: a sentence
+ * nobody can locate is a sentence nobody is checking.
+ */
+import { describe, expect, test } from "bun:test";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { repoPath } from "../helpers/repo-root";
+
+const TOTAL = PROVIDER_REGISTRY.length;
+const KEY_PRESETS = PROVIDER_REGISTRY.filter(entry => entry.authKind === "key").length;
+
+/** Guides state the total and the key-based split on one line. */
+const GUIDES = [
+  { locale: "en", path: "docs-site/src/content/docs/guides/providers.md", anchor: "opencodex ships" },
+  { locale: "ja", path: "docs-site/src/content/docs/ja/guides/providers.md", anchor: "組み込みプリセットが" },
+  { locale: "ko", path: "docs-site/src/content/docs/ko/guides/providers.md", anchor: "빌트인 프리셋이" },
+  { locale: "fr", path: "docs-site/src/content/docs/fr/guides/providers.md", anchor: "préréglages intégrés" },
+  { locale: "ru", path: "docs-site/src/content/docs/ru/guides/providers.md", anchor: "встроенными пресетами" },
+  { locale: "tr", path: "docs-site/src/content/docs/tr/guides/providers.md", anchor: "yerleşik önayar ile" },
+  { locale: "zh-cn", path: "docs-site/src/content/docs/zh-cn/guides/providers.md", anchor: "个密钥预设" },
+  { locale: "zh-tw", path: "docs-site/src/content/docs/zh-tw/guides/providers.md", anchor: "個 key-based" },
+] as const;
+
+/** Quickstarts state the total only. */
+const QUICKSTARTS = [
+  { locale: "en", path: "docs-site/src/content/docs/getting-started/quickstart.md", anchor: "built-in registry presets" },
+  { locale: "ja", path: "docs-site/src/content/docs/ja/getting-started/quickstart.md", anchor: "組み込みレジストリプリセット" },
+  { locale: "ko", path: "docs-site/src/content/docs/ko/getting-started/quickstart.md", anchor: "내장 레지스트리 프리셋" },
+  { locale: "fr", path: "docs-site/src/content/docs/fr/getting-started/quickstart.md", anchor: "préréglages intégrés au registre" },
+  { locale: "ru", path: "docs-site/src/content/docs/ru/getting-started/quickstart.md", anchor: "встроенных пресетов реестра" },
+  { locale: "tr", path: "docs-site/src/content/docs/tr/getting-started/quickstart.md", anchor: "önayardan birini" },
+  { locale: "zh-cn", path: "docs-site/src/content/docs/zh-cn/getting-started/quickstart.md", anchor: "个预设中选择一个" },
+  { locale: "zh-tw", path: "docs-site/src/content/docs/zh-tw/getting-started/quickstart.md", anchor: "個預設中選擇一個" },
+] as const;
+
+const STRUCTURE = {
+  path: "structure/ops/docs-and-release.md",
+  anchor: "documented split is",
+} as const;
+
+async function anchoredLine(path: string, anchor: string): Promise<string> {
+  const source = await Bun.file(repoPath(path)).text();
+  const lines = source.split("\n").filter(line => line.includes(anchor));
+  expect(lines.length, `${path} has no line containing "${anchor}"; re-anchor this check`).toBe(1);
+  return lines[0]!;
+}
+
+describe("documented provider preset counts match the registry", () => {
+  test("the registry is the only source of the numbers under test", () => {
+    // A derived count that collapsed to zero would make every assertion below vacuous.
+    expect(TOTAL).toBeGreaterThan(0);
+    expect(KEY_PRESETS).toBeGreaterThan(0);
+    expect(KEY_PRESETS).toBeLessThanOrEqual(TOTAL);
+  });
+
+  for (const guide of GUIDES) {
+    test(`${guide.locale} provider guide states ${TOTAL} presets and ${KEY_PRESETS} key-based`, async () => {
+      const line = await anchoredLine(guide.path, guide.anchor);
+      expect(line, `${guide.path} total`).toContain(String(TOTAL));
+      expect(line, `${guide.path} key-based split`).toContain(String(KEY_PRESETS));
+    });
+  }
+
+  for (const quickstart of QUICKSTARTS) {
+    test(`${quickstart.locale} quickstart states ${TOTAL} presets`, async () => {
+      const line = await anchoredLine(quickstart.path, quickstart.anchor);
+      expect(line, `${quickstart.path} total`).toContain(String(TOTAL));
+    });
+  }
+
+  test("the structure ops record carries the same split", async () => {
+    const line = await anchoredLine(STRUCTURE.path, STRUCTURE.anchor);
+    expect(line).toContain(String(TOTAL));
+    expect(line).toContain(String(KEY_PRESETS));
+  });
+});
diff --git a/tests/ci-workflows/structure-ssot.test.ts b/tests/ci-workflows/structure-ssot.test.ts
index 4783842bca1..6f3d3c7de5a 100644
--- a/tests/ci-workflows/structure-ssot.test.ts
+++ b/tests/ci-workflows/structure-ssot.test.ts
@@ -1,8 +1,8 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
-import { loadManifest, renderIndex, runStructureChecks, type Manifest } from "../../scripts/structure-ssot";
+import { loadManifest, renderIndex, runStructureChecks, writeGeneratedIndex, type Manifest } from "../../scripts/structure-ssot";
 import { repoRoot } from "../helpers/repo-root";
 
 /**
@@ -82,6 +82,30 @@ function scaffold(): string {
   return root;
 }
 
+/** Add one valid authority and a second doc that preserves many-to-many source review. */
+function contractScaffold(): string {
+  const root = scaffold();
+  const manifest = manifestOf(root);
+  manifest.docs.push({ path: "second.md", tier: 1, title: "Second", scope: "second scope", documents: ["src/alpha/"] });
+  manifest.contracts = {
+    version: 1,
+    entries: [
+      {
+        id: "alpha-contract",
+        owner: { document: "overview.md", anchor: "non-negotiable-invariants" },
+        dependents: ["second.md"],
+      },
+    ],
+  };
+  write(
+    root,
+    "structure/second.md",
+    "# Second\n\nAlpha uses " + BT + "src/alpha/keep.ts" + BT + ".\n\nSee the [alpha contract](overview.md#non-negotiable-invariants).\n",
+  );
+  saveManifest(root, manifest);
+  return root;
+}
+
 const fires = (root: string, needle: string): void => {
   expect(runStructureChecks(root).join("\n")).toContain(needle);
 };
@@ -111,6 +135,12 @@ describe("structure/ SSOT", () => {
     expect(runStructureChecks(scaffold())).toEqual([]);
   });
 
+  test("contracts are optional", () => {
+    const root = scaffold();
+    expect(manifestOf(root).contracts).toBeUndefined();
+    expect(runStructureChecks(root)).toEqual([]);
+  });
+
   test("a doc on disk that the manifest does not list", () => {
     const root = scaffold();
     write(root, "structure/orphan.md", "# Orphan\n");
@@ -329,6 +359,140 @@ describe("structure/ SSOT", () => {
     expect(runStructureChecks(root)).toEqual([]);
   });
 
+  test("contract manifest shapes fail with actionable errors", () => {
+    const valid = manifestOf(scaffold());
+    const cases: [unknown, string][] = [
+      [[], "contracts must be an object"],
+      [{ version: 2, entries: [] }, "contracts.version must be 1"],
+      [{ version: 1, entries: {} }, "contracts.entries must be an array"],
+      [{ version: 1, entries: [{ id: "Not Kebab", owner: {}, dependents: [] }] }, "id must be a kebab-case string"],
+      [{ version: 1, entries: [{ id: "valid-id", owner: null, dependents: [] }] }, "owner must be an object"],
+      [{ version: 1, entries: [{ id: "valid-id", owner: { document: 1, anchor: 2 }, dependents: [] }] }, "owner.document must be a string"],
+      [{ version: 1, entries: [{ id: "valid-id", owner: { document: "overview.md", anchor: "overview" }, dependents: {} }] }, "dependents must be an array"],
+      [{ version: 1, entries: [{ id: "valid-id", owner: { document: "overview.md", anchor: "overview" }, dependents: [1] }] }, "dependents[0] must be a string"],
+    ];
+    for (const [contracts, needle] of cases) {
+      const loaded = loadManifest(JSON.stringify({ ...valid, contracts }));
+      expect(loaded).toHaveProperty("error");
+      expect((loaded as { error: string }).error).toContain(needle);
+    }
+  });
+
+  test("duplicate contract ids are rejected", () => {
+    const root = contractScaffold();
+    const manifest = manifestOf(root);
+    manifest.contracts!.entries.push({
+      id: "alpha-contract",
+      owner: { document: "overview.md", anchor: "non-negotiable-invariants" },
+      dependents: [],
+    });
+    saveManifest(root, manifest);
+    fires(root, "contract alpha-contract is declared twice");
+  });
+
+  test("contract owners must be declared files with real anchors", () => {
+    const undeclared = contractScaffold();
+    const undeclaredManifest = manifestOf(undeclared);
+    undeclaredManifest.contracts!.entries[0]!.owner.document = "ghost.md";
+    saveManifest(undeclared, undeclaredManifest);
+    fires(undeclared, "owner ghost.md is not a declared structure document");
+
+    const missing = contractScaffold();
+    const missingManifest = manifestOf(missing);
+    missingManifest.docs.push({ path: "ghost.md", tier: 1, title: "Ghost", scope: "ghost", documents: [] });
+    missingManifest.contracts!.entries[0]!.owner.document = "ghost.md";
+    saveManifest(missing, missingManifest);
+    fires(missing, "owner structure/ghost.md is missing");
+
+    const anchor = contractScaffold();
+    const anchorManifest = manifestOf(anchor);
+    anchorManifest.contracts!.entries[0]!.owner.anchor = "missing-heading";
+    saveManifest(anchor, anchorManifest);
+    fires(anchor, "owner structure/overview.md has no #missing-heading heading anchor");
+  });
+
+  test("contract dependents must be unique declared files distinct from the owner", () => {
+    const duplicate = contractScaffold();
+    const duplicateManifest = manifestOf(duplicate);
+    duplicateManifest.contracts!.entries[0]!.dependents.push("second.md");
+    saveManifest(duplicate, duplicateManifest);
+    fires(duplicate, "lists dependent second.md twice");
+
+    const owner = contractScaffold();
+    const ownerManifest = manifestOf(owner);
+    ownerManifest.contracts!.entries[0]!.dependents = ["overview.md"];
+    saveManifest(owner, ownerManifest);
+    fires(owner, "lists its owner overview.md as a dependent");
+
+    const undeclared = contractScaffold();
+    const undeclaredManifest = manifestOf(undeclared);
+    undeclaredManifest.contracts!.entries[0]!.dependents = ["ghost.md"];
+    saveManifest(undeclared, undeclaredManifest);
+    fires(undeclared, "dependent ghost.md is not a declared structure document");
+
+    const missing = contractScaffold();
+    const missingManifest = manifestOf(missing);
+    missingManifest.docs.push({ path: "ghost.md", tier: 1, title: "Ghost", scope: "ghost", documents: [] });
+    missingManifest.contracts!.entries[0]!.dependents = ["ghost.md"];
+    saveManifest(missing, missingManifest);
+    fires(missing, "dependent structure/ghost.md is missing");
+  });
+
+  test("a contract dependent must link the exact owner anchor", () => {
+    const root = contractScaffold();
+    write(root, "structure/second.md", "# Second\n\nAlpha uses " + BT + "src/alpha/keep.ts" + BT + ".\n\nSee [Overview](overview.md).\n");
+    fires(root, "dependent structure/second.md does not link overview.md#non-negotiable-invariants");
+  });
+
+  test("a valid contract keeps many-to-many source review", () => {
+    const root = contractScaffold();
+    expect(runStructureChecks(root)).toEqual([]);
+    expect(renderIndex(manifestOf(root))).toContain(
+      "| " + BT + "src/alpha/" + BT + " | [" + BT + "overview.md" + BT + "](overview.md)<br>[" + BT + "second.md" + BT + "](second.md) |",
+    );
+  });
+
+  test("contract navigation has deterministic ordering and placement", () => {
+    const root = contractScaffold();
+    const manifest = manifestOf(root);
+    manifest.docs.push({ path: "third.md", tier: 1, title: "Third", scope: "third scope", documents: [] });
+    manifest.contracts!.entries = [
+      {
+        id: "zeta-contract",
+        owner: { document: "overview.md", anchor: "non-negotiable-invariants" },
+        dependents: [],
+      },
+      {
+        id: "alpha-contract",
+        owner: { document: "overview.md", anchor: "non-negotiable-invariants" },
+        dependents: ["third.md", "second.md"],
+      },
+    ];
+    const rendered = renderIndex(manifest);
+    const contracts = rendered.indexOf("## Cross-cutting contracts");
+    const decisions = rendered.indexOf("## Decision records");
+    const alpha = rendered.indexOf("| " + BT + "alpha-contract" + BT + " |");
+    const zeta = rendered.indexOf("| " + BT + "zeta-contract" + BT + " |");
+    expect(contracts).toBeGreaterThan(rendered.indexOf("### Not described by any doc"));
+    expect(decisions).toBeGreaterThan(contracts);
+    expect(alpha).toBeGreaterThan(contracts);
+    expect(zeta).toBeGreaterThan(alpha);
+    expect(rendered.slice(alpha, zeta)).toContain(
+      "[" + BT + "second.md" + BT + "](second.md)<br>[" + BT + "third.md" + BT + "](third.md)",
+    );
+    expect(rendered).toContain(
+      "[" + BT + "overview.md#non-negotiable-invariants" + BT + "](overview.md#non-negotiable-invariants)",
+    );
+    expect(rendered.slice(zeta, decisions)).toContain("| — |");
+  });
+
+  test("contract checks validate topology rather than owner prose", () => {
+    const root = contractScaffold();
+    const owner = readFileSync(join(root, "structure/overview.md"), "utf8").replace("alpha keeps working", "alpha remains available");
+    write(root, "structure/overview.md", owner);
+    expect(runStructureChecks(root)).toEqual([]);
+  });
+
   test("a malformed manifest is an actionable failure, not a stack trace", () => {
     expect(loadManifest("{not json")).toHaveProperty("error");
     const shapeless = loadManifest(JSON.stringify({ sizeBudgetLines: 600 }));
@@ -401,4 +565,71 @@ describe("structure/ SSOT", () => {
     write(root, "structure/manifest.json", JSON.stringify(manifest, null, 2) + "\n");
     fires(root, "absentPaths[0].path must be a string");
   });
+
+  test("index generation validates the manifest before writing", () => {
+    const root = scaffold();
+    const before = readFileSync(join(root, "structure/INDEX.md"), "utf8");
+    const manifest = manifestOf(root) as unknown as { contracts: unknown };
+    manifest.contracts = { version: 1, entries: "not-an-array" };
+    write(root, "structure/manifest.json", JSON.stringify(manifest, null, 2) + "\n");
+    const result = writeGeneratedIndex(root);
+    expect(result).toHaveProperty("error");
+    expect((result as { error: string }).error).toContain("contracts.entries must be an array");
+    expect(readFileSync(join(root, "structure/INDEX.md"), "utf8")).toBe(before);
+  });
+
+  test("index generation rejects a malformed contract entry without a renderer crash", () => {
+    const root = scaffold();
+    const before = readFileSync(join(root, "structure/INDEX.md"), "utf8");
+    const manifest = manifestOf(root) as unknown as { contracts: unknown };
+    // A bare string entry used to reach the renderer's id comparator and throw a TypeError.
+    manifest.contracts = { version: 1, entries: ["oops"] };
+    write(root, "structure/manifest.json", JSON.stringify(manifest, null, 2) + "\n");
+    const result = writeGeneratedIndex(root);
+    expect(result).toHaveProperty("error");
+    expect((result as { error: string }).error).toContain("id must be a kebab-case string");
+    expect(readFileSync(join(root, "structure/INDEX.md"), "utf8")).toBe(before);
+  });
+
+  // The seam-level tests above prove the helper; these two drive the real CLI tail, which is
+  // where the original bug lived (parse + cast + render before validation). The script is
+  // copied into the scaffold so its import.meta.dir resolves to the synthetic root.
+  function scaffoldCli(root: string): void {
+    mkdirSync(join(root, "scripts"), { recursive: true });
+    copyFileSync(join(repoRoot(), "scripts/structure-ssot.ts"), join(root, "scripts/structure-ssot.ts"));
+  }
+
+  test("CLI --fix fails malformed contracts with a named diagnostic and an unchanged index", () => {
+    const root = scaffold();
+    scaffoldCli(root);
+    const before = readFileSync(join(root, "structure/INDEX.md"), "utf8");
+    const manifest = manifestOf(root) as unknown as { contracts: unknown };
+    manifest.contracts = { version: 1, entries: "not-an-array" };
+    write(root, "structure/manifest.json", JSON.stringify(manifest, null, 2) + "\n");
+    const result = Bun.spawnSync([process.execPath, "scripts/structure-ssot.ts", "--fix"], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(result.exitCode).not.toBe(0);
+    const stderr = result.stderr.toString();
+    expect(stderr).toContain("contracts.entries must be an array");
+    expect(stderr).not.toContain("TypeError");
+    expect(readFileSync(join(root, "structure/INDEX.md"), "utf8")).toBe(before);
+  });
+
+  test("CLI --fix regenerates a stale index for a valid manifest", () => {
+    const root = scaffold();
+    scaffoldCli(root);
+    write(root, "structure/INDEX.md", "# stale\n");
+    const result = Bun.spawnSync([process.execPath, "scripts/structure-ssot.ts", "--fix"], {
+      cwd: root,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    expect(result.exitCode).toBe(0);
+    const regenerated = readFileSync(join(root, "structure/INDEX.md"), "utf8");
+    expect(regenerated).not.toBe("# stale\n");
+    expect(regenerated).toBe(renderIndex(manifestOf(root)));
+  });
 });
diff --git a/tests/ci-workflows/test-runner.test.ts b/tests/ci-workflows/test-runner.test.ts
index a40a989ffe6..9ac74058420 100644
--- a/tests/ci-workflows/test-runner.test.ts
+++ b/tests/ci-workflows/test-runner.test.ts
@@ -26,7 +26,10 @@ import {
   selectChangedComparisonRef,
   SERIAL_FULL_SUITE_FILES,
 } from "../../scripts/test";
-import { repoPath, repoRoot } from "../helpers/repo-root";
+import {
+  NESTED_LIVE_LOCK_RECEIPT_KEY,
+} from "../helpers/nested-test-run-lock-controller";
+import { helperPath, repoPath, repoRoot } from "../helpers/repo-root";
 import {
   acquireTestRunLock,
   resolveBareTestRunIdentity,
@@ -1059,53 +1062,76 @@ describe("bun test user lock", () => {
     expect(resolveCalls).toBe(0);
   });
 
-  test.if(process.platform === "win32" && process.env[TEST_RUN_NO_QUEUE_ENV] !== "1")(
-    "nested Windows Bun tests inherit the acquired live lock and refuse an incomplete capability",
+  // Windows-only, and deliberately no longer gated on the no-queue opt-out. The hosted
+  // batch leg sets OCX_TEST_NO_QUEUE=1 for its own six-file processes, which skipped this
+  // case on the only platform it covers (#4991). The controller below holds a lock in its
+  // own right rather than borrowing the lane's, so the regression now runs either way.
+  //
+  // Two deadlines, not one. The controller is told to finish 10s before the hard kill so
+  // it always reaches its own teardown — releasing the lock and confirming its children
+  // were reaped — instead of being terminated inside a spawn with the lock still held.
+  // The spawnSync timeout stays the backstop for a controller that ignores its deadline.
+  //
+  // The nominal per-child timeout is declared here rather than inside the helper, so the
+  // deadline that bounds four cold Bun starts stays with the case that owns them and
+  // tests/ci-workflows/cold-spawn-warmup.test.ts keeps seeing this file. The controller
+  // narrows it to whatever its own deadline still allows.
+  test.if(process.platform === "win32")(
+    "a nested Windows Bun test inherits the live lock its controller holds and refuses an incomplete capability",
     () => {
-      const root = mkdtempSync(join(tmpdir(), "opencodex-nested-test-"));
+      const root = mkdtempSync(join(tmpdir(), "opencodex-nested-lock-"));
+      const controllerBudgetMs = SPAWN_BUDGET_MS - 10_000;
+      const childSpawn = { timeout: INTERNAL_DEADLINE_MS };
+      const environmentBefore = JSON.stringify({
+        noQueue: process.env[TEST_RUN_NO_QUEUE_ENV],
+        runId: process.env[TEST_RUN_ID_ENV],
+        lockPath: process.env[TEST_RUN_LOCK_PATH_ENV],
+        // Presence only. The token is never rendered, here or by the controller.
+        hasToken: process.env[TEST_RUN_LOCK_TOKEN_ENV] !== undefined,
+      });
       try {
-        const lockPath = process.env[TEST_RUN_LOCK_PATH_ENV];
-        expect(Boolean(lockPath && process.env[TEST_RUN_LOCK_TOKEN_ENV] && process.env[TEST_RUN_ID_ENV])).toBe(true);
-        const ownerBefore = readFileSync(join(lockPath!, "owner.json"), "utf8");
-        const fixture = join(root, "nested.test.ts");
-        writeFileSync(fixture, `
-          import { test } from "bun:test";
-          import { readFileSync, existsSync } from "node:fs";
-          import { join } from "node:path";
-          test("nested lock receipt", () => {
-            const path = process.env.OCX_TEST_RUN_LOCK_PATH;
-            const owner = JSON.parse(readFileSync(join(path, "owner.json"), "utf8"));
-            console.log(JSON.stringify({ nestedLockReceipt: {
-              samePath: path === ${JSON.stringify(lockPath)},
-              sameRun: owner.runId === ${JSON.stringify(process.env[TEST_RUN_ID_ENV])},
-              sameToken: owner.token === process.env.OCX_TEST_RUN_LOCK_TOKEN,
-              member: existsSync(join(path, "members", process.pid + "-" + owner.token)),
-              preloadRan: process.env.OCX_TEST_PRELOAD_PID === String(process.pid),
-              guardArmed: process.env.OCX_TEST_HOME_GUARD === "1",
-            } }));
-          });
-        `);
-        const args = ["test", "--preload", repoPath("tests/preload.ts"), fixture];
-        const child = spawnSync(process.execPath, args, {
-          cwd: root, env: { ...process.env }, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS,
-        });
-        // Keep process diagnostics bounded and never render the owner token or child output.
-        expect(child.status).toBe(0);
-        const marker = child.stdout.split("\n").find(line => line.startsWith('{"nestedLockReceipt":'));
-        expect(marker ? JSON.parse(marker).nestedLockReceipt : null).toEqual({
-          samePath: true, sameRun: true, sameToken: true, member: true, preloadRan: true, guardArmed: true,
-        });
-        expect(readFileSync(join(lockPath!, "owner.json"), "utf8") === ownerBefore).toBe(true);
-
-        const incomplete = { ...process.env };
-        delete incomplete[TEST_RUN_LOCK_TOKEN_ENV];
-        const refused = spawnSync(process.execPath, args, {
-          cwd: root, env: incomplete, encoding: "utf8", timeout: INTERNAL_DEADLINE_MS,
+        // Only the controller's copy loses the opt-out, and its cwd stays outside the
+        // repository so Bun loads no bunfig preload into the lock holder itself.
+        const controllerEnv = { ...process.env };
+        delete controllerEnv[TEST_RUN_NO_QUEUE_ENV];
+        const controller = spawnSync(
+          process.execPath,
+          [
+            helperPath("nested-test-run-lock-controller.ts"),
+            root,
+            String(Date.now() + controllerBudgetMs),
+            JSON.stringify(childSpawn),
+          ],
+          { cwd: root, env: controllerEnv, encoding: "utf8", timeout: SPAWN_BUDGET_MS },
+        );
+        const prefix = '{"' + NESTED_LIVE_LOCK_RECEIPT_KEY + '":';
+        const line = (controller.stdout ?? "").split("\n").find(entry => entry.startsWith(prefix));
+        const payload = line
+          ? JSON.parse(line) as { nestedLiveLockReceipt: Record<string, boolean>; diagnostics: string[] }
+          : null;
+        // Booleans and redacted controller notes only; raw child output never surfaces here.
+        expect(payload?.diagnostics ?? ["the controller printed no receipt"]).toEqual([]);
+        expect(payload?.nestedLiveLockReceipt).toEqual({
+          lockHeld: true,
+          healthyChildExited: true,
+          healthyReceiptComplete: true,
+          missingTokenRefused: true,
+          wrongTokenRefused: true,
+          wrongPathRefused: true,
+          foreignOwnerTimedOut: true,
+          foreignOwnerUntouched: true,
+          ownerContentUnchanged: true,
+          childrenReaped: true,
+          releasedOnlyOwnLock: true,
+          receiptRedacted: true,
         });
-        expect(refused.status).toBe(1);
-        expect(refused.stderr.includes("capability is incomplete")).toBe(true);
-        expect(refused.stdout.includes('{"nestedLockReceipt":')).toBe(false);
-        expect(readFileSync(join(lockPath!, "owner.json"), "utf8") === ownerBefore).toBe(true);
+        expect(controller.status).toBe(0);
+        expect(JSON.stringify({
+          noQueue: process.env[TEST_RUN_NO_QUEUE_ENV],
+          runId: process.env[TEST_RUN_ID_ENV],
+          lockPath: process.env[TEST_RUN_LOCK_PATH_ENV],
+          hasToken: process.env[TEST_RUN_LOCK_TOKEN_ENV] !== undefined,
+        })).toBe(environmentBefore);
       } finally {
         removeTreeWithRetry(root);
       }
diff --git a/tests/ci-workflows/warmup-registration.test.ts b/tests/ci-workflows/warmup-registration.test.ts
new file mode 100644
index 00000000000..2a598c687fa
--- /dev/null
+++ b/tests/ci-workflows/warmup-registration.test.ts
@@ -0,0 +1,349 @@
+import { describe, expect, test } from "bun:test";
+import { repoPath } from "../helpers/repo-root";
+import {
+  analyzeWarmupRegistration,
+  dispositionComplaints,
+  warmupIsRegistered,
+  warmupRegistrationComplaints,
+} from "../helpers/warmup-registration";
+
+/**
+ * The regression set for the invocation oracle in tests/helpers/warmup-registration.ts.
+ *
+ * #5060: the coverage guard accepted the substring "helpers/cold-spawn-warmup" as proof that a file
+ * pays its cold module-graph load in setup, so a comment, a string, or an import left behind after
+ * its call was deleted all passed.
+ *
+ * The judge answers that by recognising four shapes exactly and refusing everything else, so this
+ * file has to pin both halves. The first describe is the accepted grammar - if one of those stops
+ * being accepted, ordinary test files start failing for no reason. The second is the refusals,
+ * which are the point: each one is a construct that either does not warm, or does warm in a way
+ * this judge will not claim to have proved. The third is the disposition contract, which is how a
+ * refusal records a legitimate file instead of blocking it.
+ *
+ * The fixtures are source text, never imported and never run. The fixture path is a real directory
+ * under tests/, so the relative specifier resolves to the real helper module, which is what makes
+ * the same-name-from-another-file case fail rather than pass by spelling.
+ */
+const FIXTURE = repoPath("tests", "ci-workflows", "warmup-registration-fixture.test.ts");
+
+const BUN_TEST = 'import { beforeAll, describe, test } from "bun:test";';
+const HELPER = 'import { warmModuleGraph } from "../helpers/cold-spawn-warmup";';
+
+function judge(...lines: string[]) {
+  return analyzeWarmupRegistration(FIXTURE, lines.join("\n"));
+}
+
+function registers(...lines: string[]): boolean {
+  return warmupIsRegistered(judge(...lines));
+}
+
+function why(...lines: string[]): string {
+  return warmupRegistrationComplaints(judge(...lines)).join(" | ");
+}
+
+/** The registration shape every warmed file in this repository uses today. */
+function hook(...body: string[]): string[] {
+  return [
+    'describe("subject", () => {',
+    "  beforeAll(async () => {",
+    ...body.map(line => "    " + line),
+    "  }, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    '  test("case", () => {});',
+    "});",
+  ];
+}
+
+describe("warm-up judge: the shapes it accepts", () => {
+  test("a describe, a beforeAll, and the warm-up as a whole awaited statement", () => {
+    const report = judge(BUN_TEST, HELPER, ...hook("await warmModuleGraph(options);"));
+    expect(warmupIsRegistered(report)).toBe(true);
+    expect(report.registrations).toEqual([
+      { helper: "warmModuleGraph", local: "warmModuleGraph", shape: "hook-statement", line: 5 },
+    ]);
+  });
+
+  test("the same hook at the top level, with no describe around it", () => {
+    expect(registers(
+      BUN_TEST,
+      HELPER,
+      "beforeAll(async () => {",
+      "  await warmModuleGraph(options);",
+      "}, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    )).toBe(true);
+  });
+
+  test("return and a concise body connect the promise as well as await does", () => {
+    const shapes = (...lines: string[]): string[] =>
+      judge(...lines).registrations.map(entry => entry.shape);
+    expect(shapes(BUN_TEST, HELPER, ...hook("return warmModuleGraph(options);"))).toEqual(["hook-return"]);
+    expect(shapes(BUN_TEST, HELPER, ...hook("return await warmModuleGraph(options);"))).toEqual(["hook-return"]);
+    expect(shapes(
+      BUN_TEST,
+      HELPER,
+      "beforeAll(() => warmModuleGraph(options), COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    )).toEqual(["hook-expression"]);
+    expect(registers(
+      BUN_TEST,
+      HELPER,
+      "beforeAll(async () => await warmModuleGraph(options), COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    )).toBe(true);
+  });
+
+  test("a function expression stands in for the arrow", () => {
+    expect(registers(
+      BUN_TEST,
+      HELPER,
+      "beforeAll(async function () {",
+      "  await warmModuleGraph(options);",
+      "}, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    )).toBe(true);
+  });
+
+  test("an alias is followed, and an optional call is still a call", () => {
+    const aliased = judge(
+      BUN_TEST,
+      'import { warmModuleGraph as warmUp } from "../helpers/cold-spawn-warmup";',
+      ...hook("await warmUp(options);"),
+    );
+    expect(aliased.registrations).toEqual([
+      { helper: "warmModuleGraph", local: "warmUp", shape: "hook-statement", line: 5 },
+    ]);
+    expect(registers(BUN_TEST, HELPER, ...hook("await warmModuleGraph?.(options);"))).toBe(true);
+  });
+
+  test("both entry points are recognised, not only the one most files use", () => {
+    // warmColdSpawn is the replay form, used where an import scan cannot reach the cold cost. If
+    // it fell out of the recognised set, its files would be refused as never calling the helper.
+    const report = judge(
+      BUN_TEST,
+      'import { warmColdSpawn } from "../helpers/cold-spawn-warmup";',
+      ...hook("await warmColdSpawn(graph, replay);"),
+    );
+    expect(report.registrations).toEqual([
+      { helper: "warmColdSpawn", local: "warmColdSpawn", shape: "hook-statement", line: 5 },
+    ]);
+  });
+
+  test("a module-level await is a warm-up the file always pays", () => {
+    // No hook to register: the statement runs when the module loads, which is before any test in
+    // it is timed. It has to be the whole statement, exactly as it does inside a hook.
+    const report = judge(BUN_TEST, HELPER, "await warmModuleGraph(options);");
+    expect(report.registrations.map(entry => entry.shape)).toEqual(["module-top-level"]);
+    expect(registers(BUN_TEST, HELPER, "const warmed = await warmModuleGraph(options);")).toBe(false);
+  });
+
+  test("a template substitution and a regular expression do not derail the token walk", () => {
+    // Both are scanner rescans rather than plain tokens. Read naively, the closing brace of a
+    // substitution leaks an unmatched brace and a regular expression is read as a division that
+    // swallows whatever delimiters sit inside it, and either one moves the rest of the file to a
+    // depth where the hook no longer looks like a hook.
+    expect(registers(BUN_TEST, HELPER, ...hook(
+      "const label = \`graph-\${options.graph}-\${JSON.stringify({ warm: true })}\`;",
+      'const trimmed = label.replace(/[^a-z-]{1,4}/g, "");',
+      "await warmModuleGraph(options);",
+    ))).toBe(true);
+  });
+});
+
+describe("warm-up judge: what it refuses, and says why", () => {
+  test("a comment or a string that names the warm-up binds nothing", () => {
+    // These two are the defect verbatim. Both contain every character the old substring check
+    // looked for, and neither loads a module.
+    const commented = judge(BUN_TEST, ...hook("// await warmModuleGraph(options); helpers/cold-spawn-warmup"));
+    const quoted = judge(BUN_TEST, ...hook('const note = "warmModuleGraph(options) helpers/cold-spawn-warmup";'));
+    expect([warmupIsRegistered(commented), warmupIsRegistered(quoted)]).toEqual([false, false]);
+    expect([commented.bindings, quoted.bindings, commented.mentionsEntryPoint]).toEqual([[], [], false]);
+  });
+
+  test("an import left behind after the call was deleted is not a warm-up", () => {
+    expect(why(BUN_TEST, HELPER, ...hook("const unrelated = 1;"))).toContain("never called");
+  });
+
+  test("a helper reached without a direct named import is refused rather than guessed", () => {
+    // A namespace import and a barrel both warm at run time. Following either one means resolving
+    // a binding through another module, and a judge that guesses there is a judge that can be
+    // wrong in the direction that matters. The disposition table is where such a file is recorded.
+    const namespaced = judge(
+      BUN_TEST,
+      'import * as warmup from "../helpers/cold-spawn-warmup";',
+      ...hook("await warmup.warmModuleGraph(options);"),
+    );
+    expect([warmupIsRegistered(namespaced), namespaced.mentionsEntryPoint]).toEqual([false, true]);
+    expect(warmupRegistrationComplaints(namespaced).join(" ")).toContain("namespace");
+
+    const barrel = judge(
+      BUN_TEST,
+      'import { warmModuleGraph } from "../helpers/test-helpers";',
+      ...hook("await warmModuleGraph(options);"),
+    );
+    expect([warmupIsRegistered(barrel), barrel.mentionsEntryPoint]).toEqual([false, true]);
+    expect(warmupRegistrationComplaints(barrel).join(" ")).toContain("direct named import");
+  });
+
+  test("a type-only import loads nothing, and a local function of the same name is not the import", () => {
+    expect(why(
+      BUN_TEST,
+      'import type { warmModuleGraph } from "../helpers/cold-spawn-warmup";',
+      ...hook("await warmModuleGraph(options);"),
+    )).toContain("type only");
+    expect(registers(
+      BUN_TEST,
+      "async function warmModuleGraph(options) { return options; }",
+      ...hook("await warmModuleGraph(options);"),
+    )).toBe(false);
+  });
+
+  test("a hook the file never reaches registers nothing", () => {
+    // Each of these calls beforeAll with a correct, awaited warm-up, and none of them runs: one
+    // sits in a helper nobody calls, one behind a false condition, and one inside an
+    // expression-bodied callback, which has no braces to give the scope away.
+    const uncalled = judge(BUN_TEST, HELPER,
+      "function installWarmUp() {",
+      "  beforeAll(async () => {",
+      "    await warmModuleGraph(options);",
+      "  }, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+      "}");
+    const guarded = judge(BUN_TEST, HELPER,
+      "if (false) {",
+      "  beforeAll(async () => {",
+      "    await warmModuleGraph(options);",
+      "  }, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+      "}");
+    const expressionBodied = judge(BUN_TEST, HELPER,
+      "register(() => beforeAll(async () => {",
+      "  await warmModuleGraph(options);",
+      "}));");
+    expect([uncalled, guarded, expressionBodied].map(warmupIsRegistered)).toEqual([false, false, false]);
+    expect(warmupRegistrationComplaints(expressionBodied).join(" ")).toContain("does not model");
+  });
+
+  test("a suite that is not a plain describe statement does not make its hooks run", () => {
+    // A suite reached through a member - describe.each here, and describe.skip or describe.only by
+    // the same path - is a callee this judge cannot claim runs, and a describe behind a false
+    // condition is never called at all. Both leave a correctly written beforeAll inside a suite
+    // that is not there, which is a registration in shape only.
+    const member = judge(BUN_TEST, HELPER,
+      'describe.each([1, 2])("subject %s", () => {',
+      "  beforeAll(async () => {",
+      "    await warmModuleGraph(options);",
+      "  }, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+      "});");
+    const guardedSuite = judge(BUN_TEST, HELPER,
+      'if (false) describe("subject", () => {',
+      "  beforeAll(async () => {",
+      "    await warmModuleGraph(options);",
+      "  }, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+      "});");
+    expect([member, guardedSuite].map(warmupIsRegistered)).toEqual([false, false]);
+    expect(warmupRegistrationComplaints(guardedSuite).join(" ")).toContain("plain statement");
+  });
+
+  test("an expression-bodied arrow is a scope, so a warm-up inside an uncalled one is refused", () => {
+    expect(registers(BUN_TEST, HELPER, "const warmUp = async () => await warmModuleGraph(options);"))
+      .toBe(false);
+    expect(registers(BUN_TEST, HELPER, "const warmUp = () => warmModuleGraph(options);")).toBe(false);
+  });
+
+  test("a rebound beforeAll or describe is not the bun:test one", () => {
+    // The shadowed hook takes a correct callback and runs nothing at all. Provenance has to hold
+    // for the hook name exactly as it does for the warm-up name.
+    const shadowedHook = judge(BUN_TEST, HELPER,
+      'describe("subject", () => {',
+      "  const beforeAll = (body) => body;",
+      "  beforeAll(async () => {",
+      "    await warmModuleGraph(options);",
+      "  });",
+      "});");
+    const shadowedSuite = judge(BUN_TEST, HELPER,
+      "const describe = (name, body) => body();",
+      ...hook("await warmModuleGraph(options);"));
+    expect([shadowedHook, shadowedSuite].map(warmupIsRegistered)).toEqual([false, false]);
+    expect(warmupRegistrationComplaints(shadowedHook).join(" ")).toContain("rebound");
+    expect(warmupRegistrationComplaints(shadowedSuite).join(" ")).toContain("rebound");
+  });
+
+  test("a parameter, a variable alias, and a callback reached by name are all refused", () => {
+    const parameter = judge(BUN_TEST, HELPER,
+      'describe("subject", () => {',
+      "  beforeAll(async (warmModuleGraph) => {",
+      "    await warmModuleGraph(options);",
+      "  });",
+      "});");
+    const alias = judge(BUN_TEST, HELPER, "const warm = warmModuleGraph;", ...hook("await warm(options);"));
+    const byName = judge(BUN_TEST, HELPER,
+      "const warmUpHook = async () => {",
+      "  await warmModuleGraph(options);",
+      "};",
+      "beforeAll(warmUpHook, COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);");
+    expect([parameter, alias, byName].map(warmupIsRegistered)).toEqual([false, false, false]);
+    expect(warmupRegistrationComplaints(alias).join(" ")).toContain("without being called");
+  });
+
+  test("fire and forget, void, and a partial expression leave the hook settling first", () => {
+    expect(registers(BUN_TEST, HELPER, ...hook("warmModuleGraph(options);"))).toBe(false);
+    expect(registers(BUN_TEST, HELPER, ...hook("void warmModuleGraph(options);"))).toBe(false);
+    expect(registers(BUN_TEST, HELPER, ...hook("return warmModuleGraph(options), ready();"))).toBe(false);
+    expect(registers(
+      BUN_TEST,
+      HELPER,
+      "beforeAll(() => warmModuleGraph(options) && ready(), COLD_SPAWN_WARMUP_HOOK_BUDGET_MS);",
+    )).toBe(false);
+  });
+
+  test("a conditional call is refused even when every branch warms", () => {
+    // Refused rather than analysed. Deciding that two branches both warm means modelling control
+    // flow, and the judge that models control flow from tokens is the one that gets it wrong.
+    expect(registers(BUN_TEST, HELPER, ...hook(
+      "if (portable) {",
+      "  await warmModuleGraph(portableOptions);",
+      "} else {",
+      "  await warmModuleGraph(nativeOptions);",
+      "}",
+    ))).toBe(false);
+    expect(registers(BUN_TEST, HELPER, ...hook("if (false) await warmModuleGraph(options);"))).toBe(false);
+  });
+
+  test("a file this judge cannot read is a failure, never an absence", () => {
+    const report = judge(BUN_TEST, HELPER, 'describe("unclosed", () => {');
+    expect(report.refusals.length).toBeGreaterThan(0);
+    expect(warmupIsRegistered(report)).toBe(false);
+  });
+});
+
+describe("warm-up judge: what a disposition has to match", () => {
+  const warmed = { warmed: true, why: "the canonical hook" };
+  const unwarmed = { warmed: false, why: "nothing here spawns a child that loads a repository graph" };
+  const canonical = () => judge(BUN_TEST, HELPER, ...hook("await warmModuleGraph(options);"));
+  const dropped = () => judge(BUN_TEST, HELPER, ...hook("warmModuleGraph(options);"));
+  const namespaced = () => judge(
+    BUN_TEST,
+    'import * as warmup from "../helpers/cold-spawn-warmup";',
+    ...hook("await warmup.warmModuleGraph(options);"),
+  );
+
+  test("warmed means an accepted shape and nothing refused", () => {
+    expect(dispositionComplaints("f.test.ts", warmed, canonical())).toEqual([]);
+    expect(dispositionComplaints("f.test.ts", warmed, dropped()).join(" ")).toContain("recorded warmed");
+  });
+
+  test("unwarmed means the file does not reach the helper at all", () => {
+    expect(dispositionComplaints("f.test.ts", unwarmed, judge(BUN_TEST, ...hook("const x = 1;")))).toEqual([]);
+    expect(dispositionComplaints("f.test.ts", unwarmed, canonical()).join(" ")).toContain("recorded unwarmed");
+    // A namespace import binds no name this judge follows, so bindings alone would read this as an
+    // absence. It is the reason the unwarmed test asks whether the helper is reached at all.
+    expect(dispositionComplaints("f.test.ts", unwarmed, namespaced()).join(" ")).toContain("reaches the warm-up helper");
+  });
+
+  test("an unmodelled shape is recorded, and the record has to keep matching", () => {
+    // This is how a refusal records a legitimate file instead of blocking it. The escape is not a
+    // silence: the judge still has to see the warm-up and still has to refuse it for the stated
+    // reason, so deleting the call or dropping the await changes the refusal and fails again.
+    const recorded = { warmed: true, why: "warms through a namespace import", unmodeled: "namespace" };
+    expect(dispositionComplaints("f.test.ts", recorded, namespaced())).toEqual([]);
+    expect(dispositionComplaints("f.test.ts", recorded, dropped()).join(" ")).toContain("not what was refused");
+    expect(dispositionComplaints("f.test.ts", recorded, canonical()).join(" ")).toContain("drop the note");
+    expect(dispositionComplaints("f.test.ts", recorded, judge(BUN_TEST, ...hook("const x = 1;"))).join(" "))
+      .toContain("nothing here reaches");
+  });
+});
diff --git a/tests/claude-integration/claude-code-thought-signature-scope.test.ts b/tests/claude-integration/claude-code-thought-signature-scope.test.ts
index b3d981c3277..814ce7ceb4a 100644
--- a/tests/claude-integration/claude-code-thought-signature-scope.test.ts
+++ b/tests/claude-integration/claude-code-thought-signature-scope.test.ts
@@ -11,6 +11,7 @@ import { afterEach, describe, expect, mock, test } from "bun:test";
 
 import type { ProviderAdapter } from "../../src/adapters/base";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const actualResolver = await import("../../src/server/adapter-resolve");
 
@@ -24,8 +25,15 @@ mock.module("../../src/server/adapter-resolve", () => ({
 }));
 
 const { handleResponses } = await import("../../src/server/responses");
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 afterEach(() => {
+  // Release first so a failed dispatch cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   adapterFactory = undefined;
 });
 
@@ -72,6 +80,7 @@ async function drive(options: {
   };
   if (options.promptCacheKey !== undefined) body.prompt_cache_key = options.promptCacheKey;
 
+  takeSpendHome();
   const response = await handleResponses(
     new Request("http://localhost/v1/responses", {
       method: "POST",
diff --git a/tests/claude-integration/claude-inbound-cache-stabilize.test.ts b/tests/claude-integration/claude-inbound-cache-stabilize.test.ts
index b11cbe3aaae..09b55cc3290 100644
--- a/tests/claude-integration/claude-inbound-cache-stabilize.test.ts
+++ b/tests/claude-integration/claude-inbound-cache-stabilize.test.ts
@@ -7,6 +7,7 @@ import { handleClaudeMessages } from "../../src/server/claude-messages";
 import type { OcxConfig, OcxClaudeCodeConfig } from "../../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { beforeEach, afterEach, describe, expect, test } from "bun:test";
 import { stabilizeClaudeInstructionsForPromptCache } from "../../src/claude/inbound-cache-stabilize";
 import { anthropicToResponsesTranslation } from "../../src/claude/inbound";
@@ -404,14 +405,22 @@ describe("Messages operator opt-in at the outbound boundary", () => {
   let isolatedHome: IsolatedCodexHome | undefined;
   let previousHome: string | undefined;
   let configHome: string | undefined;
+  let releaseSpendHome: (() => void) | undefined;
 
   beforeEach(() => {
     previousHome = process.env.OPENCODEX_HOME;
     isolatedHome = installIsolatedCodexHome("ocx-prefix-contract-");
     configHome = mkdtempSync(join(tmpdir(), "ocx-prefix-config-"));
     process.env.OPENCODEX_HOME = configHome;
+    // Dispatches without starting a server, so it takes the spend-journal lease itself. Taken
+    // last because the lease binds the home in effect at the moment it is taken.
+    releaseSpendHome = acquireOwnedSpendHome();
   });
   afterEach(() => {
+    // Released before this case's home is removed: an open lease inside a directory being
+    // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
     isolatedHome?.restore();
     if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/claude-integration/claude-messages-endpoint.test.ts b/tests/claude-integration/claude-messages-endpoint.test.ts
index a84e09a8782..ad5fadf5abc 100644
--- a/tests/claude-integration/claude-messages-endpoint.test.ts
+++ b/tests/claude-integration/claude-messages-endpoint.test.ts
@@ -31,6 +31,7 @@ import { estimateTokens } from "../../src/lib/token-estimate";
 import type { OcxConfig } from "../../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { SERVER_BUDGET_MS } from "../helpers/test-budget";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
 import {
@@ -1132,6 +1133,10 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
       turnAdmissionLease.release();
     }
   };
+  // One lease for the whole case rather than one per invocation: both turns run against the same
+  // home, and re-taking it between them would discard the ledger this case is still accounting
+  // into. File-wide would be wrong the other way, since most cases here start a real server.
+  const releaseSpendHome = acquireOwnedSpendHome();
   try {
     expect(await invokeMessages()).toBe(200);
 
@@ -1161,6 +1166,8 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
   } finally {
     await forward.stop(true);
     await routed.stop(true);
+    // After both upstreams are down, so nothing is still settling against the journal.
+    releaseSpendHome();
   }
 });
 
diff --git a/tests/claude-integration/claude-native-affinity.test.ts b/tests/claude-integration/claude-native-affinity.test.ts
index d3cb071e5b8..b646e6bef78 100644
--- a/tests/claude-integration/claude-native-affinity.test.ts
+++ b/tests/claude-integration/claude-native-affinity.test.ts
@@ -13,6 +13,7 @@ import type { OcxConfig } from "../../src/types";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
 const metadata = "user_test_account__session_conversation-native";
@@ -23,6 +24,7 @@ let isolated: IsolatedCodexHome;
 let home: string;
 let previousHome: string | undefined;
 let token: string;
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
@@ -33,8 +35,13 @@ beforeEach(() => {
   writeFileSync(join(isolated.path, "auth.json"), JSON.stringify({ tokens: { access_token: token, account_id: "fixture-native-main" } }));
   clearComboSelectionState();
   clearComboTargetCooldowns();
+  // Dispatches without starting a server, so the spend-journal lease is taken here.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 afterEach(() => {
+  // Released before the directory is removed, so no live database sits inside it.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearComboSelectionState();
   clearComboTargetCooldowns();
diff --git a/tests/cli/cli-account-pool-verbs.test.ts b/tests/cli/cli-account-pool-verbs.test.ts
index afab5fea2f3..3f3ca742f9a 100644
--- a/tests/cli/cli-account-pool-verbs.test.ts
+++ b/tests/cli/cli-account-pool-verbs.test.ts
@@ -437,6 +437,28 @@ describe("generic OAuth pool-settings contract (#695)", () => {
     expect(result.autoSwitchThreshold).toBeNull();
   });
 
+  test("a live generic pool reports a zero threshold as off", async () => {
+    const out = capture();
+    try {
+      expect(await cmdAutoSwitch(
+        ["google-antigravity", "status", "--json"],
+        genericDeps(() => ({ json: { enabled: true, autoSwitchThreshold: 0, inert: false } }), []),
+      )).toBe(0);
+    } finally { out.restore(); }
+    expect(JSON.parse(out.lines.join("\n"))).toEqual({
+      provider: "google-antigravity", autoSwitchThreshold: 0, enabled: false, poolEnabled: true, inert: false,
+    });
+
+    const human = capture();
+    try {
+      expect(await cmdAutoSwitch(
+        ["google-antigravity", "status"],
+        genericDeps(() => ({ json: { enabled: true, autoSwitchThreshold: 0, inert: false } }), []),
+      )).toBe(0);
+    } finally { human.restore(); }
+    expect(human.lines.join("\n")).toContain("auto-switch: off (stored threshold 0%; usage-based switching disabled)");
+  });
+
   test("a successful generic write with a null body reports unknown settings", async () => {
     const calls: Captured[] = [];
     const out = capture();
diff --git a/tests/cli/cli-provider.test.ts b/tests/cli/cli-provider.test.ts
index 5c8b72860b4..7c9d75affad 100644
--- a/tests/cli/cli-provider.test.ts
+++ b/tests/cli/cli-provider.test.ts
@@ -335,6 +335,51 @@ describe("ocx provider", () => {
     }
   });
 
+  test.each(["compatible", "reject-lossy"] as const)("provider add persists Google tool-schema policy %s", policy => {
+    const { dir } = freshConfig();
+    try {
+      const result = runCli([
+        "provider", "add", "google-policy",
+        "--adapter", "google",
+        "--base-url", "https://generativelanguage.googleapis.com",
+        "--api-key", "test-key",
+        "--google-tool-schema-policy", policy,
+      ], { OPENCODEX_HOME: dir });
+      expect(result.status).toBe(0);
+      expect(readConfig(dir).providers["google-policy"].googleToolSchemaPolicy).toBe(policy);
+    } finally {
+      removeTreeWithRetry(dir);
+    }
+  });
+
+  test("provider add rejects invalid or non-Google tool-schema policy without changing config", () => {
+    const { dir, configPath } = freshConfig();
+    try {
+      const before = readFileSync(configPath, "utf8");
+      const invalid = runCli([
+        "provider", "add", "google-policy",
+        "--adapter", "google",
+        "--base-url", "https://generativelanguage.googleapis.com",
+        "--google-tool-schema-policy", "silent-loss",
+      ], { OPENCODEX_HOME: dir });
+      expect(invalid.status).toBe(1);
+      expect(invalid.stderr).toContain('must be "compatible" or "reject-lossy"');
+      expect(readFileSync(configPath, "utf8")).toBe(before);
+
+      const wrongAdapter = runCli([
+        "provider", "add", "chat-policy",
+        "--adapter", "openai-chat",
+        "--base-url", "https://example.test/v1",
+        "--google-tool-schema-policy", "reject-lossy",
+      ], { OPENCODEX_HOME: dir });
+      expect(wrongAdapter.status).toBe(1);
+      expect(wrongAdapter.stderr).toContain("requires the google adapter");
+      expect(readFileSync(configPath, "utf8")).toBe(before);
+    } finally {
+      removeTreeWithRetry(dir);
+    }
+  });
+
   test("provider add rejects duplicate without --force", () => {
     const { dir } = freshConfig();
     try {
diff --git a/tests/cli/hub-invite.test.ts b/tests/cli/hub-invite.test.ts
index d5509459bdb..142dbd02f9e 100644
--- a/tests/cli/hub-invite.test.ts
+++ b/tests/cli/hub-invite.test.ts
@@ -179,9 +179,16 @@ describe("hub invite argument and origin helpers", () => {
 
   test("the printed command carries --clients only when the operator asked for it", () => {
     expect(hubInviteCommand(GRANT, "https://d.test:8443", "https://m.test", []))
-      .toBe(`echo '${GRANT}' | ocx connect https://d.test:8443 --management-url https://m.test --pairing-code-stdin`);
+      .toBe(`echo '${GRANT}' | ocx connect 'https://d.test:8443' --management-url 'https://m.test' --pairing-code-stdin`);
     expect(hubInviteCommand(GRANT, "https://d.test:8443", "https://m.test", ["codex"]))
-      .toContain("--clients codex --pairing-code-stdin");
+      .toContain("--clients 'codex' --pairing-code-stdin");
+  });
+
+  test("shell-quotes every dynamic value in the printed command", () => {
+    expect(hubInviteCommand("code'word", "https://x$({touch,pwn})", "https://m.test/$HOME", ["codex"]))
+      .toBe(
+        `echo 'code'"'"'word' | ocx connect 'https://x$({touch,pwn})' --management-url 'https://m.test/$HOME' --clients 'codex' --pairing-code-stdin`,
+      );
   });
 });
 
@@ -192,7 +199,7 @@ describe("hub invite output", () => {
     expect(boundOrigin).toBe("http://localhost:10100");
     expect(out.join("\n")).toContain("# Run on the other machine:");
     expect(out.join("\n")).toContain(
-      `echo '${GRANT}' | ocx connect http://100.64.0.10:10100 --management-url https://hub.tailnet.ts.net --pairing-code-stdin`,
+      `echo '${GRANT}' | ocx connect 'http://100.64.0.10:10100' --management-url 'https://hub.tailnet.ts.net' --pairing-code-stdin`,
     );
     // The warning is advice, not output a script should capture.
     expect(err.join("\n")).toContain("single-use");
@@ -222,10 +229,10 @@ describe("hub invite output", () => {
       hub: { managementPublicOrigin: "https://hub.tailnet.ts.net", dataPublicOrigin: "https://hub.tailnet.ts.net:8443" },
     });
     const fromConfig = await invite(["invite"], configured);
-    expect(fromConfig.out.join("\n")).toContain("ocx connect https://hub.tailnet.ts.net:8443 ");
+    expect(fromConfig.out.join("\n")).toContain("ocx connect 'https://hub.tailnet.ts.net:8443' ");
 
     const overridden = await invite(["invite", "--data-url", "https://front.test"], configured);
-    expect(overridden.out.join("\n")).toContain("ocx connect https://front.test ");
+    expect(overridden.out.join("\n")).toContain("ocx connect 'https://front.test' ");
   });
 
   test("--json emits exactly the documented envelope", async () => {
@@ -236,7 +243,7 @@ describe("hub invite output", () => {
       expiresAt: new Date(EXPIRES_AT).toISOString(),
       dataUrl: "http://100.64.0.10:10100",
       managementUrl: "https://hub.tailnet.ts.net",
-      command: `echo '${GRANT}' | ocx connect http://100.64.0.10:10100 --management-url https://hub.tailnet.ts.net --clients codex,claude --pairing-code-stdin`,
+      command: `echo '${GRANT}' | ocx connect 'http://100.64.0.10:10100' --management-url 'https://hub.tailnet.ts.net' --clients 'codex,claude' --pairing-code-stdin`,
     });
   });
 });
@@ -321,7 +328,7 @@ describe("hub invite refuses before burning a code", () => {
       hub: { managementPublicOrigin: "https://hub.tailnet.ts.net", dataPublicOrigin: "https://hub.tailnet.ts.net:8443" },
     }), { live: { pid: 4242, port: 10100, hostname: "127.0.0.1", source: "runtime" } });
     expect(viaConfig.code).toBe(0);
-    expect(viaConfig.out.join("\n")).toContain("ocx connect https://hub.tailnet.ts.net:8443 ");
+    expect(viaConfig.out.join("\n")).toContain("ocx connect 'https://hub.tailnet.ts.net:8443' ");
   });
 
   test("no running hub, a malformed origin, and a refused mint each exit 1 with a reason", async () => {
diff --git a/tests/clients/aside-profiles.test.ts b/tests/clients/aside-profiles.test.ts
index 800ef329f2a..b5b3cad956f 100644
--- a/tests/clients/aside-profiles.test.ts
+++ b/tests/clients/aside-profiles.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ExportModel } from "../../src/clients/config-export";
@@ -247,6 +247,92 @@ describe("Aside profile desired state, ownership and history", () => {
     expect((await getAsideProfileState(input(), 1)).enabled).toBe(false);
   });
 
+  test("a captured stored copy survives lookup-only divergence without bypassing source guards", async () => {
+    // Pin profile 0 to the legacy root: profile 1 must stay on its own child store even after
+    // its historical row is copied into the root journal.
+    config.asideProfileSync = { allProfiles: false, legacyProfileId: 0 };
+    const original = readFileSync(path(1), "utf8");
+    const enabled = await mutateAsideProfiles(input(), { profileId: 1, enabled: true });
+    const applied = enabled.results[0]!;
+    if (!applied.ok || !applied.opId) throw new Error("fixture enable failed");
+    const opId = applied.opId;
+    const profileStore = createIntegrationStateStore(join(store.root, "aside-profiles", "1"));
+    const entry = profileStore.findOperation(opId);
+    if (!entry) throw new Error("fixture operation missing from profile store");
+    const snapshot = profileStore.readSnapshot(entry);
+    if (snapshot.kind !== "stored") throw new Error("fixture snapshot is not stored");
+    expect(snapshot.text).toBe(original);
+    expect(store.findOperation(opId)).toBeNull();
+    store.captureSnapshot("aside", opId, snapshot.text);
+    store.appendJournal(structuredClone(entry));
+    rmSync(snapshot.path);
+    expect(profileStore.readSnapshot(entry).kind).toBe("expired");
+
+    let hideRootCopy = false;
+    const lookupStore: IntegrationStateStore = {
+      ...store,
+      // Only enumeration diverges. Source revalidation and snapshot reads remain real.
+      listOperations(clientId, limit) {
+        const rows = store.listOperations(clientId, Number.MAX_SAFE_INTEGER);
+        return rows.filter(row => !hideRootCopy || row.opId !== opId).slice(0, limit ?? 50);
+      },
+    };
+    const fixture = input({ store: lookupStore });
+    const captured = findAsideOperation(fixture, opId, 1);
+    if (!captured) throw new Error("fixture capture failed");
+    expect(captured.profileId).toBe(1);
+    expect(captured.store.root).toBe(store.root);
+    expect(captured.store.readSnapshot(captured.entry)).toMatchObject({ kind: "stored", text: original });
+
+    const treeBytes = (dir: string): string => !existsSync(dir) ? "" : readdirSync(dir, { recursive: true })
+      .map(String).sort().map(name => {
+        const full = join(dir, name);
+        return statSync(full).isDirectory() ? name + "/" : name + ":" + readFileSync(full, "utf8");
+      }).join("\u0000");
+    const siblingDir = join(store.root, "aside-profiles", "2");
+    createIntegrationStateStore(siblingDir).captureSnapshot("aside", "sibling-witness", "untouched");
+    const siblingBefore = treeBytes(siblingDir);
+    const siblingDocuments = [0, 2].map(id => readFileSync(path(id), "utf8"));
+    const sourceWitness = () => ["journal.jsonl", "records.json", "maintenance.json", join("snapshots", "aside", opId)]
+      .map(name => existsSync(join(store.root, name)) ? readFileSync(join(store.root, name), "utf8") : null);
+    const sourceBefore = sourceWitness();
+    const profileBefore = treeBytes(profileStore.root);
+    const appliedBytes = readFileSync(path(1), "utf8");
+    const savesBefore = saves;
+
+    hideRootCopy = true;
+    const fresh = findAsideOperation(fixture, opId, 1);
+    if (!fresh) throw new Error("fixture fresh lookup failed");
+    expect(fresh.store.root).toBe(profileStore.root);
+    expect(fresh.store.readSnapshot(fresh.entry).kind).toBe("expired");
+    expect(captured.store.findOperation(opId)).toEqual(captured.entry);
+    expect(captured.store.readSnapshot(captured.entry)).toMatchObject({ kind: "stored", text: original });
+    // Counterfactual through the real public entry point: re-resolution refuses before any write.
+    expect(await restoreAsideProfile(fixture, { opId, profileId: 1 })).toMatchObject({
+      ok: false, clientId: "aside", profileId: 1, reason: "snapshot_expired",
+    });
+    expect(saves).toBe(savesBefore);
+    expect(treeBytes(profileStore.root)).toBe(profileBefore);
+    expect(readFileSync(path(1), "utf8")).toBe(appliedBytes);
+    expect(sourceWitness()).toEqual(sourceBefore);
+
+    const restored = await restoreAsideProfile(fixture, { opId, profileId: 1, selectedOperation: captured });
+    expect(restored).toMatchObject({ ok: true, changed: true, clientId: "aside", profileId: 1 });
+    if (!restored.ok || !restored.opId) throw new Error("captured restore did not commit");
+    expect(readFileSync(path(1), "utf8")).toBe(original);
+    const finalRows = profileStore.listOperations("aside");
+    expect(finalRows.map(row => ({ kind: row.kind, opId: row.opId }))).toEqual([
+      { kind: "restore", opId: restored.opId }, { kind: "apply", opId },
+    ]);
+    expect(finalRows[0]!.configPath).toBe(path(1));
+    expect(profileStore.readSnapshot(finalRows[0]!)).toMatchObject({ kind: "stored", text: appliedBytes });
+    expect(profileStore.readSnapshot(entry)).toMatchObject({ kind: "stored", text: original });
+    expect(sourceWitness()).toEqual(sourceBefore);
+    expect(captured.store.findOperation(opId)).toEqual(captured.entry);
+    expect([0, 2].map(id => readFileSync(path(id), "utf8"))).toEqual(siblingDocuments);
+    expect(treeBytes(siblingDir)).toBe(siblingBefore);
+  });
+
   test("disable then Undo restores target intent without changing sibling overrides", async () => {
     seedLegacy();
     await mutateAsideProfiles(input(), { profileId: 2, enabled: false });
diff --git a/tests/clients/client-machine-listener.test.ts b/tests/clients/client-machine-listener.test.ts
index 582cbf0496d..c7b9e75252d 100644
--- a/tests/clients/client-machine-listener.test.ts
+++ b/tests/clients/client-machine-listener.test.ts
@@ -231,7 +231,9 @@ describe("client machine listener", () => {
           disconnected = true;
           return { restored: true, tokenRemoved: true, catalogRemoved: true, apiKeyId: "client-key-a" };
         },
-        scheduleStandaloneRecycle: () => { recycled = disconnected; },
+        scheduleStandaloneRecycle: tokenFingerprint => {
+          recycled = disconnected && tokenFingerprint === connection().tokenFingerprint;
+        },
       },
     });
     servers.push(server);
diff --git a/tests/clients/client-runtime.test.ts b/tests/clients/client-runtime.test.ts
new file mode 100644
index 00000000000..089bf367b20
--- /dev/null
+++ b/tests/clients/client-runtime.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { serviceApiTokenFingerprint } from "../../src/lib/service-secrets";
+import { standaloneRecycleEnv } from "../../src/client/runtime";
+
+describe("standalone recycle environment", () => {
+  test("removes a disconnected hub token and its token-file source", () => {
+    const dir = mkdtempSync(join(tmpdir(), "ocx-recycle-env-"));
+    const file = join(dir, "hub-service-token");
+    const hubToken = "hub-issued-token";
+    writeFileSync(file, `${hubToken}\n`, "utf8");
+    const source = {
+      OPENCODEX_API_AUTH_TOKEN: hubToken,
+      OCX_API_TOKEN_FILE: file,
+      PATH: "/usr/bin",
+    };
+
+    const result = standaloneRecycleEnv(source, serviceApiTokenFingerprint(hubToken));
+    expect(result).toEqual({
+      PATH: "/usr/bin",
+    });
+    expect(result.OCX_API_TOKEN_FILE).toBeUndefined();
+    expect(source.OPENCODEX_API_AUTH_TOKEN).toBe(hubToken);
+    expect(source.OCX_API_TOKEN_FILE).toBe(file);
+  });
+
+  test("preserves an independently configured operator credential", () => {
+    const operatorToken = "operator-token";
+    const source = {
+      OPENCODEX_API_AUTH_TOKEN: operatorToken,
+      OCX_API_TOKEN_FILE: "/tmp/operator-token",
+    };
+
+    expect(standaloneRecycleEnv(source, serviceApiTokenFingerprint("disconnected-hub-token"))).toEqual(source);
+  });
+
+  test("removes a token-file source carrying the disconnected token when the env var is empty", () => {
+    const dir = mkdtempSync(join(tmpdir(), "ocx-recycle-env-"));
+    const file = join(dir, "named-token");
+    const hubToken = "hub-issued-token";
+    writeFileSync(file, `${hubToken}\n`, "utf8");
+    const source = {
+      OCX_API_TOKEN_FILE: file,
+      PATH: "/usr/bin",
+    };
+
+    expect(standaloneRecycleEnv(source, serviceApiTokenFingerprint(hubToken))).toEqual({
+      PATH: "/usr/bin",
+    });
+    expect(source.OCX_API_TOKEN_FILE).toBe(file);
+  });
+
+  test("keeps a token file holding a different operator credential", () => {
+    const dir = mkdtempSync(join(tmpdir(), "ocx-recycle-env-"));
+    const file = join(dir, "operator-token");
+    writeFileSync(file, "operator-token\n", "utf8");
+    const hubToken = "hub-issued-token";
+    const source = {
+      OPENCODEX_API_AUTH_TOKEN: hubToken,
+      OCX_API_TOKEN_FILE: file,
+    };
+
+    expect(standaloneRecycleEnv(source, serviceApiTokenFingerprint(hubToken))).toEqual({
+      OCX_API_TOKEN_FILE: file,
+    });
+  });
+
+  test("removes a missing token-file source when the env token matches", () => {
+    const dir = mkdtempSync(join(tmpdir(), "ocx-recycle-env-"));
+    const hubToken = "hub-issued-token";
+    const source = {
+      OPENCODEX_API_AUTH_TOKEN: hubToken,
+      OCX_API_TOKEN_FILE: join(dir, "does-not-exist"),
+    };
+
+    expect(standaloneRecycleEnv(source, serviceApiTokenFingerprint(hubToken))).toEqual({});
+  });
+});
diff --git a/tests/clients/integrations-writer-frozen-config.test.ts b/tests/clients/integrations-writer-frozen-config.test.ts
new file mode 100644
index 00000000000..34804f505f6
--- /dev/null
+++ b/tests/clients/integrations-writer-frozen-config.test.ts
@@ -0,0 +1,402 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import type { ExportModel } from "../../src/clients/config-export";
+import { INTEGRATION_CLIENTS } from "../../src/integrations/registry";
+import { createIntegrationStateStore, type IntegrationStateStore } from "../../src/integrations/store";
+import { applyIntegrationCoordinated } from "../../src/integrations/writer";
+import { mutateAsideProfiles, previewAsideProfile } from "../../src/integrations/aside-profiles";
+import { previewIntegration } from "../../src/integrations/mutation-plan";
+import { loadExportModels, previewExportModels, resetExportSnapshotForTests } from "../../src/server/management/model-rows";
+import type { OcxConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+/**
+ * A coordinated write plans from its input, awaits the writer lock and a revalidation, and only
+ * then serializes the document. Everything else it resolves is frozen before that await, and the
+ * configuration was the one thing still held by reference: an edit landing in the window meant the
+ * plan that authorized the write and the document it produced described different configurations.
+ */
+let home: string;
+let store: IntegrationStateStore;
+let priorOcxHome: string | undefined;
+const TEST_ENV = {} as NodeJS.ProcessEnv;
+
+const MODELS: ExportModel[] = [
+  { namespaced: "anthropic/claude-opus-4-8", provider: "anthropic", id: "claude-opus-4-8", contextWindow: 200_000 },
+];
+
+const CHECKED_HOST = "127.0.0.1";
+const LATER_HOST = "127.0.0.2";
+
+beforeEach(() => {
+  const base = mkdtempSync(join(tmpdir(), "ocx-writer-frozen-config-"));
+  home = join(base, "home");
+  mkdirSync(home, { recursive: true });
+  store = createIntegrationStateStore(join(base, "store", "integrations"));
+  // A roster is admitted beside the configuration file, so these cases need their own
+  // configuration home rather than whatever the machine running them happens to have.
+  priorOcxHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = join(base, "config");
+});
+
+afterEach(() => {
+  if (priorOcxHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = priorOcxHome;
+  removeTreeWithRetry(dirname(home));
+});
+
+function installHermes(): string {
+  const spec = INTEGRATION_CLIENTS.hermes;
+  mkdirSync(spec.detectDir(TEST_ENV, home), { recursive: true });
+  const configPath = spec.configPath(TEST_ENV, home);
+  mkdirSync(dirname(configPath), { recursive: true });
+  return configPath;
+}
+
+test("the configuration a coordinated write checked is the one it writes", async () => {
+  const configPath = installHermes();
+  const config = {
+    port: 10100,
+    hostname: CHECKED_HOST,
+    defaultProvider: "mock",
+    providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+  } as unknown as OcxConfig;
+
+  let edited = false;
+  const result = await applyIntegrationCoordinated(
+    { clientId: "hermes", models: MODELS, config, port: 10100, store, env: TEST_ENV, home },
+    {
+      revalidate: async () => {
+        // The revalidation has just agreed that this write may proceed. A management route editing
+        // the live configuration here is the whole hazard: it is after the check and before the
+        // document exists.
+        config.hostname = LATER_HOST;
+        edited = true;
+        return null;
+      },
+    },
+  );
+
+  expect(result.ok).toBe(true);
+  expect(edited).toBe(true);
+  const written = readFileSync(configPath, "utf8");
+  // The document describes the configuration the check passed on. Holding the caller's object
+  // would have serialized the edit instead, with the plan still vouching for the other one. The
+  // port form is asserted rather than the checked host itself because a loopback hostname is
+  // normalized on the way into a client document, while the edited one would arrive verbatim.
+  expect(written).toContain(":10100/v1");
+  expect(written).not.toContain(LATER_HOST);
+  // And the edit itself is untouched: freezing the input is not an excuse to write it back.
+  expect(config.hostname).toBe(LATER_HOST);
+});
+
+/**
+ * The same rule one layer up, where the window is wider.
+ *
+ * An Aside change checks its confirmation, then awaits the preference write, and only then builds
+ * each profile's write input. The preference write edits the live configuration itself, so reading
+ * that object again afterwards guaranteed the document came from a configuration the check never
+ * saw, and anything else editing it during the await arrived the same way.
+ */
+test("the configuration an Aside change was checked against is the one written", async () => {
+  mkdirSync(join(home, ".aside", "u", "0"), { recursive: true });
+  writeFileSync(join(home, ".aside", "accounts.json"), JSON.stringify({
+    currentAccountId: 0, accounts: [{ id: 0, name: "Primary" }],
+  }));
+  const profilePath = join(home, ".aside", "u", "0", "models.json");
+  writeFileSync(profilePath, JSON.stringify({ theme: "keep", providers: { personal: { models: [] } } }));
+
+  const config = {
+    port: 10100,
+    hostname: CHECKED_HOST,
+    defaultProvider: "mock",
+    providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+  } as unknown as OcxConfig;
+
+  let checked = false;
+  const result = await mutateAsideProfiles(
+    {
+      config, models: MODELS, port: 10100, env: {} as NodeJS.ProcessEnv, home, store,
+      persistConfig: async () => {
+        // Both hosts are loopback, so neither is rewritten on the way into a client document and
+        // the one that appears is the one the write actually read.
+        config.hostname = LATER_HOST;
+        // A real suspension, so the profile write below genuinely resumes after this edit rather
+        // than being ordered ahead of it by chance.
+        await Promise.resolve();
+      },
+    },
+    { profileId: 0, enabled: true },
+    {
+      revalidate: async () => {
+        checked = true;
+        return null;
+      },
+    },
+  );
+
+  expect(checked).toBe(true);
+  expect(result.ok).toBe(true);
+  const written = readFileSync(profilePath, "utf8");
+  expect(written).toContain(":10100/v1");
+  expect(written).not.toContain(LATER_HOST);
+  // The preference write is a real effect on the live configuration and stays one.
+  expect(config.hostname).toBe(LATER_HOST);
+});
+
+/**
+ * The roster is the other half of the same input.
+ *
+ * A caller passes model objects it still owns, and the plan that authorizes the write is computed
+ * from them before the lock. Spreading the input carried those objects by reference, so an edit
+ * made after the check was serialized into the document the check had vouched for.
+ */
+test("the roster a coordinated write checked is the one it writes", async () => {
+  const configPath = installHermes();
+  const config = {
+    port: 10100,
+    hostname: CHECKED_HOST,
+    defaultProvider: "mock",
+    providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+  } as unknown as OcxConfig;
+  const models: ExportModel[] = [
+    { namespaced: "anthropic/claude-opus-4-8", provider: "anthropic", id: "claude-opus-4-8", contextWindow: 200_000 },
+  ];
+
+  const result = await applyIntegrationCoordinated(
+    { clientId: "hermes", models, config, port: 10100, store, env: TEST_ENV, home },
+    {
+      revalidate: async () => {
+        models[0]!.id = "edited-after-the-check";
+        models[0]!.namespaced = "anthropic/edited-after-the-check";
+        return null;
+      },
+    },
+  );
+
+  expect(result.ok).toBe(true);
+  const written = readFileSync(configPath, "utf8");
+  expect(written).toContain("claude-opus-4-8");
+  expect(written).not.toContain("edited-after-the-check");
+});
+
+/**
+ * What happens when the input cannot be held still at all.
+ *
+ * An accessor is not read here, so there is no copy to check a plan against and no way to promise
+ * the document matches it. The write is refused before anything is touched, which is bounded and
+ * honest; returning the caller's object and calling it frozen would have been neither.
+ */
+test("an input that cannot be copied refuses the write instead of reading it twice", async () => {
+  const configPath = installHermes();
+  let reads = 0;
+  const config = {
+    port: 10100,
+    defaultProvider: "mock",
+    providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+  } as unknown as OcxConfig;
+  Object.defineProperty(config, "hostname", {
+    configurable: true,
+    enumerable: true,
+    get: () => { reads += 1; return CHECKED_HOST; },
+  });
+
+  let checked = false;
+  const result = await applyIntegrationCoordinated(
+    { clientId: "hermes", models: MODELS, config, port: 10100, store, env: TEST_ENV, home },
+    { revalidate: async () => { checked = true; return null; } },
+  );
+
+  expect(result.ok).toBe(false);
+  if (result.ok) throw new Error("an uncopyable input must not be written");
+  expect(result.reason).toBe("unsafe");
+  // Refused before the plan, the lock and the document: nothing ran and nothing was read.
+  expect(checked).toBe(false);
+  expect(reads).toBe(0);
+  expect(existsSync(configPath)).toBe(false);
+});
+
+/**
+ * What a committed Aside change does to the retained roster, stated rather than assumed.
+ *
+ * The change writes the operator's Aside preference into the configuration, so the configuration a
+ * roster was admitted under is no longer the one in hand and the roster is retired. The next bound
+ * confirmation is answered with "no roster is cached yet" until an ordinary load runs, which is
+ * what the Integrations collection read does. This is not new behaviour introduced by binding the
+ * roster to the configuration object: persisting the preference rewrites the configuration file,
+ * and a roster has always been retired when that file moves.
+ */
+test("a committed Aside change retires the roster, and an ordinary load brings it back", async () => {
+  mkdirSync(join(home, ".aside", "u", "0"), { recursive: true });
+  writeFileSync(join(home, ".aside", "accounts.json"), JSON.stringify({
+    currentAccountId: 0, accounts: [{ id: 0, name: "Primary" }],
+  }));
+  const profilePath = join(home, ".aside", "u", "0", "models.json");
+  writeFileSync(profilePath, JSON.stringify({ theme: "keep", providers: { personal: { models: [] } } }));
+
+  const config = {
+    port: 10100,
+    hostname: CHECKED_HOST,
+    defaultProvider: "fixture",
+    providers: { fixture: { adapter: "openai-chat", baseUrl: "https://fixture.invalid/v1", liveModels: false, models: ["one", "two"] } },
+  } as unknown as OcxConfig;
+
+  resetExportSnapshotForTests();
+  await loadExportModels(config, []);
+  expect(previewExportModels(config)).not.toBeNull();
+
+  const result = await mutateAsideProfiles(
+    {
+      // A bound confirmation hands the mutation the roster the guard used, exactly as the route
+      // does, so nothing reloads it in the middle of the change.
+      config, models: MODELS, port: 10100, env: {} as NodeJS.ProcessEnv, home, store,
+      persistConfig: () => {},
+    },
+    { profileId: 0, enabled: true },
+  );
+
+  expect(result.ok).toBe(true);
+  // The preference is now part of the configuration, and the roster was admitted without it.
+  expect(config.asideProfileSync).toBeDefined();
+  expect(previewExportModels(config)).toBeNull();
+
+  // Recovery is the ordinary flow rather than a special step.
+  await loadExportModels(config, []);
+  expect(previewExportModels(config)).not.toBeNull();
+});
+
+function seedAsideProfile(): string {
+  mkdirSync(join(home, ".aside", "u", "0"), { recursive: true });
+  writeFileSync(join(home, ".aside", "accounts.json"), JSON.stringify({
+    currentAccountId: 0, accounts: [{ id: 0, name: "Primary" }],
+  }));
+  const profilePath = join(home, ".aside", "u", "0", "models.json");
+  writeFileSync(profilePath, JSON.stringify({ theme: "keep", providers: { personal: { models: [] } } }));
+  return profilePath;
+}
+
+function asideFixtureConfig(hostname: string): OcxConfig {
+  return {
+    port: 10100,
+    hostname,
+    defaultProvider: "fixture",
+    providers: { fixture: { adapter: "openai-chat", baseUrl: "https://fixture.invalid/v1", liveModels: false, models: ["one", "two"] } },
+  } as unknown as OcxConfig;
+}
+
+/**
+ * The check has to be about the input that will be written, not about whatever the live
+ * configuration says at the moment it runs.
+ *
+ * A configuration can be edited to something else and back again while an action is in flight. A
+ * check that rebuilt its own view from the live object would then plan the configuration the
+ * operator confirmed, agree with the confirmation, and let the write proceed from the copy the
+ * action actually holds, which is the other one.
+ */
+test("the Aside check plans the prepared input, not the configuration that is live when it runs", async () => {
+  const profilePath = seedAsideProfile();
+  const before = readFileSync(profilePath, "utf8");
+  const config = asideFixtureConfig(CHECKED_HOST);
+  const asideInput = { config, models: MODELS, port: 10100, env: {} as NodeJS.ProcessEnv, home, store, persistConfig: () => {} };
+
+  // A: what the operator confirmed.
+  const confirmed = await previewAsideProfile(asideInput, { profileId: 0, operation: "apply" });
+  expect(confirmed.canApply).toBe(true);
+
+  // B: what the action will hold, because the context copies the configuration when it is created.
+  config.hostname = LATER_HOST;
+
+  const checked: string[] = [];
+  const result = await mutateAsideProfiles(
+    asideInput,
+    { profileId: 0, enabled: true },
+    {
+      revalidate: async prepared => {
+        // Live is A again by the time the check runs. Only the prepared input still says B.
+        config.hostname = CHECKED_HOST;
+        const plan = previewIntegration(prepared, { profileId: 0, operation: "apply" });
+        checked.push(plan.fingerprint);
+        return plan.fingerprint === confirmed.fingerprint ? null : {
+          ok: false, reason: "conflict", state: plan.state, clientId: "aside",
+          message: "that confirmation no longer describes this profile", profileId: 0,
+        };
+      },
+    },
+  );
+
+  expect(checked).toHaveLength(1);
+  expect(checked[0]).not.toBe(confirmed.fingerprint);
+  expect(result.ok).toBe(false);
+  // Refused before the preference write and before any client write.
+  expect(config.asideProfileSync).toBeUndefined();
+  expect(readFileSync(profilePath, "utf8")).toBe(before);
+});
+
+/**
+ * The roster is resolved and copied once, before the check.
+ *
+ * It used to be resolved lazily at each profile write, which happens after the preference write. A
+ * caller still holding those model objects could edit them in that window, and the document
+ * carried the edit while the plan vouched for what it read earlier.
+ */
+test("a roster edited during the preference write is not the roster written", async () => {
+  const profilePath = seedAsideProfile();
+  const config = asideFixtureConfig(CHECKED_HOST);
+  const models: ExportModel[] = [
+    { namespaced: "anthropic/claude-opus-4-8", provider: "anthropic", id: "claude-opus-4-8", contextWindow: 200_000 },
+  ];
+
+  const result = await mutateAsideProfiles(
+    {
+      config, models, port: 10100, env: {} as NodeJS.ProcessEnv, home, store,
+      persistConfig: () => {
+        models[0]!.id = "edited-during-the-preference-write";
+        models[0]!.namespaced = "anthropic/edited-during-the-preference-write";
+      },
+    },
+    { profileId: 0, enabled: true },
+    // A confirmed change, which is what brings the roster forward: the check has to read the same
+    // rows the write will use. An unconfirmed change resolves them later, because a preference
+    // write that fails must not have done model work by then.
+    { revalidate: async () => null },
+  );
+
+  expect(result.ok).toBe(true);
+  const written = readFileSync(profilePath, "utf8");
+  expect(written).toContain("claude-opus-4-8");
+  expect(written).not.toContain("edited-during-the-preference-write");
+});
+
+/**
+ * A confirmation describes one profile.
+ *
+ * HTTP refuses a bound change that names none, and this refuses it too. Guessing which prepared
+ * input such a confirmation meant would be inventing the thing the check exists to verify.
+ */
+test("a confirmed change that names no profile is refused rather than guessed", async () => {
+  const profilePath = seedAsideProfile();
+  const before = readFileSync(profilePath, "utf8");
+  const config = asideFixtureConfig(CHECKED_HOST);
+
+  let checked = false;
+  let loads = 0;
+  await expect(mutateAsideProfiles(
+    {
+      config,
+      // A loader, not an array: resolving the roster is real work that reaches providers and can
+      // finalize an initial model selection, and a confirmation this cannot check must not cause
+      // it. An inert array would hide that.
+      models: async () => { loads += 1; return MODELS; },
+      port: 10100, env: {} as NodeJS.ProcessEnv, home, store, persistConfig: () => {},
+    },
+    { enabled: true },
+    { revalidate: async () => { checked = true; return null; } },
+  )).rejects.toThrow(/one profile/);
+
+  expect(checked).toBe(false);
+  expect(loads).toBe(0);
+  expect(config.asideProfileSync).toBeUndefined();
+  expect(readFileSync(profilePath, "utf8")).toBe(before);
+});
diff --git a/tests/clients/mutation-plan.test.ts b/tests/clients/mutation-plan.test.ts
new file mode 100644
index 00000000000..4af951a290c
--- /dev/null
+++ b/tests/clients/mutation-plan.test.ts
@@ -0,0 +1,667 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import {
+  MANAGED_PATH_TEMPLATES,
+  PLAN_CHANGE_LIMIT,
+  buildMutationPlan,
+  canonicalSchemaPath,
+  orderPlanChanges,
+  planFingerprint,
+  previewIntegration,
+  type IntegrationPlanChange,
+  type PlanInput,
+  type PlanFingerprintInput,
+} from "../../src/integrations/mutation-plan";
+import {
+  EXPORT_CLIENTS,
+  EXPORT_CLIENT_IDS,
+  type ExportContext,
+  type ExportModel,
+  type ManagedContribution,
+} from "../../src/clients/config-export";
+import type { OwnershipRecord } from "../../src/integrations/ownership";
+import { fingerprint } from "../../src/integrations/ownership";
+import type { JournalEntry } from "../../src/integrations/journal";
+import type { OcxConfig } from "../../src/types";
+import { createIntegrationStateStore } from "../../src/integrations/store";
+import { applyIntegration, disableIntegration, restoreIntegration } from "../../src/integrations/writer";
+import { clinePendingPath } from "../../src/integrations/cline-io";
+import { resolveIntegrationPaths } from "../../src/integrations/registry";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const FIXTURE_MODELS: ExportModel[] = [
+  { namespaced: "anthropic/claude-opus-4-8", provider: "anthropic", id: "claude-opus-4-8", contextWindow: 200_000 },
+  { namespaced: "gpt-5.5", provider: "openai", id: "gpt-5.5", native: true, contextWindow: 400_000 },
+];
+
+const FIXTURE_CONFIG: OcxConfig = {
+  port: 10100,
+  hostname: "127.0.0.1",
+  defaultProvider: "mock",
+  providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+} as OcxConfig;
+
+function fixtureContext(): ExportContext {
+  return { baseUrl: "http://127.0.0.1:10100/v1", models: FIXTURE_MODELS, config: FIXTURE_CONFIG };
+}
+
+const CONFIG_PATH = "/home/example/.cline/config.json";
+
+const RECORD: OwnershipRecord = {
+  clientId: "cline",
+  configPath: CONFIG_PATH,
+  fileFingerprint: "0123456789abcdef",
+  blockFingerprint: "fedcba9876543210",
+  fragmentPaths: [["providers", "opencodex"]],
+  appliedAt: "2026-01-01T00:00:00.000Z",
+  opId: "op-base",
+};
+
+const CANARY = "canary-value-must-not-be-published";
+
+const CONTRIBUTION: ManagedContribution = {
+  clientId: "cline",
+  fragments: [
+    { path: ["settings", "providers", "opencodex"], value: { baseUrl: "http://127.0.0.1:10100", apiKey: CANARY } },
+    { path: ["catalog", "providers", "opencodex"], value: { models: [CANARY] } },
+  ],
+};
+
+const ENTRY: JournalEntry = {
+  opId: "op-base",
+  clientId: "cline",
+  kind: "apply",
+  at: "2026-01-01T00:00:00.000Z",
+  configPath: CONFIG_PATH,
+  snapshot: { kind: "stored", relPath: "snapshots/op-base.json" },
+  resultFingerprint: "0123456789abcdef",
+  resultAbsent: false,
+  priorRecord: null,
+};
+
+const BASE: PlanFingerprintInput = {
+  operation: "apply",
+  clientId: "cline",
+  configPath: CONFIG_PATH,
+  detectDir: "/home/example/.cline",
+  installKind: "dir",
+  admissionBlocked: false,
+  before: "{}",
+  contribution: CONTRIBUTION,
+  record: RECORD,
+  models: [{ namespaced: "anthropic/claude", provider: "anthropic", id: "claude" }],
+};
+
+const RESTORE: NonNullable<PlanFingerprintInput["restore"]> = {
+  opId: "op-base",
+  entry: ENTRY,
+  snapshotKind: "stored",
+  snapshotText: "{\"a\":1}",
+  confirmDrift: false,
+  driftsFromResult: false,
+};
+
+const RESTORE_BASE: PlanFingerprintInput = { ...BASE, operation: "restore", restore: RESTORE };
+
+describe("integration mutation plan projection", () => {
+  test("a declared managed path is published as its template", () => {
+    expect(canonicalSchemaPath("cline", ["settings", "providers", "opencodex"])).toBe("settings.providers.opencodex");
+    expect(canonicalSchemaPath("raycast", ["providers", "[id=opencodex]"])).toBe("providers.[id=opencodex]");
+  });
+
+  test("a dynamic position never publishes the member it selected", () => {
+    // Kimi writes one fragment per model, so this position holds a user's model alias. An
+    // alphanumeric allowlist would have emitted it verbatim.
+    const path = canonicalSchemaPath("kimi", ["models", "kimi-k2-private-alias"]);
+    expect(path).toBe("models.*");
+    expect(path).not.toContain("kimi-k2-private-alias");
+  });
+
+  test("a path outside the client's declared grammar is refused, not described", () => {
+    // An ownership record accepts arbitrary strings, so a path is never published because a record
+    // carries it. Depth, a foreign static segment and another client's shape all fail closed.
+    expect(canonicalSchemaPath("kimi", ["models", "alias", "contextWindow"])).toBeNull();
+    expect(canonicalSchemaPath("pi", ["providers", "someone-elses-provider"])).toBeNull();
+    expect(canonicalSchemaPath("pi", ["settings", "providers", "opencodex"])).toBeNull();
+    expect(canonicalSchemaPath("cline", ["..", "..", "etc"])).toBeNull();
+    expect(canonicalSchemaPath("cline", [])).toBeNull();
+  });
+
+  test("every path a shipped client actually writes canonicalizes through its own templates", () => {
+    // The declarations are a second copy of what the exporters do, so the only assertion worth
+    // making is against real builder output. A template list that merely exists proves nothing.
+    for (const clientId of EXPORT_CLIENT_IDS) {
+      expect(MANAGED_PATH_TEMPLATES[clientId].length, clientId).toBeGreaterThan(0);
+      const contribution = EXPORT_CLIENTS[clientId].buildContribution(fixtureContext());
+      expect(contribution.fragments.length, clientId).toBeGreaterThan(0);
+      for (const fragment of contribution.fragments) {
+        const canonical = canonicalSchemaPath(clientId, fragment.path);
+        expect(canonical, `${clientId}: ${fragment.path.join(".")}`).not.toBeNull();
+        // A dynamic position must not carry its observed value into the published path.
+        for (const segment of fragment.path) {
+          if (!MANAGED_PATH_TEMPLATES[clientId].some(template => template.includes(segment))) {
+            expect(canonical, `${clientId} leaked ${segment}`).not.toContain(segment);
+          }
+        }
+      }
+    }
+  });
+
+  test("changes are deduplicated and ordered by kind then path", () => {
+    const input: IntegrationPlanChange[] = [
+      { kind: "journal", path: "$journal" },
+      { kind: "replace", path: "providers.b" },
+      { kind: "add", path: "providers.z" },
+      { kind: "replace", path: "providers.a" },
+      { kind: "add", path: "providers.z" },
+    ];
+    expect(orderPlanChanges(input)).toEqual([
+      { kind: "add", path: "providers.z" },
+      { kind: "replace", path: "providers.a" },
+      { kind: "replace", path: "providers.b" },
+      { kind: "journal", path: "$journal" },
+    ]);
+  });
+
+  test("the reported change list is capped and frozen", () => {
+    const many: IntegrationPlanChange[] = Array.from({ length: PLAN_CHANGE_LIMIT + 5 }, (_unused, index) => ({
+      kind: "add" as const,
+      path: `providers.p${String(index).padStart(4, "0")}`,
+    }));
+    const ordered = orderPlanChanges(many);
+    expect(ordered.length).toBe(PLAN_CHANGE_LIMIT);
+    // Frozen because a caller that sorted this in place would be editing shared plan state.
+    expect(() => (ordered as IntegrationPlanChange[]).push({ kind: "add", path: "providers.extra" })).toThrow();
+  });
+});
+
+describe("integration plan fingerprint", () => {
+  test("is stable for the same inputs and carries its version", () => {
+    expect(planFingerprint(BASE)).toBe(planFingerprint({ ...BASE }));
+    expect(planFingerprint(BASE).startsWith("p1:")).toBe(true);
+  });
+
+  test("every authority input changes it", () => {
+    const variants: PlanFingerprintInput[] = [
+      BASE,
+      { ...BASE, operation: "overwrite" },
+      { ...BASE, clientId: "opencode" },
+      { ...BASE, profileId: 1 },
+      { ...BASE, configPath: "/home/other/.cline/config.json" },
+      { ...BASE, detectDir: "/home/other/.cline" },
+      // The contribution is identical across an uninstall and across a change in admission
+      // eligibility, so binding the path alone would keep a stale confirmation valid.
+      { ...BASE, installKind: "missing" },
+      { ...BASE, installKind: "file" },
+      { ...BASE, admissionBlocked: true },
+      // Different bytes, and absent distinguished from empty: restoring over a missing file and
+      // over an empty one are different operations.
+      { ...BASE, before: "{ }" },
+      { ...BASE, before: "" },
+      { ...BASE, before: null },
+      { ...BASE, contribution: null },
+      {
+        ...BASE,
+        contribution: {
+          clientId: "cline",
+          fragments: [{ path: ["providers", "opencodex"], value: { baseUrl: "http://127.0.0.1:10101" } }],
+        },
+      },
+      { ...BASE, record: null },
+      // The contribution is derived from the model roster, so a changed roster changes what a
+      // confirmed apply would write.
+      { ...BASE, models: [{ namespaced: "anthropic/claude", provider: "anthropic", id: "claude-2" }] },
+      { ...BASE, models: [] },
+    ];
+    expect(new Set(variants.map(planFingerprint)).size).toBe(variants.length);
+  });
+
+  test("restore binds the selected row and the bytes it would publish", () => {
+    const variants: PlanFingerprintInput[] = [
+      RESTORE_BASE,
+      { ...RESTORE_BASE, restore: { ...RESTORE, opId: "op-other" } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, entry: { ...ENTRY, resultAbsent: true } } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, entry: { ...ENTRY, priorRecord: RECORD } } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, snapshotKind: "none" } },
+      // Same row and same snapshot kind, different snapshot bytes. Binding only the operation id
+      // would leave the bytes that actually land in the user's file outside the confirmation.
+      { ...RESTORE_BASE, restore: { ...RESTORE, snapshotText: "{\"a\":2}" } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, snapshotText: null } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, confirmDrift: true } },
+      { ...RESTORE_BASE, restore: { ...RESTORE, driftsFromResult: true } },
+    ];
+    expect(new Set(variants.map(planFingerprint)).size).toBe(variants.length);
+  });
+});
+
+const PLAN_BASE: PlanInput = { ...BASE, classified: { state: "absent" }, parsed: {} };
+
+/** A document that already holds a value where the settings fragment goes. */
+const OCCUPIED = { settings: { providers: { opencodex: { baseUrl: "http://elsewhere" } } } };
+
+describe("integration mutation plan", () => {
+  test("an allowed apply names every managed place and the history it writes", () => {
+    const plan = buildMutationPlan(PLAN_BASE);
+    expect(plan.canApply).toBe(true);
+    expect(plan.willChange).toBe(true);
+    expect(plan.refusalReason).toBeUndefined();
+    expect(plan.changes).toEqual([
+      { kind: "add", path: "catalog.providers.opencodex" },
+      { kind: "add", path: "settings.providers.opencodex" },
+      { kind: "snapshot", path: "$snapshot" },
+      { kind: "ownership", path: "$ownership" },
+      { kind: "journal", path: "$journal" },
+    ]);
+  });
+
+  test("an occupied place is a replacement whether or not we own it", () => {
+    // Deciding from our own record would call an overwrite of somebody else's key an addition,
+    // which is the one situation overwrite exists for.
+    const plan = buildMutationPlan({
+      ...PLAN_BASE,
+      operation: "overwrite",
+      classified: { state: "conflict", reason: "unowned-key" },
+      record: null,
+      parsed: OCCUPIED,
+    });
+    expect(plan.changes).toContainEqual({ kind: "replace", path: "settings.providers.opencodex" });
+    expect(plan.changes).toContainEqual({ kind: "add", path: "catalog.providers.opencodex" });
+  });
+
+  test("no configured value reaches the plan", () => {
+    const plan = buildMutationPlan(PLAN_BASE);
+    expect(JSON.stringify(plan)).not.toContain(CANARY);
+    expect(JSON.stringify(plan)).not.toContain(CONFIG_PATH);
+  });
+
+  test("apply refuses in the writer's order: installation, admission, conflict, then unsafe", () => {
+    const conflicted: PlanInput = { ...PLAN_BASE, classified: { state: "conflict", reason: "foreign-edit" } };
+    // Installation outranks a conflict the file would otherwise report.
+    expect(buildMutationPlan({ ...conflicted, installKind: "missing" }).refusalReason).toBe("not_installed");
+    expect(buildMutationPlan({ ...conflicted, admissionBlocked: true }).refusalReason).toBe("non_loopback");
+    // And a conflict outranks the classifier's unsafe, which apply reports last.
+    expect(buildMutationPlan(conflicted).refusalReason).toBe("conflict");
+    expect(buildMutationPlan({ ...PLAN_BASE, classified: { state: "unsafe", reason: "blocked-container" } }).refusalReason)
+      .toBe("unsafe");
+    const refused = buildMutationPlan({ ...PLAN_BASE, installKind: "missing" });
+    expect(refused.canApply).toBe(false);
+    expect(refused.changes).toEqual([]);
+  });
+
+  test("disable asks its own questions and never asks about installation", () => {
+    const disable: PlanInput = { ...PLAN_BASE, operation: "disable", classified: { state: "current" } };
+    // Removing what we wrote from a file that still exists is meaningful whether or not the
+    // client is installed now, and it emits nothing admission policy could object to.
+    expect(buildMutationPlan({ ...disable, installKind: "missing" }).canApply).toBe(true);
+    expect(buildMutationPlan({ ...disable, admissionBlocked: true }).canApply).toBe(true);
+    expect(buildMutationPlan({ ...disable, classified: { state: "conflict", reason: "foreign-edit" } }).refusalReason)
+      .toBe("conflict");
+  });
+
+  test("an operation that would write nothing says so and names no places", () => {
+    // The writer succeeds without writing in both of these, so reporting a snapshot and a journal
+    // row would describe consequences that never happen.
+    const applied = buildMutationPlan({ ...PLAN_BASE, classified: { state: "current" } });
+    expect(applied.canApply).toBe(true);
+    expect(applied.willChange).toBe(false);
+    expect(applied.changes).toEqual([]);
+
+    const disabled = buildMutationPlan({ ...PLAN_BASE, operation: "disable", classified: { state: "absent" } });
+    expect(disabled.canApply).toBe(true);
+    expect(disabled.willChange).toBe(false);
+    expect(disabled.changes).toEqual([]);
+  });
+
+  test("overwrite is the operation allowed through a conflict", () => {
+    const conflicted: PlanInput = { ...PLAN_BASE, classified: { state: "conflict", reason: "foreign-edit" } };
+    expect(buildMutationPlan(conflicted).refusalReason).toBe("conflict");
+    expect(buildMutationPlan({ ...conflicted, operation: "overwrite" }).canApply).toBe(true);
+    expect(buildMutationPlan(conflicted).foreignEdit).toBe("foreign-edit");
+  });
+
+  test("restore reports an expired backup and unconfirmed drift", () => {
+    const plan: PlanInput = { ...RESTORE_BASE, classified: { state: "current" }, parsed: {} };
+    expect(buildMutationPlan({ ...plan, restore: { ...RESTORE, snapshotKind: "expired" } }).refusalReason)
+      .toBe("snapshot_expired");
+    const drifted = buildMutationPlan({ ...plan, restore: { ...RESTORE, driftsFromResult: true } });
+    expect(drifted.refusalReason).toBe("drift_requires_confirm");
+    expect(drifted.foreignEdit).toBe("drift");
+    expect(buildMutationPlan({ ...plan, restore: { ...RESTORE, driftsFromResult: true, confirmDrift: true } }).canApply).toBe(true);
+  });
+
+  test("a file that was recorded and is now gone has drifted, it is not simply absent", () => {
+    // Calling it absent would describe a missing file as an ordinary undo, while the writer
+    // refuses it pending confirmation. Absence is only honest when the row recorded absence too.
+    const vanished = buildMutationPlan({
+      ...RESTORE_BASE,
+      classified: { state: "conflict" },
+      parsed: {},
+      before: null,
+      restore: { ...RESTORE, driftsFromResult: true },
+    });
+    expect(vanished.state).toBe("conflict");
+    expect(vanished.refusalReason).toBe("drift_requires_confirm");
+
+    const recordedAbsent = buildMutationPlan({
+      ...RESTORE_BASE,
+      classified: { state: "absent" },
+      parsed: {},
+      before: null,
+      restore: { ...RESTORE, driftsFromResult: false },
+    });
+    expect(recordedAbsent.state).toBe("absent");
+    expect(recordedAbsent.canApply).toBe(true);
+  });
+});
+
+/** Every file under a directory with its bytes, so "nothing changed" is a comparison and not a claim. */
+function treeSnapshot(root: string): Record<string, string> {
+  const seen: Record<string, string> = {};
+  const walk = (dir: string): void => {
+    for (const name of readdirSync(dir).sort()) {
+      const full = join(dir, name);
+      if (statSync(full).isDirectory()) walk(full);
+      else seen[relative(root, full)] = readFileSync(full, "utf8");
+    }
+  };
+  walk(root);
+  return seen;
+}
+
+describe("integration preview writes nothing", () => {
+  test("planning an apply leaves the client file and the whole store untouched", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-preview-home-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-preview-store-"));
+    try {
+      const env = {} as NodeJS.ProcessEnv;
+      const { configPath, detectDir } = resolveIntegrationPaths("opencode", env, home);
+      // Fail loudly rather than reading somebody's real configuration: every client resolves
+      // through the home argument, and a client that stopped doing so must not be read here.
+      expect(configPath.startsWith(home), configPath).toBe(true);
+      mkdirSync(detectDir, { recursive: true });
+      mkdirSync(dirname(configPath), { recursive: true });
+      writeFileSync(configPath, "{}\n");
+
+      const store = createIntegrationStateStore(storeRoot);
+      // Maintenance a mutation would retry on its way through. A preview must leave it pending.
+      store.markPruneFailure("opencode", "seeded pending prune");
+      const homeBefore = treeSnapshot(home);
+      const storeBefore = treeSnapshot(storeRoot);
+
+      const plan = previewIntegration(
+        { clientId: "opencode", models: FIXTURE_MODELS, config: FIXTURE_CONFIG, port: 10100, env, home, store },
+        { operation: "apply" },
+      );
+
+      expect(plan.canApply).toBe(true);
+      expect(plan.changes.some(change => change.kind === "add")).toBe(true);
+      expect(plan.changes).toContainEqual({ kind: "journal", path: "$journal" });
+
+      // The whole promise of the feature, checked against the filesystem rather than asserted.
+      // The entire home rather than the target alone: a writer lock or a marker sibling would
+      // appear next to the file, not inside it, and that is exactly what must not happen here.
+      expect(treeSnapshot(home)).toEqual(homeBefore);
+      expect(treeSnapshot(storeRoot)).toEqual(storeBefore);
+      // Still pending, so the read path ran no maintenance.
+      expect(Object.keys(store.readMaintenance().pruneFailures)).toContain("opencode");
+
+      // A plan describes places, never contents or locations.
+      const serialized = JSON.stringify(plan);
+      expect(serialized).not.toContain(home);
+      expect(serialized).not.toContain("127.0.0.1");
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+
+  test("a pending client transaction is left exactly as found", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-preview-cline-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-preview-cline-store-"));
+    try {
+      const env = {} as NodeJS.ProcessEnv;
+      const { configPath, detectDir } = resolveIntegrationPaths("cline", env, home);
+      expect(configPath.startsWith(home), configPath).toBe(true);
+      mkdirSync(detectDir, { recursive: true });
+      mkdirSync(dirname(configPath), { recursive: true });
+      writeFileSync(configPath, "{}\n");
+
+      const store = createIntegrationStateStore(storeRoot);
+      const markerPath = clinePendingPath(store, configPath);
+      mkdirSync(dirname(markerPath), { recursive: true });
+      writeFileSync(markerPath, "{\"pending\":\"left over from an interrupted mutation\"}\n");
+
+      const homeBefore = treeSnapshot(home);
+      const storeBefore = treeSnapshot(storeRoot);
+
+      const plan = previewIntegration(
+        { clientId: "cline", models: FIXTURE_MODELS, config: FIXTURE_CONFIG, port: 10100, env, home, store },
+        { operation: "apply" },
+      );
+
+      // Recovery is a mutation. A preview reports what it found and repairs nothing, so the
+      // marker and its siblings survive byte for byte whatever the plan concluded.
+      expect(plan.version).toBe(1);
+      expect(treeSnapshot(home)).toEqual(homeBefore);
+      expect(treeSnapshot(storeRoot)).toEqual(storeBefore);
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+});
+
+describe("planning an undo reads the writer's specification", () => {
+  function seedRestore(home: string, storeRoot: string, targetText: string, recordedPath?: string) {
+    const store = createIntegrationStateStore(storeRoot);
+    const env = {} as NodeJS.ProcessEnv;
+    const { configPath, detectDir } = resolveIntegrationPaths("opencode", env, home);
+    expect(configPath.startsWith(home), configPath).toBe(true);
+    mkdirSync(detectDir, { recursive: true });
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeFileSync(configPath, targetText);
+    const opId = "op-seeded";
+    const snapshot = store.captureSnapshot("opencode", opId, "{}\n");
+    store.appendJournal({
+      opId,
+      clientId: "opencode",
+      kind: "apply",
+      at: "2026-01-01T00:00:00.000Z",
+      configPath: recordedPath ?? configPath,
+      snapshot,
+      resultFingerprint: fingerprint(targetText),
+      resultAbsent: false,
+      priorRecord: null,
+    } satisfies JournalEntry);
+    return { store, env, opId };
+  }
+
+  test("a target that cannot be parsed is exactly the one worth restoring", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-restore-parse-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-restore-parse-store-"));
+    try {
+      // The writer's undo reads bytes and never parses, so refusing here would deny an operator
+      // the backup at the moment the file is in the state that most needs one.
+      const { store, env, opId } = seedRestore(home, storeRoot, "{ this is not valid json");
+      const plan = previewIntegration(
+        { clientId: "opencode", models: FIXTURE_MODELS, config: FIXTURE_CONFIG, port: 10100, env, home, store },
+        { operation: "restore", opId },
+      );
+      expect(plan.refusalReason).toBeUndefined();
+      expect(plan.canApply).toBe(true);
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+
+  test("a row recorded against another location is refused rather than planned", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-restore-path-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-restore-path-store-"));
+    try {
+      // Path equality is the single thing the writer's undo exists to enforce: a row recorded for
+      // one home must never rewrite a file in another.
+      const { store, env, opId } = seedRestore(home, storeRoot, "{}\n", join(home, "elsewhere", "opencode.json"));
+      const plan = previewIntegration(
+        { clientId: "opencode", models: FIXTURE_MODELS, config: FIXTURE_CONFIG, port: 10100, env, home, store },
+        { operation: "restore", opId },
+      );
+      expect(plan.canApply).toBe(false);
+      expect(plan.refusalReason).toBe("conflict");
+      expect(plan.changes).toEqual([]);
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+});
+
+const MANAGED_PATHS = [["settings", "providers", "opencodex"]];
+
+describe("integration mutation plan: what an undo would change", () => {
+  const owned = { ...RECORD, fragmentPaths: MANAGED_PATHS };
+
+  test("undoing an initial apply takes the managed place back out", () => {
+    // There was no prior record, because nothing was ours before that apply. Reading only the
+    // prior record therefore described this undo as touching no managed place at all, while the
+    // undo removes the block it added.
+    const plan = buildMutationPlan({
+      ...PLAN_BASE,
+      operation: "restore",
+      classified: { state: "current" },
+      restore: { ...RESTORE, entry: { ...ENTRY, priorRecord: null } },
+      record: owned,
+      parsed: OCCUPIED,
+    });
+
+    expect(plan.changes).toContainEqual({ kind: "remove", path: "settings.providers.opencodex" });
+    expect(plan.changes.some(change => change.kind === "replace")).toBe(false);
+  });
+
+  test("undoing a disable adds back a place the document does not have", () => {
+    // The disable removed it, so the document has nothing there now. Calling that a replacement
+    // described a mutation of something that is not in the file.
+    const plan = buildMutationPlan({
+      ...PLAN_BASE,
+      operation: "restore",
+      classified: { state: "absent" },
+      restore: { ...RESTORE, entry: { ...ENTRY, kind: "disable", priorRecord: owned } },
+      record: null,
+      parsed: {},
+    });
+
+    expect(plan.changes).toContainEqual({ kind: "add", path: "settings.providers.opencodex" });
+    expect(plan.changes.some(change => change.kind === "replace")).toBe(false);
+  });
+
+  test("a place that is ours on both sides is replaced, and none of this publishes a value", () => {
+    const plan = buildMutationPlan({
+      ...PLAN_BASE,
+      operation: "restore",
+      classified: { state: "current" },
+      restore: { ...RESTORE, entry: { ...ENTRY, priorRecord: owned } },
+      record: owned,
+      parsed: OCCUPIED,
+    });
+
+    expect(plan.changes).toContainEqual({ kind: "replace", path: "settings.providers.opencodex" });
+    expect(plan.changes.some(change => change.kind === "remove" || change.kind === "add")).toBe(false);
+    // The plan names places, never what is in them or where the file lives.
+    expect(JSON.stringify(plan)).not.toContain(CANARY);
+    expect(JSON.stringify(plan)).not.toContain(CONFIG_PATH);
+  });
+});
+
+describe("planning an undo of work that actually happened", () => {
+  function realApply(home: string, storeRoot: string) {
+    const store = createIntegrationStateStore(storeRoot);
+    const env = {} as NodeJS.ProcessEnv;
+    const { configPath, detectDir } = resolveIntegrationPaths("opencode", env, home);
+    mkdirSync(detectDir, { recursive: true });
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeFileSync(configPath, "{}\n");
+    const input = { clientId: "opencode" as const, models: FIXTURE_MODELS, config: FIXTURE_CONFIG, port: 10100, env, home, store };
+    const applied = applyIntegration(input);
+    if (!applied.ok || !applied.opId) throw new Error("fixture apply failed");
+    return { input, configPath, applyOpId: applied.opId };
+  }
+
+  test("undoing a real apply reports taking the managed places back out", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-undo-apply-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-undo-apply-store-"));
+    try {
+      const { input, configPath, applyOpId } = realApply(home, storeRoot);
+      expect(readFileSync(configPath, "utf8")).toContain("opencodex");
+
+      // Every input this classification reads comes from the apply that just happened: the
+      // ownership record it wrote and the document it produced, not values a builder supplied.
+      const plan = previewIntegration(input, { operation: "restore", opId: applyOpId });
+
+      expect(plan.canApply).toBe(true);
+      expect(plan.changes.some(change => change.kind === "remove")).toBe(true);
+      expect(plan.changes.some(change => change.kind === "replace")).toBe(false);
+      expect(plan.changes.some(change => change.kind === "add")).toBe(false);
+
+      // And the undo does what the plan said: the managed block is gone from the file.
+      const restored = restoreIntegration({ ...input, opId: applyOpId });
+      expect(restored.ok).toBe(true);
+      expect(readFileSync(configPath, "utf8")).toBe("{}\n");
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+
+  test("undoing a real disable reports adding the managed places back", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-undo-disable-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-undo-disable-store-"));
+    try {
+      const { input, configPath } = realApply(home, storeRoot);
+      const disabled = disableIntegration(input);
+      if (!disabled.ok || !disabled.opId) throw new Error("fixture disable failed");
+      // The disable took the block out, so the document does not hold those places now.
+      expect(readFileSync(configPath, "utf8")).not.toContain("opencodex");
+
+      const plan = previewIntegration(input, { operation: "restore", opId: disabled.opId });
+
+      expect(plan.canApply).toBe(true);
+      expect(plan.changes.some(change => change.kind === "add")).toBe(true);
+      expect(plan.changes.some(change => change.kind === "replace")).toBe(false);
+
+      // And the undo does what the plan said: the managed block is back in the file.
+      const restored = restoreIntegration({ ...input, opId: disabled.opId });
+      expect(restored.ok).toBe(true);
+      expect(readFileSync(configPath, "utf8")).toContain("opencodex");
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+
+  test("a document that cannot be read leaves every place a replacement and refuses nothing", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-undo-unreadable-"));
+    const storeRoot = mkdtempSync(join(tmpdir(), "ocx-undo-unreadable-store-"));
+    try {
+      const { input, configPath } = realApply(home, storeRoot);
+      const disabled = disableIntegration(input);
+      if (!disabled.ok || !disabled.opId) throw new Error("fixture disable failed");
+      // Restore eligibility is a byte comparison and stays one: the document is descriptive here,
+      // so an unparseable file still plans, and the places it cannot speak for are replacements.
+      writeFileSync(configPath, "{ this is not valid json");
+
+      const plan = previewIntegration(input, { operation: "restore", opId: disabled.opId, confirmDrift: true });
+
+      expect(plan.refusalReason).toBeUndefined();
+      expect(plan.canApply).toBe(true);
+      // The same undo reported additions when the document was readable and empty of them. With
+      // nothing readable to ask, it says replacement rather than inventing an answer.
+      expect(plan.changes.some(change => change.kind === "replace")).toBe(true);
+      expect(plan.changes.some(change => change.kind === "add")).toBe(false);
+    } finally {
+      removeTreeWithRetry(home);
+      removeTreeWithRetry(storeRoot);
+    }
+  });
+});
diff --git a/tests/codex-integration/codex-account-store.test.ts b/tests/codex-integration/codex-account-store.test.ts
index f56bcf7014c..2fcb9538b4b 100644
--- a/tests/codex-integration/codex-account-store.test.ts
+++ b/tests/codex-integration/codex-account-store.test.ts
@@ -1040,7 +1040,11 @@ describe("codex-account-store CRUD", () => {
   });
 
   test("a forced refresh rotates a time-valid credential that upstream rejected (#2887)", async () => {
-    const { forceRefreshCodexPoolToken, readCodexAccountRecord, saveCodexAccountCredential } =
+    const {
+      forceRefreshCodexPoolToken,
+      readCodexAccountRecord,
+      saveCodexAccountCredential,
+    } =
       await import("../../src/codex/account-store");
     // Far beyond the refresh skew: getValidCodexToken would return this untouched, which is
     // exactly why a 401 on it was unrecoverable.
@@ -1153,7 +1157,12 @@ describe("codex-account-store CRUD", () => {
    * healthy account marked for reauthentication on behalf of a live request.
    */
   test("cancelling the caller that opened a refresh flight does not cancel a live joiner (#2892)", async () => {
-    const { forceRefreshCodexPoolToken, readCodexAccountRecord, saveCodexAccountCredential } =
+    const {
+      forceRefreshCodexPoolToken,
+      readCodexAccountRecord,
+      registerCodexRefreshGenerationHandoff,
+      saveCodexAccountCredential,
+    } =
       await import("../../src/codex/account-store");
     saveCodexAccountCredential("cancel-owner", {
       accessToken: "rejected",
@@ -1164,6 +1173,8 @@ describe("codex-account-store CRUD", () => {
     const generation = readCodexAccountRecord("cancel-owner")!.generation;
 
     const originalFetch = globalThis.fetch;
+    const handoffs: Array<[string, number, number]> = [];
+    const unregisterHandoff = registerCodexRefreshGenerationHandoff((...handoff) => handoffs.push(handoff));
     let sawAbort = false;
     let calls = 0;
     let releaseFetch: (() => void) | undefined;
@@ -1203,7 +1214,11 @@ describe("codex-account-store CRUD", () => {
       expect(joined.accessToken).toBe("rotated");
       expect(calls).toBe(1);
       expect(readCodexAccountRecord("cancel-owner")!.credential!.accessToken).toBe("rotated");
+      // Completion is attached to the detached flight, not to either request's wait.
+      // The cancelled owner therefore cannot strand process-local affinities at G.
+      expect(handoffs).toEqual([["cancel-owner", generation, generation + 1]]);
     } finally {
+      unregisterHandoff();
       globalThis.fetch = originalFetch;
     }
   });
@@ -1707,6 +1722,105 @@ describe("codex-account-store CRUD", () => {
     }
   });
 
+  test("a propagated alias gets its own generation handoff from the shared flight (#5135 review)", async () => {
+    // Thread-affinity entries are generation-fenced, and a dormant alias commits at its OWN
+    // generation when it adopts the rotated credential. Handing off only the owner leaves the
+    // alias's affinities at alias.generation - 1, where the exact-generation liveness check
+    // fails them on the next request.
+    const {
+      getValidCodexToken,
+      readCodexAccountRecord,
+      registerCodexRefreshGenerationHandoff,
+      saveCodexAccountCredential,
+    } = await import("../../src/codex/account-store");
+    const shared = { accessToken: "aff-old", refreshToken: "aff-grant", expiresAt: 0, chatgptAccountId: "acc" };
+    saveCodexAccountCredential("aff-owner", { ...shared });
+    saveCodexAccountCredential("aff-alias", { ...shared });
+    const ownerGeneration = readCodexAccountRecord("aff-owner")!.generation;
+    const aliasGeneration = readCodexAccountRecord("aff-alias")!.generation;
+
+    const handoffs: Array<[string, number, number]> = [];
+    const unregisterHandoff = registerCodexRefreshGenerationHandoff((...handoff) => handoffs.push(handoff));
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () => Response.json({
+      access_token: "aff-new",
+      refresh_token: "aff-rotated",
+      expires_in: 3600,
+    })) as typeof fetch;
+
+    try {
+      await getValidCodexToken("aff-owner");
+
+      expect(handoffs).toEqual([
+        ["aff-owner", ownerGeneration, ownerGeneration + 1],
+        ["aff-alias", aliasGeneration, aliasGeneration + 1],
+      ]);
+    } finally {
+      unregisterHandoff();
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("a throwing handoff cannot fail the flight, starve other handoffs, or skip plan reconciliation (#5135 review)", async () => {
+    // Handoffs run after the rotated credential is already persisted, so a listener failure
+    // surfacing through the shared refreshPromise would report a refresh that never failed to
+    // every surviving waiter — and would skip both the remaining listeners and the plan note.
+    const {
+      getValidCodexToken,
+      readCodexAccountRecord,
+      registerCodexRefreshGenerationHandoff,
+      saveCodexAccountCredential,
+    } = await import("../../src/codex/account-store");
+    const { loadConfig, saveConfig } = await import("../../src/config");
+    const { resetJwtPlanNotesForTests } = await import("../../src/codex/plan-from-token");
+    resetJwtPlanNotesForTests();
+
+    saveConfig({
+      port: 10199,
+      providers: {},
+      defaultProvider: "openai",
+      codexAccounts: [{ id: "fragile-flight", email: "fragile@example.test", plan: "plus", isMain: false }],
+    });
+    saveCodexAccountCredential("fragile-flight", {
+      accessToken: planJwt("plus"),
+      refreshToken: "fragile-grant",
+      expiresAt: 0,
+      chatgptAccountId: "acct-plan-flight",
+    });
+    const generation = readCodexAccountRecord("fragile-flight")!.generation;
+
+    const handoffs: Array<[string, number, number]> = [];
+    // Registered first so it runs first: the recording listener behind it must still fire.
+    const unregisterThrowing = registerCodexRefreshGenerationHandoff(() => {
+      throw new Error("listener exploded");
+    });
+    const unregisterRecording = registerCodexRefreshGenerationHandoff((...handoff) => handoffs.push(handoff));
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () => Response.json({
+      access_token: planJwt("pro"),
+      refresh_token: "fragile-rotated",
+      expires_in: 3600,
+    })) as typeof fetch;
+
+    try {
+      const result = await getValidCodexToken("fragile-flight");
+
+      expect(result.accessToken).toBe(planJwt("pro"));
+      expect(readCodexAccountRecord("fragile-flight")!.credential?.refreshToken).toBe("fragile-rotated");
+      expect(handoffs).toEqual([["fragile-flight", generation, generation + 1]]);
+      // Plan reconciliation sits behind the handoffs in the same settlement and must still run.
+      expect(loadConfig().codexAccounts?.[0]?.plan).toBe("pro");
+      expect(loadConfig().codexAccounts?.[0]?.planSource).toBe("jwt");
+    } finally {
+      unregisterThrowing();
+      unregisterRecording();
+      warn.mockRestore();
+      globalThis.fetch = originalFetch;
+      resetJwtPlanNotesForTests();
+    }
+  });
+
 });
 
 describe("shared refresh flight plan reconciliation (#2892 gap 2 follow-up)", () => {
diff --git a/tests/codex-integration/codex-auth-api.test.ts b/tests/codex-integration/codex-auth-api.test.ts
index d02474985e4..ab750aa06d0 100644
--- a/tests/codex-integration/codex-auth-api.test.ts
+++ b/tests/codex-integration/codex-auth-api.test.ts
@@ -1,5 +1,6 @@
 import { registerWarmupRateLimitCases } from "../helpers/codex-warmup-rate-limit";
 import { registerResetCreditConsumeValidationTests } from "../helpers/reset-credit-consume-validation";
+import { registerPoolReauthCauseCases } from "../helpers/pool-reauth-cause";
 import * as usageHistoryModule from "../../src/usage/log";
 import { getAccountQuotaHistory } from "../../src/codex/quota";
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
@@ -2090,6 +2091,8 @@ describe("codex-auth API", () => {
     expect(existsSync(join(TEST_DIR, "config.json"))).toBe(false);
   });
 
+  registerPoolReauthCauseCases(makeConfig, seedPoolAccount);
+
   test("pool plan refresh batches multiple authoritative changes into one config save", async () => {
     const config = makeConfig();
     seedPoolAccount(config, { id: "pool-plan-a", email: "pool-plan-a@example.com", plan: "plus" });
@@ -5337,14 +5340,17 @@ describe("codex-auth API", () => {
     if (restart) clearAccountNeedsReauth(accountId);
     const rows = await listCodexAuthAccounts(config, false);
     const authFailed = !replace && (status === 401 || status === 403);
+    // The stored verdict's own http status names the cause whether or not the in-memory
+    // mark still exists; a bare mark no longer flattens the projection to refresh_failed.
+    const expectedReason = status === 403 ? "forbidden" : "unauthorized";
     const row = rows.find(entry => entry.id === accountId);
     expect(row).toMatchObject({
       needsReauth: authFailed,
-      health: { status: authFailed ? "reauth_required" : "warning", reason: authFailed ? "refresh_failed" : "validation_pending" },
+      health: { status: authFailed ? "reauth_required" : "warning", reason: authFailed ? expectedReason : "validation_pending" },
     });
     // The reason travels with the state, so an operator reading the account surface can tell a
     // failed refresh from a pending validation without inferring it from `health` (#4212).
-    if (authFailed) expect(row).toMatchObject({ reauthReason: "refresh_failed" });
+    if (authFailed) expect(row).toMatchObject({ reauthReason: expectedReason });
     else expect(row).not.toHaveProperty("reauthReason");
     fail = false;
     await refresh();
diff --git a/tests/codex-integration/codex-catalog-sync-hardening.test.ts b/tests/codex-integration/codex-catalog-sync-hardening.test.ts
index df4d08bd0f1..5dc015d702f 100644
--- a/tests/codex-integration/codex-catalog-sync-hardening.test.ts
+++ b/tests/codex-integration/codex-catalog-sync-hardening.test.ts
@@ -228,8 +228,13 @@ describe("Codex catalog sync hardening", () => {
       expect(passes).toHaveLength(2);
       expect(passes[0]!.written).toBe(true);
       expect(passes[1]!.catalog).toEqual(passes[0]!.catalog);
+      // The first pass rewrites both files; the second reproduces byte-identical content,
+      // so the cache no-op guard skips it and must report that honestly. This is the same
+      // no-op the catalog half already asserts above, and it is what keeps the startup
+      // stale-app-server warning from firing on a start where nothing changed.
+      expect(passes[0]!.invalidated).toBe(true);
+      expect(passes[1]!.invalidated).toBe(false);
       for (const pass of passes) {
-        expect(pass.invalidated).toBe(true);
         for (const rows of [pass.catalog, pass.cache]) {
           expect(rows.some(row => row.slug === "gpt-5.3-codex-spark" || row.slug.endsWith("/gpt-5.3-codex-spark"))).toBe(false);
           expect(rows.some(row => row.slug === "desktop/gpt-future-native")).toBe(true);
@@ -1307,6 +1312,59 @@ describe("Codex catalog sync hardening", () => {
     expect(out.realChangeBumpedMtime).toBe(true);
   }, 15_000);
 
+  test("an identical cache resync leaves models_cache untouched, so the startup stale warning stays quiet", () => {
+    // `refreshCodexModelCatalog` reports `invalidateCodexModelsCache`'s return value as
+    // `cacheSynced`, and `handleStart` ORs that into the stale-app-server warning. The
+    // catalog got this no-op rule in #1459/#1460, but the models cache kept rewriting
+    // identical bytes and returning true on every `ocx start`, so the warning announced
+    // "Disk catalog/cache were updated" and told the operator their Codex model list might
+    // be stale on a start where nothing on disk had changed.
+    const catalogPath = join(codexHome, "catalog.json");
+    const cachePath = join(codexHome, "models_cache.json");
+    writeFileSync(join(codexHome, "config.toml"), 'model_catalog_json = "catalog.json"\n', "utf8");
+    writeFileSync(catalogPath, JSON.stringify({
+      models: [nativeEntry("gpt-5.5", 0)],
+    }, null, 2) + "\n");
+
+    const r = runScript(codexHome, opencodexHome, `
+      const { statSync, readFileSync } = require("node:fs");
+      const { syncCatalogModels, invalidateCodexModelsCache } = require("./src/codex/catalog");
+      const path = ${JSON.stringify(cachePath)};
+      const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+      (async () => {
+        await syncCatalogModels({ providers: {} });
+        const first = invalidateCodexModelsCache();
+        const afterFirst = statSync(path).mtimeMs;
+        const bytesAfterFirst = readFileSync(path, "utf8");
+        await sleep(1100);
+        await syncCatalogModels({ providers: {} });
+        const second = invalidateCodexModelsCache();
+        const afterSecond = statSync(path).mtimeMs;
+        console.log(JSON.stringify({
+          firstWritten: first,
+          secondWritten: second,
+          identicalResyncKeptMtime: afterFirst === afterSecond,
+          bytesUnchanged: readFileSync(path, "utf8") === bytesAfterFirst,
+        }));
+      })();
+    `);
+    expect(r.status, r.stderr).toBe(0);
+
+    const out = JSON.parse(r.stdout) as {
+      firstWritten: boolean;
+      secondWritten: boolean;
+      identicalResyncKeptMtime: boolean;
+      bytesUnchanged: boolean;
+    };
+    // The first pass is a real change (the bare catalog is rewritten into Codex's cache
+    // wrapper), so it must still write. That is what keeps this test from passing on a
+    // guard that simply refuses every write.
+    expect(out.firstWritten).toBe(true);
+    expect(out.secondWritten).toBe(false);
+    expect(out.identicalResyncKeptMtime).toBe(true);
+    expect(out.bytesUnchanged).toBe(true);
+  }, 20_000);
+
   test("the no-op guard compares bytes, so a malformed byte decoding to U+FFFD is still repaired", () => {
     // The guard above must not preserve corruption. `readFileSync(path, "utf8")`
     // substitutes U+FFFD for every invalid byte, so a catalog holding a bare 0x80
diff --git a/tests/codex-integration/codex-desired-state.test.ts b/tests/codex-integration/codex-desired-state.test.ts
index 92651f2293b..91991670298 100644
--- a/tests/codex-integration/codex-desired-state.test.ts
+++ b/tests/codex-integration/codex-desired-state.test.ts
@@ -23,6 +23,7 @@ import {
   shouldSyncGrokOnStart,
   syncCodexOnStartIfEnabled,
 } from "../../src/codex/desired-state";
+import { createReadinessGate } from "../../src/server/readiness";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
@@ -268,6 +269,33 @@ describe("the startup gate", () => {
     expect(ran.catalogWritten).toBe(false);
     expect(ran.cacheSynced).toBe(false);
   });
+
+  /**
+   * #5181. The gate is driven from here, so the boundary is worth pinning at the caller and not
+   * only in `runStartupReadinessSync`: a catalog-sync warning describes artifacts in the local
+   * Codex home, and the proxy that failed to write them is still serving every other provider.
+   * Treating it as terminal is what removed the only Service endpoint in a single-replica
+   * Kubernetes deployment. The sync's own `ok` remains the verdict.
+   */
+  test("a catalog-sync warning leaves the gate ready; only ok=false fails it", async () => {
+    const degraded = createReadinessGate();
+    await syncCodexOnStartIfEnabled(
+      10100,
+      {},
+      async () => ({ ok: true, warning: "catalog sync skipped: no Codex catalog source found." }),
+      degraded,
+    );
+    expect(degraded.getStatus()).toBe("ready");
+
+    const refused = createReadinessGate();
+    await syncCodexOnStartIfEnabled(
+      10100,
+      {},
+      async () => ({ ok: false }),
+      refused,
+    );
+    expect(refused.getStatus()).toBe("failed");
+  });
 });
 
 describe("Grok has the same durability, because it shipped without it", () => {
diff --git a/tests/codex-integration/codex-history-provider.test.ts b/tests/codex-integration/codex-history-provider.test.ts
index f4e12190830..06b7a5e39e4 100644
--- a/tests/codex-integration/codex-history-provider.test.ts
+++ b/tests/codex-integration/codex-history-provider.test.ts
@@ -196,6 +196,19 @@ describe("Codex history provider sync", () => {
     expect(preflightCodexHistoryInjection(true, false, fixture.dbPath)).toBeNull();
     expect(existsSync(fixture.backupPath)).toBe(false);
   });
+  test("injection preflight refuses a paginated openai row that scans after a paginated opencodex row", () => {
+    const fixture = makeFixture({ includeLegacy: true });
+    noopSnapshotArtifacts.add(join(fixture.dbPath, ".."));
+    const db = new Database(fixture.dbPath);
+    db.run("ALTER TABLE threads ADD COLUMN history_mode TEXT DEFAULT 'legacy'");
+    // The provider-table target set has no ORDER BY: the paginated opencodex row scans
+    // first and must not stand the check down before the paginated openai row is seen.
+    db.run("UPDATE threads SET model_provider='opencodex', history_mode='paginated' WHERE id='thread-1'");
+    db.run("UPDATE threads SET model_provider='openai', history_mode='paginated' WHERE id='thread-3'");
+    db.close();
+    expect(preflightCodexHistoryInjection(true, true, fixture.dbPath)).toBe("history_paginated_openai_requires_native_writer");
+    expect(existsSync(fixture.backupPath)).toBe(false);
+  });
 
   for (const marker of ["ordinal", "history_mode"] as const) {
     test(`refuses paginated ${marker} before routing any row or writing a manifest`, () => {
diff --git a/tests/codex-integration/codex-inject-integration.test.ts b/tests/codex-integration/codex-inject-integration.test.ts
index a78c16b8fd0..75fc7b8217e 100644
--- a/tests/codex-integration/codex-inject-integration.test.ts
+++ b/tests/codex-integration/codex-inject-integration.test.ts
@@ -15,6 +15,7 @@ import { removeTreeWithRetry } from "../helpers/remove-tree";
 const repoRoot = dirname(fileURLToPath(new URL("../../package.json", import.meta.url)));
 
 setDefaultTimeout(SPAWN_BUDGET_MS);
+console.error('ocx-startup-diagnostic:{"file":"codex-inject-integration","phase":"file_imported"}');
 
 // Reads back what a TOML consumer would see for a top-level string key. A Windows path
 // is stored with escaped separators, so the raw file text never contains the unescaped path.
@@ -82,8 +83,10 @@ describe("injectCodexConfig integration (Design B)", () => {
   let ocxHome: string;
 
   beforeEach(() => {
+    console.error('ocx-startup-diagnostic:{"file":"codex-inject-integration","phase":"before_each_entered"}');
     codexHome = realpathSync.native(mkdtempSync(join(tmpdir(), "ocx-inject-codex-")));
     ocxHome = realpathSync.native(mkdtempSync(join(tmpdir(), "ocx-inject-home-")));
+    console.error('ocx-startup-diagnostic:{"file":"codex-inject-integration","phase":"before_each_ready"}');
   });
 
   afterEach(() => {
@@ -168,6 +171,7 @@ describe("injectCodexConfig integration (Design B)", () => {
   const unreadablePreimages =
     process.platform === "win32" || process.getuid?.() === 0 ? test.skip : test;
   unreadablePreimages("unreadable preimages abort capture and remain visible as compensation failures", () => {
+    console.error('ocx-startup-diagnostic:{"file":"codex-inject-integration","phase":"unreadable_preimages_entered"}');
     const script = `
       const fs = require("node:fs");
       const { join } = require("node:path");
@@ -200,10 +204,41 @@ describe("injectCodexConfig integration (Design B)", () => {
       allow();
       console.log(JSON.stringify({unreadable,captureCode,restored,outcomes,unchangedAfterEach,preserved}));
     `;
+    console.error('ocx-startup-diagnostic:{"file":"codex-inject-integration","phase":"unreadable_preimages_setup_complete"}');
+    const childStartedAt = performance.now();
+    console.error(`ocx-startup-diagnostic:${JSON.stringify({
+      file: "codex-inject-integration",
+      phase: "unreadable_preimages_child_started",
+      deadlineMs: SPAWN_BUDGET_MS - 5_000,
+    })}`);
     const child = spawnSync(process.execPath, ["--eval", script], {
       cwd: repoRoot, env: { ...process.env, CODEX_HOME: codexHome, OPENCODEX_HOME: ocxHome },
       encoding: "utf8", timeout: SPAWN_BUDGET_MS - 5_000,
     });
+    const elapsedMs = Math.min(600_000, Math.max(0, Math.round(performance.now() - childStartedAt)));
+    const status = typeof child.status === "number"
+      && Number.isSafeInteger(child.status)
+      && child.status >= 0
+      && child.status <= 255
+      ? child.status
+      : null;
+    const signal = child.signal === null
+      ? null
+      : child.signal === "SIGTERM" || child.signal === "SIGKILL"
+        ? child.signal
+        : "OTHER";
+    const rawErrorCode = child.error && "code" in child.error
+      ? String((child.error as NodeJS.ErrnoException).code ?? "")
+      : "";
+    const errorCode = rawErrorCode === "" ? null : rawErrorCode === "ETIMEDOUT" ? "ETIMEDOUT" : "OTHER";
+    console.error(`ocx-startup-diagnostic:${JSON.stringify({
+      file: "codex-inject-integration",
+      phase: "unreadable_preimages_child_returned",
+      elapsedMs,
+      status,
+      signal,
+      errorCode,
+    })}`);
     expect(child.status, child.stderr).toBe(0);
     expect(JSON.parse(child.stdout)).toEqual({
       unreadable: true, captureCode: "EACCES", restored: { complete: false, unrestored: ["profile"] }, outcomes: [true, true, true], unchangedAfterEach: [true, true, true], preserved: true,
@@ -749,6 +784,28 @@ describe("injectCodexConfig integration (Design B)", () => {
     expect(restoredRowBytes).toBe(rowBytes);
   });
 
+  test("a provider-table transition refuses rather than strand a paginated openai thread", () => {
+    const original = 'model_provider = "openai"\n# >>> opencodex managed openai_base_url >>>\nopenai_base_url = "http://127.0.0.1:10100/v1"\n# <<< opencodex managed openai_base_url <<<\n';
+    const configPath = join(codexHome, "config.toml");
+    writeFileSync(configPath, original);
+    const rollout = join(codexHome, "openai-paginated.jsonl");
+    const bytes = JSON.stringify({ ordinal: 0, type: "session_meta", payload: { id: "fixture", history_mode: "paginated", model_provider: "openai" } }) + "\n";
+    writeFileSync(rollout, bytes);
+    const db = new Database(join(codexHome, "state_5.sqlite"));
+    db.run("CREATE TABLE threads (id TEXT, rollout_path TEXT, model_provider TEXT, history_mode TEXT)");
+    db.run("INSERT INTO threads VALUES ('fixture', ?, 'openai', 'paginated')", rollout);
+    db.close();
+
+    const result = runInject(codexHome, ocxHome, JSON.stringify({ codexDesktopAuthless: true }));
+    expect(result.status, result.stderr).toBe(0);
+    expect(JSON.parse(result.stdout)).toMatchObject({
+      success: false,
+      historyPreflightFailureReason: "history_paginated_openai_requires_native_writer",
+    });
+    expect(readFileSync(configPath, "utf8")).toBe(original);
+    expect(readFileSync(rollout, "utf8")).toBe(bytes);
+  });
+
   test("a paginated home still receives the model catalog path the picker reads", () => {
     // The user-visible regression this pins. A paginated rollout made the injector refuse
     // the whole write, so `model_catalog_json` never reached config.toml: the Codex app and
diff --git a/tests/codex-integration/codex-model-denial-evidence.test.ts b/tests/codex-integration/codex-model-denial-evidence.test.ts
index bc1f7067de4..18e12f7d44b 100644
--- a/tests/codex-integration/codex-model-denial-evidence.test.ts
+++ b/tests/codex-integration/codex-model-denial-evidence.test.ts
@@ -6,12 +6,16 @@ import {
   resetCodexModelEntitlementCacheForTests,
   seedCodexModelEntitlementsForTests,
 } from "../../src/codex/model-entitlements";
+import { setObservedDenialGenerationCheck } from "../../src/codex/observed-model-denials";
 import {
   codexUnsupportedModelFromDetail,
   isAllowListedCodexAccountModel400,
   shouldRetryCodexPoolAccountModel400,
 } from "../../src/server/responses/core-codex-account";
 
+/** Credential generation these fixtures record under (#4952). */
+const GEN = 1;
+
 const TEST_CLIENT_VERSION = "0.146.0";
 const DAYBREAK = "gpt-daybreak-blue-latest";
 const SOL = "gpt-5.6-sol";
@@ -55,7 +59,7 @@ describe("upstream refusal as per-account model denial evidence", () => {
     // selection sees nothing and picks the Free account on quota.
     expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
 
-    recordCodexModelDenialEvidence("free", SOL, now);
+    recordCodexModelDenialEvidence("free", SOL, GEN, now);
 
     expect([...(cachedDeniedCodexAccountIdsForModel(SOL, now) ?? [])]).toEqual(["free"]);
     // Model-scoped: refusing Sol says nothing about Astra on the same account.
@@ -64,7 +68,7 @@ describe("upstream refusal as per-account model denial evidence", () => {
 
   test("a confirmed roster grant outranks an earlier refusal", () => {
     const now = 1_800_000_000_000;
-    recordCodexModelDenialEvidence("plus", ASTRA, now);
+    recordCodexModelDenialEvidence("plus", ASTRA, GEN, now);
     expect([...(cachedDeniedCodexAccountIdsForModel(ASTRA, now) ?? [])]).toEqual(["plus"]);
 
     // A rollout reached the account. The newer answer wins, so a refusal cannot strand an
@@ -75,10 +79,10 @@ describe("upstream refusal as per-account model denial evidence", () => {
 
   test("a success clears the refusal for that pair only", () => {
     const now = 1_800_000_000_000;
-    recordCodexModelDenialEvidence("free", SOL, now);
-    recordCodexModelDenialEvidence("free", ASTRA, now);
+    recordCodexModelDenialEvidence("free", SOL, GEN, now);
+    recordCodexModelDenialEvidence("free", ASTRA, GEN, now);
 
-    clearCodexModelDenialEvidence("free", SOL);
+    clearCodexModelDenialEvidence("free", SOL, GEN);
 
     expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
     expect([...(cachedDeniedCodexAccountIdsForModel(ASTRA, now) ?? [])]).toEqual(["free"]);
@@ -86,7 +90,7 @@ describe("upstream refusal as per-account model denial evidence", () => {
 
   test("refusal evidence expires, and outlives the five-minute roster window", () => {
     const now = 1_800_000_000_000;
-    recordCodexModelDenialEvidence("free", SOL, now);
+    recordCodexModelDenialEvidence("free", SOL, GEN, now);
 
     // The roster TTL is where #4797's evidence disappeared. This must still be answering there.
     expect([...(cachedDeniedCodexAccountIdsForModel(SOL, now + 5 * 60_000 + 1) ?? [])])
@@ -99,8 +103,8 @@ describe("upstream refusal as per-account model denial evidence", () => {
 
   test("only always-visible natives are recorded, so a 400 elsewhere cannot steer routing", () => {
     const now = 1_800_000_000_000;
-    recordCodexModelDenialEvidence("free", "gpt-5.5", now);
-    recordCodexModelDenialEvidence("free", DAYBREAK, now);
+    recordCodexModelDenialEvidence("free", "gpt-5.5", GEN, now);
+    recordCodexModelDenialEvidence("free", DAYBREAK, GEN, now);
 
     expect(cachedDeniedCodexAccountIdsForModel("gpt-5.5", now)).toBeUndefined();
     // Daybreak is account-gated and fails closed through the eligibility path instead.
@@ -109,7 +113,7 @@ describe("upstream refusal as per-account model denial evidence", () => {
 
   test("an excluded account stays unknown rather than denied", () => {
     const now = 1_800_000_000_000;
-    recordCodexModelDenialEvidence("free", SOL, now);
+    recordCodexModelDenialEvidence("free", SOL, GEN, now);
 
     // The native-main read fence: an excluded account must produce the selection it does today.
     expect(cachedDeniedCodexAccountIdsForModel(SOL, now, {
@@ -179,3 +183,151 @@ describe("unsupported-model refusal detection", () => {
     )).toBe(false);
   });
 });
+
+// ─── Credential generation (#4952) ───────────────────────────────────────────
+//
+// Denial evidence is about a CREDENTIAL, not an account id. Reauthenticating the
+// same internal account keeps the id and increments the generation, and can swap
+// the subscription underneath it — so a refusal earned by the old credential must
+// not steer routing away from the replacement. The account-wide forget that used
+// to be relied on sits behind a condition requiring a previously cached roster,
+// so with no roster it never runs; these pin the store's own behaviour instead.
+
+describe("denial evidence is scoped to the credential generation (#4952)", () => {
+  beforeEach(() => {
+    resetCodexModelEntitlementCacheForTests();
+  });
+
+  /** The liveness seam is a factory so one lookup loads the credential store once. */
+  function onlyGenerationIsLive(live: number): void {
+    setObservedDenialGenerationCheck(() => (_id, generation) => generation === live);
+  }
+
+  test("evidence from a superseded credential stops denying the replacement", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("pooled", SOL, 1, now);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["pooled"]));
+
+    // The account reauthenticates: same id, generation 1 is no longer live.
+    onlyGenerationIsLive(2);
+
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
+  });
+
+  test("a late refusal from the old generation cannot deny the replacement", () => {
+    const now = Date.now();
+    // The replacement has already been refused and re-granted, so nothing is recorded
+    // for generation 2 — then generation 1's in-flight 400 finally lands.
+    onlyGenerationIsLive(2);
+    recordCodexModelDenialEvidence("pooled", SOL, 1, now);
+
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
+  });
+
+  test("a late refusal cannot overwrite newer evidence", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("pooled", SOL, 2, now);
+    // Generation 1's refusal arrives afterwards; it must not take the entry back a
+    // generation, which would make it vanish the moment the reader checks liveness.
+    recordCodexModelDenialEvidence("pooled", SOL, 1, now);
+
+    onlyGenerationIsLive(2);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["pooled"]));
+  });
+
+  test("a late success from the old generation cannot clear newer evidence", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("pooled", SOL, 2, now);
+    // Generation 1's 200 lands after generation 2 was refused. Clearing here would
+    // re-admit an account that the current credential has just been refused by.
+    clearCodexModelDenialEvidence("pooled", SOL, 1);
+
+    onlyGenerationIsLive(2);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["pooled"]));
+  });
+
+  test("a success from the same generation still clears, which is the ordinary case", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("pooled", SOL, 2, now);
+    clearCodexModelDenialEvidence("pooled", SOL, 2);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
+  });
+
+  // A `main-pool` context — the stored main login taking part in rotation — has a real account
+  // id and NO pool credential generation, because its credential lives in auth.json. Dropping
+  // its evidence would silently revert #4906 for that account: the pool would re-send the model
+  // the login just refused, on every request. Its evidence is account-scoped instead.
+  test("evidence with no generation is account-scoped, not discarded", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("main-pool-account", SOL, undefined, now);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["main-pool-account"]));
+  });
+
+  test("account-scoped evidence is not expired by a pool generation rolling over", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("main-pool-account", SOL, undefined, now);
+    // No generation was ever claimed, so there is nothing for the liveness fence to supersede.
+    onlyGenerationIsLive(7);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["main-pool-account"]));
+  });
+
+  test("an account-scoped success clears account-scoped evidence", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("main-pool-account", SOL, undefined, now);
+    clearCodexModelDenialEvidence("main-pool-account", SOL, undefined);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toBeUndefined();
+  });
+
+  // The write fence has to reject a stale refusal BEFORE it mutates the map, not only when the
+  // same key already holds newer evidence. With no entry for its own key the stale row would be
+  // inserted, and at the entry bound the insert evicts the oldest valid row — which no later
+  // read fence can restore, because the evidence is simply gone.
+  test("a stale refusal for an unseen key cannot evict valid evidence at the entry bound", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("first-pooled", SOL, 2, now);
+    for (let i = 0; i < 511; i++) recordCodexModelDenialEvidence(`filler-${i}`, SOL, 2, now);
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)?.has("first-pooled")).toBe(true);
+
+    // Generation 1 is dead and this account has no entry of its own. The insert would take the
+    // map to 513 and evict the oldest row, which is the valid one recorded first.
+    onlyGenerationIsLive(2);
+    recordCodexModelDenialEvidence("late-stale", SOL, 1, now);
+
+    const denied = cachedDeniedCodexAccountIdsForModel(SOL, now);
+    expect(denied?.has("first-pooled")).toBe(true);
+    expect(denied?.has("late-stale")).toBe(false);
+  });
+
+  // The issue asks for identity validation AFTER the exclusion read fence. An excluded account
+  // — a draining profile switch, or a request-owned credential — must not cause a credential
+  // store read on its behalf, and must stay unknown rather than denied.
+  test("an excluded account is skipped before the liveness check reads anything", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("excluded", SOL, 1, now);
+    let lookups = 0;
+    setObservedDenialGenerationCheck(() => {
+      lookups += 1;
+      return () => true;
+    });
+
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now, {
+      excludeAccountIds: new Set(["excluded"]),
+    })).toBeUndefined();
+    expect(lookups).toBe(0);
+  });
+
+  test("the credential store is opened at most once per lookup", () => {
+    const now = Date.now();
+    recordCodexModelDenialEvidence("pool-a", SOL, 1, now);
+    recordCodexModelDenialEvidence("pool-b", SOL, 1, now);
+    recordCodexModelDenialEvidence("pool-c", SOL, 1, now);
+    let opens = 0;
+    setObservedDenialGenerationCheck(() => {
+      opens += 1;
+      return () => true;
+    });
+
+    expect(cachedDeniedCodexAccountIdsForModel(SOL, now)).toEqual(new Set(["pool-a", "pool-b", "pool-c"]));
+    expect(opens).toBe(1);
+  });
+});
diff --git a/tests/codex-integration/codex-prompt-route.test.ts b/tests/codex-integration/codex-prompt-route.test.ts
index feb38632db2..ec90891f2a5 100644
--- a/tests/codex-integration/codex-prompt-route.test.ts
+++ b/tests/codex-integration/codex-prompt-route.test.ts
@@ -1520,5 +1520,46 @@ describe("020 coverage completions", () => {
     expect(res.body.code).toBe("invalid_body");
   });
 
+  test("41. unmapped layers stay distinct from the unprintable base prompt", async () => {
+    // "not-exposed" is the base prompt's contract: it is confirmed to travel
+    // outside the printable message list, and the GUI renders a
+    // base-prompt-specific explanation for it. Reusing that reason for layers
+    // whose tag the extractor has not verified showed that explanation on
+    // unrelated layers.
+    const fx = fixture("");
+    // The probe reads the base prompt from CODEX_HOME - the decoy here, whose
+    // sentinel config selects model "sentinel". A catalog row that publishes
+    // only an instructions_template makes the base confirmed unprintable, so
+    // base-instructions must report "not-exposed" while the tag-less layers
+    // report "unmapped".
+    writeFileSync(join(fx.decoyHome, "opencodex-catalog.json"), JSON.stringify({
+      models: [{ slug: "sentinel", model_messages: { instructions_template: "template {{unprintable}}" } }],
+    }), "utf8");
+    const probeOutput = JSON.stringify([{
+      type: "message",
+      role: "developer",
+      content: [{ type: "input_text", text: "<skills_instructions>Skill text.</skills_instructions>" }],
+    }]);
+    setPromptTextProbeCommandForTests({
+      binary: process.execPath,
+      args: ["-e", `process.stdout.write(${JSON.stringify(probeOutput)});`],
+    });
+
+    const res = await call("GET", "/api/codex-prompt/text", fx);
+    expect(res.status).toBe(200);
+    expect(res.body.ok).toBe(true);
+    expect(res.body.base.representation).toBe("template");
+    expect(res.body.layers["base-instructions"].reason).toBe("not-exposed");
+    // Mirrors UNMAPPED_LAYER_IDS in prompt-text-probe.ts.
+    for (const id of [
+      "model-switch", "context-window-guidance", "environments-instructions",
+      "tools", "multi-agent-mode", "personality", "realtime", "collaboration",
+      "git-attribution",
+    ]) {
+      expect(res.body.layers[id]?.reason).toBe("unmapped");
+    }
+    expectDecoyUntouched(fx);
+  });
+
 
 });
diff --git a/tests/codex-integration/codex-prompt-text-probe.test.ts b/tests/codex-integration/codex-prompt-text-probe.test.ts
index 58df48c1c11..3d7b756dfa5 100644
--- a/tests/codex-integration/codex-prompt-text-probe.test.ts
+++ b/tests/codex-integration/codex-prompt-text-probe.test.ts
@@ -613,6 +613,38 @@ describe("prompt probe process lifecycle", () => {
   });
 });
 
+describe("unmapped layers", () => {
+  test("a layer with no confirmed tag reports unmapped, not the base prompt's not-exposed", async () => {
+    // UNMAPPED_LAYER_IDS used to reuse "not-exposed", which is the base prompt's
+    // contract: the GUI renders a base-prompt-specific explanation for it. A
+    // layer the extractor simply has no verified tag for is a smaller claim.
+    const home = promptHome({
+      "config.toml": "model = \"gpt-test\"\n",
+      "opencodex-catalog.json": catalogJson([{ slug: "gpt-test", base_instructions: "Base prompt body." }]),
+    });
+    const previousHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = home;
+    setPromptTextProbeCommandForTests({
+      binary: process.execPath,
+      args: ["-e", `process.stdout.write(${JSON.stringify(VALID_PROBE_OUTPUT)})`],
+    });
+    try {
+      const result = await probePromptText(2_000);
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.layers["personality"]).toMatchObject({ text: null, reason: "unmapped", bytes: 0 });
+        expect(result.layers["tools"]).toMatchObject({ text: null, reason: "unmapped", bytes: 0 });
+        // The base prompt keeps its own contract: readable text stays "ok" and an
+        // unexpanded template stays "not-exposed" - never "unmapped".
+        expect(result.layers["base-instructions"]).toMatchObject({ text: "Base prompt body.", reason: "ok" });
+      }
+    } finally {
+      if (previousHome === undefined) delete process.env.CODEX_HOME;
+      else process.env.CODEX_HOME = previousHome;
+    }
+  });
+});
+
 describe("runtime resolution and failure classification", () => {
   test("a runtime the shared resolver finds is spawned, not reported missing", async () => {
     // Issue 4458: the old four-path POSIX check reported "codex binary not
diff --git a/tests/codex-integration/codex-shim-destroyed-probe.test.ts b/tests/codex-integration/codex-shim-destroyed-probe.test.ts
new file mode 100644
index 00000000000..1263b676898
--- /dev/null
+++ b/tests/codex-integration/codex-shim-destroyed-probe.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { rmSync } from "node:fs";
+import { repoPath, repoRoot } from "../helpers/repo-root";
+import { withInstalledShim } from "../helpers/codex-shim-install-fixture";
+
+describe("version-manager shim destruction (#2412)", () => {
+  test("a destroyed shim diagnostic does not open a non-file launcher", () => {
+    if (process.platform === "win32") return;
+    withInstalledShim(({ home, wrappers, backups }) => {
+      rmSync(wrappers[0]);
+      expect(spawnSync("mkfifo", [wrappers[0]]).status).toBe(0);
+      rmSync(backups[0]);
+      const shimModule = repoPath("src", "codex", "shim.ts");
+      const script = `
+        const { autoRestoreCodexShim } = await import(${JSON.stringify(shimModule)});
+        console.log(JSON.stringify(autoRestoreCodexShim({ enabled: () => true, stabilitySleep: () => {} })));
+      `;
+
+      const child = spawnSync(process.execPath, ["-e", script], {
+        cwd: repoRoot(),
+        env: { ...process.env, OPENCODEX_HOME: home },
+        encoding: "utf8",
+        timeout: 1_000,
+      });
+
+      expect(child.error).toBeUndefined();
+      expect(child.status).toBe(0);
+      expect(JSON.parse(child.stdout)).toMatchObject({ status: "ineligible" });
+    });
+  });
+});
diff --git a/tests/codex-integration/codex-shim.test.ts b/tests/codex-integration/codex-shim.test.ts
index 3178a7ed3ab..f684fa8de91 100644
--- a/tests/codex-integration/codex-shim.test.ts
+++ b/tests/codex-integration/codex-shim.test.ts
@@ -1,9 +1,10 @@
 import { afterAll, describe, expect, spyOn, test } from "bun:test";
 import { spawnSync } from "node:child_process";
 import { chmodSync, copyFileSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, utimesSync, writeFileSync } from "node:fs";
-import { delimiter, dirname, join } from "node:path";
+import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { autoRestoreCodexShim, buildUnixCodexShim, buildWindowsCodexShim, buildWindowsPowerShellCodexShim, diagnoseCodexShim, findCodexOnPath, inspectCodexShimBackingForCommand, installCodexShim, isLocalAbsoluteInspectionPath, isVersionManagerOwnedCodexPath, isWindowsInteropDir, lastCodexDiscoveryError, setCodexShimFreshWriteHookForTests, setCodexShimGuardedWriteHookForTests, setCodexShimProbeHookForTests, setCodexShimProbeObservationMsForTests, setCodexShimProbeShellForTests, setCodexShimRollbackRestoreHookForTests, uninstallCodexShim } from "../../src/codex/shim";
+import { prependPath, withInstalledShim } from "../helpers/codex-shim-install-fixture";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import { repoPath, repoRoot } from "../helpers/repo-root";
 import { INTERNAL_DEADLINE_MS, SPAWN_BUDGET_MS } from "../helpers/test-budget";
@@ -41,10 +42,6 @@ setCodexShimProbeObservationMsForTests(20);
 afterAll(() => setCodexShimProbeObservationMsForTests(null));
 const psPath = process.platform !== "win32" && existsSync("/bin/ps") ? "/bin/ps" : "";
 
-function prependPath(dir: string, current: string | undefined): string {
-  return [dir, current].filter(Boolean).join(delimiter);
-}
-
 function successfulLauncher(label: string): string {
   return process.platform === "win32" ? `${label}\r\n` : `#!/bin/sh\n# ${label}\nexit 0\n`;
 }
@@ -85,48 +82,6 @@ function expectProcessGroupMissing(groupId: number): void {
   expect(code).toBe("ESRCH");
 }
 
-function withInstalledShim(run: (paths: {
-  binDir: string;
-  home: string;
-  wrappers: string[];
-  backups: string[];
-  statePath: string;
-}) => void): void {
-  const binDir = mkdtempSync(join(tmpdir(), "ocx-shim-bin-"));
-  const home = mkdtempSync(join(tmpdir(), "ocx-shim-home-"));
-  const oldPath = process.env.PATH;
-  const oldHome = process.env.OPENCODEX_HOME;
-  const wrappers = process.platform === "win32"
-    ? [join(binDir, "codex.cmd"), join(binDir, "codex.ps1"), join(binDir, "codex")]
-    : [join(binDir, "codex")];
-  try {
-    process.env.PATH = prependPath(binDir, oldPath);
-    process.env.OPENCODEX_HOME = home;
-    for (const wrapper of wrappers) {
-      writeFileSync(wrapper, process.platform === "win32" ? `real ${wrapper}\n` : "#!/bin/sh\necho real\n", "utf8");
-      if (process.platform !== "win32") chmodSync(wrapper, 0o755);
-    }
-    const installed = installCodexShim();
-    expect(installed.installed, installed.message).toBe(true);
-    const statePath = join(home, "codex-shim.json");
-    const state = JSON.parse(readFileSync(statePath, "utf8")) as { wrappers: Array<{ wrapperPath: string; backupPath: string }> };
-    run({
-      binDir,
-      home,
-      wrappers: state.wrappers.map(file => file.wrapperPath),
-      backups: state.wrappers.map(file => file.backupPath),
-      statePath,
-    });
-  } finally {
-    if (oldPath === undefined) delete process.env.PATH;
-    else process.env.PATH = oldPath;
-    if (oldHome === undefined) delete process.env.OPENCODEX_HOME;
-    else process.env.OPENCODEX_HOME = oldHome;
-    removeTreeWithRetry(binDir);
-    removeTreeWithRetry(home);
-  }
-}
-
 describe("Codex autostart shim", () => {
   test("builds a Unix shim that starts ocx before execing Codex", () => {
     const script = buildUnixCodexShim("/usr/local/bin/codex-real", "/usr/local/bin/bun", "/opt/opencodex/src/cli.ts", "bundled");
diff --git a/tests/codex-integration/codex-sqlite-home.test.ts b/tests/codex-integration/codex-sqlite-home.test.ts
index f8f7c088bb0..7fcfd94c88d 100644
--- a/tests/codex-integration/codex-sqlite-home.test.ts
+++ b/tests/codex-integration/codex-sqlite-home.test.ts
@@ -4,12 +4,13 @@ import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 
 import { resolveCodexHistoryJobTarget } from "../../src/codex/history-job";
-import { historyBackupPathFor } from "../../src/codex/history-provider";
+import { legacyHistoryBackupPathFor, resolveExistingHistoryBackupPath } from "../../src/codex/history-provider";
 import { resolveCodexLogsDbPath, resolveCodexSqliteHome, resolveCodexStateDbPath } from "../../src/codex/paths";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const originalCodexHome = process.env.CODEX_HOME;
 const originalSqliteHome = process.env.CODEX_SQLITE_HOME;
+const originalOpenCodexHome = process.env.OPENCODEX_HOME;
 const roots: string[] = [];
 
 afterEach(() => {
@@ -17,6 +18,8 @@ afterEach(() => {
   else process.env.CODEX_HOME = originalCodexHome;
   if (originalSqliteHome === undefined) delete process.env.CODEX_SQLITE_HOME;
   else process.env.CODEX_SQLITE_HOME = originalSqliteHome;
+  if (originalOpenCodexHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = originalOpenCodexHome;
   for (const root of roots.splice(0)) removeTreeWithRetry(root);
 });
 
@@ -108,11 +111,31 @@ describe("Codex SQLite home resolution", () => {
 
     const configured = resolveCodexHistoryJobTarget();
     expect(configured.canonicalStateDbPath).toBe(join(configSqliteHome, "state_5.sqlite"));
-    expect(configured.canonicalBackupPath).toBe(historyBackupPathFor(configured.canonicalStateDbPath));
+    expect(configured.canonicalBackupPath).toBe(resolveExistingHistoryBackupPath(configured.canonicalStateDbPath));
 
     unlinkSync(join(codexHome, "config.toml"));
     const fromEnv = resolveCodexHistoryJobTarget();
     expect(fromEnv.canonicalStateDbPath).toBe(join(envSqliteHome, "state_5.sqlite"));
-    expect(fromEnv.canonicalBackupPath).toBe(historyBackupPathFor(fromEnv.canonicalStateDbPath));
+    expect(fromEnv.canonicalBackupPath).toBe(resolveExistingHistoryBackupPath(fromEnv.canonicalStateDbPath));
+  });
+
+  test.skipIf(process.platform !== "win32")("history jobs preserve a pre-normalization extended-path manifest", () => {
+    const root = mkdtempSync(join(tmpdir(), "ocx-sqlite-home-legacy-"));
+    roots.push(root);
+    const codexHome = join(root, "codex");
+    const configHome = join(root, "opencodex");
+    const sqliteHome = join(root, "sqlite");
+    mkdirSync(codexHome);
+    mkdirSync(configHome);
+    mkdirSync(sqliteHome);
+    process.env.CODEX_HOME = codexHome;
+    process.env.OPENCODEX_HOME = configHome;
+    process.env.CODEX_SQLITE_HOME = `\\\\?\\${sqliteHome}`;
+
+    const stateDb = resolveCodexStateDbPath({ codexHome });
+    const legacyBackup = legacyHistoryBackupPathFor(stateDb);
+    writeFileSync(legacyBackup, "{}\n");
+
+    expect(resolveCodexHistoryJobTarget().canonicalBackupPath).toBe(legacyBackup);
   });
 });
diff --git a/tests/codex-integration/context-compat.test.ts b/tests/codex-integration/context-compat.test.ts
index a0e19f4c604..3786f989b66 100644
--- a/tests/codex-integration/context-compat.test.ts
+++ b/tests/codex-integration/context-compat.test.ts
@@ -1,5 +1,11 @@
 import { describe, test, expect } from "bun:test";
-import { codexCompatibleUrl, contextEndpoint, contextCompatibleBaseLine } from "../../src/codex/context-compat";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  codexCompatibleUrl, contextEndpoint, contextCompatibleBaseLine,
+  contextExperimentalEnabled, contextRelayActivated, resetContextRelayActivationForTests,
+} from "../../src/codex/context-compat";
 
 describe("route and config isolation", () => {
   test("aliases data-plane routes and preserves query; never aliases management", () => {
@@ -20,3 +26,71 @@ describe("route and config isolation", () => {
     expect(contextCompatibleBaseLine('[features.context_management]\nexperimental_mode=true\n',remote)).toBe(remote);
   });
 });
+
+describe("native context opt-in forms", () => {
+  const cases: Array<[string, string, boolean]> = [
+    ["boolean true", "[features]\ncontext_management = true\n", true],
+    ["root dotted boolean", "features.context_management = true\n", true],
+    ["inline feature table", "features = { context_management = true }\n", true],
+    ["dotted experimental mode", "[features]\ncontext_management.experimental_mode = true\n", true],
+    ["nested experimental mode", "[features.context_management]\nexperimental_mode = true\n", true],
+    ["inline experimental mode", "[features]\ncontext_management = { experimental_mode = true }\n", true],
+    ["absent feature", "model = 'gpt-6-astra'\n", false],
+    ["boolean false", "[features]\ncontext_management = false\n", false],
+    ["experimental mode false", "[features.context_management]\nexperimental_mode = false\n", false],
+    ["empty table", "[features.context_management]\n", false],
+    ["unsupported enabled field", "[features.context_management]\nenabled = true\n", false],
+    ["string true", "[features]\ncontext_management = 'true'\n", false],
+    ["numeric true", "[features]\ncontext_management = 1\n", false],
+    ["array true", "[features]\ncontext_management = [true]\n", false],
+    ["string experimental mode", "[features.context_management]\nexperimental_mode = 'true'\n", false],
+    ["malformed TOML", "[features\ncontext_management = true\n", false],
+    ["conflicting forms", "[features]\ncontext_management = true\ncontext_management.experimental_mode = true\n", false],
+    ["profile-only opt-in", "[profiles.trial.features]\ncontext_management = true\n", false],
+  ];
+
+  for (const [name, content, expected] of cases) {
+    test(name, () => {
+      expect(contextExperimentalEnabled(content)).toBe(expected);
+      const original = 'openai_base_url = "http://127.0.0.1:10100/v1"';
+      expect(contextCompatibleBaseLine(content, original)).toBe(expected
+        ? 'openai_base_url = "http://127.0.0.1:10100/backend-api/codex"'
+        : original);
+    });
+  }
+
+  test("boolean opt-in preserves remote, custom-provider and unrelated paths", () => {
+    const content = "[features]\ncontext_management = true\n";
+    for (const line of [
+      'openai_base_url = "https://example.com/v1"',
+      'openai_base_url = "http://192.0.2.1:10100/v1"',
+      'openai_base_url = "http://127.0.0.1:10100/custom/v1"',
+      'base_url = "http://127.0.0.1:10100/v1"',
+      'experimental_realtime_ws_base_url = "http://127.0.0.1:10100/v1"',
+    ]) {
+      expect(contextCompatibleBaseLine(content, line)).toBe(line);
+    }
+  });
+
+  test("runtime gate follows boolean opt-in and revocation without restart", () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-context-opt-in-"));
+    const path = join(home, "config.toml");
+    resetContextRelayActivationForTests();
+    try {
+      expect(contextRelayActivated(path)).toBe(false);
+      writeFileSync(path, "[features]\ncontext_management = true\n");
+      expect(contextRelayActivated(path)).toBe(true);
+      expect(contextRelayActivated(path)).toBe(true); // Exercise the unchanged-file cache.
+      // Different content sizes invalidate the stat cache even on coarse-mtime filesystems.
+      writeFileSync(path, "[features]\ncontext_management = false\n");
+      expect(contextRelayActivated(path)).toBe(false);
+      writeFileSync(path, "[features.context_management]\nexperimental_mode = true\n");
+      expect(contextRelayActivated(path)).toBe(true);
+      writeFileSync(path, "[features\ncontext_management = true\n");
+      expect(contextRelayActivated(path)).toBe(false);
+    } finally {
+      resetContextRelayActivationForTests();
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/tests/codex-integration/doctor.test.ts b/tests/codex-integration/doctor.test.ts
index fe07a6a797c..2280a9224f1 100644
--- a/tests/codex-integration/doctor.test.ts
+++ b/tests/codex-integration/doctor.test.ts
@@ -879,6 +879,47 @@ describe("doctor version skew projection", () => {
       removeTreeWithRetry(home);
     }
   }, STORE_BUDGET_MS);
+
+  test("a malformed CODEX_HOME/agents path warns instead of aborting the report", async () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-doctor-agents-"));
+    const codexHome = join(home, "codex");
+    const previousHome = process.env.OPENCODEX_HOME;
+    const previousCodexHome = process.env.CODEX_HOME;
+    const previousExitCode = process.exitCode;
+    const restore: Array<() => void> = [];
+    try {
+      mkdirSync(codexHome, { recursive: true });
+      process.env.OPENCODEX_HOME = home;
+      process.env.CODEX_HOME = codexHome;
+      writeFileSync(join(home, "config.json"), JSON.stringify({ ...getDefaultConfig(), port: 9, codexAutoStart: false }));
+      // A regular file where the role scan expects a readable directory.
+      writeFileSync(join(codexHome, "agents"), "not a directory");
+      const logged: string[] = [];
+      const log = spyOn(console, "log").mockImplementation((...args: unknown[]) => { logged.push(args.map(String).join(" ")); });
+      restore.push(() => log.mockRestore());
+      // Other doctor sections probe upstream health; this diagnostic fixture must stay offline.
+      const fetch = spyOn(globalThis, "fetch").mockImplementation(async () => new Response(null, { status: 503 }));
+      restore.push(() => fetch.mockRestore());
+      const live = spyOn(proxyLiveness, "findLiveProxy").mockResolvedValue({
+        pid: null, port: 9, hostname: "127.0.0.1", source: "config",
+      });
+      restore.push(() => live.mockRestore());
+      await runDoctor([]);
+      const output = logged.join("\n");
+      expect(output).toContain("[WARN] unable to scan $CODEX_HOME/agents/*.toml:");
+      expect(output).not.toContain("no per-role model_fallback fields");
+      // The dependent derived-role scan shares the listing; a missing guard would warn twice.
+      expect(output.match(/\[WARN\] unable to scan \$CODEX_HOME\/agents\/\*\.toml:/g) ?? []).toHaveLength(1);
+    } finally {
+      for (const cleanup of restore.reverse()) cleanup();
+      process.exitCode = previousExitCode;
+      if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousHome;
+      if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+      else process.env.CODEX_HOME = previousCodexHome;
+      removeTreeWithRetry(home);
+    }
+  }, STORE_BUDGET_MS);
 });
 
 describe("doctor reclaim wiring (end to end)", () => {
diff --git a/tests/codex-integration/issue-702-expired-replay-state.test.ts b/tests/codex-integration/issue-702-expired-replay-state.test.ts
index afc233754d0..59657cfd870 100644
--- a/tests/codex-integration/issue-702-expired-replay-state.test.ts
+++ b/tests/codex-integration/issue-702-expired-replay-state.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, readdirSync, unlinkSync } from "node:fs";
+import { mkdtempSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveConfig } from "../../src/config";
@@ -53,6 +53,19 @@ interface ForwardScenario {
 
 type ForwardScenarioMode = "expired" | "fresh" | "ordinary";
 
+/**
+ * The one answer every local replay failure gives a client.
+ *
+ * Missing, corrupt and task-scope-mismatched state all mean "replay in full", so they share a
+ * response rather than each describing which one happened. Stated once here so a drift shows up
+ * as one failing constant instead of several assertions written from memory.
+ */
+const LOCAL_REPLAY_UNAVAILABLE = {
+  message: "Continuation state is unavailable or corrupt; resend the full conversation without previous_response_id.",
+  type: "invalid_request_error",
+  code: "previous_response_not_found",
+} as const;
+
 function forwardConfig(): OcxConfig {
   return {
     port: 0,
@@ -649,13 +662,7 @@ describe("Issue #702 expired forward replay state", () => {
             }),
           });
           expect(response.status).toBe(400);
-          expect(await response.json()).toEqual({
-            error: {
-              message: "Continuation state is unavailable or corrupt; resend the full conversation without previous_response_id.",
-              type: "invalid_request_error",
-              code: "previous_response_not_found",
-            },
-          });
+          expect(await response.json()).toEqual({ error: LOCAL_REPLAY_UNAVAILABLE });
         } finally {
           await server.stop(true);
         }
@@ -685,11 +692,7 @@ describe("Issue #702 expired forward replay state", () => {
     expect(scenario.upstreamRequests).toHaveLength(1);
     expect(scenario.secondStatus).toBe(400);
     expect(JSON.parse(scenario.secondResponseText)).toMatchObject({
-      error: {
-        message: expect.stringMatching(/continuation state.*expired/i),
-        type: "invalid_request_error",
-        code: "previous_response_not_found",
-      },
+      error: LOCAL_REPLAY_UNAVAILABLE,
     });
   });
 
@@ -786,6 +789,145 @@ describe("Issue #702 expired forward replay state", () => {
     expect(serialized).toContain(CURRENT_USER_SENTINEL);
   });
 
+  test("a task-scope mismatch refuses the delta before ordinary HTTP upstream I/O", async () => {
+    const scenario = await runForwardScenario("fresh", { "x-codex-parent-thread-id": "other-task" });
+
+    expect(scenario.firstStatus).toBe(200);
+    expect(scenario.secondStatus).toBe(400);
+    expect(JSON.parse(scenario.secondResponseText)).toEqual({ error: LOCAL_REPLAY_UNAVAILABLE });
+    expect(scenario.upstreamRequests).toHaveLength(1);
+  });
+
+  test("missing, corrupt and mismatched local state answer identically on one route", async () => {
+    // All three mean the same thing to a client: replay in full. Each is produced for real here
+    // rather than inferred from the source strings - one spill deleted, one overwritten with
+    // bytes that do not parse, and one entry retained under a different task.
+    setResponseStateByteCapForTests(1_024);
+    const stored = async (id: string, threadId?: string): Promise<string> => {
+      rememberResponseState(
+        { model: "gpt-5.5", input: "x".repeat(8_000), store: false },
+        { id, status: "completed", output: [{ role: "assistant", content: "done" }] },
+        undefined,
+        { force: true, ...(threadId ? { clientThreadId: threadId } : {}) },
+      );
+      await flushPendingResponseSpillsForTests();
+      const spillDir = responseSpillDirectory(testHome);
+      const spill = readdirSync(spillDir).find(name => name.includes(id));
+      expect(spill, `spill for ${id}`).toBeDefined();
+      return join(spillDir, spill!);
+    };
+
+    const missingPath = await stored("resp_local_missing");
+    unlinkSync(missingPath);
+    const corruptPath = await stored("resp_local_corrupt");
+    writeFileSync(corruptPath, "{ this is not valid json", "utf8");
+    await stored("resp_local_foreign", "task-a");
+
+    let upstreamCalls = 0;
+    globalThis.fetch = (async () => {
+      upstreamCalls += 1;
+      throw new Error("upstream must not be called");
+    }) as typeof fetch;
+    saveConfig(forwardConfig());
+    const server = startServer(0);
+    const token = fakeChatGptJwt({ chatgpt_account_id: "acct-issue-702" });
+    const ask = async (previousResponseId: string, threadId: string): Promise<{ status: number; body: string }> => {
+      const response = await originalFetch(new URL("/v1/responses", server.url), {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${token}`,
+          "chatgpt-account-id": "acct-issue-702",
+          "x-codex-parent-thread-id": threadId,
+        },
+        body: JSON.stringify({
+          model: "gpt-5.5",
+          previous_response_id: previousResponseId,
+          input: [inputMessage(CURRENT_USER_SENTINEL)],
+          stream: true,
+          store: false,
+        }),
+      });
+      return { status: response.status, body: await response.text() };
+    };
+
+    try {
+      const missing = await ask("resp_local_missing", "task-a");
+      const corrupt = await ask("resp_local_corrupt", "task-a");
+      const mismatch = await ask("resp_local_foreign", "task-b");
+      const expected = { error: LOCAL_REPLAY_UNAVAILABLE };
+      for (const [label, outcome] of [["missing", missing], ["corrupt", corrupt], ["mismatch", mismatch]] as const) {
+        expect(outcome.status, label).toBe(400);
+        expect(JSON.parse(outcome.body), label).toEqual(expected);
+      }
+      // Byte-identical, not merely equivalent once parsed.
+      expect(corrupt.body).toBe(missing.body);
+      expect(mismatch.body).toBe(missing.body);
+      expect(upstreamCalls).toBe(0);
+    } finally {
+      await server.stop(true);
+    }
+  });
+
+  test("a WebSocket client whose task scope changed is refused and recovers by replaying in full", async () => {
+    // The existing WebSocket coverage exercises expired and missing state. A scope mismatch is
+    // the third way local replay becomes unusable, and it has to reach the client as the same
+    // frame so Codex reconnects with its full input instead of terminating the task.
+    const upstreamRequests: Record<string, unknown>[] = [];
+    const upstream = Bun.serve({
+      port: 0,
+      async fetch(request) {
+        upstreamRequests.push(await request.json() as Record<string, unknown>);
+        return new Response(completedSse("resp_scope_ws", "replayed"), {
+          headers: { "content-type": "text/event-stream" },
+        });
+      },
+    });
+    let server: ReturnType<typeof startServer> | null = null;
+    let socket: WebSocket | null = null;
+    try {
+      rememberResponseState(
+        { input: [inputMessage(HISTORICAL_USER_SENTINEL)], store: false },
+        { id: FIRST_RESPONSE_ID, status: "completed", output: [] },
+        undefined,
+        { force: true, clientThreadId: "task-a" },
+      );
+      saveConfig({
+        port: 0, hostname: "127.0.0.1", websockets: true, defaultProvider: "routed-test",
+        providers: {
+          "routed-test": {
+            adapter: "openai-responses", baseUrl: upstream.url.toString(), allowPrivateNetwork: true,
+            authMode: "key", apiKey: "synthetic-key", defaultModel: "test-model", statelessResponses: true,
+          },
+        },
+      } as OcxConfig);
+      server = startServer(0);
+      socket = await openResponseSocket(server.url, { "x-codex-parent-thread-id": "task-b" });
+      const refused = await sendSocketTurn(socket, {
+        model: "routed-test/test-model", previous_response_id: FIRST_RESPONSE_ID,
+        input: [inputMessage(CURRENT_USER_SENTINEL)], store: false,
+      });
+      expect(refused).toMatchObject({
+        type: "error", status: 400,
+        error: { type: "invalid_request_error", code: "previous_response_not_found" },
+      });
+      expect(upstreamRequests).toHaveLength(0);
+
+      const recovered = await sendSocketTurn(socket, {
+        model: "routed-test/test-model",
+        input: [inputMessage(HISTORICAL_USER_SENTINEL), inputMessage(CURRENT_USER_SENTINEL)],
+        store: false,
+      });
+      expect(recovered.type).toBe("response.completed");
+      expect(upstreamRequests).toHaveLength(1);
+      expect(upstreamRequests[0]!.previous_response_id).toBeUndefined();
+    } finally {
+      socket?.close();
+      await server?.stop(true);
+      await upstream.stop(true);
+    }
+  });
+
   test("forward mode still sends an ordinary request without previous_response_id", async () => {
     const scenario = await runForwardScenario("ordinary");
 
@@ -796,6 +938,77 @@ describe("Issue #702 expired forward replay state", () => {
     expect(JSON.stringify(scenario.upstreamRequests[0]!.body)).toContain(HISTORICAL_USER_SENTINEL);
   });
 
+  test("a destination that owns continuations still gets an unknown id, but never a foreign one", async () => {
+    // An id this process cannot resolve is the destination's business, and forwarding it is the
+    // behavior the case below pins. An id this process CAN resolve, to another task's state, is
+    // not: forwarding it would continue that task's conversation for a different caller. The
+    // refusal therefore comes before the native exception, not after it.
+    const upstreamRequests: Record<string, unknown>[] = [];
+    let upstream: ReturnType<typeof Bun.serve> | null = null;
+    let server: ReturnType<typeof startServer> | null = null;
+    try {
+      upstream = Bun.serve({
+        port: 0,
+        async fetch(request) {
+          upstreamRequests.push(await request.json() as Record<string, unknown>);
+          return new Response(completedSse("resp_native_forwarded", "forwarded"), {
+            headers: { "content-type": "text/event-stream" },
+          });
+        },
+      });
+      saveConfig({
+        port: 0,
+        hostname: "127.0.0.1",
+        defaultProvider: "test-openai",
+        providers: {
+          "test-openai": {
+            adapter: "openai-responses",
+            baseUrl: `${upstream.url.toString().replace(/\/$/, "")}/v1`,
+            allowPrivateNetwork: true,
+            apiKey: "provider-key",
+            defaultModel: "gpt-5.5",
+            statelessResponses: false,
+          },
+        },
+      } as OcxConfig);
+      server = startServer(0);
+      rememberResponseState(
+        { input: [inputMessage(HISTORICAL_USER_SENTINEL)], store: false },
+        { id: FIRST_RESPONSE_ID, status: "completed", output: [] },
+        undefined,
+        { force: true, clientThreadId: "task-a" },
+      );
+      const send = (previousResponseId: string, threadId: string) => originalFetch(
+        new URL("/v1/responses", server!.url),
+        {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-codex-parent-thread-id": threadId },
+          body: JSON.stringify({
+            model: "test-openai/gpt-5.5",
+            previous_response_id: previousResponseId,
+            input: [inputMessage(CURRENT_USER_SENTINEL)],
+            stream: true,
+            store: false,
+          }),
+        },
+      );
+
+      const foreign = await send(FIRST_RESPONSE_ID, "task-b");
+      expect(foreign.status).toBe(400);
+      expect(await foreign.json()).toMatchObject({ error: { code: "previous_response_not_found" } });
+      expect(upstreamRequests).toHaveLength(0);
+
+      const unknown = await send("resp_never_seen_here", "task-b");
+      expect(unknown.status).toBe(200);
+      await unknown.text();
+      expect(upstreamRequests).toHaveLength(1);
+      expect(upstreamRequests[0]!.previous_response_id).toBe("resp_never_seen_here");
+    } finally {
+      await server?.stop(true);
+      await upstream?.stop(true);
+    }
+  });
+
   test.each(["message", "function", "custom"] as const)("API-key Responses providers can still forward native %s continuation state", async kind => {
     const upstreamRequests: Record<string, unknown>[] = [];
     const realNow = Date.now;
diff --git a/tests/codex-integration/main-account-hard-lock-auth.test.ts b/tests/codex-integration/main-account-hard-lock-auth.test.ts
index 6b25b58abbb..3e0bb6a7994 100644
--- a/tests/codex-integration/main-account-hard-lock-auth.test.ts
+++ b/tests/codex-integration/main-account-hard-lock-auth.test.ts
@@ -35,6 +35,7 @@ import { setIcaclsRunnerForTests } from "../../src/lib/windows-secret-acl";
 import type { OcxConfig } from "../../src/types";
 import { COLD_SPAWN_WARMUP_HOOK_BUDGET_MS, warmModuleGraph } from "../helpers/cold-spawn-warmup";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { helperPath, repoRoot } from "../helpers/repo-root";
 import { INTERNAL_DEADLINE_MS, SPAWN_BUDGET_MS } from "../helpers/test-budget";
 
@@ -106,6 +107,14 @@ function addAlternative(cfg: OcxConfig): void {
   });
 }
 
+let releaseSpendHome: (() => void) | undefined;
+// Taken by the two cases that dispatch in-process, never for the whole file. Two describes here
+// spawn a child that runs startServer against this same home, and that child takes the real
+// lease: a parent holding one turns the child's startup into SPEND_LEDGER_OWNER_BUSY, which is
+// the contract working and the case failing for a reason it is not about.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
+
 beforeEach(() => {
   tokenExpiry = Math.floor(Date.now() / 1000) + 86_400;
   previousHome = process.env.OPENCODEX_HOME;
@@ -125,6 +134,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Released before this case's home is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  dropSpendHome();
   mock.restore();
   clearAccountQuota();
   clearThreadAccountMap();
@@ -493,6 +505,7 @@ describe("main quota policy at native admission", () => {
         model: "fixture-model", output: [], usage: { input_tokens: 1, output_tokens: 0, total_tokens: 1 },
       });
     }, { preconnect() {} }));
+    takeSpendHome();
     const post = (model: string) => handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { ...Object.fromEntries(caller()), "content-type": "application/json" },
@@ -532,6 +545,7 @@ describe("main quota policy at native admission", () => {
       sends.push({ url: request.url, authorization: request.headers.get("authorization") });
       return Response.json({ id: "cmp_policy_transport", object: "response.compaction", output: [] });
     }, { preconnect() {} }));
+    takeSpendHome();
     const post = (model: string) => handleResponsesCompact(new Request("http://localhost/v1/responses/compact", {
       method: "POST",
       headers: { ...Object.fromEntries(caller()), "content-type": "application/json" },
diff --git a/tests/codex-integration/model-pinned-effort.test.ts b/tests/codex-integration/model-pinned-effort.test.ts
index a808b867675..9aa8063f57b 100644
--- a/tests/codex-integration/model-pinned-effort.test.ts
+++ b/tests/codex-integration/model-pinned-effort.test.ts
@@ -12,6 +12,7 @@ import { parseRequest } from "../../src/responses/parser";
 import { routeModel } from "../../src/router";
 import { createTestTranslatorBudget, withTestTranslatorBudget } from "../helpers/translator-budget";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../src/types";
 
@@ -265,11 +266,14 @@ describe("operator pins on the actual request wire", () => {
   let failFirst: boolean;
   let failureStatus: number;
   let onFirstSend: (() => void) | undefined;
+  let releaseSpendHome: (() => void) | undefined;
 
   beforeEach(() => {
     savedHome = process.env.OPENCODEX_HOME;
     home = mkdtempSync(join(tmpdir(), "ocx-pin-wire-"));
     process.env.OPENCODEX_HOME = home;
+    // Take the writer lease after this block installs its home so direct handler dispatch can open the spend journal.
+    releaseSpendHome = acquireOwnedSpendHome();
     codexHome = installIsolatedCodexHome("ocx-pin-wire-codex-");
     captured = [];
     failFirst = false;
@@ -309,6 +313,9 @@ describe("operator pins on the actual request wire", () => {
   });
 
   afterEach(() => {
+    // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
     if (savedHome === undefined) delete process.env.OPENCODEX_HOME;
     else process.env.OPENCODEX_HOME = savedHome;
diff --git a/tests/codex-integration/multi-agent-compat.test.ts b/tests/codex-integration/multi-agent-compat.test.ts
index 181bcbc32c7..d4c96d8513e 100644
--- a/tests/codex-integration/multi-agent-compat.test.ts
+++ b/tests/codex-integration/multi-agent-compat.test.ts
@@ -1377,7 +1377,7 @@ describe("sanitizeEncryptedContentInPlace", () => {
   };
 
   test("plaintext parked in encrypted slots becomes input_text; real blobs survive", () => {
-    const blob = "gAAAAAB".padEnd(120, "Qw1_-=");
+    const blob = fernetFixture();
     const input = [
       { type: "message", role: "user", content: [
         { type: "encrypted_content", encrypted_content: "[CXC-LEAF-GUARD] plain text with spaces" },
diff --git a/tests/codex-integration/native-main-owner-lifetime.test.ts b/tests/codex-integration/native-main-owner-lifetime.test.ts
index 1bca364f8b1..96fe8fb4249 100644
--- a/tests/codex-integration/native-main-owner-lifetime.test.ts
+++ b/tests/codex-integration/native-main-owner-lifetime.test.ts
@@ -133,6 +133,26 @@ function fixture(configName = "opencodex", includePool = true): Fixture {
   return { root, codexHome, configDir, key, manager };
 }
 
+/**
+ * The same fixture with its own state directory, for a successor launched while the owner still
+ * listens.
+ *
+ * These cases deliberately overlap two live proxies to prove the contended, admission-denied,
+ * hard-kill and takeover sequence. They cannot share one OPENCODEX_HOME: the spend journal
+ * allows one writer per state directory, so the successor would be refused before it ever bound
+ * and the case would report a startup failure instead of the transition it is about. CODEX_HOME
+ * is unchanged, and the native-main lock, recovery journal and vault all derive from that, so
+ * every assertion in these cases still observes the same shared native state.
+ */
+function successorConfig(f: Fixture, configName: string, includePool: boolean): Fixture {
+  const configDir = join(f.root, configName);
+  const parentConfigDir = process.env.OPENCODEX_HOME;
+  writeConfig(f.codexHome, configDir, MAIN_CODEX_ACCOUNT_ID, includePool);
+  if (parentConfigDir === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = parentConfigDir;
+  return { ...f, configDir };
+}
+
 // Each wait bounds a real child proxy doing real work: spawning Bun, opening the
 // owner SQLite database, and acquiring or releasing the lease. On the Windows
 // shards four Bun pools share one runner, so the fixed 10s bounds were reporting
@@ -465,7 +485,7 @@ describe("native-main process owner lease", () => {
     const target = await f.manager.finishStage(stage.stageId, stage.writerToken, "target");
     expect(source.profile.state).toBe("active");
 
-    const successorFixture = { ...f };
+    const successorFixture = successorConfig(f, "crash-a-successor", false);
     const owner = new ChildHarness(f, { NATIVE_OWNER_HOLD_SWITCH_BOUNDARY: "auth-replaced" });
     let successor: ChildHarness | undefined;
     try {
@@ -532,7 +552,7 @@ describe("native-main process owner lease", () => {
       expect(readFileSync(tempPath, "utf8")).toContain("access-target");
       expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
 
-      successor = new ChildHarness(f, { NATIVE_OWNER_HOLD_RECOVERY: "1" });
+      successor = new ChildHarness(successorConfig(f, "temp-crash-successor", false), { NATIVE_OWNER_HOLD_RECOVERY: "1" });
       await successor.waitFor(event => event.event === "listening");
       await successor.snapshot(isContended);
       await owner.hardKill();
diff --git a/tests/codex-integration/reserve-auth-context.test.ts b/tests/codex-integration/reserve-auth-context.test.ts
index b66c2377bf6..c5ab020d0d8 100644
--- a/tests/codex-integration/reserve-auth-context.test.ts
+++ b/tests/codex-integration/reserve-auth-context.test.ts
@@ -25,6 +25,7 @@ import type { DataPlaneAdmission } from "../../src/server/auth-cors";
 import type { WhamUsageResponse } from "../../src/codex/quota-types";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const MAIN = mainAccount.MAIN_CODEX_ACCOUNT_ID;
 const accountId = "reserve-workspace-fixture";
@@ -88,6 +89,8 @@ function prohibitPhysicalReads(): void {
   spyOn(mainAccount, "getValidMainAccountToken").mockImplementation(fail);
 }
 
+let releaseSpendHome: (() => void) | undefined;
+
 beforeEach(() => {
   oldHome = process.env.OPENCODEX_HOME;
   oldCodexHome = process.env.CODEX_HOME;
@@ -133,9 +136,16 @@ beforeEach(() => {
     }
     throw new Error("unexpected outbound fixture destination");
   }, { preconnect() {} }));
+  // Dispatches without starting a server, so it takes the spend-journal lease itself. Taken
+  // last because the lease binds the home in effect at the moment it is taken.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(async () => {
+  // Released before this case's home is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   mock.restore();
   clearAccountQuota(); // Cancels this fixture's pending persistence timer before deleting its home.
   clearMainAccountInfoCache();
diff --git a/tests/codex-integration/reserve-catalog-lifecycle.test.ts b/tests/codex-integration/reserve-catalog-lifecycle.test.ts
index 2a3e8d6e15e..4323c0e5ff3 100644
--- a/tests/codex-integration/reserve-catalog-lifecycle.test.ts
+++ b/tests/codex-integration/reserve-catalog-lifecycle.test.ts
@@ -125,7 +125,24 @@ function sync(sandbox: Sandbox): RawCatalog {
     const config = loadConfig();
     for (const provider of Object.values(config.providers)) provider.fetch = globalThis.fetch;
     const result = await refreshCodexModelCatalog(config, undefined, { allowWhenDesiredDisabled: true });
-    if (!result.catalogExists || !result.cacheSynced) throw new Error(JSON.stringify(result));
+    if (!result.catalogExists) throw new Error(JSON.stringify(result));
+    if (result.refreshOutcome !== "committed") throw new Error(JSON.stringify(result));
+    // cacheSynced reports whether bytes were written, so a byte-identical no-op is a
+    // legitimate false and so is a broad failure. Neither can be the oracle on its own.
+    // Require the commit verdict, then read the cache back and prove it carries this
+    // catalog rather than trusting the write flag. Matching serialized slugs in order
+    // keeps the check independent of the cache document shape: it proves the same rows
+    // lead the file, not that a particular envelope was used.
+    const cacheRaw = readFileSync(${JSON.stringify(sandbox.cachePath)}, "utf8");
+    const active = JSON.parse(readFileSync(${JSON.stringify(sandbox.catalogPath)}, "utf8"));
+    const slugs = (active.models ?? []).map(row => row.slug).filter(Boolean);
+    if (slugs.length === 0) throw new Error("active catalog has no rows: " + JSON.stringify(result));
+    let cursor = -1;
+    for (const slug of slugs) {
+      const at = cacheRaw.indexOf(JSON.stringify(slug), cursor + 1);
+      if (at < 0) throw new Error("models cache is missing " + slug + ": " + JSON.stringify(result));
+      cursor = at;
+    }
     console.log("RESERVE_CATALOG_LIFECYCLE_OK");
   `;
   const child = spawnSync(process.execPath, withOwnedServiceHomePreload(["--eval", script], sandbox.preloadPath), {
diff --git a/tests/codex-integration/reserve-dispatch.test.ts b/tests/codex-integration/reserve-dispatch.test.ts
index f8da3b4af03..bd75b0af64f 100644
--- a/tests/codex-integration/reserve-dispatch.test.ts
+++ b/tests/codex-integration/reserve-dispatch.test.ts
@@ -27,6 +27,7 @@ import { flushConfigDirHardeningForTests } from "../../src/config/paths";
 import type { DataPlaneAdmission } from "../../src/server/auth-cors";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const accountId = "reserve-dispatch-workspace";
 const accessToken = "reserve-dispatch-owned-fixture";
@@ -68,6 +69,8 @@ async function authorize() {
   return { ctx, cfg, guard };
 }
 
+let releaseSpendHome: (() => void) | undefined;
+
 beforeEach(() => {
   oldHome = process.env.OPENCODEX_HOME;
   oldCodexHome = process.env.CODEX_HOME;
@@ -113,9 +116,16 @@ beforeEach(() => {
     }
     throw new Error("unexpected dispatch fixture destination");
   }, { preconnect() {} }));
+  // Dispatches without starting a server, so it takes the spend-journal lease itself. Taken
+  // last because the lease binds the home in effect at the moment it is taken.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(async () => {
+  // Released before this case's home is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   mock.restore();
   clearAccountQuota();
   clearMainAccountInfoCache();
diff --git a/tests/codex-integration/slug-codec.test.ts b/tests/codex-integration/slug-codec.test.ts
index 5248b75020c..a7e1550411c 100644
--- a/tests/codex-integration/slug-codec.test.ts
+++ b/tests/codex-integration/slug-codec.test.ts
@@ -19,6 +19,8 @@ import { knownModelIdsForProvider, routeModel } from "../../src/router";
 import { buildCatalogEntries, resetCatalogRuntimeStateForTests } from "../../src/codex/catalog";
 import { clearModelCache, setCached } from "../../src/codex/model-cache";
 import { getModelMetadata } from "../../src/generated/model-metadata";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { registryModelIdKeys } from "../../src/providers/registry/model-ids";
 import type { RawEntry } from "../../src/codex/catalog";
 import type { OcxConfig } from "../../src/types";
 
@@ -119,6 +121,44 @@ describe("slug-codec primitives", () => {
 });
 
 describe("routeModel decode (proxy layer)", () => {
+  const fixtureId = "slug-codec-registry-fixture";
+  const fixtureBaseUrl = "https://slug-codec-registry.fixture.example/v1";
+  const mutableRegistry = PROVIDER_REGISTRY as unknown as Array<Record<string, unknown>>;
+
+  function withSyntheticRegistryEntry(
+    fields: Record<string, unknown>,
+    assertion: (config: OcxConfig) => void,
+  ): void {
+    // A disposable row prevents decode tests from changing any shipped provider metadata.
+    mutableRegistry.push({
+      id: fixtureId,
+      label: "Slug codec registry fixture",
+      adapter: "openai-chat",
+      baseUrl: fixtureBaseUrl,
+      authKind: "key",
+      preserveCustomDestination: true,
+      ...fields,
+    });
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: fixtureId,
+      providers: {
+        [fixtureId]: {
+          adapter: "openai-chat",
+          baseUrl: fixtureBaseUrl,
+          authMode: "key",
+          apiKey: "k",
+        },
+      },
+    };
+    try {
+      assertion(config);
+    } finally {
+      const index = mutableRegistry.findIndex(entry => entry.id === fixtureId);
+      if (index >= 0) mutableRegistry.splice(index, 1);
+    }
+  }
+
   test("encoded zenmux slug decodes to the native id via the registry seed (cold cache)", () => {
     const route = routeModel(zenmuxConfig(), "zenmux/moonshotai-kimi-k3-free");
     expect(route.providerName).toBe("zenmux");
@@ -149,6 +189,91 @@ describe("routeModel decode (proxy layer)", () => {
     expect(routeModel(config, "nvidia/moonshotai/kimi-k2.6").modelId).toBe("moonshotai/kimi-k2.6");
   });
 
+  test("every classified direct registry map independently seeds selector decoding", () => {
+    // All fifteen, not only the ones the old hand-written list omitted. The eight it did carry
+    // are now reached through the same classification as the rest, so they belong in the public
+    // route-level table too rather than resting on helper-level parity alone.
+    const cases = [
+      ["modelWireDefaults", "openai-chat"],
+      ["modelResponsesUpstreamStreaming", false],
+      ["modelResponsesTerminalRepair", { graceMs: 25 }],
+      ["modelSupportsServiceTier", true],
+      ["modelSupportsReasoningSummaries", false],
+      ["modelSupportsVerbosity", true],
+      ["modelContextWindows", 100_000],
+      ["modelDisplayNames", "Synthetic display name"],
+      ["modelInputModalities", ["text"]],
+      ["modelMaxOutputTokens", 8_000],
+      ["modelReasoningEfforts", ["low"]],
+      ["modelDefaultReasoningEfforts", "low"],
+      ["modelReasoningEffortMap", { low: "low" }],
+      ["virtualModels", { wireModelId: "wire-target", reasoningMode: "pro" }],
+      ["modelMaxInputTokens", 100_000],
+    ] as const;
+    const nativeIds = new Map<string, string>();
+    const fields = Object.fromEntries(cases.map(([field, value], index) => {
+      const nativeId = `vendor/${field}-${index}`;
+      nativeIds.set(field, nativeId);
+      return [field, { [nativeId]: value }];
+    }));
+
+    withSyntheticRegistryEntry(fields, config => {
+      for (const [field] of cases) {
+        const nativeId = nativeIds.get(field)!;
+        const route = routeModel(config, `${fixtureId}/${encodeRoutedModelId(nativeId)}`);
+        expect(route.modelId, field).toBe(nativeId);
+      }
+    });
+  });
+
+  test("the nested key-auth service-tier map seeds selector decoding", () => {
+    const nativeId = "vendor/nested-service-tier-model";
+    withSyntheticRegistryEntry({
+      keyAuthServiceTier: { modelSupportsServiceTier: { [nativeId]: true } },
+    }, config => {
+      expect(routeModel(config, `${fixtureId}/${encodeRoutedModelId(nativeId)}`).modelId).toBe(nativeId);
+    });
+  });
+
+  test("the collected ids are frozen and the registry entry is left untouched", () => {
+    // The helper documents a frozen result and promises not to mutate registry data. A caller
+    // that could push into the returned array, or a helper that sorted the entry's own maps in
+    // place, would be editing shared process-wide registry state from a decode path.
+    const metaMuse = PROVIDER_REGISTRY.find(entry => entry.id === "meta-muse")!;
+    const before = JSON.stringify(metaMuse);
+    const ids = registryModelIdKeys(metaMuse);
+    expect(Object.isFrozen(ids)).toBe(true);
+    expect(() => (ids as string[]).push("vendor/injected")).toThrow();
+    expect(JSON.stringify(metaMuse)).toBe(before);
+  });
+
+  test("decode hints preserve unknown pass-through and ambiguous-selector rejection", () => {
+    withSyntheticRegistryEntry({
+      modelWireDefaults: { "a/b-c": "openai-chat" },
+      modelDisplayNames: { "a-b/c": "Ambiguous sibling" },
+    }, config => {
+      expect(routeModel(config, `${fixtureId}/unknown-model`).modelId).toBe("unknown-model");
+      expect(() => routeModel(config, `${fixtureId}/a-b-c`)).toThrow(/ambiguous/);
+    });
+  });
+
+  test("a provider with a mismatched transport inherits no registry decode hints", () => {
+    const nativeId = "vendor/transport-guarded-model";
+    withSyntheticRegistryEntry({ modelDisplayNames: { [nativeId]: "Transport guarded" } }, config => {
+      config.providers[fixtureId]!.baseUrl = "https://unrelated.example/v1";
+      expect(routeModel(config, `${fixtureId}/${encodeRoutedModelId(nativeId)}`).modelId)
+        .toBe(encodeRoutedModelId(nativeId));
+    });
+  });
+
+  test("a registry decode hint alone does not publish a catalog row", () => {
+    const nativeId = "vendor/decode-hint-only";
+    withSyntheticRegistryEntry({ modelDisplayNames: { [nativeId]: "Decode hint only" } }, () => {
+      const entries = buildCatalogEntries(nativeTemplate(), [], []);
+      expect(entries.some(entry => entry.slug === `${fixtureId}/${encodeRoutedModelId(nativeId)}`)).toBe(false);
+    });
+  });
+
   test("defaultModel encoded fallback routes to the native id", () => {
     const config: OcxConfig = {
       port: 10100,
diff --git a/tests/config/settings-stream-mode.test.ts b/tests/config/settings-stream-mode.test.ts
index 06eb3c41fa5..c614aefc9f9 100644
--- a/tests/config/settings-stream-mode.test.ts
+++ b/tests/config/settings-stream-mode.test.ts
@@ -874,3 +874,54 @@ describe("config.json schema resilience", () => {
   });
 });
 import { ManagementRequest as Request } from "../helpers/management-auth";
+
+describe("manual compaction settings", () => {
+  test("saves, reloads, replaces effort, and clears without changing other settings", async () => {
+    const config = baseConfig();
+    config.effortCap = "high";
+    const originalProviders = structuredClone(config.providers);
+    expect((await (await getSettings(config))!.json()).compactionRouting).toBeNull();
+    const setting = { model: "gateway/cheap", reasoningEffort: "low" };
+    const response = await putSettings(config, { compactionRouting: setting });
+    expect(response?.status).toBe(200);
+    expect((await response!.json()).compactionRouting).toEqual(setting);
+    expect(loadConfig().compactionRouting).toEqual(setting);
+    expect((await (await getSettings(config))!.json()).compactionRouting).toEqual(setting);
+    await putSettings(config, { compactionRouting: { model: "gateway/cheap" } });
+    expect(loadConfig().compactionRouting).toEqual({ model: "gateway/cheap" });
+    const automatic = { model: "gateway/cheap", triggers: ["manual", "auto"] };
+    expect((await putSettings(config, { compactionRouting: automatic }))?.status).toBe(200);
+    expect(loadConfig().compactionRouting).toEqual(automatic);
+    await putSettings(config, { compactionRouting: null });
+    expect(config.compactionRouting).toBeUndefined();
+    expect(loadConfig().compactionRouting).toBeUndefined();
+    expect(config.effortCap).toBe("high");
+    expect(config.providers).toEqual(originalProviders);
+    expect((await (await getSettings(config))!.json()).compactionRouting).toBeNull();
+  });
+
+  test("rejects malformed settings before any mutation", async () => {
+    const config = baseConfig();
+    config.compactionRouting = { model: "gateway/cheap", reasoningEffort: "low" };
+    const before = structuredClone(config);
+    for (const value of [false, [], {}, { model: " " }, { model: 2 }, { model: "m", reasoningEffort: "invalid" }, { model: "m", enabled: true },
+      { model: "m", triggers: [] }, { model: "m", triggers: ["nope"] }, { model: "m", triggers: ["manual", "manual"] }, { model: "m", triggers: "manual" }]) {
+      const response = await putSettings(config, { compactionRouting: value, streamMode: "eager-relay" });
+      expect(response?.status).toBe(400);
+      expect(config).toEqual(before);
+    }
+  });
+
+  test("failed persistence restores the override and its deletion intent", async () => {
+    const { projectConfigRebaseProvenance } = await import("../../src/config/rebase-provenance");
+    const config = baseConfig();
+    config.compactionRouting = { model: "gateway/cheap", reasoningEffort: "low" };
+    const before = projectConfigRebaseProvenance(config);
+    const deps = { saveConfigPreservingClaudeCode() { throw new Error("fixture save failure"); } };
+    for (const value of [null, { model: "gateway/other" }]) {
+      await expect(putSettings(config, { compactionRouting: value }, deps)).rejects.toThrow("fixture save failure");
+      expect(projectConfigRebaseProvenance(config)).toEqual(before);
+      expect(config.compactionRouting).toEqual({ model: "gateway/cheap", reasoningEffort: "low" });
+    }
+  });
+});
diff --git a/tests/e2e-style/phase100-native-parity.test.ts b/tests/e2e-style/phase100-native-parity.test.ts
index 04088ace30d..abe4f8e51b2 100644
--- a/tests/e2e-style/phase100-native-parity.test.ts
+++ b/tests/e2e-style/phase100-native-parity.test.ts
@@ -18,6 +18,7 @@ function nativeTemplate(): Record<string, unknown> {
     multi_agent_version: "v2",
     use_responses_lite: true,
     supports_websockets: true,
+    supports_experimental_context: true,
     web_search_tool_type: "text_and_image",
     supports_search_tool: true,
     supported_reasoning_levels: [
@@ -88,6 +89,7 @@ describe("Phase 100 Codex-native parity smoke", () => {
     expect(routed).not.toHaveProperty("model_messages");
     expect(routed).not.toHaveProperty("use_responses_lite");
     expect(routed).not.toHaveProperty("supports_websockets");
+    expect(routed).not.toHaveProperty("supports_experimental_context");
 
     const parsed = parseRequest({
       model: "opencode-go/deepseek-v4-flash",
diff --git a/tests/fixtures/google-wire-shape-cases.ts b/tests/fixtures/google-wire-shape-cases.ts
new file mode 100644
index 00000000000..50177efee23
--- /dev/null
+++ b/tests/fixtures/google-wire-shape-cases.ts
@@ -0,0 +1,113 @@
+/**
+ * Synthetic compiled Google wire bodies for the #5008 structural projection.
+ *
+ * Builders rather than recorded traffic: a captured Antigravity request is exactly the artifact
+ * this projection exists so that nobody has to handle. Every string below is a marker, and the
+ * tests assert that none of them survives into a summary.
+ */
+
+export const WIRE_MARKERS = {
+  prompt: "MARKER-PROMPT-TEXT",
+  systemText: "MARKER-SYSTEM-INSTRUCTION",
+  toolName: "MARKER_TOOL_NAME",
+  toolArgument: "MARKER-TOOL-ARGUMENT",
+  toolResult: "MARKER-TOOL-RESULT",
+  signature: "MARKERSIGNATUREBLOB0123456789",
+  sessionId: "-1234567890123456789",
+} as const;
+
+/** Mirrors THOUGHT_SIGNATURE_BYPASS in src/adapters/google-antigravity-replay.ts. */
+export const THOUGHT_SIGNATURE_SENTINEL = "skip_thought_signature_validator";
+
+export type WirePart = Record<string, unknown>;
+export type WireTurn = { role: string; parts: WirePart[] };
+export type WireBody = Record<string, unknown>;
+
+export function callId(ordinal: number): string {
+  return `MARKER-CALL-ID-${ordinal}`;
+}
+
+export function userTurn(text: string = WIRE_MARKERS.prompt): WireTurn {
+  return { role: "user", parts: [{ text }] };
+}
+
+export function modelTextTurn(text: string = WIRE_MARKERS.prompt): WireTurn {
+  return { role: "model", parts: [{ text }] };
+}
+
+export function modelCallTurn(ids: readonly string[], options: { signature?: string } = {}): WireTurn {
+  return {
+    role: "model",
+    parts: ids.map(id => ({
+      functionCall: { name: WIRE_MARKERS.toolName, args: { query: WIRE_MARKERS.toolArgument }, id },
+      ...(options.signature === undefined ? {} : { thoughtSignature: options.signature }),
+    })),
+  };
+}
+
+/** A function call the translator could not give a usable id, as an id-less wire part. */
+export function unidentifiedCallTurn(): WireTurn {
+  return {
+    role: "model",
+    parts: [{ functionCall: { name: WIRE_MARKERS.toolName, args: { query: WIRE_MARKERS.toolArgument } } }],
+  };
+}
+
+export function toolResultTurn(ids: readonly string[]): WireTurn {
+  return {
+    role: "user",
+    parts: ids.map(id => ({
+      functionResponse: { name: WIRE_MARKERS.toolName, response: { result: WIRE_MARKERS.toolResult }, id },
+    })),
+  };
+}
+
+export function compiledWireBody(
+  contents: readonly WireTurn[],
+  options: { toolDeclarations?: number; systemInstruction?: boolean; sessionId?: string } = {},
+): WireBody {
+  const body: WireBody = { contents: [...contents] };
+  if (options.systemInstruction !== false) {
+    body.systemInstruction = { parts: [{ text: WIRE_MARKERS.systemText }] };
+  }
+  const declarations = options.toolDeclarations ?? 0;
+  if (declarations > 0) {
+    body.tools = [{
+      functionDeclarations: Array.from({ length: declarations }, (_unused, i) => ({
+        name: `${WIRE_MARKERS.toolName}_${i}`,
+        description: WIRE_MARKERS.toolArgument,
+        parameters: { type: "object", properties: {} },
+      })),
+    }];
+  }
+  body.sessionId = options.sessionId ?? WIRE_MARKERS.sessionId;
+  return body;
+}
+
+/**
+ * The shape a well-formed tool round trip reaches the wire as: user, then the model call turn,
+ * then the adjacent function-response turn.
+ */
+export function toolRoundTrip(round: number, options: { signature?: string } = {}): WireTurn[] {
+  const id = callId(round);
+  return [modelCallTurn([id], options), toolResultTurn([id])];
+}
+
+/**
+ * A long tool-heavy session of the kind #5008 reports: one opening user turn followed by
+ * `rounds` adjacent call/response pairs. Deterministic, so a projection of it is stable.
+ */
+export function longToolSession(rounds: number, options: { signature?: string } = {}): WireTurn[] {
+  const contents: WireTurn[] = [userTurn()];
+  for (let round = 1; round <= rounds; round++) contents.push(...toolRoundTrip(round, options));
+  contents.push(userTurn());
+  return contents;
+}
+
+/** Compaction keeps the tail and replaces the head; the structure survives, the text does not. */
+export function compactedToolSession(rounds: number, keptRounds: number): WireTurn[] {
+  const contents: WireTurn[] = [userTurn("MARKER-COMPACTION-SUMMARY")];
+  for (let round = rounds - keptRounds + 1; round <= rounds; round++) contents.push(...toolRoundTrip(round));
+  contents.push(userTurn());
+  return contents;
+}
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 1d4d47ceaef..d8a39f76b8b 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -3,6 +3,7 @@
   "key-attribution.test.ts": "usage",
   "provider-send-path-import.test.ts": "server",
   "socks5-fetch.test.ts": "lib",
+  "socks5-upload-lifecycle.test.ts": "lib",
   "start-args.test.ts": "cli",
   "responses-core-modules.test.ts": "responses",
   "responses-passthrough-transient-policy.test.ts": "responses",
@@ -12,6 +13,7 @@
   "chat-responses-control-integration.test.ts": "responses",
   "coding-agent-tool-result-images.test.ts": "adapters",
   "cold-spawn-warmup.test.ts": "ci-workflows",
+  "warmup-registration.test.ts": "ci-workflows",
   "hub-usage.test.ts": "server",
   "client-hub-usage.test.ts": "clients",
   "cli-usage-hub.test.ts": "cli",
@@ -42,6 +44,7 @@
   "alibaba-region-backup.test.ts": "providers",
   "alibaba-region-migration.test.ts": "providers",
   "alibaba-region-startup.test.ts": "providers",
+  "alibaba-token-plan-responses-optin.test.ts": "providers",
   "always-on-429-failover.test.ts": "routing",
   "anthropic-account-pool.test.ts": "adapters/anthropic",
   "anthropic-agentrouter-language-framing.test.ts": "adapters/anthropic",
@@ -205,7 +208,6 @@
   "cleanup-orphaned-workflows.test.ts": "ci-workflows",
   "clearable-deadline.test.ts": "lib",
   "cli-account-orca-import.test.ts": "cli",
-
   "cli-account-pin-drain.test.ts": "cli",
   "cli-account-pool-verbs.test.ts": "cli",
   "cli-account.test.ts": "cli",
@@ -436,6 +438,7 @@
   "context-history-ownership.test.ts": "server",
   "context-history.test.ts": "server",
   "context-window-seed-repair.test.ts": "providers",
+  "vision-classification-seed-repair.test.ts": "providers",
   "continuation-dedup.test.ts": "responses",
   "core-lab-boundary.test.ts": "lab",
   "cost-cap-unknown-evidence.test.ts": "usage",
@@ -537,6 +540,7 @@
   "docs-429-failover-claims.test.ts": "ci-workflows",
   "docs-bun-source-requirement.test.ts": "ci-workflows",
   "docs-provider-billing-claims.test.ts": "ci-workflows",
+  "docs-provider-preset-counts.test.ts": "ci-workflows",
   "docs-readme-translation-parity.test.ts": "ci-workflows",
   "docs-remote-hub-claims.test.ts": "ci-workflows",
   "doctor-codex-envkey-readiness.test.ts": "service",
@@ -601,11 +605,13 @@
   "google-provider-metadata-roundtrip.test.ts": "adapters/google",
   "google-signature-history-roundtrip.test.ts": "adapters/google",
   "google-tool-result-adjacency.test.ts": "adapters/google",
+  "google-tool-schema-contract.test.ts": "adapters/google",
   "google-tool-schema.test.ts": "adapters/google",
   "google-vertex-http.test.ts": "adapters/google",
   "google-vertex-stream.test.ts": "adapters/google",
   "google-vertex-thought-signature.test.ts": "adapters/google",
   "google-wire-compiler.test.ts": "adapters/google",
+  "google-wire-shape.test.ts": "adapters/google",
   "grok-attribution.test.ts": "providers/xai",
   "grok-config-inject.test.ts": "providers/xai",
   "grok-effort-inject.test.ts": "providers/xai",
@@ -643,6 +649,7 @@
   "integrations-merge.test.ts": "clients",
   "integrations-serialize.test.ts": "clients",
   "integrations-state.test.ts": "clients",
+  "integrations-writer-frozen-config.test.ts": "clients",
   "integrations-writer.test.ts": "clients",
   "interactive-confirm.test.ts": "cli",
   "issue-452-empty-503.test.ts": "codex-integration",
@@ -746,9 +753,13 @@
   "main-quota-provenance.test.ts": "codex-integration",
   "main-quota-window-observation.test.ts": "codex-integration",
   "management-api-logs-metrics.test.ts": "server",
+  "management-metrics-export.test.ts": "server",
   "management-client-config-route.test.ts": "server",
+  "management-google-tool-schema-policy.test.ts": "server",
   "management-integration-journal-delete.test.ts": "server",
   "management-integration-routes.test.ts": "server",
+  "management-model-roster-gather-race.test.ts": "server",
+  "management-model-roster.test.ts": "server",
   "management-origin-tls.test.ts": "server",
   "management-provider-pinsless-validation.test.ts": "server",
   "management-provider-proto-override.test.ts": "server",
@@ -789,6 +800,7 @@
   "muse-spark-web-search-compat.test.ts": "providers",
   "muse-subscription-usage.test.ts": "providers",
   "muse-tool-name-alias.test.ts": "providers",
+  "mutation-plan.test.ts": "clients",
   "namespace-tool-compat.test.ts": "responses",
   "native-alias-maintainer-regressions.test.ts": "codex-integration",
   "native-claude-code-toggle.test.ts": "codex-integration",
@@ -905,6 +917,7 @@
   "passthrough-override.test.ts": "responses",
   "phase100-native-parity.test.ts": "e2e-style",
   "pi-path-contract.test.ts": "clients",
+  "pinned-http-content-coding.test.ts": "lib",
   "pinned-http.test.ts": "lib",
   "pinned-https-get.test.ts": "images",
   "plaintext-v2-agent-messages-server.test.ts": "server",
@@ -983,6 +996,8 @@
   "relay-eager.test.ts": "server",
   "release-helper.test.ts": "ci-workflows",
   "release-notes.test.ts": "ci-workflows",
+  "resolved-model-policy-consumers.test.ts": "routing",
+  "resolved-model-policy.test.ts": "providers",
   "release-version-line.test.ts": "ci-workflows",
   "remote-catalog.test.ts": "clients",
   "remote-workspace-activation.test.ts": "clients",
@@ -1032,14 +1047,20 @@
   "responses-bare-echo-helper-fence.test.ts": "responses",
   "responses-canonical-only-top-level-fields.test.ts": "responses",
   "responses-compact-handoff-admission.test.ts": "responses",
+  "responses-compaction-override.test.ts": "responses",
   "responses-compaction-routing.test.ts": "responses",
   "responses-compaction.test.ts": "responses",
   "responses-console-go-upload-retry.test.ts": "responses",
   "responses-context-overflow.test.ts": "responses",
   "responses-custom-tool-guidance.test.ts": "responses",
+  "responses-custom-tool-repair-dispatch.test.ts": "responses",
   "responses-custom-tool-repair.test.ts": "responses",
+  "responses-custom-tool-stream-consistency.test.ts": "responses",
+  "responses-freeform-wrapper-keys.test.ts": "responses",
+  "responses-default-namespace-emit-normalize.test.ts": "responses",
   "responses-fetch-helpers-boundary.test.ts": "responses",
   "responses-hosted-tool-declaration.test.ts": "responses",
+  "responses-hosted-tool-min-spread.test.ts": "responses",
   "responses-field-backfill.test.ts": "responses",
   "responses-forward-dangling-call.test.ts": "responses",
   "responses-forward-incomplete-quota.test.ts": "responses",
@@ -1050,6 +1071,7 @@
   "responses-inbound-store-default.test.ts": "responses",
   "responses-item-id-repair.test.ts": "responses",
   "responses-json-events.test.ts": "responses",
+  "responses-legacy-dotted-tool-name-repair.test.ts": "responses",
   "responses-muse-tool-name-alias.test.ts": "responses",
   "responses-native-main-refresh.test.ts": "responses",
   "responses-opaque-blob-recovery.test.ts": "responses",
@@ -1166,6 +1188,9 @@
   "sponsor-presets.test.ts": "providers",
   "spend-ceiling-enforcement.test.ts": "lib",
   "spend-ledger-file-journal.test.ts": "lib",
+  "spend-ledger-lifecycle.test.ts": "server",
+  "spend-ledger-owner-startup.test.ts": "server",
+  "spend-ledger-owner.test.ts": "lib",
   "spend-reservation-ledger.test.ts": "lib",
   "sse-client-frame-bounds.test.ts": "responses",
   "sse-decoder.test.ts": "responses",
@@ -1227,6 +1252,7 @@
   "tool-choice-performance.test.ts": "adapters",
   "transient-budget-scope-source.test.ts": "lib",
   "translator-budget.test.ts": "adapters",
+  "transport-null-body.test.ts": "lib",
   "tray-proxy-deadline.test.ts": "windows",
   "tray-proxy.test.ts": "windows",
   "types-barrel-identity.test.ts": "config",
@@ -1274,6 +1300,7 @@
   "vision-anthropic.test.ts": "vision",
   "vision-backend-union.test.ts": "vision",
   "vision-cache.test.ts": "vision",
+  "vision-custom-row-precedence.test.ts": "vision",
   "vision-eligibility.test.ts": "vision",
   "vision-fail-closed.test.ts": "vision",
   "vision-reasoning-contract.test.ts": "vision",
@@ -1291,6 +1318,7 @@
   "web-search-parse.test.ts": "web-search",
   "web-search-passthrough-bridge.test.ts": "web-search",
   "web-search-progress-stream.test.ts": "web-search",
+  "web-search-retry-heartbeat.test.ts": "web-search",
   "web-search-sources.test.ts": "web-search",
   "web-search-timeout-contract.test.ts": "web-search",
   "web-search-timeout-plan.test.ts": "web-search",
@@ -1333,6 +1361,7 @@
   "yaml-fragment-source.test.ts": "config",
   "z-fulfill.test.ts": "images",
   "z-handler-activation.test.ts": "images",
+  "zai-reasoning-replay.test.ts": "providers",
   "zcode-client.test.ts": "providers",
   "zhipu-bigmodel-provider.test.ts": "providers",
   "zhipu-bigmodel-responses-quota.test.ts": "providers",
@@ -1363,5 +1392,11 @@
   "ws-steering-smoke.test.ts": "responses",
   "combo-authoritative-reset.test.ts": "codex-integration",
   "devin-stated-reset-hardening.test.ts": "providers",
-  "devin-stated-reset-retry.test.ts": "providers"
+  "devin-stated-reset-retry.test.ts": "providers",
+  "ci-structure-gate.test.ts": "ci-workflows",
+  "responses-code-mode-patch-compile.test.ts": "responses",
+  "gui-codex-usage-score-parity.test.ts": "gui",
+  "web-search-sidecar-429.test.ts": "web-search",
+  "codex-shim-destroyed-probe.test.ts": "codex-integration",
+  "client-runtime.test.ts": "clients"
 }
diff --git a/tests/gui/volcengine-providers.test.ts b/tests/gui/volcengine-providers.test.ts
index 868a5bbc89c..ba165d1bf99 100644
--- a/tests/gui/volcengine-providers.test.ts
+++ b/tests/gui/volcengine-providers.test.ts
@@ -2,10 +2,11 @@ import { describe, expect, test } from "bun:test";
 import { createOpenAIChatAdapter as createOpenAIChatAdapterProduction } from "../../src/adapters/openai-chat";
 import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
 import { applyProviderConfigHints, buildCatalogEntries } from "../../src/codex/catalog";
-import { KEY_LOGIN_PROVIDERS } from "../../src/oauth/key-providers";
+import { enrichProviderFromCatalog, KEY_LOGIN_PROVIDERS } from "../../src/oauth/key-providers";
 import { deriveProviderPresets, providerConfigSeed } from "../../src/providers/derive";
 import { PROVIDER_REGISTRY } from "../../src/providers/registry";
 import { safeConfigDTO } from "../../src/server/auth-cors";
+import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve";
 import { routeModel } from "../../src/router";
 import type { OcxConfig } from "../../src/types";
 import { buildProviderPostBody } from "../../gui/src/provider-payload";
@@ -49,9 +50,12 @@ describe("Volcengine Ark providers", () => {
     expect(PROVIDER_REGISTRY.find(provider => provider.id === "volcengine-coding-plan")).toMatchObject({
       label: "Volcengine Ark Coding Plan",
       baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
-      adapter: "openai-chat",
+      responsesPath: "/responses",
+      adapter: "openai-responses",
       authKind: "key",
+      supportsServiceTier: false,
       preserveCustomDestination: true,
+      dropResponsesReasoningItems: true,
       defaultModel: "ark-code-latest",
       models: [
         "ark-code-latest",
@@ -111,6 +115,8 @@ describe("Volcengine Ark providers", () => {
     });
     expect(KEY_LOGIN_PROVIDERS["volcengine-coding-plan"]).toMatchObject({
       baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
+      responsesPath: "/responses",
+      adapter: "openai-responses",
       defaultModel: "ark-code-latest",
       liveModels: false,
       preserveReasoningContentModels: ["deepseek-v4-flash"],
@@ -155,6 +161,134 @@ describe("Volcengine Ark providers", () => {
     expect(request.url).toBe("https://ark.cn-beijing.volces.com/api/plan/v3/responses");
   });
 
+  test("routes Coding Plan to native Responses and drops replayed reasoning items", () => {
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: "volcengine-coding-plan",
+      providers: {
+        "volcengine-coding-plan": {
+          adapter: "openai-responses",
+          baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
+          authMode: "key",
+          apiKey: "test-key",
+        },
+      },
+    };
+    const route = routeModel(config, "volcengine-coding-plan/glm-5.3");
+    expect(route.provider.responsesPath).toBe("/responses");
+    expect(route.provider.dropResponsesReasoningItems).toBe(true);
+
+    const request = createResponsesPassthroughAdapter(route.provider).buildRequest({
+      modelId: route.modelId,
+      context: { messages: [] },
+      stream: true,
+      options: {},
+      _rawBody: {
+        model: route.modelId,
+        input: [
+          { type: "reasoning", id: "rs_1", content: [{ type: "reasoning_text", text: "private" }] },
+          { type: "function_call", call_id: "call_1", name: "echo", arguments: "{\"value\":\"ok\"}" },
+          { type: "function_call_output", call_id: "call_1", output: "ok" },
+          { type: "function_call_output", call_id: "orphan", output: "must-stay-a-tool-output" },
+        ],
+        stream: true,
+      },
+    }, { headers: new Headers() });
+
+    expect(request.url).toBe("https://ark.cn-beijing.volces.com/api/coding/v3/responses");
+    const body = JSON.parse(request.body) as { input: Array<Record<string, unknown>> };
+    expect(body.input.map(item => item.type)).toEqual([
+      "function_call",
+      "function_call_output",
+      "function_call_output",
+    ]);
+    expect(body.input[2]).toEqual({
+      type: "function_call_output",
+      call_id: "orphan",
+      output: "must-stay-a-tool-output",
+    });
+  });
+
+  // The preset default moves to Responses for NEW rows only. An install that already saved the
+  // Chat row keeps it: `volcengine-coding-plan` is a `preserveCustomDestination` key entry, so
+  // `providerMatchesRegistryTransport` refuses the adapter mismatch and `routedProviderConfig`
+  // returns the configured row untouched.
+  //
+  // This pins the routing outcome, which is what a user observes. It is not a guard against a
+  // startup migration being reintroduced — that guarantee is the absence of a migration module,
+  // and the startup composition in src/server/index.ts is not reachable from a test that must
+  // not touch persisted config.
+  test("leaves an already-saved Coding Plan Chat row on Chat", () => {
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: "volcengine-coding-plan",
+      providers: {
+        "volcengine-coding-plan": {
+          adapter: "openai-chat",
+          baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
+          authMode: "key",
+          apiKey: "test-key",
+        },
+      },
+    };
+    const route = routeModel(config, "volcengine-coding-plan/glm-5.3");
+    expect(route.provider.adapter).toBe("openai-chat");
+    expect(route.provider.responsesPath).toBeUndefined();
+
+    const request = createOpenAIChatAdapter(route.provider).buildRequest({
+      modelId: route.modelId,
+      context: { messages: [{ role: "user", content: "hi", timestamp: 0 }] },
+      stream: false,
+      options: {},
+    });
+    expect(request.url).toBe("https://ark.cn-beijing.volces.com/api/coding/v3/chat/completions");
+  });
+
+  // The replay-drop flag belongs to the destination, not to the provider-wide wire. A saved Chat
+  // row that opts ONE model into Responses reaches the Responses adapter without ever matching
+  // the registry transport, so a fill that only ran on the matched path would leave exactly this
+  // continuation forwarding the reasoning item Ark answers 400 to.
+  test("carries the replay-drop flag onto a saved Chat row that opts one model into Responses", () => {
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: "volcengine-coding-plan",
+      providers: {
+        "volcengine-coding-plan": {
+          adapter: "openai-chat",
+          baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
+          authMode: "key",
+          apiKey: "test-key",
+          modelAdapters: { "glm-5.3": "openai-responses" },
+        },
+      },
+    };
+    const route = routeModel(config, "volcengine-coding-plan/glm-5.3");
+    expect(route.provider.adapter).toBe("openai-chat");
+    expect(route.provider.dropResponsesReasoningItems).toBe(true);
+
+    const resolved = resolveWireProtocolOverride("volcengine-coding-plan", route.modelId, route.provider, "responses");
+    expect(resolved.adapter).toBe("openai-responses");
+
+    const request = createResponsesPassthroughAdapter(resolved).buildRequest({
+      modelId: route.modelId,
+      context: { messages: [] },
+      stream: true,
+      options: {},
+      _rawBody: {
+        model: route.modelId,
+        input: [
+          { type: "reasoning", id: "rs_1", content: [{ type: "reasoning_text", text: "private" }] },
+          { type: "function_call", call_id: "call_1", name: "echo", arguments: "{\"value\":\"ok\"}" },
+          { type: "function_call_output", call_id: "call_1", output: "ok" },
+        ],
+        stream: true,
+      },
+    }, { headers: new Headers() });
+
+    const body = JSON.parse(request.body) as { input: Array<Record<string, unknown>> };
+    expect(body.input.map(item => item.type)).toEqual(["function_call", "function_call_output"]);
+  });
+
   test.each([
     ["volcengine", "openai-chat", "https://custom.example.com/api/v3"],
     ["volcengine-coding-plan", "openai-chat", "https://custom.example.com/api/coding/v3"],
@@ -218,10 +352,11 @@ describe("Volcengine Ark providers", () => {
         defaultProvider: "volcengine-coding-plan",
         providers: {
           "volcengine-coding-plan": {
-            adapter: "openai-chat",
+            adapter: "openai-responses",
             baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
             authMode: "key",
             apiKey: "test-key",
+            modelAdapters: { [modelId]: "openai-chat" },
           },
         },
       };
@@ -290,6 +425,36 @@ describe("Volcengine Ark providers", () => {
     }
   });
 
+  test("keeps Coding Plan replay compatibility when the GUI saves it under a custom name", () => {
+    const preset = deriveProviderPresets().find(provider => provider.id === "volcengine-coding-plan")!;
+    const postBody = buildProviderPostBody(preset, {
+      name: "my-coding-plan",
+      adapter: preset.adapter,
+      baseUrl: preset.baseUrl,
+      responsesPath: preset.responsesPath,
+      authMode: preset.auth,
+      apiKey: "test-key",
+      defaultModel: preset.defaultModel ?? "",
+    });
+    const provider = postBody.provider as OcxConfig["providers"][string];
+    enrichProviderFromCatalog(postBody.name, provider);
+
+    expect(provider).toMatchObject({
+      adapter: "openai-responses",
+      baseUrl: "https://ark.cn-beijing.volces.com/api/coding/v3",
+      responsesPath: "/responses",
+      dropResponsesReasoningItems: true,
+    });
+
+    const unrelated = {
+      adapter: "openai-responses",
+      baseUrl: "https://responses.example.test/v1",
+      authMode: "key",
+    } as OcxConfig["providers"][string];
+    enrichProviderFromCatalog("my-responses", unrelated);
+    expect(unrelated.dropResponsesReasoningItems).toBeUndefined();
+  });
+
   test("keeps Agent Plan response routing when the GUI saves it under a custom name", () => {
     const preset = deriveProviderPresets().find(provider => provider.id === "volcengine-agent-plan")!;
     const postBody = buildProviderPostBody(preset, {
diff --git a/tests/helpers/codex-shim-install-fixture.ts b/tests/helpers/codex-shim-install-fixture.ts
new file mode 100644
index 00000000000..72582434156
--- /dev/null
+++ b/tests/helpers/codex-shim-install-fixture.ts
@@ -0,0 +1,62 @@
+import { expect } from "bun:test";
+import { chmodSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { installCodexShim } from "../../src/codex/shim";
+import { removeTreeWithRetry } from "./remove-tree";
+
+/**
+ * Installs a real Codex shim over a throwaway PATH entry and a throwaway OPENCODEX_HOME, hands
+ * the resolved wrapper and backup paths to the caller, and restores both environment variables
+ * and removes both temporary trees afterwards.
+ *
+ * This lived inside tests/codex-integration/codex-shim.test.ts until a second file needed it.
+ * Copying it would have been the cheaper edit and the wrong one: the fixture owns the contract
+ * that every shim test starts from a clean install, and two copies drift the moment one of them
+ * learns something about Windows wrappers that the other does not.
+ */
+export function prependPath(dir: string, current: string | undefined): string {
+  return [dir, current].filter(Boolean).join(delimiter);
+}
+
+export function withInstalledShim(run: (paths: {
+  binDir: string;
+  home: string;
+  wrappers: string[];
+  backups: string[];
+  statePath: string;
+}) => void): void {
+  const binDir = mkdtempSync(join(tmpdir(), "ocx-shim-bin-"));
+  const home = mkdtempSync(join(tmpdir(), "ocx-shim-home-"));
+  const oldPath = process.env.PATH;
+  const oldHome = process.env.OPENCODEX_HOME;
+  const wrappers = process.platform === "win32"
+    ? [join(binDir, "codex.cmd"), join(binDir, "codex.ps1"), join(binDir, "codex")]
+    : [join(binDir, "codex")];
+  try {
+    process.env.PATH = prependPath(binDir, oldPath);
+    process.env.OPENCODEX_HOME = home;
+    for (const wrapper of wrappers) {
+      writeFileSync(wrapper, process.platform === "win32" ? `real ${wrapper}\n` : "#!/bin/sh\necho real\n", "utf8");
+      if (process.platform !== "win32") chmodSync(wrapper, 0o755);
+    }
+    const installed = installCodexShim();
+    expect(installed.installed, installed.message).toBe(true);
+    const statePath = join(home, "codex-shim.json");
+    const state = JSON.parse(readFileSync(statePath, "utf8")) as { wrappers: Array<{ wrapperPath: string; backupPath: string }> };
+    run({
+      binDir,
+      home,
+      wrappers: state.wrappers.map(file => file.wrapperPath),
+      backups: state.wrappers.map(file => file.backupPath),
+      statePath,
+    });
+  } finally {
+    if (oldPath === undefined) delete process.env.PATH;
+    else process.env.PATH = oldPath;
+    if (oldHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = oldHome;
+    removeTreeWithRetry(binDir);
+    removeTreeWithRetry(home);
+  }
+}
diff --git a/tests/helpers/combo-failover-upstream.ts b/tests/helpers/combo-failover-upstream.ts
new file mode 100644
index 00000000000..ff9d0ee62bb
--- /dev/null
+++ b/tests/helpers/combo-failover-upstream.ts
@@ -0,0 +1,60 @@
+/**
+ * Upstream response shapes for the combo failover suite.
+ *
+ * Moved verbatim out of tests/server/server-combo-failover-e2e.test.ts: that file is one line
+ * under its file-size cap and needed room to take the spend-journal lease. These builders
+ * decide nothing; each returns exactly the payload its callers were already constructing.
+ */
+export function chatSuccess(text: string, model = "model"): Response {
+  return Response.json({
+    id: `chatcmpl-${model}`,
+    object: "chat.completion",
+    model,
+    choices: [{ index: 0, message: { role: "assistant", content: text }, finish_reason: "stop" }],
+    usage: { prompt_tokens: 2, completion_tokens: 1, total_tokens: 3 },
+  });
+}
+
+export function chatStream(text: string): Response {
+  const frames = [
+    `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: text }, finish_reason: null }] })}\n\n`,
+    `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage: { prompt_tokens: 2, completion_tokens: 1, total_tokens: 3 } })}\n\n`,
+    "data: [DONE]\n\n",
+  ].join("");
+  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
+}
+
+export function chatTruncatedZeroOutputStream(): Response {
+  const frames = [
+    `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: null }] })}\n\n`,
+  ].join("");
+  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
+}
+
+export function chatErrorStream(message: string, prefix?: string): Response {
+  const frames = [
+    ...(prefix
+      ? [`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: prefix }, finish_reason: null }] })}\n\n`]
+      : []),
+    `data: ${JSON.stringify({ error: { type: "server_error", code: "upstream_server_error", message } })}\n\n`,
+    "data: [DONE]\n\n",
+  ].join("");
+  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
+}
+
+export function responsesSuccess(text: string, model = "responses-model"): Record<string, unknown> {
+  return {
+    id: `resp-${model}`,
+    object: "response",
+    status: "completed",
+    model,
+    output: [{
+      id: "msg_backup",
+      type: "message",
+      role: "assistant",
+      status: "completed",
+      content: [{ type: "output_text", text, annotations: [] }],
+    }],
+    usage: { input_tokens: 2, output_tokens: 1, total_tokens: 3 },
+  };
+}
diff --git a/tests/helpers/combo-tool-routing-cases.ts b/tests/helpers/combo-tool-routing-cases.ts
new file mode 100644
index 00000000000..efb20684288
--- /dev/null
+++ b/tests/helpers/combo-tool-routing-cases.ts
@@ -0,0 +1,66 @@
+import { expect, test } from "bun:test";
+import { isComboTargetInCooldown } from "../../src/combos";
+import { responsesSuccess } from "./combo-failover-upstream";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+
+interface Harness<Server> {
+  serve(handler: (request: Request) => Response | Promise<Response>): Server;
+  baseUrl(server: Server): string;
+  provider(adapter: string, url: string, apiKey: string, extra?: Partial<OcxProviderConfig>): OcxProviderConfig;
+  comboConfig(providers: OcxConfig["providers"], targets?: Array<{ provider: string; model: string }>,
+    extra?: Partial<NonNullable<OcxConfig["combos"]>[string]>): OcxConfig;
+  post(config: OcxConfig, raw?: Record<string, unknown>): Promise<Response>;
+}
+
+/**
+ * Register inside the parent describe: its isolated homes, mocks and cleanup still apply.
+ *
+ * Split out of tests/server/server-combo-failover-e2e.test.ts when that file crossed its
+ * file-size ratchet cap. The case is unchanged; only its home moved, following the same
+ * register-cases seam the forced-effort and context-overflow groups already use.
+ */
+export function registerComboToolRoutingCases<Server>({
+  serve, baseUrl, provider, comboConfig, post,
+}: Harness<Server>): void {
+for (const stream of [false, true]) {
+  test(`Responses tool-routing mismatch advances to a healthy target, stream=${stream}`, async () => {
+    const hits: string[] = [];
+    const toolResult = { type: "function_call_output", call_id: "call_exec", output: "tool result" };
+    const incompatible = serve(async request => {
+      hits.push("incompatible");
+      const raw = await request.json() as { input?: unknown[] };
+      expect(raw.input).toEqual([toolResult]);
+      return Response.json({ error: {
+        type: "invalid_request_error", code: null, param: "reasoning_effort",
+        message: "Function tools with reasoning_effort are not supported for gpt-6-astra-2026-09-03 in /v1/chat/completions. To use function tools, use /v1/responses or set reasoning_effort to 'none'.",
+      } }, { status: 400 });
+    });
+    const backup = serve(async request => {
+      hits.push("backup");
+      const raw = await request.json() as { input?: unknown[] };
+      expect(raw.input).toEqual([toolResult]);
+      const response = responsesSuccess("recovered tool request", "m2");
+      return stream
+        ? new Response([
+          `event: response.output_text.delta\ndata: ${JSON.stringify({ type: "response.output_text.delta", delta: "recovered tool request", item_id: "msg_backup", output_index: 0, content_index: 0 })}\n\n`,
+          `event: response.completed\ndata: ${JSON.stringify({ type: "response.completed", response })}\n\n`,
+        ].join(""), { headers: { "content-type": "text/event-stream" } })
+        : Response.json(response);
+    });
+    const config = comboConfig({
+      a: provider("openai-responses", baseUrl(incompatible), "key-a"),
+      b: provider("openai-responses", baseUrl(backup), "key-b"),
+    });
+    const response = await post(config, { stream, input: [toolResult], reasoning: { effort: "high" }, tools: [{
+      type: "function", name: "exec", description: "Run a command",
+      parameters: { type: "object", properties: {} },
+    }] });
+    const text = await response.text();
+    expect(response.status).toBe(200);
+    expect(text).toContain("recovered tool request");
+    expect(text).not.toContain("chat/completions");
+    expect(hits).toEqual(["incompatible", "backup"]);
+    expect(isComboTargetInCooldown("free", { provider: "a", model: "m1" })).toBe(false);
+  });
+}
+}
diff --git a/tests/helpers/compaction-routing-fixtures.ts b/tests/helpers/compaction-routing-fixtures.ts
new file mode 100644
index 00000000000..fb4db7b627b
--- /dev/null
+++ b/tests/helpers/compaction-routing-fixtures.ts
@@ -0,0 +1,107 @@
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+
+/**
+ * Config, request and upstream-response fixtures for the compaction-routing suite.
+ *
+ * Moved verbatim out of tests/responses/responses-compaction-routing.test.ts: that file sits at
+ * its file-size cap, and the repository answer to a cap is a sibling helper rather than
+ * compressed control flow. Nothing here decides anything; every value is the one its callers
+ * were already building inline.
+ */
+export function keyProviderConfig(overrides: Partial<OcxProviderConfig> = {}): OcxConfig {
+  return {
+    defaultProvider: "gw",
+    providers: {
+      gw: {
+        adapter: "openai-responses",
+        baseUrl: "https://gateway.example/v1",
+        authMode: "key",
+        apiKey: "test-key",
+        ...overrides,
+      },
+    },
+  } as unknown as OcxConfig;
+}
+
+export function nativePoolConfig(): OcxConfig {
+  return {
+    defaultProvider: "openai",
+    activeCodexAccountId: "pool-a",
+    providers: {
+      openai: {
+        adapter: "openai-responses",
+        baseUrl: "https://chatgpt.com/backend-api/codex",
+        authMode: "forward",
+        codexAccountMode: "pool",
+      },
+    },
+    codexAccounts: [{
+      id: "pool-a",
+      email: "pool@example.test",
+      isMain: false,
+      chatgptAccountId: "pool_acc",
+    }],
+  } as OcxConfig;
+}
+
+/** Two-account pool: the alternate-attempt tests need somewhere for the retry to go. */
+export function twoAccountPoolConfig(): OcxConfig {
+  const config = nativePoolConfig();
+  config.codexAccounts = [
+    { id: "pool-a", email: "a@example.test", isMain: false, chatgptAccountId: "pool_acc_a" },
+    { id: "pool-b", email: "b@example.test", isMain: false, chatgptAccountId: "pool_acc_b" },
+  ] as OcxConfig["codexAccounts"];
+  return config;
+}
+
+export function compactionRequest(
+  body: Record<string, unknown>,
+  signal?: AbortSignal,
+  extraHeaders: Record<string, string> = {},
+): Request {
+  return new Request("http://localhost/v1/responses", {
+    method: "POST",
+    headers: { "content-type": "application/json", ...extraHeaders },
+    body: JSON.stringify(body),
+    signal,
+  });
+}
+
+export function baseCompactionBody(extra: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    model: "gw/some-model",
+    stream: false,
+    input: [
+      { type: "message", role: "user", content: [{ type: "input_text", text: "earlier turn" }] },
+      { type: "compaction_trigger" },
+    ],
+    tools: [{ type: "function", name: "shell" }],
+    tool_choice: "auto",
+    parallel_tool_calls: true,
+    ...extra,
+  };
+}
+
+export function jsonResponse(payload: unknown): Response {
+  return new Response(JSON.stringify(payload), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+export function completedPayload(text: string): Record<string, unknown> {
+  return {
+    id: "resp_1",
+    status: "completed",
+    output: [{ type: "message", role: "assistant", content: [{ type: "output_text", text }] }],
+    usage: { input_tokens: 10, output_tokens: 5, total_tokens: 15 },
+  };
+}
+
+export function sseResponse(events: Array<Record<string, unknown>>): Response {
+  const body = events.map(e => `event: ${String(e.type)}\ndata: ${JSON.stringify(e)}\n\n`).join("");
+  return new Response(body, {
+    status: 200,
+    headers: { "content-type": "text/event-stream" },
+  });
+}
diff --git a/tests/helpers/custom-tool-repair-fixtures.ts b/tests/helpers/custom-tool-repair-fixtures.ts
new file mode 100644
index 00000000000..cedd3094903
--- /dev/null
+++ b/tests/helpers/custom-tool-repair-fixtures.ts
@@ -0,0 +1,20 @@
+/**
+ * Shared fixtures for the routed custom-tool repair suites.
+ *
+ * Both halves of that suite read the same SSE data line, build the same event block and compare
+ * the same decorated and canonical apply_patch bodies. They live here because the suite was split
+ * in two and duplicating a fixture is how two copies of it drift apart.
+ */
+export function dataPayload(block: string): Record<string, unknown> {
+  const line = block.split(/\r?\n/).find(entry => entry.startsWith("data:"));
+  if (!line) throw new Error("missing SSE data line");
+  return JSON.parse(line.slice(5).trim()) as Record<string, unknown>;
+}
+
+export function frame(event: string, payload: Record<string, unknown>): string {
+  return `event: ${event}\ndata: ${JSON.stringify({ type: event, ...payload })}`;
+}
+
+export const DECORATED_PATCH = "*** Begin Patch ***\n*** Update File: README.md\n@@\n-old\n+new\n*** End Patch ***";
+export const CANONICAL_PATCH = "*** Begin Patch\n*** Update File: README.md\n@@\n-old\n+new\n*** End Patch";
+export const WRAPPED_DECORATED_PATCH = JSON.stringify({ input: DECORATED_PATCH });
diff --git a/tests/helpers/deferred-reset-sse-upstream.ts b/tests/helpers/deferred-reset-sse-upstream.ts
new file mode 100644
index 00000000000..00a3bfa3078
--- /dev/null
+++ b/tests/helpers/deferred-reset-sse-upstream.ts
@@ -0,0 +1,73 @@
+/**
+ * An SSE upstream body that resets mid-stream on demand, where the reset is raised somewhere
+ * the stream itself observes rather than somewhere nothing is listening (#5073).
+ *
+ * The direct way to write this fixture is to leak the stream's controller out of `start()`
+ * and call `controller.error()` from the test body. That is what
+ * `tests/server/server-auth.test.ts` did, and under load the fixture's own error escaped as
+ * an unhandled error instead of being delivered to the code under test, failing the whole
+ * file on four unrelated heads (#4989, #5024, `dev` at ecd3adae75, #5085).
+ *
+ * The reason is that a leaked controller can be errored at a moment of the test's choosing,
+ * which is not necessarily a moment when anything is reading. Between the server sink's
+ * reads there is no pending read request to reject, so the rejection's only subscriber is
+ * whatever the runtime attaches next — and on a busy runner the unhandled-rejection report
+ * can win that race. The test cannot see or control that window from outside the stream.
+ *
+ * So the reset is raised from inside `pull()` instead. Two properties come from that, and
+ * they are worth separating because only the first one is absolute:
+ *
+ * The pull algorithm's promise is always observed. `CallPullIfNeeded` attaches its own
+ * rejection handler and routes the failure into `ReadableStreamDefaultControllerError`, so a
+ * throw from `pull()` cannot be an orphaned rejection whatever the consumer is doing. That is
+ * the guarantee this fixture rests on.
+ *
+ * `highWaterMark: 0` then keeps the reset in a faithful place. The queue is never stocked
+ * ahead of demand, so `shouldCallPull` is true only while a read request is outstanding, and
+ * `pull()` runs if and only if a consumer has asked for the next chunk. The stream is never
+ * errored before anything has attached to it, which is the state where the error has nowhere
+ * to go. It is not a promise that a read request is still pending at the instant of the
+ * throw — a consumer that cancels in between removes its own request — only that the error is
+ * raised in response to demand and is consumed by the stream either way.
+ *
+ * The enqueued opening chunks are unaffected: `enqueue()` ignores the high-water mark, and the
+ * first read is still served from the queue.
+ *
+ * What the code under test sees is unchanged: one SSE chunk, then a mid-stream body error.
+ */
+
+/** The reset every body from this helper raises, so assertions can name it. */
+export const DEFERRED_RESET_MESSAGE = "fixture upstream connection reset";
+
+export type DeferredResetSseUpstream = {
+  /** A fresh body for one upstream attempt; a retried dispatch gets its own stream. */
+  response: (init?: ResponseInit) => Response;
+  /** Reset every body this helper has handed out, and every later one. */
+  reset: () => void;
+};
+
+/**
+ * Build an SSE upstream that emits `chunks` and then resets when `reset()` is called.
+ *
+ * `reset()` is idempotent and order-independent: calling it before the first attempt is
+ * dispatched arms the reset for that attempt rather than losing it.
+ */
+export function deferredResetSseUpstream(...chunks: string[]): DeferredResetSseUpstream {
+  const encoder = new TextEncoder();
+  const requested = Promise.withResolvers<void>();
+  return {
+    reset: () => requested.resolve(),
+    response: (init = { headers: { "content-type": "text/event-stream" } }) => new Response(
+      new ReadableStream<Uint8Array>({
+        start(controller) {
+          for (const chunk of chunks) controller.enqueue(encoder.encode(chunk));
+        },
+        async pull() {
+          await requested.promise;
+          throw new Error(DEFERRED_RESET_MESSAGE);
+        },
+      }, { highWaterMark: 0 }),
+      init,
+    ),
+  };
+}
diff --git a/tests/helpers/native-injection-fixture.ts b/tests/helpers/native-injection-fixture.ts
index 07f2703334c..c7d3a10b31d 100644
--- a/tests/helpers/native-injection-fixture.ts
+++ b/tests/helpers/native-injection-fixture.ts
@@ -6,6 +6,15 @@ import type { ServeOptionsContext } from "../../src/server/index/serve-options";
 import type { WsData } from "../../src/server/ws-bridge";
 import { clearRequestLogsForTests } from "../../src/server/request-log";
 import { runOptionalShutdownHooks } from "../../src/lib/optional-shutdown-hooks";
+import { acquireOwnedSpendHome } from "./owned-spend-home";
+
+// The websocket handler dispatches through the real request path, so it reaches the shared spend
+// journal and needs the writer lease startServer would have taken. Without it the turn is refused
+// and the symptom is the fixture's own wait timing out, which names nothing.
+let releaseSpendHome: (() => void) | undefined;
+// Every synthetic client this fixture opens, so teardown can close them before the lease is
+// given back rather than leaving a handler mid-turn against a journal nobody owns.
+const clients: Array<ServerWebSocket<WsData>> = [];
 
 export type Frame = Record<string, any>;
 const realSocket = globalThis.WebSocket;
@@ -50,12 +59,14 @@ export const waitForInjection = async (condition: () => boolean) => {
   throw new Error("injection fixture condition timed out");
 };
 export function injectionClient(fields: Frame = {}, settings = injectionConfig(), credential = "test") {
+  releaseSpendHome ??= acquireOwnedSpendHome();
   const handler = createWebsocketHandler({ config: settings, deps: {} } as ServeOptionsContext);
   const sent: Frame[] = [];
   const ws = { readyState: 1, data: { headers: new Headers({ authorization: `Bearer ${credential}`, "thread-id": `injection-fixture-${++nextId}`, "openai-beta": "fixture_beta=v1" }) } as WsData,
     send: (text: string) => { sent.push(JSON.parse(text)); return 1; }, close() { handler.close(ws, 1000, "fixture close"); },
   } as unknown as ServerWebSocket<WsData>;
   const send = (frame: Frame) => handler.message(ws, JSON.stringify(frame));
+  clients.push(ws);
   send({ type: "response.create", model: settings.defaultProvider === "api" ? "api/gpt-5.6-sol" : "gpt-5.6-sol", input: "initial", multi_agent: { enabled: true },
     tools: [{ type: "function", name: "get_value", parameters: { type: "object", properties: {} } }], ...fields });
   return { ws, sent, send, handler };
@@ -98,10 +109,38 @@ export function installInjectionFixture() {
     globalThis.fetch = (async () => { fallbackCalls++; throw new Error("network disabled in injection fixture"); }) as typeof fetch;
     clearRequestLogsForTests();
   });
-  afterEach(() => {
-    for (const socket of InjectionSocket.all) socket.close();
-    InjectionSocket.all = []; runOptionalShutdownHooks();
-    globalThis.WebSocket = realSocket; globalThis.fetch = realFetch;
-    for (const key of proxyKeys) { delete process.env[key]; if (savedProxy[key] !== undefined) process.env[key] = savedProxy[key]; }
+  afterEach(async () => {
+    // handler.close only STARTS the pump cancellation. Waiting for the socket to drop its stream
+    // cancel and its native control is what proves the turn finished accounting; releasing the
+    // lease before that leaves a reader settling against a journal nobody owns.
+    //
+    // The rest runs even when that wait gives up, and the failure still propagates. A wait that
+    // expired is NOT evidence the turn settled: it means this fixture could not prove it, and
+    // the case should say so while still handing back the lease and the globals it replaced.
+    let failure: unknown;
+    const note = (error: unknown): void => { failure ??= error; };
+    try {
+      // Every client gets its close and its wait even after an earlier one gave up. Stopping at
+      // the first failure left the rest open for the next case to inherit.
+      for (const client of clients.splice(0)) {
+        // Separate guards: close() runs the production handler, so a throw there would otherwise
+        // skip this client's completion wait as well as its own failure.
+        try { client.close(); } catch (error) { note(error); }
+        try {
+          await waitForInjection(() => client.data.cancel === undefined && client.data.nativeControl === undefined);
+        } catch (error) { note(error); }
+      }
+      for (const socket of InjectionSocket.all) {
+        try { socket.close(); } catch (error) { note(error); }
+      }
+      InjectionSocket.all = [];
+      try { runOptionalShutdownHooks(); } catch (error) { note(error); }
+      // The release itself can throw, and it used to take the global restore down with it.
+      try { releaseSpendHome?.(); } catch (error) { note(error); } finally { releaseSpendHome = undefined; }
+    } finally {
+      globalThis.WebSocket = realSocket; globalThis.fetch = realFetch;
+      for (const key of proxyKeys) { delete process.env[key]; if (savedProxy[key] !== undefined) process.env[key] = savedProxy[key]; }
+    }
+    if (failure !== undefined) throw failure;
   });
 }
diff --git a/tests/helpers/nested-test-run-lock-controller.ts b/tests/helpers/nested-test-run-lock-controller.ts
new file mode 100644
index 00000000000..964d8e951d5
--- /dev/null
+++ b/tests/helpers/nested-test-run-lock-controller.ts
@@ -0,0 +1,342 @@
+/**
+ * Lock owner for the Windows nested live-lock regression (issue #4991).
+ *
+ * The regression in tests/ci-workflows/test-runner.test.ts proves that a nested Bun test
+ * inherits the live test-run lock exactly and refuses an incomplete capability. It used
+ * to read that capability out of its own environment, so it could only run while the
+ * outer process already held a lock — and the hosted Windows batch leg sets
+ * OCX_TEST_NO_QUEUE=1 precisely so that it does not. The case was therefore skipped on
+ * the only platform it applies to, and the coverage existed on paper only.
+ *
+ * This controller supplies the missing holder instead of borrowing the lane's. It runs as
+ * a plain "bun <file>" child with exactly one environment change — the no-queue opt-out
+ * removed for this process and its descendants — resolves the user-scoped lock through
+ * the ordinary safe path, and acquires it for its own run id. When a wrapped or bare
+ * Windows run has already published a complete capability it joins that owner instead,
+ * because a second owner for one path is the clobber this suite exists to prevent.
+ * Nothing here writes an owner file by hand: a fabricated capability would only prove
+ * that a child trusts what it is told, which is the inverse of the contract under test.
+ *
+ * Three things about how it is launched are load-bearing. It must be spawned with a cwd
+ * OUTSIDE the repository so Bun loads no bunfig preload into the holder itself; a
+ * preloaded controller would take the same lock in tests/preload.ts and then wait on
+ * itself. It must be handed a temporary root it may write into, because every fixture it
+ * generates and the foreign-owner probe it plants live there. And it must be handed both
+ * a deadline and the caller's spawn options: the nominal per-child timeout belongs to the
+ * case that owns these children, and the controller only narrows it to what is left of
+ * the deadline minus a cleanup reserve, so the controller always reaches its own teardown
+ * rather than being killed inside a spawn with the lock still held.
+ *
+ * Everything below runs only as an entry point. The test file imports the receipt key
+ * from here, and an import must not acquire a lock or spawn anything.
+ *
+ * Output is one JSON line of booleans plus diagnostics with every UUID-shaped substring
+ * removed. Child output is parsed, never echoed.
+ */
+import { randomUUID } from "node:crypto";
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, win32 } from "node:path";
+import {
+  acquireTestRunLock,
+  resolveWrappedTestRunLockPath,
+  TEST_RUN_ID_ENV,
+  TEST_RUN_LOCK_PATH_ENV,
+  TEST_RUN_LOCK_TOKEN_ENV,
+  TEST_RUN_NO_QUEUE_ENV,
+  type TestRunLock,
+} from "../../scripts/test-run-lock";
+import { repoPath } from "./repo-root";
+
+/** Shape the caller asserts on; every field must be true for the case to pass. */
+export interface NestedLiveLockReceipt {
+  lockHeld: boolean;
+  healthyChildExited: boolean;
+  healthyReceiptComplete: boolean;
+  missingTokenRefused: boolean;
+  wrongTokenRefused: boolean;
+  wrongPathRefused: boolean;
+  foreignOwnerTimedOut: boolean;
+  foreignOwnerUntouched: boolean;
+  ownerContentUnchanged: boolean;
+  childrenReaped: boolean;
+  releasedOnlyOwnLock: boolean;
+  receiptRedacted: boolean;
+}
+
+export const NESTED_LIVE_LOCK_RECEIPT_KEY = "nestedLiveLockReceipt";
+const CHILD_MARKER = '{"nestedLockReceipt":';
+const CHILD_RECEIPT_KEYS = ["samePath", "sameRun", "sameToken", "member", "preloadRan", "guardArmed"] as const;
+/** Healthy, missing token, foreign token, foreign path. A short count means one was skipped. */
+const EXPECTED_CHILD_SPAWNS = 4;
+const ACQUIRE_POLL_MS = 250;
+const ACQUIRE_MAX_WAIT_MS = 10_000;
+const FOREIGN_POLL_MS = 100;
+const FOREIGN_MAX_WAIT_MS = 300;
+/** Time kept back from every child so teardown runs before the caller's hard kill. */
+const CLEANUP_RESERVE_MS = 4_000;
+const MINIMUM_CHILD_ALLOWANCE_MS = 1_000;
+/**
+ * Any UUID, not merely the token this process knows about. Several errors in
+ * scripts/test-run-lock.ts can carry a member filename, and one of them is reachable
+ * before acquire returns, so a redactor keyed on our own token would be blind exactly
+ * where a leak is possible. Built fresh per call because a global regex carries
+ * lastIndex between a replace and a test.
+ */
+const uuidPattern = (): RegExp => /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi;
+
+interface ChildSpawnOptions {
+  timeout: number;
+}
+
+async function runNestedLiveLockController(
+  tempRoot: string | undefined,
+  deadlineAt: number,
+  childSpawn: ChildSpawnOptions | undefined,
+): Promise<void> {
+  const receipt: NestedLiveLockReceipt = {
+    lockHeld: false,
+    healthyChildExited: false,
+    healthyReceiptComplete: false,
+    missingTokenRefused: false,
+    wrongTokenRefused: false,
+    wrongPathRefused: false,
+    foreignOwnerTimedOut: false,
+    foreignOwnerUntouched: false,
+    ownerContentUnchanged: false,
+    childrenReaped: false,
+    releasedOnlyOwnLock: false,
+    receiptRedacted: false,
+  };
+  const diagnostics: string[] = [];
+  const note = (message: string): void => { diagnostics.push(message); };
+  const describeError = (error: unknown): string => (error instanceof Error ? error.message : String(error));
+  const budgetLeftMs = (): number => deadlineAt - Date.now() - CLEANUP_RESERVE_MS;
+  let lock: TestRunLock | undefined;
+  let ownerFile: string | undefined;
+  let ownerBefore: string | undefined;
+  let ownerToken: string | undefined;
+  let foreignOwnerFile: string | undefined;
+  let foreignOwner: string | undefined;
+  // Whether each spawned child was waited on, which is what reaping means for spawnSync.
+  const settledChildren: boolean[] = [];
+
+  try {
+    if (process.platform !== "win32") throw new Error("the nested live-lock controller is Windows-only");
+    if (!tempRoot) throw new Error("the nested live-lock controller needs a temporary root argument");
+    if (!Number.isFinite(deadlineAt)) throw new Error("the nested live-lock controller needs a deadline argument");
+    if (!childSpawn || !Number.isFinite(childSpawn.timeout) || childSpawn.timeout <= 0) {
+      throw new Error("the nested live-lock controller needs the caller's child spawn options");
+    }
+    if (process.env[TEST_RUN_NO_QUEUE_ENV] !== undefined) {
+      throw new Error("the controller environment must have the no-queue opt-out removed");
+    }
+
+    // A wrapped or bare Windows run already holds this lock and handed us its complete
+    // capability, so join it. The hosted no-queue lane has no such holder, and there we
+    // resolve and acquire one of our own.
+    const inheritedPath = process.env[TEST_RUN_LOCK_PATH_ENV]?.trim();
+    const inheritedToken = process.env[TEST_RUN_LOCK_TOKEN_ENV]?.trim();
+    const inheritedRunId = process.env[TEST_RUN_ID_ENV]?.trim();
+    const joining = Boolean(inheritedPath && inheritedToken && inheritedRunId);
+    // Known before the join can fail, so a failure inside registerMember cannot reach the
+    // diagnostics with a live token the redactor has not been told about.
+    if (joining) ownerToken = inheritedToken;
+    const resolved = joining ? inheritedPath : resolveWrappedTestRunLockPath({ env: process.env });
+    if (!resolved) throw new Error("the user-scoped Bun test lock path did not resolve");
+    const lockPath = resolved;
+    const runId = joining && inheritedRunId ? inheritedRunId : "nested-live-lock-" + randomUUID();
+
+    lock = await acquireTestRunLock({
+      runId,
+      lockPath,
+      validatedRuntimePath: true,
+      env: process.env,
+      joinExistingOwnerToken: joining ? inheritedToken : undefined,
+      pollMs: ACQUIRE_POLL_MS,
+      maxWaitMs: Math.max(ACQUIRE_POLL_MS, Math.min(ACQUIRE_MAX_WAIT_MS, budgetLeftMs())),
+    });
+    const owner = lock.owner;
+    if (!owner) throw new Error("the run lock produced no owner record");
+    ownerToken = owner.token;
+    receipt.lockHeld = true;
+
+    // Publish the capability into our own environment so the children below inherit it the
+    // way any descendant of a real run does, rather than being handed a constructed one.
+    process.env[TEST_RUN_ID_ENV] = runId;
+    process.env[TEST_RUN_LOCK_PATH_ENV] = lockPath;
+    process.env[TEST_RUN_LOCK_TOKEN_ENV] = owner.token;
+
+    const activeOwnerFile = join(lockPath, "owner.json");
+    const activeOwnerBefore = readFileSync(activeOwnerFile, "utf8");
+    ownerFile = activeOwnerFile;
+    ownerBefore = activeOwnerBefore;
+    receipt.ownerContentUnchanged = true;
+    const confirmOwnerUnchanged = (): void => {
+      const current = existsSync(activeOwnerFile) ? readFileSync(activeOwnerFile, "utf8") : null;
+      if (current === activeOwnerBefore) return;
+      receipt.ownerContentUnchanged = false;
+      note("the owner receipt changed while a nested child ran");
+    };
+
+    const fixture = join(tempRoot, "nested-live-lock.test.ts");
+    writeFileSync(fixture, [
+      'import { test } from "bun:test";',
+      'import { existsSync, readFileSync } from "node:fs";',
+      'import { join } from "node:path";',
+      'test("nested lock receipt", () => {',
+      '  const path = process.env.OCX_TEST_RUN_LOCK_PATH ?? "";',
+      '  const owner = JSON.parse(readFileSync(join(path, "owner.json"), "utf8"));',
+      "  console.log(JSON.stringify({ nestedLockReceipt: {",
+      "    samePath: path === " + JSON.stringify(lockPath) + ",",
+      "    sameRun: owner.runId === " + JSON.stringify(runId)
+        + " && process.env.OCX_TEST_RUN_ID === " + JSON.stringify(runId) + ",",
+      "    sameToken: owner.token === process.env.OCX_TEST_RUN_LOCK_TOKEN,",
+      '    member: existsSync(join(path, "members", process.pid + "-" + owner.token)),',
+      "    preloadRan: process.env.OCX_TEST_PRELOAD_PID === String(process.pid),",
+      '    guardArmed: process.env.OCX_TEST_HOME_GUARD === "1",',
+      "  } }));",
+      "});",
+      "",
+    ].join("\n"));
+
+    const args = ["test", "--preload", repoPath("tests", "preload.ts"), fixture];
+    const runChild = (label: string, mutate?: (env: NodeJS.ProcessEnv) => void): SpawnSyncReturns<string> => {
+      const allowance = Math.min(childSpawn.timeout, budgetLeftMs());
+      if (allowance < MINIMUM_CHILD_ALLOWANCE_MS) {
+        throw new Error("the controller ran out of budget before spawning " + label);
+      }
+      const env = { ...process.env };
+      // Drop the two receipts the child is supposed to produce for itself. Inherited, they
+      // would report a preload that never ran and a guard nobody armed.
+      delete env.OCX_TEST_PRELOAD_PID;
+      delete env.OCX_TEST_HOME_GUARD;
+      mutate?.(env);
+      const result = spawnSync(process.execPath, args, {
+        cwd: tempRoot, env, encoding: "utf8", timeout: Math.floor(allowance),
+      });
+      // spawnSync returns only after the child has been waited on, so a settled status or
+      // signal IS the reap. A liveness probe on the pid would be a race against pid reuse.
+      settledChildren.push(result.status !== null || result.signal !== null);
+      return result;
+    };
+    const refusal = (result: SpawnSyncReturns<string>, needle: string, label: string): boolean => {
+      const refused = result.status !== 0
+        && (result.stderr ?? "").includes(needle)
+        && !(result.stdout ?? "").includes(CHILD_MARKER);
+      if (!refused) note(label + " was not refused (status " + String(result.status) + ")");
+      return refused;
+    };
+
+    const healthy = runChild("the healthy child");
+    receipt.healthyChildExited = healthy.status === 0;
+    if (!receipt.healthyChildExited) {
+      note("the healthy child exited with status " + String(healthy.status) + " signal " + String(healthy.signal));
+    }
+    const marker = (healthy.stdout ?? "").split("\n").find(line => line.startsWith(CHILD_MARKER));
+    const nested = marker
+      ? (JSON.parse(marker) as { nestedLockReceipt?: Record<string, unknown> }).nestedLockReceipt
+      : undefined;
+    receipt.healthyReceiptComplete = nested !== undefined
+      && CHILD_RECEIPT_KEYS.every(key => nested[key] === true);
+    if (!receipt.healthyReceiptComplete) note("nested receipt: " + JSON.stringify(nested ?? null));
+    confirmOwnerUnchanged();
+
+    receipt.missingTokenRefused = refusal(
+      runChild("the tokenless child", env => { delete env[TEST_RUN_LOCK_TOKEN_ENV]; }),
+      "capability is incomplete",
+      "a child holding no token",
+    );
+    confirmOwnerUnchanged();
+
+    receipt.wrongTokenRefused = refusal(
+      runChild("the foreign-token child", env => { env[TEST_RUN_LOCK_TOKEN_ENV] = randomUUID(); }),
+      "exact live owner no longer matches",
+      "a child holding a foreign token",
+    );
+    confirmOwnerUnchanged();
+
+    receipt.wrongPathRefused = refusal(
+      runChild("the foreign-path child", env => {
+        env[TEST_RUN_LOCK_PATH_ENV] = win32.join(win32.dirname(lockPath), "opencodex-bun-test-not-this-host.lock");
+      }),
+      "refusing inherited lock access",
+      "a child holding a foreign lock path",
+    );
+    confirmOwnerUnchanged();
+
+    // The acquire path must wait out a live owner it does not own and then give up rather
+    // than reclaim it. Planted under the temporary root so the probe can never reach the
+    // real lock, and owned by this very pid so its liveness is a fact, not a fixture.
+    const foreignLock = join(tempRoot, "foreign-owner.lock");
+    mkdirSync(foreignLock, { recursive: true, mode: 0o700 });
+    const plantedFile = join(foreignLock, "owner.json");
+    const planted = JSON.stringify({
+      version: 1,
+      runId: "foreign-" + randomUUID(),
+      token: randomUUID(),
+      pid: process.pid,
+      acquiredAt: new Date().toISOString(),
+    }) + "\n";
+    writeFileSync(plantedFile, planted, { encoding: "utf8", mode: 0o600 });
+    foreignOwnerFile = plantedFile;
+    foreignOwner = planted;
+    const probeStartedAt = Date.now();
+    try {
+      await acquireTestRunLock({
+        runId: "timeout-probe-" + randomUUID(),
+        lockPath: foreignLock,
+        env: process.env,
+        pollMs: FOREIGN_POLL_MS,
+        maxWaitMs: FOREIGN_MAX_WAIT_MS,
+      });
+      note("the controller took a lock a live foreign owner still held");
+    } catch (error) {
+      // The elapsed floor is the point: an immediate refusal would satisfy the message
+      // alone while proving nothing about waiting for the holder.
+      receipt.foreignOwnerTimedOut = describeError(error).includes("timed out after")
+        && Date.now() - probeStartedAt >= FOREIGN_MAX_WAIT_MS;
+      if (!receipt.foreignOwnerTimedOut) note("unexpected foreign-owner failure: " + describeError(error));
+    }
+    receipt.foreignOwnerUntouched = existsSync(plantedFile)
+      && readFileSync(plantedFile, "utf8") === planted;
+    confirmOwnerUnchanged();
+  } catch (error) {
+    note("controller failure: " + describeError(error));
+  } finally {
+    receipt.childrenReaped = settledChildren.length === EXPECTED_CHILD_SPAWNS
+      && settledChildren.every(Boolean);
+    try {
+      // Releasing must remove our own lock and nothing else, so the planted foreign owner
+      // is re-read afterwards rather than only before.
+      const foreignIntact = foreignOwnerFile === undefined
+        || (existsSync(foreignOwnerFile) && readFileSync(foreignOwnerFile, "utf8") === foreignOwner);
+      if (lock?.acquired) {
+        lock.release();
+        receipt.releasedOnlyOwnLock = ownerFile !== undefined && !existsSync(ownerFile) && foreignIntact;
+      } else if (lock && ownerFile !== undefined && ownerBefore !== undefined) {
+        // Joined rather than acquired: leaving the other holder exactly as found IS the claim.
+        receipt.releasedOnlyOwnLock = existsSync(ownerFile)
+          && readFileSync(ownerFile, "utf8") === ownerBefore
+          && foreignIntact;
+      }
+    } catch (error) {
+      note("release failure: " + describeError(error));
+    }
+
+    const body = {
+      [NESTED_LIVE_LOCK_RECEIPT_KEY]: receipt,
+      diagnostics: diagnostics.map(entry => entry.replace(uuidPattern(), "<redacted>")),
+    };
+    receipt.receiptRedacted = !uuidPattern().test(JSON.stringify(body));
+    process.stdout.write(JSON.stringify(body) + "\n");
+    process.exitCode = diagnostics.length === 0 && Object.values(receipt).every(Boolean) ? 0 : 1;
+  }
+}
+
+if (import.meta.main) {
+  const spawnOptions = process.argv[4]
+    ? JSON.parse(process.argv[4]) as ChildSpawnOptions
+    : undefined;
+  await runNestedLiveLockController(process.argv[2], Number(process.argv[3]), spawnOptions);
+}
diff --git a/tests/helpers/owned-spend-home.ts b/tests/helpers/owned-spend-home.ts
new file mode 100644
index 00000000000..f954d1d0b27
--- /dev/null
+++ b/tests/helpers/owned-spend-home.ts
@@ -0,0 +1,34 @@
+import { acquireSpendLedgerOwner, type SpendLedgerOwnerLease } from "../../src/lib/spend-ledger-owner";
+import { resetSharedSpendLedgerForTest } from "../../src/lib/spend-reservation-ledger";
+
+/**
+ * Hold the spend-journal writer lease for a case that dispatches without starting a server.
+ *
+ * `startServer` takes this lease before anything can serve, so production traffic always
+ * reaches the ledger owning its state directory. A case that calls an internal handler directly
+ * skips that step, and the ledger refuses to write for a process that owns nothing. Taking the
+ * real lease here keeps the production rule intact instead of teaching the ledger to make an
+ * exception for tests.
+ *
+ * Returns an idempotent release. Call it FIRST in the case's own teardown, before the state
+ * directory is removed and before the home variable is restored: an open SQLite lease inside a
+ * directory being deleted fails the removal on Windows and leaves an unlinked live database on
+ * POSIX. Ordering is stated by the caller rather than inferred from hook registration order,
+ * which differs between these fixtures and is not a contract either way.
+ */
+export function acquireOwnedSpendHome(): () => void {
+  resetSharedSpendLedgerForTest();
+  const lease: SpendLedgerOwnerLease = acquireSpendLedgerOwner();
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    // A rollback or close failure is a real defect in the thing under test, so it is allowed to
+    // fail the case. Swallowing it would leave a green run over a lease that never let go.
+    try {
+      lease.release();
+    } finally {
+      resetSharedSpendLedgerForTest();
+    }
+  };
+}
diff --git a/tests/helpers/passthrough-key-url.ts b/tests/helpers/passthrough-key-url.ts
new file mode 100644
index 00000000000..15716abdd63
--- /dev/null
+++ b/tests/helpers/passthrough-key-url.ts
@@ -0,0 +1,26 @@
+import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses";
+import { withTestTranslatorBudget } from "./translator-budget";
+
+/**
+ * The upstream URL a key-auth Responses passthrough adapter would actually request.
+ *
+ * Moved out of tests/responses/openai-responses-passthrough.test.ts verbatim, including the
+ * test translator budget its local adapter wrapper applied: that file is at its file-size cap,
+ * and the repository answer to a cap is a sibling helper rather than compressed control flow.
+ */
+export function buildKeyAuthUrl(baseUrl: string, responsesPath?: string): string {
+  const adapter = withTestTranslatorBudget(createResponsesPassthroughAdapter({
+    adapter: "openai-responses",
+    baseUrl,
+    authMode: "key" as const,
+    apiKey: "sk-test",
+    ...(responsesPath === undefined ? {} : { responsesPath }),
+  }));
+  return adapter.buildRequest({
+    modelId: "test-model",
+    context: { messages: [] },
+    stream: true,
+    options: {},
+    _rawBody: { model: "test-model", input: "ping" },
+  }, { headers: new Headers() }).url;
+}
diff --git a/tests/helpers/phase-timing.ts b/tests/helpers/phase-timing.ts
new file mode 100644
index 00000000000..02f0beaf749
--- /dev/null
+++ b/tests/helpers/phase-timing.ts
@@ -0,0 +1,206 @@
+import { cpus, release } from "node:os";
+
+/**
+ * Monotonic phase timing for the cases in issue #4997.
+ *
+ * Those cases exceed their own budgets only when the suite runs unsharded, and pass in the
+ * sharded lanes running the same files. Three control dispatches produced three DISJOINT failing
+ * sets, so the shared factor is elapsed time in a process holding 1367 files rather than any one
+ * subsystem. A single per-test duration cannot separate the possibilities that implies: cold
+ * fixture setup, a wait the assertion actually needs, slow contended execution, and a teardown
+ * still reaping a child all arrive as one number.
+ *
+ * This splits that number. `prepare` is everything done before the contract is observable,
+ * `execute` is the part the assertion is about, and `teardown` is release plus child reap. A
+ * reader comparing a control log against a sharded log can then say WHICH phase grew, which is
+ * the question every disposition in that issue is blocked on.
+ *
+ * ## Why it also ticks
+ *
+ * A budget overrun kills the test, so the closing line of the phase that overran is exactly the
+ * line that never prints. With nothing emitted DURING a phase, an overrun and a wedge are the
+ * same observation: a log that stops mid-phase. So an open phase emits progress ticks on an
+ * exponential schedule, and each tick reports whether the case's own progress counter moved since
+ * the previous one. A truncated record ending in `moving=yes` is slow execution under contention;
+ * one ending in `moving=no` is a stall with no work happening. Those are different defects and
+ * the per-test duration cannot tell them apart.
+ *
+ * ## What it does not collect
+ *
+ * Runtime and host identity only. A control lane and a shard differ in load rather than in
+ * configuration, so an environment dump would be noise that still has to be audited; `privacy:scan`
+ * reads this tree, and a diagnostic needing redaction is one nobody will leave enabled.
+ *
+ * ## Reading it
+ *
+ * The job log is the only channel the `macos control` lane has: `.github/workflows/ci.yml` tees
+ * the suite and uploads no artifact. Grep a job log for `[test-phase]`.
+ *
+ * `at` is milliseconds since process start from `performance.now()`, monotonic and unaffected by a
+ * clock step, matching the timing convention already used across this suite. It doubles as
+ * position-in-run: sorting every emitted line by `at` recovers the order the runner selected these
+ * cases in, so no file has to restate an ordering it would then have to keep correct.
+ */
+
+/** One prefix for the whole record, so a single grep over a job log finds all of it. */
+const TAG = "[test-phase]";
+
+/** First tick delay; each later gap doubles until it reaches TICK_MAX_MS. */
+const TICK_FIRST_MS = 1_000;
+const TICK_MAX_MS = 15_000;
+
+/**
+ * How long one phase may keep reporting. The bound matters because a phase killed by a test
+ * timeout never closes, and `unref` keeps the process from being held open without cancelling
+ * anything, so an unbounded chain would outlive its case and write into an unrelated part of the
+ * log. Two minutes is past every budget in #4997, the largest of which is 60s, and ends long
+ * before the job does.
+ */
+const TICK_WINDOW_MS = 120_000;
+
+let envEmitted = false;
+let seq = 0;
+
+function emit(fields: string[]): void {
+  console.info([TAG, ...fields].join(" "));
+}
+
+/** Milliseconds since process start, monotonic, to a tenth of a millisecond. */
+function nowMs(): string {
+  return performance.now().toFixed(1);
+}
+
+/**
+ * Runtime and host, once per isolate. `bun test --isolate` reclaims the realm at file boundaries,
+ * so this runs once per instrumented file rather than once per process, which is what makes it
+ * usable as a per-file anchor when lines from several files interleave in one log.
+ */
+function emitEnvOnce(): void {
+  if (envEmitted) return;
+  envEmitted = true;
+  emit([
+    "env",
+    "bun=" + Bun.version,
+    "platform=" + process.platform,
+    "release=" + release(),
+    "arch=" + process.arch,
+    "cpus=" + cpus().length,
+    "pid=" + process.pid,
+  ]);
+}
+
+/**
+ * A tick fires from the event loop while the case is parked on an `await`, so the case itself
+ * cannot push a count at that moment. A probe is therefore the only way a tick can observe work
+ * that is happening inside the awaited call: give it something externally readable and monotonic,
+ * such as the normalizer's encode counter, and a frozen reading becomes evidence of a stall rather
+ * than of the test simply not being scheduled.
+ */
+export type ProgressProbe = () => number;
+
+export interface PhaseTimer {
+  /**
+   * Run `fn` as a named phase. The opening line is emitted before `fn` starts, so a phase that
+   * never returns still appears in the log with the ticks that followed it.
+   */
+  phase<T>(name: string, fn: () => T): Promise<Awaited<T>>;
+  /**
+   * Close the open segment and start a named one. For a long linear case body, where wrapping
+   * each part in a closure would re-indent hundreds of lines of assertions and bury the real
+   * change, this marks the same boundaries in place.
+   */
+  split(name: string): void;
+  /** Close the open segment without starting another. Safe to call when none is open. */
+  end(): void;
+  /** Advance the built-in counter. Ignored when a probe was supplied. */
+  progress(): void;
+}
+
+/**
+ * Instrument one case. `label` should identify the case well enough to grep on its own, because
+ * these lines land in a log holding 26k other tests.
+ */
+export function phaseTimer(label: string, probe?: ProgressProbe): PhaseTimer {
+  emitEnvOnce();
+  const base = ["case=" + JSON.stringify(label), "seq=" + seq++];
+  let progressCount = 0;
+  const read = (): number => {
+    if (probe === undefined) return progressCount;
+    // A probe reaches into the code under test, so a throw here must never become the case's
+    // failure: the diagnostic reports what it can see and the assertion keeps its own verdict.
+    try { return probe(); } catch { return -1; }
+  };
+
+  /** Open a named segment and return the function that closes it. */
+  const open = (name: string): (() => void) => {
+    const startedAt = performance.now();
+    const openMs = (): string => (performance.now() - startedAt).toFixed(1);
+    emit([...base, "phase=" + name, "state=start", "at=" + nowMs()]);
+
+    let gap = TICK_FIRST_MS;
+    let seenAtLastTick = read();
+    let handle: ReturnType<typeof setTimeout> | undefined;
+    let closed = false;
+
+    const scheduleTick = (): void => {
+      if (closed || performance.now() - startedAt >= TICK_WINDOW_MS) return;
+      handle = setTimeout(() => {
+        if (closed) return;
+        const seen = read();
+        const moved = seen !== seenAtLastTick;
+        seenAtLastTick = seen;
+        emit([
+          ...base,
+          "phase=" + name,
+          "state=tick",
+          "at=" + nowMs(),
+          "openMs=" + openMs(),
+          "progress=" + seen,
+          "moving=" + (moved ? "yes" : "no"),
+        ]);
+        gap = Math.min(gap * 2, TICK_MAX_MS);
+        scheduleTick();
+      }, gap);
+      // A diagnostic must never be the reason a process stays alive.
+      (handle as unknown as { unref?: () => void }).unref?.();
+    };
+    scheduleTick();
+
+    return () => {
+      if (closed) return;
+      closed = true;
+      if (handle !== undefined) clearTimeout(handle);
+      emit([
+        ...base,
+        "phase=" + name,
+        "state=end",
+        "at=" + nowMs(),
+        "durMs=" + openMs(),
+        "progress=" + read(),
+      ]);
+    };
+  };
+
+  let closeCurrent: (() => void) | undefined;
+  const end = (): void => {
+    closeCurrent?.();
+    closeCurrent = undefined;
+  };
+
+  return {
+    async phase<T>(name: string, fn: () => T): Promise<Awaited<T>> {
+      const close = open(name);
+      try {
+        return await fn();
+      } finally {
+        close();
+      }
+    },
+    split(name: string): void {
+      end();
+      closeCurrent = open(name);
+    },
+    end,
+    progress: () => { progressCount += 1; },
+  };
+}
diff --git a/tests/helpers/pool-reauth-cause.ts b/tests/helpers/pool-reauth-cause.ts
new file mode 100644
index 00000000000..a1e8c05bc34
--- /dev/null
+++ b/tests/helpers/pool-reauth-cause.ts
@@ -0,0 +1,136 @@
+import { expect, test } from "bun:test";
+import {
+  clearAccountNeedsReauth,
+  handleCodexAuthAPI,
+  setAccountQuotaFromParsed,
+} from "../../src/codex/auth-api";
+import { readCodexAccountRecord } from "../../src/codex/account-store";
+import { captureConfigGeneration } from "../../src/lib/state-store-sweeper";
+import type { OcxConfig } from "../../src/types";
+
+/**
+ * #4212 follow-up: `poolAccountDto` used to infer the reauthentication cause from overlapping
+ * booleans, so a WHAM 401 and a dead refresh grant both reported `refresh_failed`. These cases
+ * pin the observed cause through `handleCodexAuthAPI`, one per failure source.
+ *
+ * They live here rather than in `codex-auth-api.test.ts` because that file sits against its
+ * `file-size-baseline.json` cap, which only ever moves downward.
+ */
+export function registerPoolReauthCauseCases(
+  makeConfig: () => OcxConfig,
+  seedPoolAccount: (
+    config: OcxConfig,
+    account: { id: string; email: string; expiresAt?: number },
+  ) => void,
+): void {
+  test("pool quota rejection reports quota authorization as the reauthentication cause", async () => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "pool-quota-rejected", email: "pool-quota-rejected@example.com" });
+    globalThis.fetch = (async () => Response.json(
+      { detail: { code: "invalid_refresh_token" } },
+      { status: 401 },
+    )) as typeof fetch;
+
+    const req = new Request("http://localhost/api/codex-auth/accounts?refresh=1");
+    const resp = await handleCodexAuthAPI(req, new URL(req.url), config);
+    const data = await resp!.json() as {
+      accounts: Array<{ id: string; reauthReason?: string; health?: { status: string; reason?: string } }>;
+    };
+
+    expect(data.accounts.find(account => account.id === "pool-quota-rejected"))
+      .toMatchObject({
+        reauthReason: "quota_unauthorized",
+        health: { status: "reauth_required", reason: "unauthorized" },
+      });
+  });
+
+  test("pool token refresh rejection reports refresh failure as the reauthentication cause", async () => {
+    const config = makeConfig();
+    seedPoolAccount(config, {
+      id: "pool-refresh-rejected",
+      email: "pool-refresh-rejected@example.com",
+      expiresAt: Date.now() - 1,
+    });
+    setAccountQuotaFromParsed("pool-refresh-rejected", { weeklyPercent: 12 }, captureConfigGeneration());
+    const urls: string[] = [];
+    globalThis.fetch = (async input => {
+      urls.push(String(input));
+      return Response.json({ error: "invalid_grant" }, { status: 400 });
+    }) as typeof fetch;
+
+    const req = new Request("http://localhost/api/codex-auth/accounts/refresh", { method: "POST" });
+    const resp = await handleCodexAuthAPI(req, new URL(req.url), config);
+    const data = await resp!.json() as {
+      accounts: Array<{ id: string; needsReauth?: boolean; reauthReason?: string }>;
+    };
+
+    expect(urls).toEqual(["https://auth.openai.com/oauth/token"]);
+    expect(data.accounts.find(account => account.id === "pool-refresh-rejected"))
+      .toMatchObject({ reauthReason: "refresh_failed" });
+
+    // A dead grant stays dead: the cached-quota listing performs no refresh at all, so only
+    // the recorded marks keep the cause visible instead of flipping back to healthy.
+    const cachedReq = new Request("http://localhost/api/codex-auth/accounts");
+    const cachedResp = await handleCodexAuthAPI(cachedReq, new URL(cachedReq.url), config);
+    const cachedData = await cachedResp!.json() as {
+      accounts: Array<{ id: string; needsReauth?: boolean; reauthReason?: string }>;
+    };
+    expect(urls).toEqual(["https://auth.openai.com/oauth/token"]);
+    expect(cachedData.accounts.find(account => account.id === "pool-refresh-rejected"))
+      .toMatchObject({ needsReauth: true, reauthReason: "refresh_failed" });
+
+    // The terminal verdict is also persisted like the token guardian's, so losing the
+    // in-memory mark on restart cannot flip the dead grant back to healthy.
+    expect(readCodexAccountRecord("pool-refresh-rejected")).toMatchObject({
+      lastCodexValidationStatus: "failed",
+      lastCodexValidationError: "refresh_revoked",
+      lastCodexValidationTerminal: true,
+    });
+    clearAccountNeedsReauth("pool-refresh-rejected");
+    const restartedReq = new Request("http://localhost/api/codex-auth/accounts");
+    const restartedResp = await handleCodexAuthAPI(restartedReq, new URL(restartedReq.url), config);
+    const restartedData = await restartedResp!.json() as {
+      accounts: Array<{
+        id: string;
+        needsReauth?: boolean;
+        reauthReason?: string;
+        health?: { status: string; reason?: string };
+      }>;
+    };
+    expect(urls).toEqual(["https://auth.openai.com/oauth/token"]);
+    expect(restartedData.accounts.find(account => account.id === "pool-refresh-rejected"))
+      .toMatchObject({
+        needsReauth: true,
+        reauthReason: "refresh_failed",
+        health: { status: "reauth_required", reason: "refresh_failed" },
+      });
+  });
+
+  test("a transient pool token refresh failure does not raise reauthentication", async () => {
+    const config = makeConfig();
+    seedPoolAccount(config, {
+      id: "pool-refresh-transient",
+      email: "pool-refresh-transient@example.com",
+      expiresAt: Date.now() - 1,
+    });
+    // A token-endpoint 5xx classifies as `unknown`, which the account store treats as
+    // transient: the credential may still be fine, so no reauth cause may surface (#2887).
+    globalThis.fetch = (async () => Response.json({ error: "server_error" }, { status: 500 })) as typeof fetch;
+
+    const req = new Request("http://localhost/api/codex-auth/accounts/refresh", { method: "POST" });
+    const resp = await handleCodexAuthAPI(req, new URL(req.url), config);
+    const data = await resp!.json() as {
+      accounts: Array<{
+        id: string;
+        needsReauth?: boolean;
+        reauthReason?: string;
+        health?: { status: string; reason?: string };
+      }>;
+    };
+
+    const account = data.accounts.find(row => row.id === "pool-refresh-transient");
+    expect(account?.needsReauth).toBe(false);
+    expect(account?.reauthReason).toBeUndefined();
+    expect(account?.health?.status).not.toBe("reauth_required");
+  });
+}
diff --git a/tests/helpers/request-log-entry.ts b/tests/helpers/request-log-entry.ts
new file mode 100644
index 00000000000..4ccafb3ed4c
--- /dev/null
+++ b/tests/helpers/request-log-entry.ts
@@ -0,0 +1,21 @@
+import type { RequestLogEntry } from "../../src/server";
+
+/**
+ * One request-log row with every required field already filled in.
+ *
+ * Moved out of tests/usage/request-log.test.ts verbatim: that file sits at its file-size cap, and
+ * the repository answer to a cap is a sibling helper rather than compressed control flow. The
+ * defaults are the ones its twenty-seven call sites were already relying on.
+ */
+export function log(overrides: Partial<RequestLogEntry>): RequestLogEntry {
+  return {
+    requestId: "ocx-test",
+    timestamp: 1,
+    model: "gpt-test",
+    provider: "openai",
+    status: 200,
+    durationMs: 10,
+    usageStatus: "unreported",
+    ...overrides,
+  };
+}
diff --git a/tests/helpers/responses-core-source.ts b/tests/helpers/responses-core-source.ts
index a4f9ae1a9a5..6b1aa1e5d63 100644
--- a/tests/helpers/responses-core-source.ts
+++ b/tests/helpers/responses-core-source.ts
@@ -29,6 +29,7 @@ export const RESPONSES_CORE_MODULES = [
   "core-normalize.ts",
   "core-combo.ts",
   "request-prepare.ts",
+  "compaction-routing.ts",
   "request-transport.ts",
   "request-sidecar-auth.ts",
   "response-effects.ts",
diff --git a/tests/helpers/sideband-relay-probe.ts b/tests/helpers/sideband-relay-probe.ts
new file mode 100644
index 00000000000..049f27c32ef
--- /dev/null
+++ b/tests/helpers/sideband-relay-probe.ts
@@ -0,0 +1,169 @@
+import type { Server, ServerWebSocket } from "bun";
+import { expect } from "bun:test";
+
+/**
+ * Observable state of the mock sideband peer, for a case whose only symptom is a deadline.
+ *
+ * A relay case that exceeds its ceiling reports the ceiling and nothing else: not which leg was
+ * slow, and not whether the peer's reply was actually handed to the socket. The second one is
+ * knowable. `ServerWebSocket.send` reports what it did with the payload: a positive byte count
+ * when it was written, `-1` when it was enqueued behind backpressure, `0` when it was dropped.
+ * That separates a reply this peer never handed to the socket from one it did. It is not proof
+ * of delivery -- nothing on this side can observe what the client received.
+ *
+ * Note what the large frame actually is. The 50MiB payload travels client to peer; the reply is
+ * a short `bytes:<length>` acknowledgement, so `send=` on the reply says nothing about the big
+ * frame. What proves the peer saw all of it is the `recv=` count it recorded.
+ * See https://bun.com/docs/runtime/http/websockets.
+ *
+ * This records; it diagnoses nothing on its own and asserts nothing.
+ */
+export interface SidebandRelayProbe {
+  /**
+   * Monotonic count of observable relay events.
+   *
+   * Handed to `phaseTimer` as its progress probe so a tick can say whether anything moved since
+   * the last one. Without it every tick reads "no movement" and a stalled leg looks the same as
+   * a slow runner.
+   *
+   * It counts milestones and nothing finer. A frame is one event whatever its size, so a tick
+   * that reports no movement means no further milestone was reached -- not that the transport
+   * stalled. A partially delivered frame and a runner busy with CPU work both look like this.
+   */
+  progress(): number;
+  /** Advance from the client side of the relay, which this module cannot observe directly. */
+  noteClient(event: string): void;
+  /** One line naming what the peer saw, for a failure message. */
+  summary(): string;
+}
+
+export interface SidebandRelayUpstream {
+  readonly server: Server;
+  readonly seenPaths: string[];
+  readonly seenUpgradeHeaders: Headers[];
+  readonly probe: SidebandRelayProbe;
+}
+
+/**
+ * A mock sideband peer that echoes what it receives and remembers how that went.
+ *
+ * Behaviorally identical to the inline peer it replaces: same upgrade handling, same echo
+ * payloads, same `maxPayloadLength`.
+ */
+export function sidebandRelayUpstream(maxPayloadLength: number): SidebandRelayUpstream {
+  const seenPaths: string[] = [];
+  const seenUpgradeHeaders: Headers[] = [];
+  const events: string[] = [];
+  let ticks = 0;
+  const note = (event: string): void => {
+    ticks += 1;
+    // Bounded: a failure message is evidence, not a transcript.
+    if (events.length < 24) events.push(event);
+  };
+  const probe: SidebandRelayProbe = {
+    progress: () => ticks,
+    noteClient: event => note("client:" + event),
+    summary: () => events.join(" "),
+  };
+  const server = Bun.serve({
+    port: 0,
+    fetch(req, server) {
+      const url = new URL(req.url);
+      if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+        seenPaths.push(url.pathname);
+        seenUpgradeHeaders.push(req.headers);
+        note("upgrade");
+        if (server.upgrade(req, { data: {} })) return undefined as unknown as Response;
+        return new Response("upgrade failed", { status: 500 });
+      }
+      return new Response("not found", { status: 404 });
+    },
+    websocket: {
+      maxPayloadLength,
+      message(ws: ServerWebSocket<unknown>, message: string | Buffer) {
+        const bytes = typeof message === "string" ? message.length : message.byteLength;
+        note("recv=" + bytes);
+        const sent = ws.send(typeof message === "string" ? `echo:${message}` : `bytes:${message.byteLength}`);
+        // The reply is a short acknowledgement, not an echo of a large frame, and this number is
+        // about that reply only: negative is queued behind backpressure, zero is dropped, and a
+        // positive count is bytes written to the socket rather than bytes the client received.
+        note("send=" + sent);
+      },
+      drain(ws: ServerWebSocket<unknown>) {
+        note("drain=" + ws.getBufferedAmount());
+      },
+      close(_ws: ServerWebSocket<unknown>, code: number) {
+        note("peerclose=" + code);
+      },
+    },
+  });
+  return { server, seenPaths, seenUpgradeHeaders, probe };
+}
+
+/**
+ * What the peer must have received to have been reached as itself.
+ *
+ * Lives beside the peer because it asserts the peer's own record: the path it was opened on and
+ * the headers the relay forwarded, including the caller's authorization.
+ */
+export function expectSidebandUpgrade(
+  upstream: Pick<SidebandRelayUpstream, "seenPaths" | "seenUpgradeHeaders">,
+  path: string,
+  token: string,
+): void {
+  expect(upstream.seenPaths).toContain(path);
+  expect(upstream.seenUpgradeHeaders).toHaveLength(1);
+  expect(upstream.seenUpgradeHeaders[0]?.get("openai-alpha")).toBe("quicksilver=v2");
+  expect(upstream.seenUpgradeHeaders[0]?.get("x-session-id")).toBe("rts_side");
+  expect(upstream.seenUpgradeHeaders[0]?.get("authorization")).toBe(`Bearer ${token}`);
+}
+
+/**
+ * Point ChatGPT sideband WebSocket targets at a local mock for the duration of one case.
+ *
+ * The configuration stays canonical: the relay still resolves api.openai.com, and only the
+ * socket the runtime opens on that host is redirected. The untouched constructor comes back
+ * with it because the case needs one that is NOT redirected to open its own client against the
+ * proxy under test.
+ */
+export function redirectSidebandWebSocket(port: number): {
+  readonly OriginalWebSocket: typeof WebSocket;
+  restore(): void;
+} {
+  const OriginalWebSocket = globalThis.WebSocket;
+  globalThis.WebSocket = class extends OriginalWebSocket {
+    constructor(url: string | URL, protocols?: string | string[] | Record<string, unknown>) {
+      const parsed = new URL(String(url));
+      const target = parsed.hostname === "api.openai.com" && parsed.pathname.startsWith("/v1/live/")
+        ? `ws://127.0.0.1:${port}${parsed.pathname}${parsed.search}`
+        : String(url);
+      super(target, protocols as string[]);
+    }
+  } as typeof WebSocket;
+  return { OriginalWebSocket, restore: () => { globalThis.WebSocket = OriginalWebSocket; } };
+}
+
+/**
+ * Open a sideband client against the proxy under test, with the headers the relay must forward.
+ *
+ * Beside `expectSidebandUpgrade` deliberately: that function asserts these exact values on the
+ * peer's side, so the request and the assertion about it cannot drift apart in separate files.
+ * The constructor is passed in because it has to be the one that was NOT redirected.
+ */
+export function openSidebandClient(
+  WebSocketCtor: typeof WebSocket,
+  serverUrl: string | URL,
+  path: string,
+  token: string,
+): WebSocket {
+  const wsUrl = new URL(path, serverUrl);
+  wsUrl.protocol = "ws:";
+  return new WebSocketCtor(wsUrl.toString(), {
+    headers: {
+      authorization: `Bearer ${token}`,
+      "chatgpt-account-id": "acct-123",
+      "openai-alpha": "quicksilver=v2",
+      "x-session-id": "rts_side",
+    },
+  } as unknown as string[]);
+}
diff --git a/tests/helpers/spend-ledger-owner-child.ts b/tests/helpers/spend-ledger-owner-child.ts
new file mode 100644
index 00000000000..5731b23b913
--- /dev/null
+++ b/tests/helpers/spend-ledger-owner-child.ts
@@ -0,0 +1,45 @@
+/** Real-process holder for spend-ledger single-writer tests. */
+import { existsSync, writeFileSync } from "node:fs";
+import { acquireSpendLedgerOwner, SpendLedgerOwnerError } from "../../src/lib/spend-ledger-owner";
+import {
+  configureSharedSpendLedger,
+  sharedSpendLedger,
+  type SpendReservationPolicy,
+} from "../../src/lib/spend-reservation-ledger";
+
+const payload = JSON.parse(process.env.OCX_SPEND_OWNER_CHILD ?? "{}") as {
+  holdMarker?: string;
+  releaseMarker?: string;
+  mode?: "observe" | "enforced";
+};
+
+try {
+  const lease = acquireSpendLedgerOwner();
+  const policy: SpendReservationPolicy = {
+    root: payload.mode === "enforced" ? { maxTokens: 1_000 } : {},
+    identity: {},
+    pool: {},
+    retentionMs: 60_000,
+  };
+  configureSharedSpendLedger(policy);
+  const ledger = sharedSpendLedger();
+  ledger.reserve({
+    sendId: `child-${payload.mode ?? "observe"}`,
+    scopes: { rootId: "child-root" },
+    inputTokens: 1,
+    outputCeilingTokens: 1,
+  });
+  if (payload.holdMarker) writeFileSync(payload.holdMarker, "held");
+  const waiter = new Int32Array(new SharedArrayBuffer(4));
+  while (payload.releaseMarker && !existsSync(payload.releaseMarker)) {
+    Atomics.wait(waiter, 0, 0, 20);
+  }
+  lease.release();
+  console.log(JSON.stringify({ status: "acquired" }));
+} catch (error) {
+  console.log(JSON.stringify({
+    status: "refused",
+    code: error instanceof SpendLedgerOwnerError ? error.code : "UNKNOWN",
+    message: error instanceof Error ? error.message : String(error),
+  }));
+}
diff --git a/tests/helpers/sse-stream.ts b/tests/helpers/sse-stream.ts
new file mode 100644
index 00000000000..63e5ccb6399
--- /dev/null
+++ b/tests/helpers/sse-stream.ts
@@ -0,0 +1,35 @@
+/**
+ * Read one SSE body end to end, and build one from a string.
+ *
+ * Both are the same two functions nine test files had written out for themselves, which is how
+ * they came to live here: a case at its file-size cap needed room for one more line, and the
+ * repository answer to that is a sibling helper rather than compressed control flow. Moved
+ * verbatim from tests/responses/responses-undeclared-tool-guard.test.ts, so a case that used the
+ * local copies is reading exactly the same behaviour through a different name.
+ */
+export function streamFromText(text: string): ReadableStream<Uint8Array> {
+  const chunk = new TextEncoder().encode(text);
+  let sent = false;
+  return new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (sent) {
+        controller.close();
+        return;
+      }
+      sent = true;
+      controller.enqueue(chunk);
+    },
+  });
+}
+
+export async function readAll(stream: ReadableStream<Uint8Array>): Promise<string> {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    text += decoder.decode(value, { stream: true });
+  }
+  return text;
+}
diff --git a/tests/helpers/warmup-registration.ts b/tests/helpers/warmup-registration.ts
new file mode 100644
index 00000000000..4857bbd50f1
--- /dev/null
+++ b/tests/helpers/warmup-registration.ts
@@ -0,0 +1,714 @@
+import { dirname, isAbsolute, resolve } from "node:path";
+import { SyntaxKind } from "typescript/unstable/ast";
+import { helperPath } from "./repo-root";
+import { argumentEnd, at, CLOSERS, lineOf, OPENERS, tokenize, type Token } from "./warmup-tokens";
+
+/**
+ * Decide, from a test file's source alone, whether it registers a cold-spawn warm-up and waits for
+ * it: by recognising a small set of exact shapes and refusing everything else.
+ *
+ * ## The defect this exists for
+ *
+ * The coverage guard in tests/ci-workflows/cold-spawn-warmup.test.ts recorded a file as warmed when
+ * its text contained the substring "helpers/cold-spawn-warmup" (#5060). A comment, a string literal,
+ * or an import left behind after the beforeAll call was deleted all satisfied it, and the measured
+ * child went back to paying its cold module-graph load with a green guard standing in front of it.
+ *
+ * ## The shapes this judge accepts
+ *
+ * W is a name bound by a DIRECT named import of tests/helpers/cold-spawn-warmup, aliases followed;
+ * the call may be W(...) or W?.(...). describe and beforeAll must be direct named imports of
+ * bun:test, and neither may be rebound anywhere in the file.
+ *
+ *   hook-statement    describe(...)* > beforeAll(async () => { ... await W(...); ... }, ...)
+ *   hook-return       describe(...)* > beforeAll(() => { return W(...); }, ...)
+ *   hook-expression   describe(...)* > beforeAll(() => W(...), ...) and its awaited form
+ *   module-top-level  await W(...); as a whole statement at the top level of the file
+ *
+* In the two statement shapes the call is the whole statement: it begins right after a brace or a
+* semicolon and ends on its own semicolon or on the closing brace of the hook. A function
+* expression stands in for the arrow in any of them. Nesting is exact - every block between the
+* file and the hook must be a describe callback, and the open calls must be exactly the calls that
+* own those blocks, so an extra paren or an extra block is not the same shape.
+ *
+ * A describe callback counts only when the describe is a plain statement call of the bare imported
+ * name. describe.skip registers a suite that never runs and a describe behind a condition is never
+ * called, so a hook inside either one is a registration in shape only.
+ *
+ * ## What it refuses, by design
+ *
+ * Every other occurrence of W is a refusal naming its line, and one refusal anywhere on the binding
+ * path means the file is not proven. Shapes that do warm at run time are refused too:
+ *
+ *   a namespace import of the helper, and any call made through it;
+ *   a barrel or re-export path, because the specifier does not resolve to the helper module;
+ *   an alias through a variable, const warm = W, and a callback the hook reaches by name;
+*   a call in a scope this judge does not model - a nested function, an uncalled helper, a bare
+*     block, a conditional branch, even when every branch warms;
+ *   a hook inside a suite that is not a plain describe statement, such as describe.skip or
+ *     describe.each;
+*   fire-and-forget, void, and a call that is one operand of a larger expression.
+ *
+ * That list is the design rather than a backlog. TypeScript 7.0.2 publishes no in-process parser
+ * (see tests/helpers/warmup-tokens.ts), so the alternative to an exact accept-set is reconstructing
+ * scoping and expression grammar from tokens, where every wrong guess is a FALSE PASS - the one
+ * failure this file exists to remove. A refusal is the opposite: loud, located, and cheap to answer.
+ * A legitimate file that needs a refused shape records it once in its disposition, which keeps the
+ * refusal itself under test; see WarmupDisposition.
+ *
+ * ## What no structural check can decide
+ *
+ * It reads the shape of a file, not the run. It does not prove the process reached the describe that
+ * holds the registration, and it does not prove the warm-up child loaded anything. That oracle is
+ * separate and unchanged: the helper prints one completion line per warmed graph on every hosted
+ * run, and a warm-up that throws fails its file as a setup failure.
+ */
+
+/** The entry points in tests/helpers/cold-spawn-warmup.ts that pay a cold module graph. */
+const WARMUP_ENTRY_POINTS: ReadonlySet<string> = new Set(["warmColdSpawn", "warmModuleGraph"]);
+
+/** The bun:test hook a warm-up belongs in, and the only call its scopes may be nested inside. */
+const REGISTRATION_HOOK = "beforeAll";
+const SUITE_CALL = "describe";
+
+/** What a modelled statement may begin after. Anything else means it is part of something larger. */
+const STATEMENT_START: ReadonlySet<SyntaxKind> = new Set([
+  SyntaxKind.SemicolonToken,
+  SyntaxKind.OpenBraceToken,
+  SyntaxKind.CloseBraceToken,
+]);
+
+/** Keywords that introduce a new binding for the name that follows them. */
+const DECLARATION_KEYWORDS: ReadonlySet<SyntaxKind> = new Set([
+  SyntaxKind.ConstKeyword,
+  SyntaxKind.LetKeyword,
+  SyntaxKind.VarKeyword,
+  SyntaxKind.FunctionKeyword,
+  SyntaxKind.ClassKeyword,
+]);
+
+export type WarmupShape = "hook-statement" | "hook-return" | "hook-expression" | "module-top-level";
+
+export type WarmupRegistration = Readonly<{
+  /** The helper entry point the file waits for. */
+  helper: string;
+  /** The local name it was called through, which is the alias when the import renames it. */
+  local: string;
+  /** Which of the accepted shapes matched. */
+  shape: WarmupShape;
+  /** 1-based line of the call, so a failure points at a place rather than a file. */
+  line: number;
+}>;
+
+export type WarmupRegistrationReport = Readonly<{
+  /** Local names a direct named import bound to a warm-up entry point. */
+  bindings: readonly string[];
+  /** Whether any import specifier resolves to the helper module. */
+  importsHelperModule: boolean;
+  /**
+   * Whether either entry-point name appears as an identifier at all, however it got here. A barrel
+   * import and a namespace call both bind nothing this judge follows, so bindings alone would read
+   * a real warm-up as an absence.
+   */
+  mentionsEntryPoint: boolean;
+  /** Occurrences that matched an accepted shape. */
+  registrations: readonly WarmupRegistration[];
+  /** One channel for everything fatal: unreadable source, and every construct not modelled. */
+  refusals: readonly string[];
+}>;
+
+export type WarmupDisposition = Readonly<{
+  /** Whether the file is claimed to pay its cold module-graph load in setup. */
+  warmed: boolean;
+  /** Why, in enough detail to survive review. */
+  why: string;
+  /**
+   * For a file that really does warm in a shape this judge refuses: the text its refusal has to
+   * contain. The judge still has to see the warm-up and still has to refuse it for that stated
+   * reason, so deleting the call, or degrading it to fire-and-forget, changes the refusal and fails.
+   */
+  unmodeled?: string;
+}>;
+
+/** True only when an accepted shape matched and nothing on the binding path was refused. */
+export function warmupIsRegistered(report: WarmupRegistrationReport): boolean {
+  return report.refusals.length === 0 && report.registrations.length > 0;
+}
+
+/** Everything the judge refused, for a failure message that names the construct and the line. */
+export function warmupRegistrationComplaints(report: WarmupRegistrationReport): string[] {
+  return [...report.refusals];
+}
+
+/**
+ * Where a file disagrees with the disposition recorded for it, empty when they agree.
+ *
+ * Three states rather than two. A file recorded as warmed has to show an accepted shape and nothing
+ * refused; a file recorded as unwarmed must not reach the helper at all; and a file recorded as
+ * warmed through an unmodelled shape has to still reach the helper and still be refused for the
+ * stated reason. That third state is what keeps a refusal from blocking a legitimate test file
+ * while keeping the refusal itself honest.
+ */
+export function dispositionComplaints(
+  path: string,
+  disposition: WarmupDisposition,
+  report: WarmupRegistrationReport,
+): string[] {
+  const complaints: string[] = [];
+  const say = (what: string): number => complaints.push(path + ": " + what);
+  const refused = report.refusals.join("; ");
+  if (!disposition.warmed) {
+    if (report.mentionsEntryPoint || report.importsHelperModule) say("recorded unwarmed, but it reaches the warm-up helper");
+    if (report.registrations.length > 0) say("recorded unwarmed, but it registers a warm-up");
+    if (report.refusals.length > 0) say("recorded unwarmed, and " + refused);
+    return complaints;
+  }
+  const unmodeled = disposition.unmodeled;
+  if (unmodeled === undefined) {
+    if (report.registrations.length === 0) {
+      say("recorded warmed, but no accepted shape is here: " + (refused || "nothing reaches the warm-up helper"));
+    } else if (report.refusals.length > 0) {
+      say("recorded warmed, and " + refused);
+    }
+    return complaints;
+  }
+  if (!report.mentionsEntryPoint) say("recorded warmed through " + unmodeled + ", but nothing here reaches the warm-up helper");
+  else if (report.registrations.length > 0) say("recorded warmed through " + unmodeled + ", but this judge accepts what it found; drop the note");
+  else if (!report.refusals.some(refusal => refusal.includes(unmodeled))) {
+    say("recorded warmed through " + unmodeled + ", which is not what was refused: " + (refused || "nothing was refused"));
+  }
+  return complaints;
+}
+
+export function analyzeWarmupRegistration(fileName: string, source: string): WarmupRegistrationReport {
+  const scan = tokenize(source);
+  if (scan.unreadable.length > 0) {
+    return {
+      bindings: [], importsHelperModule: false, mentionsEntryPoint: false,
+      registrations: [], refusals: scan.unreadable,
+    };
+  }
+  const tokens = scan.tokens;
+  const refusals: string[] = [];
+  const clauses = importClauses(tokens);
+
+  const bindings = new Map<string, string>();
+  let importsHelperModule = false;
+  for (const clause of clauses) {
+    if (!importsTheWarmupHelper(fileName, clause.specifier)) continue;
+    importsHelperModule = true;
+    if (clause.namespace !== undefined) {
+      refusals.push(at(source, clause.start) + "the warm-up helper is imported as a namespace (* as "
+        + clause.namespace + "), which this judge does not model");
+    }
+    for (const name of clause.names) {
+      if (!WARMUP_ENTRY_POINTS.has(name.imported)) continue;
+      if (name.typeOnly) {
+        refusals.push(at(source, clause.start) + name.imported
+          + " is imported for its type only, which loads nothing at run time");
+        continue;
+      }
+      bindings.set(name.local, name.imported);
+    }
+  }
+  const mentionsEntryPoint = importsHelperModule || tokens.some(token =>
+    token.kind === SyntaxKind.Identifier && WARMUP_ENTRY_POINTS.has(token.text));
+
+  if (bindings.size === 0) {
+    if (mentionsEntryPoint && refusals.length === 0) {
+      refusals.push("the warm-up helper is reached without a direct named import of "
+        + "tests/helpers/cold-spawn-warmup, which this judge does not model");
+    }
+    return { bindings: [], importsHelperModule, mentionsEntryPoint, registrations: [], refusals };
+  }
+
+  const hooks = importedLocals(clauses, "bun:test", REGISTRATION_HOOK);
+  const suites = importedLocals(clauses, "bun:test", SUITE_CALL);
+  const rebound = new Map<string, Token>();
+  for (const name of [...hooks, ...suites]) {
+    const rebinding = rebindingOf(tokens, name);
+    if (rebinding !== undefined) rebound.set(name, rebinding);
+  }
+
+  const registrations = judgeOccurrences({ tokens, source, bindings, hooks, suites, rebound, refusals,
+    imported: importedTokenRanges(clauses) });
+  if (registrations.length === 0 && refusals.length === 0) {
+    refusals.push("the warm-up helper is imported here and never called");
+  }
+  return { bindings: [...bindings.keys()], importsHelperModule, mentionsEntryPoint, registrations, refusals };
+}
+
+type CallFrame = Readonly<{
+  /** The bare identifier being called, or empty when the call is anything more elaborate. */
+  callee: string;
+  /** Token index of the paren that opened the call. */
+  open: number;
+  /** Whether the callee itself starts a statement, which is what makes its callback run. */
+  statement: boolean;
+}>;
+
+/** How a scope reads in a refusal, so the message says where the call actually sits. */
+const LAYER_LABELS: Readonly<Record<string, string>> = {
+  suite: "a describe callback",
+  hook: "a beforeAll callback",
+  "hook-expression": "a beforeAll expression body",
+  other: "a scope this judge does not model",
+};
+
+/**
+ * A scope the judge tracks. Only two kinds are part of an accepted shape; everything else is
+ * "other" and refuses whatever sits inside it. A concise arrow body is a scope with no braces, and
+ * missing it is how a hook registered inside an uncalled callback reads as top-level work.
+ */
+type Layer = Readonly<{
+  kind: "suite" | "hook" | "hook-expression" | "other";
+  /** Token index where the scope ends: its closing brace, or the end of the arrow expression. */
+  end: number;
+  /** Token index of the first token inside it. */
+  bodyStart: number;
+  /** Why a scope that looks like one of the accepted kinds is not, for the refusal message. */
+  reason?: string;
+}>;
+
+type Judgement = Readonly<{
+  tokens: readonly Token[];
+  source: string;
+  bindings: ReadonlyMap<string, string>;
+  hooks: ReadonlySet<string>;
+  suites: ReadonlySet<string>;
+  rebound: ReadonlyMap<string, Token>;
+  refusals: string[];
+  imported: readonly { from: number; to: number }[];
+}>;
+
+/**
+ * One pass over the file, carrying the two stacks an accepted shape is defined in terms of: the
+ * calls that are open, and the scopes that are open. Every occurrence of a warm-up binding is
+ * classified against them, and an occurrence that matches no accepted shape is refused by name.
+ */
+function judgeOccurrences(j: Judgement): WarmupRegistration[] {
+  const { tokens } = j;
+  const matches = delimiterMatches(tokens);
+  const registrations: WarmupRegistration[] = [];
+  const layers: Layer[] = [];
+  const calls: CallFrame[] = [];
+  const acceptedHookCalls = new Set<number>();
+  for (let i = 0; i < tokens.length; i += 1) {
+    while (layers.length > 0 && layers[layers.length - 1].end <= i) layers.pop();
+    const token = tokens[i];
+    if (token.kind === SyntaxKind.CloseParenToken) {
+      calls.pop();
+      continue;
+    }
+    if (token.kind === SyntaxKind.OpenParenToken) {
+      calls.push(callFrame(tokens, i));
+      continue;
+    }
+    if (token.kind === SyntaxKind.OpenBraceToken) {
+      layers.push(braceLayer(j, i, calls, acceptedHookCalls, matches));
+      continue;
+    }
+    if (token.kind === SyntaxKind.EqualsGreaterThanToken
+      && (tokens[i + 1] === undefined || tokens[i + 1].kind !== SyntaxKind.OpenBraceToken)) {
+      layers.push(conciseArrowLayer(j, i, calls, acceptedHookCalls, matches));
+      continue;
+    }
+    if (token.kind !== SyntaxKind.Identifier) continue;
+    if (j.hooks.has(token.text) && !isMemberName(tokens, i)) {
+      const open = opensCall(tokens, i);
+      if (open !== undefined && hookCallIsVisible(j, i, layers, calls)) acceptedHookCalls.add(open);
+      continue;
+    }
+    if (!isBindingOccurrence(j, i)) continue;
+    const verdict = classifyOccurrence(j, i, layers, calls, matches);
+    if (typeof verdict === "string") j.refusals.push(verdict);
+    else registrations.push(verdict);
+  }
+  return registrations;
+}
+
+/** Index of the delimiter each delimiter pairs with, computed once rather than scanned per call. */
+function delimiterMatches(tokens: readonly Token[]): number[] {
+  const matches = new Array<number>(tokens.length).fill(-1);
+  const open: number[] = [];
+  for (let i = 0; i < tokens.length; i += 1) {
+    if (OPENERS.has(tokens[i].kind)) open.push(i);
+    else if (CLOSERS.has(tokens[i].kind)) {
+      const start = open.pop();
+      if (start !== undefined) {
+        matches[start] = i;
+        matches[i] = start;
+      }
+    }
+  }
+  return matches;
+}
+
+function braceLayer(
+  j: Judgement,
+  brace: number,
+  calls: readonly CallFrame[],
+  accepted: ReadonlySet<number>,
+  matches: readonly number[],
+): Layer {
+  const end = matches[brace] < 0 ? j.tokens.length : matches[brace];
+  const bodyStart = brace + 1;
+  const owner = calls[calls.length - 1];
+  if (!opensArgumentCallback(j.tokens, brace, matches)) return { kind: "other", end, bodyStart };
+  if (owner !== undefined && accepted.has(owner.open)) return { kind: "hook", end, bodyStart };
+  if (owner !== undefined && owner.statement && j.suites.has(owner.callee) && !j.rebound.has(owner.callee)) {
+    return { kind: "suite", end, bodyStart };
+  }
+  const reason = braceLayerReason(j, owner);
+  return { kind: "other", end, bodyStart, reason };
+}
+
+/**
+ * Why a block that looks like a describe body is not one. A rebound name is not bun:test, and a
+ * describe that is not itself a plain statement - behind a condition, through a member such as
+ * describe.skip, or inside another callback - registers hooks that never run.
+ */
+function braceLayerReason(j: Judgement, owner: CallFrame | undefined): string | undefined {
+  if (owner === undefined) return undefined;
+  const rebinding = j.rebound.get(owner.callee);
+  if (rebinding !== undefined) {
+    return owner.callee + " is rebound at line " + lineOf(j.source, rebinding.start) + ", so this is not bun:test";
+  }
+  if (j.suites.has(owner.callee) && !owner.statement) {
+    return owner.callee + " is not called as a plain statement here, so its callback is not known to run";
+  }
+  return undefined;
+}
+
+function conciseArrowLayer(
+  j: Judgement,
+  arrow: number,
+  calls: readonly CallFrame[],
+  accepted: ReadonlySet<number>,
+  matches: readonly number[],
+): Layer {
+  const owner = calls[calls.length - 1];
+  const ownsHookBody = owner !== undefined && accepted.has(owner.open)
+    && arrowIsArgument(j.tokens, arrow, matches);
+  return {
+    kind: ownsHookBody ? "hook-expression" : "other",
+    end: argumentEnd(j.tokens, arrow + 1),
+    bodyStart: arrow + 1,
+  };
+}
+
+/**
+ * Whether a beforeAll call is one this judge can see running: the bun:test import itself, at the
+ * start of a statement, with describe callbacks and nothing else between it and the file.
+ */
+function hookCallIsVisible(
+  j: Judgement,
+  hook: number,
+  layers: readonly Layer[],
+  calls: readonly CallFrame[],
+): boolean {
+  if (j.rebound.has(j.tokens[hook].text)) return false;
+  if (calls.length !== layers.length) return false;
+  if (!layers.every(layer => layer.kind === "suite")) return false;
+  const before = j.tokens[hook - 1];
+  return before === undefined || STATEMENT_START.has(before.kind);
+}
+
+function classifyOccurrence(
+  j: Judgement,
+  w: number,
+  layers: readonly Layer[],
+  calls: readonly CallFrame[],
+  matches: readonly number[],
+): WarmupRegistration | string {
+  const token = j.tokens[w];
+  const helper = j.bindings.get(token.text) ?? token.text;
+  const made = (shape: WarmupShape): WarmupRegistration =>
+    ({ helper, local: token.text, shape, line: lineOf(j.source, token.start) });
+  const refuse = (why: string): string => at(j.source, token.start) + token.text + " " + why;
+  const open = opensCall(j.tokens, w);
+  if (open === undefined) return refuse("is used without being called, which this judge does not model");
+  const close = matches[open];
+  if (close < 0) return refuse("opens a call this judge cannot close");
+  if (calls.length !== layers.length) {
+    return chainRefusal(j, w, layers, " (the open calls do not match the open scopes)");
+  }
+  if (layers.length === 0) {
+    const statement = wholeStatement(j.tokens, w, close, undefined);
+    if (statement === undefined || statement.keyword !== "await") {
+      return refuse("is not a whole awaited statement at the top level of the file");
+    }
+    return made("module-top-level");
+  }
+  const inner = layers[layers.length - 1];
+  if (!layers.slice(0, layers.length - 1).every(layer => layer.kind === "suite")) return chainRefusal(j, w, layers);
+  if (inner.kind === "hook") {
+    const statement = wholeStatement(j.tokens, w, close, inner.end);
+    if (statement === undefined) {
+      return refuse("is not a whole awaited or returned statement of the hook callback");
+    }
+    return made(statement.keyword === "return" ? "hook-return" : "hook-statement");
+  }
+  if (inner.kind === "hook-expression") {
+    const head = inner.bodyStart;
+    const awaited = j.tokens[head] !== undefined && j.tokens[head].kind === SyntaxKind.AwaitKeyword;
+    if (w !== head && !(awaited && w === head + 1)) {
+      return refuse("is not the whole body of the hook callback");
+    }
+    if (close + 1 !== inner.end) return refuse("is one part of a larger returned expression");
+    return made("hook-expression");
+  }
+  return chainRefusal(j, w, layers);
+}
+
+function chainRefusal(j: Judgement, w: number, layers: readonly Layer[], extra = ""): string {
+  const chain = layers
+    .map(layer => LAYER_LABELS[layer.kind] + (layer.reason === undefined ? "" : " (" + layer.reason + ")"))
+    .join(" > ");
+  return at(j.source, j.tokens[w].start) + j.tokens[w].text
+    + " is not in a shape this judge models; enclosing scopes: "
+    + (chain === "" ? "the top level of the file" : chain) + extra;
+}
+
+/**
+ * The call as a whole statement introduced by await or return, or undefined when it is part of
+ * something larger. A statement begins right after a brace or a semicolon and ends on its own
+ * semicolon or on the brace that closes the scope, which is what rules out fire-and-forget, void,
+ * a conditional consequent, and an operand of a larger expression without modelling any of them.
+ */
+function wholeStatement(
+  tokens: readonly Token[],
+  w: number,
+  close: number,
+  scopeEnd: number | undefined,
+): { start: number; keyword: "await" | "return" } | undefined {
+  const pre = tokens[w - 1];
+  if (pre === undefined) return undefined;
+  let start = w - 1;
+  let keyword: "await" | "return";
+  if (pre.kind === SyntaxKind.AwaitKeyword) keyword = "await";
+  else if (pre.kind === SyntaxKind.ReturnKeyword) keyword = "return";
+  else return undefined;
+  const beforeKeyword = tokens[start - 1];
+  if (keyword === "await" && beforeKeyword !== undefined && beforeKeyword.kind === SyntaxKind.ReturnKeyword) {
+    start -= 1;
+    keyword = "return";
+  }
+  const before = tokens[start - 1];
+  if (before !== undefined && !STATEMENT_START.has(before.kind)) return undefined;
+  const after = tokens[close + 1];
+  const ends = after === undefined || after.kind === SyntaxKind.SemicolonToken
+    || (scopeEnd !== undefined && close + 1 === scopeEnd);
+  return ends ? { start, keyword } : undefined;
+}
+
+/** Index of the paren that opens a call on the identifier at i, for W(...) and W?.(...). */
+function opensCall(tokens: readonly Token[], i: number): number | undefined {
+  const next = tokens[i + 1];
+  if (next === undefined) return undefined;
+  if (next.kind === SyntaxKind.OpenParenToken) return i + 1;
+  if (next.kind === SyntaxKind.QuestionDotToken && tokens[i + 2] !== undefined
+    && tokens[i + 2].kind === SyntaxKind.OpenParenToken) return i + 2;
+  return undefined;
+}
+
+function isMemberName(tokens: readonly Token[], i: number): boolean {
+  const before = tokens[i - 1];
+  return before !== undefined
+    && (before.kind === SyntaxKind.DotToken || before.kind === SyntaxKind.QuestionDotToken);
+}
+
+/** An identifier that IS the imported binding: not a property name, and not the import clause. */
+function isBindingOccurrence(j: Judgement, i: number): boolean {
+  const token = j.tokens[i];
+  if (token.kind !== SyntaxKind.Identifier || !j.bindings.has(token.text)) return false;
+  if (isMemberName(j.tokens, i)) return false;
+  return !j.imported.some(range => i >= range.from && i <= range.to);
+}
+
+type ImportedName = Readonly<{ imported: string; local: string; typeOnly: boolean }>;
+
+type ImportClause = Readonly<{
+  specifier: string;
+  names: readonly ImportedName[];
+  namespace: string | undefined;
+  /** Token index of the import keyword and of its specifier, so occurrences inside are not calls. */
+  from: number;
+  to: number;
+  start: number;
+}>;
+
+/**
+ * Every import DECLARATION and what it binds. A dynamic import(...) and import.meta are skipped:
+ * neither creates the top-level binding an accepted shape is written in terms of.
+ */
+function importClauses(tokens: readonly Token[]): ImportClause[] {
+  const clauses: ImportClause[] = [];
+  for (let i = 0; i < tokens.length; i += 1) {
+    if (tokens[i].kind !== SyntaxKind.ImportKeyword) continue;
+    const next = tokens[i + 1];
+    if (next === undefined) break;
+    if (next.kind === SyntaxKind.OpenParenToken || next.kind === SyntaxKind.DotToken) continue;
+    if (next.kind === SyntaxKind.StringLiteral) {
+      clauses.push({ specifier: next.value, names: [], namespace: undefined, from: i, to: i + 1, start: tokens[i].start });
+      i += 1;
+      continue;
+    }
+    let cursor = i + 1;
+    while (cursor < tokens.length
+      && tokens[cursor].kind !== SyntaxKind.FromKeyword
+      && tokens[cursor].kind !== SyntaxKind.SemicolonToken
+      && tokens[cursor].kind !== SyntaxKind.ImportKeyword) cursor += 1;
+    const specifier = tokens[cursor + 1];
+    if (cursor >= tokens.length || tokens[cursor].kind !== SyntaxKind.FromKeyword) continue;
+    if (specifier === undefined || specifier.kind !== SyntaxKind.StringLiteral) continue;
+    const clauseIsTypeOnly = next.kind === SyntaxKind.TypeKeyword;
+    const names: ImportedName[] = [];
+    let namespace: string | undefined;
+    for (let k = i + 1; k < cursor; k += 1) {
+      if (tokens[k].kind === SyntaxKind.AsteriskToken && tokens[k + 1] !== undefined
+        && tokens[k + 1].kind === SyntaxKind.AsKeyword && tokens[k + 2] !== undefined) {
+        namespace = tokens[k + 2].text;
+        k += 2;
+        continue;
+      }
+      if (tokens[k].kind !== SyntaxKind.OpenBraceToken) continue;
+      let entry = k + 1;
+      while (entry < cursor && tokens[entry].kind !== SyntaxKind.CloseBraceToken) {
+        let entryIsTypeOnly = false;
+        const after = tokens[entry + 1];
+        if (tokens[entry].kind === SyntaxKind.TypeKeyword && after !== undefined
+          && after.kind !== SyntaxKind.CommaToken && after.kind !== SyntaxKind.CloseBraceToken
+          && after.kind !== SyntaxKind.AsKeyword) {
+          entryIsTypeOnly = true;
+          entry += 1;
+        }
+        const imported = tokens[entry];
+        if (imported === undefined) break;
+        let local = imported;
+        if (tokens[entry + 1] !== undefined && tokens[entry + 1].kind === SyntaxKind.AsKeyword
+          && tokens[entry + 2] !== undefined) {
+          local = tokens[entry + 2];
+          entry += 2;
+        }
+        names.push({ imported: imported.text, local: local.text, typeOnly: entryIsTypeOnly || clauseIsTypeOnly });
+        entry += 1;
+        if (tokens[entry] !== undefined && tokens[entry].kind === SyntaxKind.CommaToken) entry += 1;
+      }
+      k = entry;
+    }
+    clauses.push({ specifier: specifier.value, names, namespace, from: i, to: cursor + 1, start: tokens[i].start });
+    i = cursor + 1;
+  }
+  return clauses;
+}
+
+function importedLocals(
+  clauses: readonly ImportClause[],
+  specifier: string,
+  imported: string,
+): Set<string> {
+  const locals = new Set<string>();
+  for (const clause of clauses) {
+    if (clause.specifier !== specifier) continue;
+    for (const name of clause.names) if (name.imported === imported && !name.typeOnly) locals.add(name.local);
+  }
+  return locals;
+}
+
+function importedTokenRanges(clauses: readonly ImportClause[]): { from: number; to: number }[] {
+  return clauses.map(clause => ({ from: clause.from, to: clause.to }));
+}
+
+/** The module a binding has to come from. A same-named export of another file is not this one. */
+function warmupHelperModule(): string {
+  return withoutTsExtension(helperPath("cold-spawn-warmup.ts"));
+}
+
+function withoutTsExtension(path: string): string {
+  return path.endsWith(".ts") ? path.slice(0, -3) : path;
+}
+
+function importsTheWarmupHelper(fileName: string, specifier: string): boolean {
+  if (!specifier.startsWith(".") && !isAbsolute(specifier)) return false;
+  const resolved = isAbsolute(specifier) ? specifier : resolve(dirname(fileName), specifier);
+  return withoutTsExtension(resolved) === warmupHelperModule();
+}
+
+/**
+ * Where a name is bound to something other than its import: a declaration, an assignment, or a
+ * parameter. A shadowed beforeAll takes a correct callback and runs nothing, so the hook name has
+ * to be as provably the import as the warm-up name is.
+ */
+function rebindingOf(tokens: readonly Token[], name: string): Token | undefined {
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (token.kind !== SyntaxKind.Identifier || token.text !== name) continue;
+    if (isMemberName(tokens, i)) continue;
+    const before = tokens[i - 1];
+    const after = tokens[i + 1];
+    if (before !== undefined && DECLARATION_KEYWORDS.has(before.kind)) return token;
+    if (after === undefined) continue;
+    if (after.kind === SyntaxKind.EqualsToken) return token;
+    if (after.kind === SyntaxKind.EqualsGreaterThanToken) return token;
+    if (before !== undefined && before.kind === SyntaxKind.OpenParenToken
+      && after.kind === SyntaxKind.CloseParenToken && tokens[i + 2] !== undefined
+      && tokens[i + 2].kind === SyntaxKind.EqualsGreaterThanToken) return token;
+  }
+  return undefined;
+}
+
+/**
+ * The call an open paren belongs to. Only a BARE identifier counts as the callee: describe.skip
+ * and describe.each reach a suite this judge cannot claim runs, and reading them as describe is
+ * how a hook inside a skipped suite would be recorded as a registration.
+ */
+function callFrame(tokens: readonly Token[], open: number): CallFrame {
+  const name = tokens[open - 1];
+  if (name === undefined || name.kind !== SyntaxKind.Identifier || isMemberName(tokens, open - 1)) {
+    return { callee: "", open, statement: false };
+  }
+  const before = tokens[open - 2];
+  return { callee: name.text, open, statement: before === undefined || STATEMENT_START.has(before.kind) };
+}
+
+/**
+ * Whether an arrow is written directly as an argument of the call it sits in. A describe body and
+ * a hook body are arguments; a helper assigned to a name is not, and that difference is the whole
+ * distance between a hook that registers and one that never runs.
+ */
+function arrowIsArgument(tokens: readonly Token[], arrow: number, matches: readonly number[]): boolean {
+  let k = arrow - 1;
+  if (tokens[k] === undefined) return false;
+  if (tokens[k].kind === SyntaxKind.CloseParenToken) {
+    const open = matches[k];
+    if (open < 0) return false;
+    k = open - 1;
+  } else if (tokens[k].kind === SyntaxKind.Identifier) {
+    k -= 1;
+  } else {
+    return false;
+  }
+  if (tokens[k] !== undefined && tokens[k].kind === SyntaxKind.AsyncKeyword) k -= 1;
+  const before = tokens[k];
+  return before !== undefined
+    && (before.kind === SyntaxKind.OpenParenToken || before.kind === SyntaxKind.CommaToken);
+}
+
+/** Whether a block brace opens a callback written directly as an argument, arrow or function. */
+function opensArgumentCallback(tokens: readonly Token[], brace: number, matches: readonly number[]): boolean {
+  const pre = tokens[brace - 1];
+  if (pre === undefined) return false;
+  if (pre.kind === SyntaxKind.EqualsGreaterThanToken) return arrowIsArgument(tokens, brace - 1, matches);
+  if (pre.kind !== SyntaxKind.CloseParenToken) return false;
+  const open = matches[brace - 1];
+  if (open < 0) return false;
+  let k = open - 1;
+  if (tokens[k] !== undefined && tokens[k].kind === SyntaxKind.Identifier) k -= 1;
+  if (tokens[k] === undefined || tokens[k].kind !== SyntaxKind.FunctionKeyword) return false;
+  k -= 1;
+  if (tokens[k] !== undefined && tokens[k].kind === SyntaxKind.AsyncKeyword) k -= 1;
+  const before = tokens[k];
+  return before !== undefined
+    && (before.kind === SyntaxKind.OpenParenToken || before.kind === SyntaxKind.CommaToken);
+}
diff --git a/tests/helpers/warmup-tokens.ts b/tests/helpers/warmup-tokens.ts
new file mode 100644
index 00000000000..473eadeac1a
--- /dev/null
+++ b/tests/helpers/warmup-tokens.ts
@@ -0,0 +1,171 @@
+import { createScanner, LanguageVariant, SyntaxKind } from "typescript/unstable/ast";
+
+/**
+ * A balanced token stream for one TypeScript file, and the positional helpers a structural check
+ * needs on top of it.
+ *
+ * ## Why tokens and not a parsed tree
+ *
+ * TypeScript here is 7.0.2, the native port, and it publishes no in-process parser. The
+ * "typescript/unstable/ast" entry point is a node factory, type guards, a visitor, navigation and
+ * this scanner: the createSourceFile it exports is the FACTORY, whose first parameter is an array
+ * of already-parsed statements. Parsed trees come from Program.getSourceFile on the
+ * "typescript/unstable/sync" client, which spawns the Go tsgo executable and loads a whole project
+ * over JSON-RPC. Reading one test file that way would start a compiler process on every shard of
+ * every platform.
+ *
+ * So the judge built on this module recognises an exact, small set of shapes and refuses everything
+ * else, rather than reconstructing the grammar by hand. Tokens are enough for that, and being
+ * wrong about a shape costs a refusal rather than a false pass.
+ *
+ * ## What the driver has to get right
+ *
+ * Two rescans, without which the stream does not balance. A template substitution closes on an
+ * ordinary brace, so every template in the file would otherwise leak one unmatched brace: the brace
+ * depth each substitution opened at is remembered, and the closing token is rescanned as the
+ * template middle or tail it is. A slash either opens a regular expression or divides, decided by
+ * the token before it, and a wrong guess swallows whichever delimiters sit between it and the next
+ * slash; an unterminated rescan is rewound and the slash stays a division.
+ *
+ * Whatever is left has to balance. A file that does not is reported unreadable, and unreadable is a
+ * failure rather than an absence of evidence.
+ */
+
+export type Token = Readonly<{
+  kind: SyntaxKind;
+  /** Source text of the token, which for an identifier is its name. */
+  text: string;
+  /** Cooked value, filled for string literals so a module specifier can be read without its quotes. */
+  value: string;
+  /** Offset of the token in the source, for line numbers in diagnostics. */
+  start: number;
+}>;
+
+/**
+ * A slash opens a regular expression unless the token before it ends a value. The one genuinely
+ * ambiguous case, a closing brace, is read as the end of a statement: a regular expression after a
+ * block is real code, and dividing by an object literal is not.
+ */
+const REGEX_CANNOT_FOLLOW: ReadonlySet<SyntaxKind> = new Set([
+  SyntaxKind.Identifier,
+  SyntaxKind.PrivateIdentifier,
+  SyntaxKind.NumericLiteral,
+  SyntaxKind.BigIntLiteral,
+  SyntaxKind.StringLiteral,
+  SyntaxKind.NoSubstitutionTemplateLiteral,
+  SyntaxKind.TemplateTail,
+  SyntaxKind.RegularExpressionLiteral,
+  SyntaxKind.CloseParenToken,
+  SyntaxKind.CloseBracketToken,
+  SyntaxKind.PlusPlusToken,
+  SyntaxKind.MinusMinusToken,
+  SyntaxKind.ThisKeyword,
+  SyntaxKind.SuperKeyword,
+  SyntaxKind.TrueKeyword,
+  SyntaxKind.FalseKeyword,
+  SyntaxKind.NullKeyword,
+]);
+
+export const OPENERS: ReadonlyMap<SyntaxKind, SyntaxKind> = new Map([
+  [SyntaxKind.OpenBraceToken, SyntaxKind.CloseBraceToken],
+  [SyntaxKind.OpenParenToken, SyntaxKind.CloseParenToken],
+  [SyntaxKind.OpenBracketToken, SyntaxKind.CloseBracketToken],
+]);
+
+export const CLOSERS: ReadonlySet<SyntaxKind> = new Set([
+  SyntaxKind.CloseBraceToken,
+  SyntaxKind.CloseParenToken,
+  SyntaxKind.CloseBracketToken,
+]);
+
+/** The file as a balanced token stream, or the reason it could not be read as one. */
+export function tokenize(source: string): { tokens: Token[]; unreadable: string[] } {
+  const scanner = createScanner(true, LanguageVariant.Standard, source);
+  const tokens: Token[] = [];
+  const unreadable: string[] = [];
+  const templates: number[] = [];
+  let braces = 0;
+  let parens = 0;
+  let brackets = 0;
+  for (;;) {
+    let kind = scanner.scan();
+    if (kind === SyntaxKind.EndOfFile) break;
+    let start = scanner.getTokenStart();
+    let text = scanner.getTokenText();
+    if (kind === SyntaxKind.SlashToken || kind === SyntaxKind.SlashEqualsToken) {
+      const afterSlash = scanner.getTokenEnd();
+      const previous = tokens[tokens.length - 1];
+      if (previous === undefined || !REGEX_CANNOT_FOLLOW.has(previous.kind)) {
+        const rescanned = scanner.reScanSlashToken();
+        if (rescanned === SyntaxKind.RegularExpressionLiteral && !scanner.isUnterminated()) {
+          kind = rescanned;
+          start = scanner.getTokenStart();
+          text = scanner.getTokenText();
+        } else {
+          scanner.resetTokenState(afterSlash);
+        }
+      }
+    }
+    if (kind === SyntaxKind.CloseBraceToken && templates[templates.length - 1] === braces) {
+      templates.pop();
+      kind = scanner.reScanTemplateToken(false);
+      start = scanner.getTokenStart();
+      text = scanner.getTokenText();
+    }
+    const value = kind === SyntaxKind.StringLiteral ? scanner.getTokenValue() : "";
+    if (scanner.isUnterminated()) {
+      unreadable.push(at(source, start) + "an unterminated literal, so this judge is reading the file wrong");
+      return { tokens, unreadable };
+    }
+    if (kind === SyntaxKind.TemplateHead || kind === SyntaxKind.TemplateMiddle) templates.push(braces);
+    else if (kind === SyntaxKind.OpenBraceToken) braces += 1;
+    else if (kind === SyntaxKind.CloseBraceToken) braces -= 1;
+    else if (kind === SyntaxKind.OpenParenToken) parens += 1;
+    else if (kind === SyntaxKind.CloseParenToken) parens -= 1;
+    else if (kind === SyntaxKind.OpenBracketToken) brackets += 1;
+    else if (kind === SyntaxKind.CloseBracketToken) brackets -= 1;
+    if (braces < 0 || parens < 0 || brackets < 0) {
+      unreadable.push(at(source, start) + "a closing delimiter with nothing open, so this judge is reading the file wrong");
+      return { tokens, unreadable };
+    }
+    tokens.push({ kind, text, value: value ?? "", start });
+  }
+  if (braces !== 0 || parens !== 0 || brackets !== 0 || templates.length > 0) {
+    unreadable.push("the file does not close every delimiter this judge opened (braces " + braces
+      + ", parens " + parens + ", brackets " + brackets + ", open template substitutions "
+      + templates.length + ")");
+  }
+  return { tokens, unreadable };
+}
+
+/**
+ * Where the expression beginning at start ends: its comma, the closing delimiter around it, or its
+ * semicolon. The semicolon matters for a concise arrow body written outside a call, which would
+ * otherwise read as running to the end of the file and swallow every scope after it.
+ */
+export function argumentEnd(tokens: readonly Token[], start: number): number {
+  let depth = 0;
+  for (let i = start; i < tokens.length; i += 1) {
+    const kind = tokens[i].kind;
+    if (OPENERS.has(kind)) depth += 1;
+    else if (CLOSERS.has(kind)) {
+      if (depth === 0) return i;
+      depth -= 1;
+    } else if (depth === 0
+      && (kind === SyntaxKind.CommaToken || kind === SyntaxKind.SemicolonToken)) return i;
+  }
+  return tokens.length;
+}
+
+/** 1-based line of an offset. */
+export function lineOf(source: string, offset: number): number {
+  let line = 1;
+  const bound = Math.min(offset, source.length);
+  for (let i = 0; i < bound; i += 1) if (source.charCodeAt(i) === 10) line += 1;
+  return line;
+}
+
+/** "line N: ", the prefix every diagnostic carries so a failure points at a place. */
+export function at(source: string, offset: number): string {
+  return "line " + lineOf(source, offset) + ": ";
+}
diff --git a/tests/helpers/ws-upstream-fixtures.ts b/tests/helpers/ws-upstream-fixtures.ts
new file mode 100644
index 00000000000..8fd6c719558
--- /dev/null
+++ b/tests/helpers/ws-upstream-fixtures.ts
@@ -0,0 +1,34 @@
+import {
+  codexWsUpstreamFetch as rawCodexWsUpstreamFetch,
+  shouldUseCodexWsUpstream as rawShouldUseCodexWsUpstream,
+} from "../../src/server/responses/ws-upstream";
+
+/**
+ * Runtime pin and request shapes for the Codex WebSocket upstream suite.
+ *
+ * Moved verbatim out of tests/responses/ws-upstream.test.ts: that file sits at its file-size
+ * cap, and the repository answer to a cap is a sibling helper rather than compressed control
+ * flow. The two wrappers exist only to bind the pinned runtime identity, which is what makes
+ * the suite read the bounded-relay path instead of whatever the host Bun reports.
+ */
+export const BOUNDED_WS_RUNTIME = "1.4.0";
+
+export function shouldUseCodexWsUpstream(url: string, init?: RequestInit, upstreamWebsocket = false): boolean {
+  return rawShouldUseCodexWsUpstream(url, init, BOUNDED_WS_RUNTIME, upstreamWebsocket);
+}
+
+export function codexWsUpstreamFetch(
+  url: string,
+  init: RequestInit,
+  fallback: typeof fetch,
+): Promise<Response> {
+  return rawCodexWsUpstreamFetch(url, init, fallback, BOUNDED_WS_RUNTIME);
+}
+
+export function streamingInit(body: Record<string, unknown> = {}): RequestInit {
+  return {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: "Bearer test" },
+    body: JSON.stringify({ model: "gpt-5.5", stream: true, ...body }),
+  };
+}
diff --git a/tests/images/loop.test.ts b/tests/images/loop.test.ts
index 9dbddf1a680..cfbadfae3d7 100644
--- a/tests/images/loop.test.ts
+++ b/tests/images/loop.test.ts
@@ -880,9 +880,13 @@ describe("runWithImageBridge", () => {
     let fetchCalls = 0;
     let rotations = 0;
     let activeAdapter: ProviderAdapter | undefined;
+    let retryState: Pick<OcxParsedRequest, "_kiroAuthContext" | "_providerContinuation"> | undefined;
     const makeRotatingAdapter = (label: string): ProviderAdapter => ({
       name: label,
-      buildRequest: async () => ({ url: "https://test/v1/chat", method: "POST", headers: {}, body: "{}" }),
+      buildRequest: async requestParsed => {
+        if (label === "after-rotate") retryState = requestParsed;
+        return { url: "https://test/v1/chat", method: "POST", headers: {}, body: "{}" };
+      },
       fetchResponse: async () => {
         fetchCalls++;
         if (fetchCalls === 1) return new Response("rate limited", { status: 429, headers: { "retry-after": "1" } });
@@ -897,13 +901,19 @@ describe("runWithImageBridge", () => {
     const firstAdapter = makeRotatingAdapter("before-rotate");
     const secondAdapter = makeRotatingAdapter("after-rotate");
     activeAdapter = firstAdapter;
+    const outerParsed = makeParsed();
+    outerParsed._kiroAuthContext = { apiRegion: "eu-west-1", profileArn: "account-a" };
+    outerParsed._providerContinuation = { kiro: { conversationId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa" } };
     const response = await runWithImageBridge({
-      parsed: makeParsed(),
+      parsed: outerParsed,
       adapter: firstAdapter,
       plan,
-      on429: async () => {
+      on429: async (_retryAfter, _responseHeaders, retryParsed) => {
         rotations++;
         await Promise.resolve();
+        if (!retryParsed) throw new Error("the loop must pass the iteration request to on429");
+        retryParsed._kiroAuthContext = { apiRegion: "ap-southeast-2", profileArn: "account-b" };
+        delete retryParsed._providerContinuation;
         activeAdapter = secondAdapter;
         return secondAdapter;
       },
@@ -912,6 +922,8 @@ describe("runWithImageBridge", () => {
     expect(rotations).toBe(1);
     expect(fetchCalls).toBe(2);
     expect(activeAdapter).toBe(secondAdapter);
+    expect(retryState?._kiroAuthContext).toEqual({ apiRegion: "ap-southeast-2", profileArn: "account-b" });
+    expect(retryState?._providerContinuation).toBeUndefined();
     expect(sse).toContain("after rotate");
   });
 });
diff --git a/tests/images/z-handler-activation.test.ts b/tests/images/z-handler-activation.test.ts
index 5b6f578a79d..a2227dc8b1f 100644
--- a/tests/images/z-handler-activation.test.ts
+++ b/tests/images/z-handler-activation.test.ts
@@ -4,6 +4,8 @@ import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import type { ProviderAdapter } from "../../src/adapters/base";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /**
  * Dispatch-priority regression test for the image bridge (PR #424).
@@ -39,9 +41,16 @@ let runTurnCalled = false;
 let mockWsPlan: unknown = undefined;
 
 let handleResponses: typeof import("../../src/server/responses")["handleResponses"];
+let releaseSpendHome: (() => void) | undefined;
+// Retained so teardown can remove it. Nothing created this directory before the lease did:
+// taking ownership mkdirs the state directory, so the suite now owns its removal too.
+let ownedHome = "";
 
 beforeAll(async () => {
-  process.env.OPENCODEX_HOME = join(tmpdir(), "ocx-test-" + randomUUID());
+  ownedHome = join(tmpdir(), "ocx-test-" + randomUUID());
+  process.env.OPENCODEX_HOME = ownedHome;
+  // Take the writer lease after this suite installs its home so direct handler dispatch can open the spend journal.
+  releaseSpendHome = acquireOwnedSpendHome();
 
   const actualResolver = await import("../../src/server/adapter-resolve");
   mock.module("../../src/server/adapter-resolve", () => ({
@@ -112,6 +121,12 @@ beforeAll(async () => {
 });
 
 afterAll(() => {
+  // Release, then remove, then restore. An open lease inside a directory being deleted fails
+  // the removal on Windows and leaves an unlinked live database on POSIX, and the removal has
+  // to happen while OPENCODEX_HOME still names the directory being removed.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  if (ownedHome) removeTreeWithRetry(ownedHome);
   if (PREV_HOME === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = PREV_HOME;
   mock.restore();
@@ -155,6 +170,9 @@ describe("image bridge dispatch priority (handler activation)", () => {
     const res = await post(true, [{ type: "image_generation" }]);
     expect(imageBridgeRun).toBe(true);
     expect(res.headers.get("content-type")).toBe("text/event-stream");
+    // The bridge answers with a live SSE stream. Releasing it here means no reader is
+    // still attached when this suite drops its lease in afterAll.
+    await res.body?.cancel();
   });
 
   test("alias-only image tool_choice keeps canonical bridge interception armed", async () => {
@@ -176,6 +194,7 @@ describe("image bridge dispatch priority (handler activation)", () => {
     expect(imageBridgeToolNames).toContain("generate_image");
     expect(imageBridgeToolNames).toContain("image_gen");
     expect(res.headers.get("content-type")).toBe("text/event-stream");
+    await res.body?.cancel();
   });
 
   test("stream=false + image_generation tool → 400 (bridge requires stream=true)", async () => {
@@ -193,6 +212,7 @@ describe("image bridge dispatch priority (handler activation)", () => {
     expect(webSearchRun).toBe(true);
     expect(imageBridgeRun).toBe(false);
     expect(res.headers.get("content-type")).toBe("text/event-stream");
+    await res.body?.cancel();
   });
 
   test("routed compaction with image_generation tool → image bridge does NOT hijack compaction (#424)", async () => {
@@ -214,6 +234,7 @@ describe("image bridge dispatch priority (handler activation)", () => {
     );
     expect(imageBridgeRun).toBe(false);
     expect(res.headers.get("content-type")).toBe("text/event-stream");
+    await res.body?.cancel();
   });
 
   test("dual-tool on a runTurn adapter → image bridge wins (web-search loop has no runTurn support)", async () => {
@@ -226,6 +247,7 @@ describe("image bridge dispatch priority (handler activation)", () => {
       expect(imageBridgeRun).toBe(true);
       expect(runTurnCalled).toBe(false);
       expect(res.headers.get("content-type")).toBe("text/event-stream");
+      await res.body?.cancel();
     } finally {
       useRunTurnAdapter = false;
     }
@@ -241,6 +263,7 @@ describe("image bridge dispatch priority (handler activation)", () => {
       expect(webSearchRun).toBe(false);
       expect(runTurnCalled).toBe(false);
       expect(res.headers.get("content-type")).toBe("text/event-stream");
+      await res.body?.cancel();
     } finally {
       useRunTurnAdapter = false;
     }
diff --git a/tests/lab/core-lab-boundary.test.ts b/tests/lab/core-lab-boundary.test.ts
index 82c97190bf8..32a5a9758fc 100644
--- a/tests/lab/core-lab-boundary.test.ts
+++ b/tests/lab/core-lab-boundary.test.ts
@@ -15,6 +15,8 @@ import { repoRoot as resolveRepoRoot } from "../helpers/repo-root";
  * job is to know which optional subsystems exist. It is covered by a behavioral assertion
  * instead (see below).
  *
+ * Invariant binding: INV-LAB-01 (structure/overview.md#non-negotiable-invariants).
+ *
  * Design and rationale: devlog/_fin/260814_lab_core_decoupling/
  */
 const PROTECTED = [
@@ -136,7 +138,11 @@ export function namesLabDirectly(source: string): boolean {
  * routes subagents to a different model than the operator configured. Nothing goes red;
  * the wrong model simply answers.
  */
-const SERVE_ANCHOR = "server = Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost });";
+// The anchor carries the spend-ledger wrapper because the listener is registered for rollback
+// at the moment it is created. It is still the same statement and still the start of the same
+// window; what changed is the expression the listener is assigned from. An anchor that no
+// longer matches makes every scan below measure an empty string, which is why they assert on it.
+const SERVE_ANCHOR = "server = spendLedgerLifecycle.track(Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost }));";
 const ACTIVATION_ANCHOR = "if (labActivationRequired(config, labConfigDir)) {";
 /**
  * The window ends at the RETURN, not at the activation check.
@@ -1015,6 +1021,7 @@ describe("activation window stays synchronous", () => {
     "(...).then()": "Promise.then on the fire-and-forget `import('../codex/plan-from-token')` chain. then() registers a callback and returns immediately; the callback is a nested function this scan skips. Awaiting the import would already fail Guard 3.",
     "(...).catch()": "Promise.catch on that same dynamic-import chain. Same fire-and-forget: it cannot suspend startServer.",
     "backgroundLifecycle.scheduleStartupRun()": "src/server/background-lifecycle.ts owns this object method. The call site cannot resolve the declaration statically; scheduleStartupRun is declared `(): void` and is documented as never blocking listen.",
+    "spendLedgerLifecycle.track()": "Instance method on the lifecycle from acquireSpendLedgerServerLifecycle in src/server/index/spend-ledger-lifecycle.ts, called on each listener as it is created. It binds the listener's stop, records a rollback closure and returns the same server; it is declared `<T>(server: T): T` and contains no await. An `await spendLedgerLifecycle.track(...)` would already fail Guard 3. The lifecycle's release() is not here because it is called inside the async stop wrapper, which this scan skips as a nested function.",
   };
 
   /**
diff --git a/tests/lab/lab-live-pinned-timeouts.test.ts b/tests/lab/lab-live-pinned-timeouts.test.ts
index a3a4757c9c9..3af1c038642 100644
--- a/tests/lab/lab-live-pinned-timeouts.test.ts
+++ b/tests/lab/lab-live-pinned-timeouts.test.ts
@@ -1,6 +1,7 @@
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { afterEach, describe, expect, test } from "bun:test";
 import { createLabAuthorizedPinnedSender } from "../../src/lib/lab-live-pinned-sender";
+import { TransportError, classifyTransportError } from "../../src/lab/live/transport";
 import type { LabCredentialLeaseV1, LabDestinationV1, LiveRunConfig } from "../../src/lab/live/types";
 
 const SERVERS: Server[] = [];
@@ -124,6 +125,43 @@ describe("CL-03 pinned live transport failure classification", () => {
     });
   });
 
+  // An answer the transport cannot read is the peer's doing. Before this was classified, it
+  // reached Lab as an unrecognized error, and the executor's fallback reported it as
+  // harness_failure / execution_error - the runner blamed for what the upstream sent.
+  test("reports a coding this transport cannot undo as an unreadable response", async () => {
+    const port = await listen((_req, res) => {
+      res.writeHead(200, { "content-type": "application/json", "content-encoding": "br" });
+      res.end("not really brotli");
+    });
+
+    // Classify the error the sender actually rejected with. Building a second TransportError and
+    // classifying that would pass even if the sender raised something else entirely.
+    const error = await send(port, { firstByteTimeoutMs: 1_000, inactivityTimeoutMs: 1_000 })
+      .then(() => undefined, (caught: unknown) => caught);
+    expect(error).toBeInstanceOf(TransportError);
+    expect(error).toMatchObject({ name: "TransportError", code: "unreadable_response" });
+    expect(classifyTransportError(error)).toEqual({
+      classification: "protocol_failure",
+      secondaryCode: "unreadable_response",
+    });
+  });
+
+  test("reports coded bytes that do not decode as an unreadable response", async () => {
+    const port = await listen((_req, res) => {
+      res.writeHead(200, { "content-type": "application/json", "content-encoding": "gzip" });
+      res.end("this is not gzip at all");
+    });
+
+    const error = await send(port, { firstByteTimeoutMs: 1_000, inactivityTimeoutMs: 1_000 })
+      .then(() => undefined, (caught: unknown) => caught);
+    expect(error).toBeInstanceOf(TransportError);
+    expect(error).toMatchObject({ name: "TransportError", code: "unreadable_response" });
+    expect(classifyTransportError(error)).toEqual({
+      classification: "protocol_failure",
+      secondaryCode: "unreadable_response",
+    });
+  });
+
   test("allows a response exactly at the output byte ceiling", async () => {
     const port = await listen((_req, res) => {
       res.writeHead(200, { "content-type": "text/plain" });
diff --git a/tests/lib/debug.test.ts b/tests/lib/debug.test.ts
index b80f7db41f5..2a9b8153cb5 100644
--- a/tests/lib/debug.test.ts
+++ b/tests/lib/debug.test.ts
@@ -3,7 +3,7 @@ import { appendDebugLogLine, debugBufferMetrics, getDebugLogEntries, resetDebugL
 import { ResourceAdmissionError, RETAINED_TRUNCATION_MARKER, retainedUtf8Bytes, truncateRetainedUtf8 } from "../../src/lib/admission";
 import { getInjectionDebugLogEntries, injectionDebugLog, resetInjectionDebugLogBufferForTests } from "../../src/lib/injection-debug-log";
 import { markActivity, activityBreadcrumb } from "../../src/lib/sidecar-tracker";
-import { debugDroppedFrame, debugProviderDiagnostic } from "../../src/lib/debug";
+import { debugDroppedFrame, debugProviderDiagnostic, debugProviderDiagnosticLazy } from "../../src/lib/debug";
 import { resetDebugSettingsForTests, setDebugSettings } from "../../src/lib/debug-settings";
 
 describe("retained UTF-8 sizing", () => {
@@ -142,6 +142,53 @@ describe("debug frame logging", () => {
     }
   });
 
+  // The eager form builds its details in argument position, so an expensive or fallible
+  // projection runs outside both the gate and the try/catch. The lazy form is what a caller on
+  // the request path has to use, and these are the two properties it exists for.
+  test("debugProviderDiagnosticLazy never invokes its builder while disabled", () => {
+    delete process.env.OCX_DEBUG;
+    delete process.env.OCX_DEBUG_FRAMES;
+    let built = 0;
+    const error = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      debugProviderDiagnosticLazy("google", "wire-shape", () => { built += 1; return { turns: 1 }; });
+      expect(built).toBe(0);
+      expect(error).not.toHaveBeenCalled();
+    } finally {
+      error.mockRestore();
+    }
+  });
+
+  test("debugProviderDiagnosticLazy swallows a builder that throws", () => {
+    delete process.env.OCX_DEBUG;
+    setDebugSettings({ debug: true });
+    resetDebugLogBufferForTests();
+    const error = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      expect(() => debugProviderDiagnosticLazy("google", "wire-shape", () => {
+        throw new Error("projection boom");
+      })).not.toThrow();
+      // Nothing reached the console or the ring: a failed diagnostic is a silent one.
+      expect(error).not.toHaveBeenCalled();
+      expect(getDebugLogEntries()).toEqual([]);
+    } finally {
+      error.mockRestore();
+    }
+  });
+
+  test("debugProviderDiagnosticLazy emits the built details when enabled", () => {
+    delete process.env.OCX_DEBUG;
+    setDebugSettings({ debug: true });
+    const error = spyOn(console, "error").mockImplementation(() => {});
+    try {
+      debugProviderDiagnosticLazy("google", "wire-shape", () => ({ turns: 7 }));
+      expect(error).toHaveBeenCalledTimes(1);
+      expect(String(error.mock.calls[0]?.[0] ?? "")).toContain("[ocx:google:wire-shape] {\"turns\":7}");
+    } finally {
+      error.mockRestore();
+    }
+  });
+
   test("debugProviderDiagnostic emits when enabled via runtime settings API", () => {
     delete process.env.OCX_DEBUG;
     setDebugSettings({ debug: true });
diff --git a/tests/lib/pinned-http-content-coding.test.ts b/tests/lib/pinned-http-content-coding.test.ts
new file mode 100644
index 00000000000..0f2f5953bcc
--- /dev/null
+++ b/tests/lib/pinned-http-content-coding.test.ts
@@ -0,0 +1,358 @@
+import { describe, expect, test } from "bun:test";
+import { createConnection, createServer as createTcpServer, type AddressInfo, type Server as TcpServer, type Socket } from "node:net";
+import { randomBytes } from "node:crypto";
+import { gzipSync, deflateSync } from "node:zlib";
+import { PinnedHttpError, pinnedHttpGet } from "../../src/lib/pinned-http";
+import { socks5Fetch } from "../../src/lib/socks5-fetch";
+
+const openSockets = new WeakMap<object, Set<Socket>>();
+
+async function listen(server: TcpServer): Promise<number> {
+  const sockets = new Set<Socket>();
+  openSockets.set(server, sockets);
+  server.on("connection", socket => {
+    sockets.add(socket);
+    socket.once("error", () => { /* a refused coding resets its peer */ });
+    socket.once("close", () => sockets.delete(socket));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  return (server.address() as AddressInfo).port;
+}
+
+async function close(server: TcpServer): Promise<void> {
+  for (const socket of openSockets.get(server) ?? []) socket.destroy();
+  await new Promise<void>(resolve => server.close(() => resolve()));
+}
+
+/** A no-auth SOCKS5 peer that connects to the loopback port the request names and pipes both ways. */
+function socksProxy(): TcpServer {
+  return createTcpServer(socket => {
+    let stage: "greeting" | "connect" = "greeting";
+    let buffer = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      while (true) {
+        if (stage === "greeting") {
+          if (buffer.length < 2 || buffer.length < 2 + buffer[1]!) return;
+          buffer = buffer.subarray(2 + buffer[1]!);
+          socket.write(Buffer.from([0x05, 0x00]));
+          stage = "connect";
+          continue;
+        }
+        if (buffer.length < 7) return;
+        const hostnameLength = buffer[4]!;
+        const requestLength = 7 + hostnameLength;
+        if (buffer.length < requestLength) return;
+        const port = buffer.readUInt16BE(5 + hostnameLength);
+        buffer = buffer.subarray(requestLength);
+        const target = createConnection({ host: "127.0.0.1", port }, () => {
+          socket.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 127, 0, 0, 1, 0, 1]));
+          socket.removeListener("data", onData);
+          if (buffer.length > 0) socket.unshift(buffer);
+          socket.pipe(target);
+          target.pipe(socket);
+        });
+        target.once("error", error => socket.destroy(error));
+        return;
+      }
+    };
+    socket.on("data", onData);
+    socket.once("error", () => { /* the proxy is torn down with its peers */ });
+  });
+}
+
+/** A peer that answers one coded body and records the request head it was asked with. */
+function codedTarget(
+  coding: string,
+  payload: Uint8Array,
+  options?: { truncateAfter?: number; holdAfter?: number; declaredLength?: number },
+) {
+  let requestText = "";
+  let connection: Socket | undefined;
+  const server = createTcpServer(socket => {
+    connection = socket;
+    socket.once("error", () => { /* the caller may reset this peer */ });
+    let request = Buffer.alloc(0);
+    socket.on("data", chunk => {
+      request = Buffer.concat([request, chunk]);
+      requestText = request.toString("latin1");
+      if (!requestText.includes("\r\n\r\n")) return;
+      const head = "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-encoding: "
+        + coding
+        + "\r\ncontent-length: " + (options?.declaredLength ?? payload.byteLength) + "\r\n\r\n";
+      const hold = options?.holdAfter;
+      if (hold !== undefined) {
+        // Promise more than is sent and then stay open. The response is still in flight, so a
+        // cancellation has to travel backwards to close it; an already-finished body would be
+        // released by ordinary end-of-stream and prove nothing about cancellation.
+        socket.write(Buffer.concat([Buffer.from(head, "latin1"), Buffer.from(payload.subarray(0, hold))]));
+        return;
+      }
+      const truncate = options?.truncateAfter;
+      if (truncate === undefined) {
+        socket.write(Buffer.concat([Buffer.from(head, "latin1"), Buffer.from(payload)]));
+        return;
+      }
+      // Announce the whole coded length, send a valid prefix of it, then vanish. The decoder
+      // sees a truncated stream; the caller's real problem is the connection.
+      socket.write(Buffer.concat([Buffer.from(head, "latin1"), Buffer.from(payload.subarray(0, truncate))]));
+      socket.destroy();
+    });
+  });
+  return { server, requestHead: () => requestText, connection: () => connection };
+}
+
+/**
+ * Wait for a socket to be observably destroyed, under a bounded deadline.
+ *
+ * The contract is that the transport releases the connection, not that it does so inside any
+ * particular window, so this waits for the state the contract promises rather than sleeping for
+ * a fixed time and asserting something about machine load.
+ */
+async function awaitDestroyed(socket: Socket | undefined, timeoutMs = 2_000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (socket?.destroyed !== true && Date.now() < deadline) await Bun.sleep(5);
+  return socket?.destroyed === true;
+}
+
+function pinnedGet(port: number, path: string, options?: { maxBytes?: number; headers?: HeadersInit }): Promise<Response> {
+  return pinnedHttpGet(
+    `http://provider.invalid:${port}${path}`,
+    { address: "127.0.0.1", family: 4 },
+    undefined,
+    { idleTimeoutMs: 5_000, context: "provider response", ...options },
+  );
+}
+
+// The pinned direct helper and the SOCKS tunnel are chosen by the same provider outbound
+// decision, so a body that is readable on one route and compressed on the other makes the
+// provider's behavior depend on the operator's egress configuration. These pin the parity.
+describe("pinned direct content coding", () => {
+  test("a gzip body is decoded and stops advertising a coding it no longer carries", async () => {
+    const body = JSON.stringify({ ok: true, note: "compressed" });
+    const { server: target } = codedTarget("gzip", gzipSync(Buffer.from(body, "utf8")));
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/gzip");
+      expect(response.headers.get("content-encoding")).toBeNull();
+      // The declared length counted the coded bytes; keeping it would misdescribe the body.
+      expect(response.headers.get("content-length")).toBeNull();
+      expect(await response.json()).toEqual({ ok: true, note: "compressed" });
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("a deflate body is decoded the same way", async () => {
+    // HTTP `deflate` is the zlib container, not raw DEFLATE, and that is what
+    // `DecompressionStream("deflate")` reads.
+    const { server: target } = codedTarget("deflate", deflateSync(Buffer.from(JSON.stringify({ ok: true }), "utf8")));
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/deflate");
+      expect(await response.json()).toEqual({ ok: true });
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("both raw transports produce the same logical JSON for the same coded payload", async () => {
+    const body = JSON.stringify({ route: "parity", values: [1, 2, 3] });
+    const direct = codedTarget("gzip", gzipSync(Buffer.from(body, "utf8")));
+    const tunneled = codedTarget("gzip", gzipSync(Buffer.from(body, "utf8")));
+    const proxy = socksProxy();
+    const [directPort, tunneledPort, proxyPort] = await Promise.all([
+      listen(direct.server),
+      listen(tunneled.server),
+      listen(proxy),
+    ]);
+    try {
+      const pinned = await pinnedGet(directPort, "/parity");
+      const tunneledResponse = await socks5Fetch(
+        `http://provider.invalid:${tunneledPort}/parity`,
+        undefined,
+        `socks5://127.0.0.1:${proxyPort}`,
+      );
+      expect(await pinned.json()).toEqual(JSON.parse(body));
+      expect(await tunneledResponse.json()).toEqual(JSON.parse(body));
+    } finally {
+      await Promise.all([close(proxy), close(direct.server), close(tunneled.server)]);
+    }
+  });
+
+  test("a coding this transport cannot undo is refused by name before the body is handed over", async () => {
+    // Brotli is not a format `DecompressionStream` implements. Returning the bytes anyway is the
+    // behavior being removed: the caller would get a SyntaxError from its own parser with
+    // nothing naming the cause.
+    const { server: target } = codedTarget("br", new TextEncoder().encode("not really brotli"));
+    const port = await listen(target);
+    try {
+      const error = await pinnedGet(port, "/brotli").catch((caught: unknown) => caught);
+      expect(error).toBeInstanceOf(PinnedHttpError);
+      expect(error).toMatchObject({ code: "unsupported_content_encoding" });
+      expect(String(error)).toContain("unsupported content-encoding: br");
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("a corrupt coded body fails with a named decode error rather than a bare stream failure", async () => {
+    // Promise more than is sent and keep the socket open. A fixture that delivers its whole
+    // declared length lets the response complete before the decoder rejects, and then the
+    // connection may be pooled rather than closed - which would make this assert the same
+    // agent behavior the success case above deliberately does not pin. Holding the response
+    // unfinished is what makes the close attributable to this path.
+    const corrupt = new TextEncoder().encode("this is not gzip at all");
+    const { server: target, connection } = codedTarget("gzip", corrupt, {
+      holdAfter: corrupt.byteLength,
+      declaredLength: corrupt.byteLength + 1_024,
+    });
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/corrupt");
+      const error = await response.text().catch((caught: unknown) => caught);
+      expect(error).toBeInstanceOf(PinnedHttpError);
+      expect(error).toMatchObject({ code: "content_decode_failed" });
+      // The response never finished, so closing it is this path's obligation.
+      expect(await awaitDestroyed(connection())).toBe(true);
+    } finally {
+      connection()?.destroy();
+      await close(target);
+    }
+  });
+
+  test("maxBytes bounds the decoded body, not only the bytes that arrived", async () => {
+    // The coded payload is tiny and the decoded one is not: a ceiling applied only to the socket
+    // would admit a body far larger than the caller agreed to hold.
+    const expanded = Buffer.alloc(64 * 1024, 0x61);
+    const { server: target } = codedTarget("gzip", gzipSync(expanded));
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/expanded", { maxBytes: 1024 });
+      const error = await response.text().catch((caught: unknown) => caught);
+      expect(error).toBeInstanceOf(PinnedHttpError);
+      expect(error).toMatchObject({ code: "output_byte_limit" });
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("a reset during a valid coded body reports the transport failure, not a decode failure", async () => {
+    // The decoder sees a truncated stream either way, so this is the case where naming every
+    // pipeline failure a decode failure would tell the caller the peer sent unreadable bytes
+    // when what actually happened is that the connection died mid-body.
+    const gzipped = gzipSync(Buffer.from(JSON.stringify({ ok: true, note: "half sent" }), "utf8"));
+    const { server: target } = codedTarget("gzip", gzipped, { truncateAfter: Math.max(1, gzipped.byteLength - 4) });
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/reset");
+      const error = await response.text().catch((caught: unknown) => caught);
+      expect(error).toBeInstanceOf(Error);
+      expect(error).not.toMatchObject({ code: "content_decode_failed" });
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("cancelling a coded body propagates through the decoder and releases the peer", async () => {
+    const coded = gzipSync(Buffer.alloc(256 * 1024, 0x62));
+    // Send almost all of it, promise more than that, and never finish: the body is still open
+    // when the caller gives up.
+    const { server: target, connection } = codedTarget("gzip", coded, {
+      holdAfter: coded.byteLength - 16,
+      declaredLength: coded.byteLength + 1_024,
+    });
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/cancel");
+      const reader = response.body!.getReader();
+      // Read once so the pipeline is actually running before cancellation, rather than
+      // cancelling a body nothing has started to consume.
+      const first = await reader.read();
+      expect(first.done).toBe(false);
+      // A caller's own reason must travel the decode pipeline without the transport turning it
+      // into a failure of its own.
+      await reader.cancel(new Error("caller stopped reading"));
+      // Cancellation propagates through the decoder to the socket rather than stopping at it.
+      expect(await awaitDestroyed(connection())).toBe(true);
+    } finally {
+      connection()?.destroy();
+      await close(target);
+    }
+  });
+
+  test("the byte ceiling still binds the bytes that arrive, not only the decoded ones", async () => {
+    // Deliberately inverted: gzip framing costs more than these bytes save, so the coded body is
+    // larger than the decoded one. With the ceiling above the decoded size, only the socket-side
+    // counter can refuse this, which is what makes the case an oracle for that counter rather
+    // than one the decoded guard could also satisfy. The sizes are asserted, not assumed.
+    const tiny = randomBytes(8);
+    const coded = gzipSync(tiny);
+    const limit = coded.byteLength - 1;
+    expect(coded.byteLength).toBeGreaterThan(limit);
+    expect(tiny.byteLength).toBeLessThanOrEqual(limit);
+    // Unfinished for the same reason the corrupt case is: the ceiling must be what closes this
+    // connection, not the response having completed.
+    const { server: target, connection } = codedTarget("gzip", coded, {
+      holdAfter: coded.byteLength,
+      declaredLength: coded.byteLength + 1_024,
+    });
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/inverted", { maxBytes: limit });
+      const error = await response.text().catch((caught: unknown) => caught);
+      expect(error).toBeInstanceOf(PinnedHttpError);
+      expect(error).toMatchObject({ code: "output_byte_limit" });
+      expect(await awaitDestroyed(connection())).toBe(true);
+    } finally {
+      connection()?.destroy();
+      await close(target);
+    }
+  });
+
+  test("a decoded response settles at end of stream", async () => {
+    // What a completed body owes is that it ends: the decoder flushes, the stream closes, and
+    // the caller sees the whole value. What happens to the connection afterwards is the HTTP
+    // agent's decision - Node documents a completed connection as destroyed or pooled
+    // depending on keepAlive - so asserting either outcome here would pin a mechanism this
+    // transport does not own. Cleanup this path does owe is asserted where a response ends
+    // early: the decode-failure, ceiling and cancellation cases above each observe a close.
+    const { server: target, connection } = codedTarget("gzip", gzipSync(Buffer.from('{"ok":true}', "utf8")));
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/complete");
+      const reader = response.body!.getReader();
+      let decoded = "";
+      for (;;) {
+        const next = await reader.read();
+        if (next.done) break;
+        decoded += new TextDecoder().decode(next.value);
+      }
+      expect(JSON.parse(decoded)).toEqual({ ok: true });
+    } finally {
+      connection()?.destroy();
+      await close(target);
+    }
+  });
+
+  test("the request asks for identity by default and keeps an explicit caller preference", async () => {
+    const payload = gzipSync(Buffer.from(JSON.stringify({ ok: true }), "utf8"));
+    const bare = codedTarget("identity", new TextEncoder().encode("{}"));
+    // A preference list that mentions a coding this transport cannot undo is not a reason to
+    // refuse the response: what matters is the coding the peer actually chose.
+    const chosen = codedTarget("gzip", payload);
+    const [barePort, chosenPort] = await Promise.all([listen(bare.server), listen(chosen.server)]);
+    try {
+      await pinnedGet(barePort, "/default");
+      expect(bare.requestHead().toLowerCase()).toContain("accept-encoding: identity");
+      const response = await pinnedGet(chosenPort, "/explicit", { headers: { "accept-encoding": "gzip, br" } });
+      expect(chosen.requestHead().toLowerCase()).toContain("accept-encoding: gzip, br");
+      expect(await response.json()).toEqual({ ok: true });
+    } finally {
+      await Promise.all([close(bare.server), close(chosen.server)]);
+    }
+  });
+});
diff --git a/tests/lib/process-control-graceful.test.ts b/tests/lib/process-control-graceful.test.ts
index 9f1f2fe7fc0..da9983d7cbf 100644
--- a/tests/lib/process-control-graceful.test.ts
+++ b/tests/lib/process-control-graceful.test.ts
@@ -19,6 +19,11 @@ describe("gracefulStopHost", () => {
     expect(gracefulStopHost("2001:db8::5")).toBe("[2001:db8::5]");
     expect(gracefulStopHost("[2001:db8::5]")).toBe("[2001:db8::5]");
   });
+
+  test("DNS bind names fall back to loopback so credentials are never sent through DNS", () => {
+    expect(gracefulStopHost("proxy.internal.example")).toBe("127.0.0.1");
+    expect(gracefulStopHost("attacker.invalid")).toBe("127.0.0.1");
+  });
 });
 
 describe("stopProxyGracefully", () => {
@@ -127,6 +132,21 @@ describe("stopProxyGracefully", () => {
     expect(headers?.["x-opencodex-api-key"]).toBe("admin-secret");
   });
 
+  test("never sends the management token to a recorded DNS hostname", async () => {
+    let requestedUrl = "";
+    await stopProxyGracefully(1, {
+      readRuntime: () => ({ port: 10100, hostname: "attacker.invalid" }),
+      fetchFn: (async (url: string | URL | Request) => {
+        requestedUrl = String(url);
+        return okResponse();
+      }) as typeof fetch,
+      waitExit: () => true,
+      env: { OPENCODEX_ADMIN_AUTH_TOKEN: "admin-secret" },
+    });
+
+    expect(requestedUrl).toBe("http://127.0.0.1:10100/api/stop");
+  });
+
   test("returns false when no runtime port is recorded (caller falls back to killProxy)", async () => {
     const result = await stopProxyGracefully(7, {
       readRuntime: () => null,
diff --git a/tests/lib/socks5-upload-lifecycle.test.ts b/tests/lib/socks5-upload-lifecycle.test.ts
new file mode 100644
index 00000000000..18b1b4975b8
--- /dev/null
+++ b/tests/lib/socks5-upload-lifecycle.test.ts
@@ -0,0 +1,465 @@
+import { describe, expect, test } from "bun:test";
+import { Socket, createConnection, createServer as createTcpServer, type AddressInfo, type Server as TcpServer } from "node:net";
+import { socks5Fetch } from "../../src/lib/socks5-fetch";
+
+/**
+ * The budget the transport arms for a response, mirrored from SOCKS5_RESPONSE_TIMEOUT_MS in
+ * src/lib/socks5-fetch.ts, which keeps it module-private.
+ *
+ * Mirrored rather than exported: the value is what identifies the transport's own timer among the
+ * several this exchange arms, and a test is not a reason to widen that module's surface. If the
+ * budget changes there, the assertion below stops finding it and says so.
+ */
+const RESPONSE_TIMEOUT_MS = 200_000;
+
+const openSockets = new WeakMap<object, Set<Socket>>();
+
+async function listen(server: TcpServer): Promise<number> {
+  const sockets = new Set<Socket>();
+  openSockets.set(server, sockets);
+  server.on("connection", socket => {
+    sockets.add(socket);
+    socket.once("error", () => { /* an abandoned upload resets its peer */ });
+    socket.once("close", () => sockets.delete(socket));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  return (server.address() as AddressInfo).port;
+}
+
+async function close(server: TcpServer): Promise<void> {
+  for (const socket of openSockets.get(server) ?? []) socket.destroy();
+  await new Promise<void>(resolve => server.close(() => resolve()));
+}
+
+/** A no-auth SOCKS5 peer that connects to the loopback port the request names and pipes both ways. */
+function socksProxy(): TcpServer {
+  return createTcpServer(socket => {
+    let stage: "greeting" | "connect" = "greeting";
+    let buffer = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      while (true) {
+        if (stage === "greeting") {
+          if (buffer.length < 2 || buffer.length < 2 + buffer[1]!) return;
+          buffer = buffer.subarray(2 + buffer[1]!);
+          socket.write(Buffer.from([0x05, 0x00]));
+          stage = "connect";
+          continue;
+        }
+        if (buffer.length < 7) return;
+        const hostnameLength = buffer[4]!;
+        const requestLength = 7 + hostnameLength;
+        if (buffer.length < requestLength) return;
+        const port = buffer.readUInt16BE(5 + hostnameLength);
+        buffer = buffer.subarray(requestLength);
+        const target = createConnection({ host: "127.0.0.1", port }, () => {
+          socket.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 127, 0, 0, 1, 0, 1]));
+          socket.removeListener("data", onData);
+          if (buffer.length > 0) socket.unshift(buffer);
+          socket.pipe(target);
+          target.pipe(socket);
+        });
+        target.once("error", error => socket.destroy(error));
+        return;
+      }
+    };
+    socket.on("data", onData);
+    socket.once("error", () => { /* the proxy is torn down with its peers */ });
+  });
+}
+
+/**
+ * A request body that produces one chunk and then never produces another.
+ *
+ * This is the shape the transport could not settle: the caller's stream owns that pending read,
+ * so destroying the socket does nothing to it. `pull` returns a promise that never settles, which
+ * is how a stream legitimately says "not yet" without ending.
+ */
+function stallingBody(first: Uint8Array) {
+  let markDelivered: () => void = () => { /* replaced below */ };
+  let markCancelled: () => void = () => { /* replaced below */ };
+  const delivered = new Promise<void>(resolve => { markDelivered = resolve; });
+  const cancelled = new Promise<void>(resolve => { markCancelled = resolve; });
+  let sent = false;
+  const stream = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (sent) return new Promise<void>(() => { /* the body stalls here */ });
+      sent = true;
+      controller.enqueue(first);
+      markDelivered();
+      return undefined;
+    },
+    cancel() { markCancelled(); },
+  });
+  return { stream, delivered, cancelled };
+}
+
+/** True when the promise settles inside the deadline, without asserting anything about timing. */
+async function settlesWithin(promise: Promise<unknown>, timeoutMs = 2_000): Promise<boolean> {
+  return await Promise.race([
+    promise.then(() => true, () => true),
+    Bun.sleep(timeoutMs).then(() => false),
+  ]);
+}
+
+function post(port: number, proxyPort: number, body: ReadableStream<Uint8Array>, signal?: AbortSignal) {
+  const init = {
+    method: "POST",
+    body,
+    duplex: "half",
+    ...(signal ? { signal } : {}),
+  } satisfies RequestInit & { duplex: "half" };
+  return socks5Fetch(`http://provider.invalid:${port}/upload`, init, `socks5://127.0.0.1:${proxyPort}`);
+}
+
+/** A peer that completes the request head and then reports the first body byte it receives. */
+function uploadObserver(): { server: TcpServer; uploading: Promise<void> } {
+  let markUploading: () => void = () => { /* replaced below */ };
+  const uploading = new Promise<void>(resolve => { markUploading = resolve; });
+  const server = createTcpServer(socket => {
+    socket.once("error", () => { /* the caller resets this peer on abort */ });
+    let head = Buffer.alloc(0);
+    let headComplete = false;
+    socket.on("data", chunk => {
+      if (headComplete) {
+        markUploading();
+        return;
+      }
+      head = Buffer.concat([head, chunk]);
+      const end = head.indexOf("\r\n\r\n");
+      if (end < 0) return;
+      headComplete = true;
+      if (head.byteLength > end + 4) markUploading();
+    });
+    // Never answer: a fetch here can only settle through the abort path.
+  });
+  return { server, uploading };
+}
+
+// A peer may answer a request it has not finished receiving, and a request body may stall. The
+// upload loop used to await the caller's body reader before looking at the socket at all, so
+// those two facts together produced a fetch that never settled with the answer already buffered.
+describe("SOCKS5 upload lifecycle", () => {
+  test("an early final response resolves and stops the upload", async () => {
+    const uploaded: Buffer[] = [];
+    let answered = false;
+    const target = createTcpServer(socket => {
+      socket.once("error", () => { /* the client stops writing once it has its answer */ });
+      let head = Buffer.alloc(0);
+      socket.on("data", chunk => {
+        if (answered) {
+          uploaded.push(Buffer.from(chunk));
+          return;
+        }
+        head = Buffer.concat([head, chunk]);
+        const end = head.indexOf("\r\n\r\n");
+        if (end < 0) return;
+        answered = true;
+        const trailing = head.subarray(end + 4);
+        if (trailing.byteLength > 0) uploaded.push(Buffer.from(trailing));
+        socket.write("HTTP/1.1 413 Payload Too Large\r\nContent-Length: 5\r\nConnection: close\r\n\r\nlarge");
+      });
+    });
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const body = stallingBody(new TextEncoder().encode("first chunk"));
+    try {
+      const pending = post(targetPort, proxyPort, body.stream);
+      expect(await settlesWithin(pending)).toBe(true);
+      const response = await pending;
+      expect(response.status).toBe(413);
+      expect(await response.text()).toBe("large");
+      // The stalled body is released rather than left holding the caller's stream open.
+      expect(await settlesWithin(body.cancelled)).toBe(true);
+      // A terminating chunk after the answer would be read as the head of the next request.
+      expect(Buffer.concat(uploaded).toString("latin1")).not.toContain("0\r\n\r\n");
+    } finally {
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+  test("a caller abort settles a fetch waiting on a body chunk that never arrives", async () => {
+    // Abort is driven by the upstream actually receiving a body byte, not by the caller's
+    // stream having produced one. A stream can be pulled before the tunnel is established, so
+    // aborting on that signal would not prove the fetch was parked mid-upload.
+    const { server: target, uploading } = uploadObserver();
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const body = stallingBody(new TextEncoder().encode("first chunk"));
+    const controller = new AbortController();
+    const reason = new Error("caller gave up");
+    try {
+      const pending = post(targetPort, proxyPort, body.stream, controller.signal);
+      const outcome = pending.then(() => "resolved" as const, (error: unknown) => error);
+      // The upload is now parked on a read the caller's stream will never fulfil.
+      expect(await settlesWithin(uploading)).toBe(true);
+      controller.abort(reason);
+      expect(await settlesWithin(outcome)).toBe(true);
+      expect(await outcome).toBe(reason);
+      expect(await settlesWithin(body.cancelled)).toBe(true);
+    } finally {
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+  // `AbortSignal.reason` is whatever the caller passed, and several waiters inside this
+  // transport can win the race that settles an abort. They disagree about a reason they consider
+  // absent - one substitutes an Error for null, others coerce anything that is not an Error - so
+  // without a single answer the same abort surfaces differently depending on scheduling.
+  test.each([
+    ["a string", "caller gave up"],
+    ["null", null],
+    ["a plain object", { cancelled: true }],
+  ] as const)("an abort reason that is %s reaches the caller unchanged", async (_label, reason) => {
+    const { server: target, uploading } = uploadObserver();
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const body = stallingBody(new TextEncoder().encode("first chunk"));
+    const controller = new AbortController();
+    try {
+      const pending = post(targetPort, proxyPort, body.stream, controller.signal);
+      const outcome = pending.then(() => "resolved" as const, (error: unknown) => error);
+      expect(await settlesWithin(uploading)).toBe(true);
+      controller.abort(reason);
+      expect(await settlesWithin(outcome)).toBe(true);
+      expect(await outcome).toBe(reason);
+    } finally {
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+  test("a peer that disappears during a stalled body read settles rather than hanging", async () => {
+    const target = createTcpServer(socket => {
+      socket.once("error", () => { /* this peer leaves deliberately */ });
+      let head = Buffer.alloc(0);
+      socket.on("data", chunk => {
+        head = Buffer.concat([head, chunk]);
+        if (head.indexOf("\r\n\r\n") < 0) return;
+        socket.destroy();
+      });
+    });
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const body = stallingBody(new TextEncoder().encode("first chunk"));
+    try {
+      const pending = post(targetPort, proxyPort, body.stream);
+      const outcome = pending.then(() => "resolved" as const, (error: unknown) => error);
+      expect(await settlesWithin(outcome)).toBe(true);
+      expect(await outcome).toBeInstanceOf(Error);
+      expect(await settlesWithin(body.cancelled)).toBe(true);
+    } finally {
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+  test("an ordinary streamed POST still completes with its terminating chunk", async () => {
+    let received = "";
+    const target = createTcpServer(socket => {
+      socket.once("error", () => { /* teardown may reset this peer */ });
+      socket.on("data", chunk => {
+        received += chunk.toString("latin1");
+        if (!received.includes("0\r\n\r\n")) return;
+        socket.write("HTTP/1.1 200 OK\r\nContent-Length: 6\r\nConnection: close\r\n\r\nposted");
+      });
+    });
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(encoder.encode("hello "));
+        controller.enqueue(encoder.encode("socks"));
+        controller.close();
+      },
+    });
+    try {
+      const response = await post(targetPort, proxyPort, stream);
+      expect(response.status).toBe(200);
+      expect(await response.text()).toBe("posted");
+      expect(received).toContain("hello ");
+      expect(received).toContain("socks");
+      expect(received).toContain("0\r\n\r\n");
+    } finally {
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+  test("interim informational answers are consumed and the upload runs to completion", async () => {
+    /*
+     * A peer may answer 100 and 103 before the request body is finished, and those are not the
+     * answer. The transport consumes them and reads on for the real one while the upload keeps
+     * going; one that treated the first head it saw as final would hand the caller an empty 100
+     * and stop writing mid-body.
+     *
+     * The ordering is arranged rather than hoped for. The rest of the body is withheld until both
+     * interim heads have arrived at this side of the tunnel and the reader has had a scheduling
+     * turn to consume them, and the fetch is required to be unsettled at that moment. So
+     * everything asserted afterwards about the remainder of the upload genuinely happened after
+     * the transport had those answers in hand and had not mistaken either for the final one.
+     */
+    let received = "";
+    let receivedWhenInformed: number | undefined;
+    let markPeerClosed: () => void = () => { /* replaced below */ };
+    const peerClosed = new Promise<void>(resolve => { markPeerClosed = resolve; });
+    const target = createTcpServer(socket => {
+      socket.once("error", () => { /* teardown may reset this peer */ });
+      socket.once("close", () => markPeerClosed());
+      socket.on("data", chunk => {
+        received += chunk.toString("latin1");
+        if (receivedWhenInformed === undefined && received.includes("\r\n\r\n")) {
+          socket.write("HTTP/1.1 100 Continue\r\n\r\n");
+          socket.write("HTTP/1.1 103 Early Hints\r\nLink: </style.css>; rel=preload\r\n\r\n");
+          receivedWhenInformed = received.length;
+        }
+        if (!received.includes("0\r\n\r\n")) return;
+        socket.write("HTTP/1.1 200 OK\r\nContent-Length: 6\r\nConnection: close\r\n\r\nposted");
+      });
+    });
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+
+    // Both interim heads, seen arriving on this side of the tunnel rather than merely written by
+    // the peer. The reader is already in flowing mode, so this listener observes the same chunks
+    // it does and consumes nothing.
+    let clientSeen = "";
+    let markInterimAtClient: () => void = () => { /* replaced below */ };
+    const interimAtClient = new Promise<void>(resolve => { markInterimAtClient = resolve; });
+    const originalSetTimeout = Socket.prototype.setTimeout;
+    let transportSocket: Socket | undefined;
+    const observeInterim = (chunk: Buffer | string): void => {
+      clientSeen += typeof chunk === "string" ? chunk : chunk.toString("latin1");
+      if (clientSeen.includes("HTTP/1.1 100 Continue\r\n\r\n")
+        && clientSeen.includes("HTTP/1.1 103 Early Hints\r\nLink: </style.css>; rel=preload\r\n\r\n")) {
+        markInterimAtClient();
+      }
+    };
+
+    const encoder = new TextEncoder();
+    let bodyController!: ReadableStreamDefaultController<Uint8Array>;
+    let settled = false;
+    let cancelled = false;
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        bodyController = controller;
+        controller.enqueue(encoder.encode("hello "));
+      },
+      cancel() { cancelled = true; },
+    });
+    const abort = new AbortController();
+    let outcome: Promise<void> | undefined;
+
+    try {
+      Socket.prototype.setTimeout = function patched(this: Socket, ms: number, callback?: () => void) {
+        if (ms === RESPONSE_TIMEOUT_MS && transportSocket === undefined) {
+          transportSocket = this;
+          this.on("data", observeInterim);
+        }
+        return originalSetTimeout.call(this, ms, callback as never);
+      } as typeof Socket.prototype.setTimeout;
+
+      const pending = post(targetPort, proxyPort, stream, abort.signal);
+      // Both handlers are attached before waiting for receipt; outcome never rejects.
+      outcome = pending.then(() => { settled = true; }, () => { settled = true; });
+      expect(await settlesWithin(interimAtClient)).toBe(true);
+      // Complete client receipt followed by a native checkpoint drains the current parser's
+      // buffered-header promise continuations before another body chunk becomes available.
+      await new Promise<void>(resolve => { setImmediate(resolve); });
+      expect(settled).toBe(false);
+      expect(cancelled).toBe(false);
+      expect(received).not.toContain("socks");
+      expect(received).not.toContain("0\r\n\r\n");
+      bodyController.enqueue(encoder.encode("socks"));
+      bodyController.close();
+
+      expect(await settlesWithin(outcome)).toBe(true);
+      const response = await pending;
+
+      /*
+       * The final answer reaching the caller is the receipt that those heads were consumed rather
+       * than merely delivered: 200 with its body can only be read by something that read past
+       * both of them.
+       */
+      expect(response.status).toBe(200);
+      const responseText = response.text();
+      expect(await settlesWithin(responseText)).toBe(true);
+      expect(await responseText).toBe("posted");
+
+      // Upload continuity, measured against the moment the interim answers were sent rather than
+      // against the whole exchange.
+      expect(receivedWhenInformed).toBeDefined();
+      const afterInterim = received.slice(receivedWhenInformed ?? 0);
+      expect(received).toContain("hello ");
+      expect(afterInterim).toContain("socks");
+      expect(afterInterim).toContain("0\r\n\r\n");
+
+      // The exchange ends by itself, before anything here tears a peer down.
+      expect(await settlesWithin(peerClosed)).toBe(true);
+    } finally {
+      Socket.prototype.setTimeout = originalSetTimeout;
+      transportSocket?.removeListener("data", observeInterim);
+      try {
+        abort.abort(new Error("informational fixture teardown"));
+      } finally {
+        await Promise.all([close(proxy), close(target)]);
+        if (outcome) await settlesWithin(outcome);
+      }
+    }
+  });
+
+  test("the response timeout fires while a body read is pending and cleans up after itself", async () => {
+    /*
+     * The branch that matters here runs while the upload is parked on a chunk the caller will
+     * never produce. Waiting out the real budget would make this a three-minute test, so the timer
+     * is observed as the transport arms it and then fired deliberately once the peer has witnessed
+     * the stall. What runs is the transport's own callback, not a substitute for it.
+     */
+    const { server: target, uploading } = uploadObserver();
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    const body = stallingBody(new TextEncoder().encode("first chunk"));
+    const armed: number[] = [];
+    let responseTimeoutSocket: Socket | undefined;
+    let fireResponseTimeout: (() => void) | undefined;
+    const originalSetTimeout = Socket.prototype.setTimeout;
+    try {
+      Socket.prototype.setTimeout = function patched(this: Socket, ms: number, callback?: () => void) {
+        armed.push(ms);
+        if (ms === RESPONSE_TIMEOUT_MS) {
+          responseTimeoutSocket = this;
+          fireResponseTimeout = callback;
+        }
+        return originalSetTimeout.call(this, ms, callback as never);
+      } as typeof Socket.prototype.setTimeout;
+
+      const pending = post(targetPort, proxyPort, body.stream);
+      const outcome = pending.then(() => "resolved" as const, (error: unknown) => error);
+
+      // Parked on a read the caller's stream will never fulfil, which is the state this timeout
+      // exists for.
+      expect(await settlesWithin(uploading)).toBe(true);
+      expect(armed).toContain(RESPONSE_TIMEOUT_MS);
+      expect(responseTimeoutSocket).toBeDefined();
+      expect(fireResponseTimeout).toBeDefined();
+
+      // The transport's own callback, invoked where its timer would have invoked it. Nothing here
+      // substitutes for what it does.
+      fireResponseTimeout?.();
+
+      // Settlement: the caller is answered rather than left pending.
+      expect(await settlesWithin(outcome)).toBe(true);
+      const error = await outcome;
+      expect(error).toBeInstanceOf(Error);
+      expect((error as Error).message).toContain("timed out");
+      // Reader cleanup: the caller's stream is released rather than held open by a dead exchange.
+      expect(await settlesWithin(body.cancelled)).toBe(true);
+      // Socket cleanup: the tunnel this exchange owned is gone.
+      expect(responseTimeoutSocket?.destroyed).toBe(true);
+    } finally {
+      Socket.prototype.setTimeout = originalSetTimeout;
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+});
diff --git a/tests/lib/spend-ceiling-enforcement.test.ts b/tests/lib/spend-ceiling-enforcement.test.ts
index 1e8b988118d..91acd121efe 100644
--- a/tests/lib/spend-ceiling-enforcement.test.ts
+++ b/tests/lib/spend-ceiling-enforcement.test.ts
@@ -42,6 +42,7 @@ import {
 import { workflowDecisionRefusalResponse, workflowRefusalResponse } from "../../src/server/workflow-refusal";
 import { getConfigDir } from "../../src/config/paths";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireSpendLedgerOwner, type SpendLedgerOwnerLease } from "../../src/lib/spend-ledger-owner";
 
 const memoryJournal = (): SpendJournal & { lines: string[] } => {
   const lines: string[] = [];
@@ -80,17 +81,21 @@ const watched = (inner: SpendReservationLedger, asked: string[]): SpendReservati
 
 let home = "";
 let previousHome: string | undefined;
+let owner: SpendLedgerOwnerLease | null = null;
 
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
   home = mkdtempSync(join(tmpdir(), "ocx-spend-ceiling-"));
   process.env.OPENCODEX_HOME = home;
+  owner = acquireSpendLedgerOwner();
   resetSharedSpendLedgerForTest();
   resetWorkflowBudgetsForTest();
 });
 
 afterEach(() => {
   resetSharedSpendLedgerForTest();
+  owner?.release();
+  owner = null;
   if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = previousHome;
   removeTreeWithRetry(home);
diff --git a/tests/lib/spend-ledger-file-journal.test.ts b/tests/lib/spend-ledger-file-journal.test.ts
index f2c10952fd0..ea45233c3a0 100644
--- a/tests/lib/spend-ledger-file-journal.test.ts
+++ b/tests/lib/spend-ledger-file-journal.test.ts
@@ -1,22 +1,134 @@
-import { describe, expect, test } from "bun:test";
-import { chmodSync, mkdtempSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { afterEach, describe, expect, test } from "bun:test";
+import { appendFileSync, chmodSync, existsSync, mkdtempSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import {
-  createFileSpendJournal,
+  createOwnedFileSpendJournal,
   loadOrCreateSpendLedgerSalt,
+  SPEND_LEDGER_JOURNAL_FILENAME,
+  SPEND_LEDGER_SALT_FILENAME,
+  resetSharedSpendLedgerForTest,
+  setSpendJournalFaultForTests,
 } from "../../src/lib/spend-reservation-ledger";
+import {
+  acquireSpendLedgerOwner,
+  mintSpendLedgerStorage,
+  SpendLedgerOwnerError,
+  type SpendLedgerOwnerLease,
+} from "../../src/lib/spend-ledger-owner";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /** POSIX mode bits do not describe a Windows ACL, where hardenSecretPath does the work. */
 const posixModes = process.platform !== "win32";
 const modeOf = (path: string): number => statSync(path).mode & 0o777;
 const line = (send: string): string => JSON.stringify({ v: 1, kind: "lost", send, at: 1 });
 
+const homes: string[] = [];
+const leases: SpendLedgerOwnerLease[] = [];
+let previousHome: string | undefined;
+
+/**
+ * A real lease over a throwaway state directory.
+ *
+ * These cases cover the production persistence, hardening and compaction paths, so they use the
+ * production entrypoints rather than a stand-in: storage is minted by the owner module from the
+ * directory it owns, which is the only way to obtain it.
+ */
+function ownedHome(prefix: string): string {
+  const home = mkdtempSync(join(tmpdir(), prefix));
+  homes.push(home);
+  previousHome ??= process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = home;
+  resetSharedSpendLedgerForTest();
+  leases.push(acquireSpendLedgerOwner());
+  return home;
+}
+
+afterEach(() => {
+  setSpendJournalFaultForTests(undefined);
+  for (const lease of leases.splice(0)) {
+    try { lease.release(); } catch { /* a failed release must not mask the case's result */ }
+  }
+  resetSharedSpendLedgerForTest();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  previousHome = undefined;
+  for (const home of homes.splice(0)) removeTreeWithRetry(home);
+});
+
 describe("spend ledger file journal", () => {
+  test.skipIf(!posixModes || process.getuid?.() === 0)(
+    "an entry that cannot be read is refused rather than reported absent", () => {
+    const dir = ownedHome("ocx-spend-journal-unreadable-");
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
+    journal.append(line("alias-one"));
+
+    const before = readdirSync(dir).sort();
+    // Deny traversal of the owned directory, so the entry's lstat fails with EACCES instead of
+    // ENOENT. Answering "absent" for that is what this pins: the file-safety assertion is
+    // skipped for an entry that reads as missing, so a journal nobody can inspect would have
+    // been appended to as though the slot were empty.
+    chmodSync(dir, 0o000);
+    try {
+      // Refused, and refused in the module's own vocabulary rather than with the errno and path
+      // of a state file. WHICH gate notices first is platform-dependent: where the directory
+      // cannot be traversed at all, the ownership check cannot resolve it before the entry is
+      // ever inspected. Both are the same refusal, so the type and the absence of a leaked path
+      // are what this pins; the seam-driven case below pins the exact message everywhere.
+      let refusal: unknown;
+      try { journal.read(); } catch (error) { refusal = error; }
+      expect(refusal).toBeInstanceOf(SpendLedgerOwnerError);
+      expect((refusal as Error).message).not.toContain(dir);
+    } finally {
+      chmodSync(dir, 0o700);
+    }
+    // Nothing was created or reset while the directory was unreadable.
+    expect(readdirSync(dir).sort()).toEqual(before);
+    // The same entry is readable again once the directory is, so the refusal was about the
+    // failed inspection and not about the journal's own contents.
+    expect(journal.read()).toHaveLength(1);
+  });
+
+  test("a genuinely absent entry still reads as empty", () => {
+    ownedHome("ocx-spend-journal-absent-");
+    // The ENOENT control for the case above: absent is still absent, and only absent is.
+    expect(createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME)).read()).toEqual([]);
+  });
+
+  test("a journal whose entry cannot be inspected refuses on every platform", () => {
+    const dir = ownedHome("ocx-spend-journal-stat-fault-");
+    const journalPath = join(dir, SPEND_LEDGER_JOURNAL_FILENAME);
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
+    journal.append(line("alias-one"));
+    const original = readFileSync(journalPath, "utf8");
+    const before = readdirSync(dir).sort();
+
+    // The chmod case above is real but POSIX-only and meaningless as root. This one is the same
+    // contract proved everywhere: only the JOURNAL's own inspection fails, the salt stays
+    // readable, and every other filesystem step is real.
+    for (const code of ["EACCES", "EIO"] as const) {
+      // Matched by entry name, not by full path: the owned home is the REAL path of the
+      // directory, and on macOS the temp root is a symlink, so an equality check against the
+      // path this case built never fired and the fault silently did nothing.
+      setSpendJournalFaultForTests((step, target) => {
+        if (step !== "stat" || basename(target) !== SPEND_LEDGER_JOURNAL_FILENAME) return;
+        throw Object.assign(new Error(`injected ${code}`), { code });
+      });
+      expect(() => journal.read()).toThrowError(SpendLedgerOwnerError);
+      expect(() => journal.append(line("alias-two"))).toThrow(/could not be inspected safely/);
+      setSpendJournalFaultForTests(undefined);
+    }
+
+    // Refused, not reset: no truncation, no new entries, and the salt is still mintable.
+    expect(readFileSync(journalPath, "utf8")).toBe(original);
+    expect(readdirSync(dir).sort()).toEqual(before);
+    expect(loadOrCreateSpendLedgerSalt(mintSpendLedgerStorage(SPEND_LEDGER_SALT_FILENAME))).toMatch(/^[0-9a-f]{32,}$/);
+  });
+
   test.skipIf(!posixModes)("a journal that already exists is re-hardened, not trusted", () => {
-    const dir = mkdtempSync(join(tmpdir(), "ocx-spend-journal-"));
-    const path = join(dir, "spend-ledger.jsonl");
-    const journal = createFileSpendJournal(path);
+    const dir = ownedHome("ocx-spend-journal-");
+    const path = join(dir, SPEND_LEDGER_JOURNAL_FILENAME);
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
 
     journal.append(line("alias-one"));
     expect(modeOf(path)).toBe(0o600);
@@ -34,9 +146,9 @@ describe("spend ledger file journal", () => {
   });
 
   test("compaction replaces the journal atomically and leaves no temp behind", () => {
-    const dir = mkdtempSync(join(tmpdir(), "ocx-spend-compact-"));
-    const path = join(dir, "spend-ledger.jsonl");
-    const journal = createFileSpendJournal(path);
+    const dir = ownedHome("ocx-spend-compact-");
+    const path = join(dir, SPEND_LEDGER_JOURNAL_FILENAME);
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
     journal.append(line("alias-one"));
     journal.append(line("alias-two"));
 
@@ -46,20 +158,98 @@ describe("spend ledger file journal", () => {
 
     expect(readFileSync(path, "utf8")).toBe(line("checkpoint-stand-in") + "\n");
     expect(journal.read()).toHaveLength(1);
-    // The temp file is renamed over the journal, never left in the home directory.
-    expect(readdirSync(dir)).toEqual(["spend-ledger.jsonl"]);
+    // The temp file is renamed over the journal, never left in the home directory. Asserted as
+    // the absence of a compaction temp rather than an exact listing, because the owned state
+    // directory also holds the lease database this case had to acquire to write at all.
+    expect(readdirSync(dir).filter(name => name.includes(".compact-"))).toEqual([]);
+    expect(readdirSync(dir)).toContain(SPEND_LEDGER_JOURNAL_FILENAME);
     if (posixModes) expect(modeOf(path)).toBe(0o600);
   });
 
+  /**
+   * Compaction failure paths, driven through the journal's own fault seam.
+   *
+   * The temp name carries random bytes, so a failure that leaves it behind is not one stale file
+   * but one per attempt. Each case below drives the same compaction repeatedly and asserts the
+   * directory holds no compaction residue and the original journal is untouched.
+   */
+  for (const step of ["validate", "harden", "rename"] as const) {
+    test(`a compaction that fails at ${step} leaves no temp behind`, () => {
+      const dir = ownedHome(`ocx-spend-compact-${step}-`);
+      const path = join(dir, SPEND_LEDGER_JOURNAL_FILENAME);
+      const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
+      journal.append(line("alias-one"));
+      const original = readFileSync(path, "utf8");
+
+      setSpendJournalFaultForTests((actual) => {
+        if (actual === step) throw new Error(`fault injected at ${step}`);
+      });
+      for (let attempt = 0; attempt < 3; attempt += 1) {
+        expect(() => journal.rewrite?.call(journal, [line("checkpoint")])).toThrow(/fault injected/);
+      }
+      setSpendJournalFaultForTests(undefined);
+
+      expect(readdirSync(dir).filter(name => name.includes(".compact-"))).toEqual([]);
+      expect(readFileSync(path, "utf8")).toBe(original);
+    });
+  }
+
+  test("a compaction whose write stops partway leaves neither residue nor a truncated journal", () => {
+    const dir = ownedHome("ocx-spend-compact-partial-");
+    const path = join(dir, SPEND_LEDGER_JOURNAL_FILENAME);
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
+    journal.append(line("alias-one"));
+    const original = readFileSync(path, "utf8");
+
+    // The entry already exists by the time the write runs, which is the case the exclusive
+    // create exists to make unambiguous. A real prefix goes in first, so this is a SHORT write
+    // rather than a failure before any byte landed: the residue that must be cleaned is a file
+    // with content in it.
+    setSpendJournalFaultForTests((actual, temp) => {
+      if (actual !== "write") return;
+      expect(existsSync(temp)).toBe(true);
+      appendFileSync(temp, line("half-written").slice(0, 12), { encoding: "utf8" });
+      expect(readFileSync(temp, "utf8").length).toBeGreaterThan(0);
+      throw Object.assign(new Error("no space left on device"), { code: "ENOSPC" });
+    });
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      expect(() => journal.rewrite?.call(journal, [line("checkpoint")])).toThrow(/no space left/);
+    }
+    setSpendJournalFaultForTests(undefined);
+
+    expect(readdirSync(dir).filter(name => name.includes(".compact-"))).toEqual([]);
+    expect(readFileSync(path, "utf8")).toBe(original);
+  });
+
+  test("a compaction candidate that already exists is left exactly as it was", () => {
+    const dir = ownedHome("ocx-spend-compact-eexist-");
+    const journal = createOwnedFileSpendJournal(mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME));
+    journal.append(line("alias-one"));
+
+    // Occupy the exact candidate name before the exclusive create reaches it. The create then
+    // fails EEXIST, and because this call never created the entry it must not remove it.
+    let occupied: string | undefined;
+    setSpendJournalFaultForTests((actual, temp) => {
+      if (actual !== "create" || occupied !== undefined) return;
+      occupied = temp;
+      writeFileSync(temp, "not ours\n", { encoding: "utf8", mode: 0o600, flag: "wx" });
+    });
+    expect(() => journal.rewrite?.call(journal, [line("checkpoint")])).toThrow();
+    setSpendJournalFaultForTests(undefined);
+
+    expect(occupied).toBeDefined();
+    expect(readFileSync(occupied!, "utf8")).toBe("not ours\n");
+  });
+
   test("the alias salt is minted once and reused, so replay still matches live requests", () => {
-    const dir = mkdtempSync(join(tmpdir(), "ocx-spend-salt-"));
-    const path = join(dir, "spend-ledger.salt");
+    const dir = ownedHome("ocx-spend-salt-");
+    const path = join(dir, SPEND_LEDGER_SALT_FILENAME);
 
-    const minted = loadOrCreateSpendLedgerSalt(path);
+    const minted = loadOrCreateSpendLedgerSalt(mintSpendLedgerStorage(SPEND_LEDGER_SALT_FILENAME));
     expect(minted).toMatch(/^[0-9a-f]{64}$/);
     // Stability is the whole contract: a salt that changed per process would alias the same
     // root id differently after a restart and hand every scope a fresh allowance.
-    expect(loadOrCreateSpendLedgerSalt(path)).toBe(minted);
+    expect(loadOrCreateSpendLedgerSalt(mintSpendLedgerStorage(SPEND_LEDGER_SALT_FILENAME))).toBe(minted);
     if (posixModes) expect(modeOf(path)).toBe(0o600);
   });
 });
diff --git a/tests/lib/spend-ledger-owner.test.ts b/tests/lib/spend-ledger-owner.test.ts
new file mode 100644
index 00000000000..25584deb8bb
--- /dev/null
+++ b/tests/lib/spend-ledger-owner.test.ts
@@ -0,0 +1,532 @@
+/** Cross-process ownership for the process-wide spend journal (#5123). */
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  acquireSpendLedgerOwner,
+  SPEND_LEDGER_OWNER_FILENAME,
+  mintSpendLedgerStorage,
+  SPEND_LEDGER_RESTART_PARENT_ENV,
+  SpendLedgerOwnerError,
+  spendLedgerRestartEnvironment,
+  spendLedgerOwnerSnapshot,
+  type SpendLedgerOwnerLease,
+} from "../../src/lib/spend-ledger-owner";
+import {
+  SPEND_LEDGER_JOURNAL_FILENAME,
+  SPEND_LEDGER_SALT_FILENAME,
+  configureSharedSpendLedger,
+  createOwnedFileSpendJournal,
+  loadOrCreateSpendLedgerSalt,
+  resetSharedSpendLedgerForTest,
+  sharedSpendLedger,
+  spendLedgerDiagnosticsSnapshot,
+  type SpendReservationPolicy,
+} from "../../src/lib/spend-reservation-ledger";
+import { helperPath } from "../helpers/repo-root";
+import { CONFIG_OWNER_FILE, CONFIG_UNINSTALL_MANIFEST, removeOwnedConfigState } from "../../src/lib/config-ownership";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { INTERNAL_DEADLINE_MS, SPAWN_BUDGET_MS } from "../helpers/test-budget";
+
+const childPath = helperPath("spend-ledger-owner-child.ts");
+/** The shape the ledger actually takes: scopes plus the two token figures it books against. */
+const reserveRequest = (sendId: string) => ({
+  sendId,
+  scopes: { rootId: "r1" },
+  inputTokens: 1,
+  outputCeilingTokens: 1,
+});
+let root = "";
+let home = "";
+let previousHome: string | undefined;
+const children = new Set<ReturnType<typeof Bun.spawn>>();
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "ocx-spend-owner-"));
+  home = join(root, "state-a");
+  previousHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = home;
+  resetSharedSpendLedgerForTest();
+});
+
+afterEach(async () => {
+  for (const child of children) {
+    if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+    await child.exited;
+  }
+  children.clear();
+  resetSharedSpendLedgerForTest();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(root);
+});
+
+function spawnHolder(
+  targetHome: string,
+  mode: "observe" | "enforced",
+  suffix: string,
+  extraEnv: Record<string, string> = {},
+) {
+  const holdMarker = join(root, `held-${suffix}`);
+  const releaseMarker = join(root, `release-${suffix}`);
+  const child = Bun.spawn([process.execPath, childPath], {
+    env: {
+      ...process.env,
+      ...extraEnv,
+      OPENCODEX_HOME: targetHome,
+      OCX_SPEND_OWNER_CHILD: JSON.stringify({ holdMarker, releaseMarker, mode }),
+    },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  children.add(child);
+  return { child, holdMarker, releaseMarker };
+}
+
+async function waitForMarker(path: string, child: ReturnType<typeof Bun.spawn>): Promise<void> {
+  const deadline = Date.now() + INTERNAL_DEADLINE_MS;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return;
+    if (child.exitCode !== null || child.signalCode !== null) {
+      throw new Error(`owner child exited before holding: ${await new Response(child.stderr).text()}`);
+    }
+    await Bun.sleep(10);
+  }
+  throw new Error("timed out waiting for spend-ledger owner child");
+}
+
+async function childResult(child: ReturnType<typeof Bun.spawn>) {
+  const [stdout] = await Promise.all([new Response(child.stdout).text(), child.exited]);
+  children.delete(child);
+  return JSON.parse(stdout.trim().split("\n").filter(Boolean).at(-1) ?? "{}") as {
+    status: string;
+    code?: string;
+    message?: string;
+  };
+}
+
+function busyError(): SpendLedgerOwnerError {
+  try { acquireSpendLedgerOwner(); }
+  catch (error) {
+    if (error instanceof SpendLedgerOwnerError) return error;
+    throw error;
+  }
+  throw new Error("expected spend-ledger ownership refusal");
+}
+
+/**
+ * The contender's own spend configuration, in this process, before it tries to acquire.
+ *
+ * Recording a policy touches no journal while this process owns nothing, so this is exactly the
+ * state a second instance is in when it starts: configured one way or the other, and not yet a
+ * writer. Without it the matrix below named a contender mode it never activated.
+ */
+function contenderPolicy(mode: "observe" | "enforced"): SpendReservationPolicy {
+  return {
+    root: mode === "enforced" ? { maxTokens: 1_000 } : {},
+    identity: {},
+    pool: {},
+    retentionMs: 60_000,
+  };
+}
+
+describe("real process ownership", () => {
+  test("only a parent-exit restart environment carries the handoff marker", () => {
+    const source = { OCX_SPEND_LEDGER_RESTART_PARENT_PID: "stale", KEEP_ME: "yes" };
+    expect(spendLedgerRestartEnvironment(source)).toEqual({ KEEP_ME: "yes" });
+    expect(spendLedgerRestartEnvironment(source, 4242)).toEqual({
+      KEEP_ME: "yes",
+      OCX_SPEND_LEDGER_RESTART_PARENT_PID: "4242",
+    });
+  });
+
+  // All four combinations, not the two mixed ones. The rule under test is that ownership does
+  // not depend on either side's ceiling, so a matrix missing observe/observe and
+  // enforced/enforced was not testing the claim its names made.
+  for (const [holderMode, contenderMode] of [
+    ["observe", "observe"],
+    ["observe", "enforced"],
+    ["enforced", "observe"],
+    ["enforced", "enforced"],
+  ] as const) {
+    test(`${holderMode} and ${contenderMode} configurations contend identically`, async () => {
+      const holder = spawnHolder(home, holderMode, `${holderMode}-${contenderMode}`);
+      await waitForMarker(holder.holdMarker, holder.child);
+      configureSharedSpendLedger(contenderPolicy(contenderMode));
+      const refusal = busyError();
+      expect(refusal.code).toBe("SPEND_LEDGER_OWNER_BUSY");
+      writeFileSync(holder.releaseMarker, "release");
+      expect((await childResult(holder.child)).status).toBe("acquired");
+    }, SPAWN_BUDGET_MS);
+  }
+
+  test("turning a ceiling on after an observe-only start does not change contention", async () => {
+    const holder = spawnHolder(home, "observe", "ceiling-transition");
+    await waitForMarker(holder.holdMarker, holder.child);
+
+    configureSharedSpendLedger(contenderPolicy("observe"));
+    expect(busyError().code).toBe("SPEND_LEDGER_OWNER_BUSY");
+
+    // The operator enables a ceiling while another process still owns the directory. A policy
+    // is a recorded value until a ledger exists, so this changes what WOULD be refused, never
+    // who may write, and the ownership refusal is identical either side of the transition.
+    configureSharedSpendLedger(contenderPolicy("enforced"));
+    expect(busyError().code).toBe("SPEND_LEDGER_OWNER_BUSY");
+
+    writeFileSync(holder.releaseMarker, "release");
+    expect((await childResult(holder.child)).status).toBe("acquired");
+  }, SPAWN_BUDGET_MS);
+
+  test("independent state directories are independent", async () => {
+    const holder = spawnHolder(home, "observe", "independent");
+    await waitForMarker(holder.holdMarker, holder.child);
+    const other = acquireSpendLedgerOwner(join(root, "state-b"));
+    expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+    other.release();
+    writeFileSync(holder.releaseMarker, "release");
+    await childResult(holder.child);
+  }, SPAWN_BUDGET_MS);
+
+  test("graceful release lets the next process acquire", async () => {
+    const holder = spawnHolder(home, "observe", "graceful");
+    await waitForMarker(holder.holdMarker, holder.child);
+    writeFileSync(holder.releaseMarker, "release");
+    await childResult(holder.child);
+    const next = acquireSpendLedgerOwner();
+    next.release();
+  }, SPAWN_BUDGET_MS);
+
+  test("a marked restart child waits for the parent lease while an ordinary sibling fails immediately", async () => {
+    const parent = acquireSpendLedgerOwner();
+    const ordinary = spawnHolder(home, "observe", "ordinary-sibling");
+    expect((await childResult(ordinary.child)).code).toBe("SPEND_LEDGER_OWNER_BUSY");
+
+    const restart = spawnHolder(home, "observe", "restart-child", {
+      [SPEND_LEDGER_RESTART_PARENT_ENV]: String(process.pid),
+    });
+    await Bun.sleep(25);
+    expect(restart.child.exitCode).toBeNull();
+    parent.release();
+    await waitForMarker(restart.holdMarker, restart.child);
+    writeFileSync(restart.releaseMarker, "release");
+    expect((await childResult(restart.child)).status).toBe("acquired");
+  }, SPAWN_BUDGET_MS);
+
+  test("an abruptly killed owner is reacquirable without replacing the lock file", async () => {
+    const holder = spawnHolder(home, "observe", "killed");
+    await waitForMarker(holder.holdMarker, holder.child);
+    const lockPath = join(home, SPEND_LEDGER_OWNER_FILENAME);
+    const journalPath = join(home, SPEND_LEDGER_JOURNAL_FILENAME);
+    const saltPath = join(home, SPEND_LEDGER_SALT_FILENAME);
+    const before = [lockPath, journalPath, saltPath].map(path => ({ path, stat: statSync(path) }));
+    holder.child.kill("SIGKILL");
+    await holder.child.exited;
+    children.delete(holder.child);
+    const next = acquireSpendLedgerOwner();
+    for (const entry of before) {
+      const after = statSync(entry.path);
+      expect(after.size).toBe(entry.stat.size);
+      if (process.platform !== "win32") expect(after.ino).toBe(entry.stat.ino);
+    }
+    next.release();
+  }, SPAWN_BUDGET_MS);
+});
+
+describe("in-process references and privacy", () => {
+  let leases: SpendLedgerOwnerLease[] = [];
+  afterEach(() => {
+    for (const lease of leases.splice(0).reverse()) lease.release();
+  });
+
+  test("two leases share ownership and one release does not free it", async () => {
+    const first = acquireSpendLedgerOwner();
+    const second = acquireSpendLedgerOwner();
+    leases.push(first, second);
+    first.release();
+    const holder = spawnHolder(home, "observe", "references");
+    expect((await childResult(holder.child)).code).toBe("SPEND_LEDGER_OWNER_BUSY");
+    second.release();
+    expect(spendLedgerOwnerSnapshot().ownership).toBe("unheld");
+  }, SPAWN_BUDGET_MS);
+
+  test("one process refuses a second different state directory", () => {
+    leases.push(acquireSpendLedgerOwner());
+    let failure: unknown;
+    try { acquireSpendLedgerOwner(join(root, "state-b")); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_HOME_CONFLICT");
+  });
+
+  test("releasing the final lease frees the process to own a different state directory", () => {
+    // The refusal above is about two homes owned at once. Once ownership is gone the singleton
+    // has no directory to belong to, so it is discarded with the lease: the next home builds its
+    // own ledger by replaying its own journal. Keeping the old binding instead would strand a
+    // process that legitimately serves one home and then another.
+    const first = acquireSpendLedgerOwner();
+    sharedSpendLedger();
+    first.release();
+    expect(spendLedgerDiagnosticsSnapshot()).toMatchObject({ ownership: "unheld", initialized: false });
+
+    process.env.OPENCODEX_HOME = join(root, "state-b");
+    const second = acquireSpendLedgerOwner();
+    leases.push(second);
+    sharedSpendLedger();
+    expect(spendLedgerDiagnosticsSnapshot()).toMatchObject({ ownership: "held", initialized: true });
+    expect(existsSync(join(root, "state-b", SPEND_LEDGER_OWNER_FILENAME))).toBe(true);
+  });
+
+  test("a retained ledger stays refused after the same home is owned again", () => {
+    // The dangerous case is not a different directory, it is the same one owned again. The
+    // retained handle carries totals from before the gap, and another writer may have appended
+    // to the journal while nobody held the lock.
+    const first = acquireSpendLedgerOwner();
+    const retained = sharedSpendLedger();
+    first.release();
+
+    const second = acquireSpendLedgerOwner();
+    leases.push(second);
+    let failure: unknown;
+    try { retained.snapshot("root", "r1"); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_NOT_HELD");
+
+    let mutation: unknown;
+    try { retained.reserve(reserveRequest("s1")); } catch (error) { mutation = error; }
+    expect(mutation).toBeInstanceOf(SpendLedgerOwnerError);
+
+    // Reads are refused for the same reason writes are: the figures describe a journal this
+    // handle no longer owns.
+    for (const read of [
+      () => retained.knows("s1"),
+      () => retained.exhausted("root", "r1"),
+      () => retained.policy,
+      () => retained.degraded,
+      () => retained.persistFailures,
+      () => retained.corruptRecords,
+    ]) {
+      expect(read).toThrow(SpendLedgerOwnerError);
+    }
+
+    // A handle taken under the new ownership works and sees the journal as it is now.
+    expect(() => sharedSpendLedger().snapshot("root", "r1")).not.toThrow();
+  });
+
+  test("storage this module did not mint is not accepted as proof", () => {
+    // Three ways to try: a bare look-alike, and - the one a marker on the object cannot stop -
+    // a spread of a real token with the path redirected and the guard replaced. Identity is the
+    // only thing a copy cannot reproduce.
+    const lease = acquireSpendLedgerOwner();
+    leases.push(lease);
+    const elsewhere = join(root, "elsewhere.jsonl");
+    const minted = mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME);
+    const forgeries = [
+      {} as unknown as typeof minted,
+      { path: elsewhere, assert(): void { /* proves nothing */ } } as unknown as typeof minted,
+      { ...minted, path: elsewhere, assert(): void { /* proves nothing */ } } as unknown as typeof minted,
+    ];
+
+    for (const forged of forgeries) {
+      expect(() => createOwnedFileSpendJournal(forged)).toThrow(SpendLedgerOwnerError);
+      expect(() => loadOrCreateSpendLedgerSalt(forged)).toThrow(SpendLedgerOwnerError);
+    }
+    expect(existsSync(elsewhere)).toBe(false);
+
+    // A token this module did mint keeps working, so the refusal is about identity and not
+    // about refusing everything.
+    expect(() => createOwnedFileSpendJournal(minted)).not.toThrow();
+  });
+
+  test("a minted token stops working once its ownership ends", () => {
+    const first = acquireSpendLedgerOwner();
+    const minted = mintSpendLedgerStorage(SPEND_LEDGER_JOURNAL_FILENAME);
+    const journal = createOwnedFileSpendJournal(minted);
+    first.release();
+
+    const second = acquireSpendLedgerOwner();
+    leases.push(second);
+    expect(() => journal.append("{}")).toThrow(SpendLedgerOwnerError);
+    expect(() => journal.read()).toThrow(SpendLedgerOwnerError);
+  });
+
+  test("minting refuses a name that is not a plain file in the owned directory", () => {
+    const lease = acquireSpendLedgerOwner();
+    leases.push(lease);
+    for (const name of ["../escape.jsonl", "nested/child.jsonl", ".."]) {
+      expect(() => mintSpendLedgerStorage(name)).toThrow(SpendLedgerOwnerError);
+    }
+  });
+
+  test("a dangling journal symlink is refused rather than followed", () => {
+    const lease = acquireSpendLedgerOwner();
+    leases.push(lease);
+    const journal = join(home, SPEND_LEDGER_JOURNAL_FILENAME);
+    const target = join(root, "elsewhere.jsonl");
+    symlinkSync(target, journal);
+
+    let failure: unknown;
+    try { sharedSpendLedger().reserve(reserveRequest("s1")); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    // The point of the case: the link's target must not have been created by following it.
+    expect(existsSync(target)).toBe(false);
+  });
+
+  test("a retained shared ledger refuses mutation after its final lease releases", async () => {
+    const lease = acquireSpendLedgerOwner();
+    const retained = sharedSpendLedger();
+    lease.release();
+    const holder = spawnHolder(home, "observe", "retained-handle");
+    await waitForMarker(holder.holdMarker, holder.child);
+    let failure: unknown;
+    try {
+      retained.reserve({
+        sendId: "retained",
+        scopes: { rootId: "retained-root" },
+        inputTokens: 1,
+        outputCeilingTokens: 1,
+      });
+    } catch (error) {
+      failure = error;
+    }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_NOT_HELD");
+    writeFileSync(holder.releaseMarker, "release");
+    await childResult(holder.child);
+  }, SPAWN_BUDGET_MS);
+
+  test("busy refusal contains no private identity or filesystem data", async () => {
+    const holder = spawnHolder(home, "observe", "privacy");
+    await waitForMarker(holder.holdMarker, holder.child);
+    const refusal = busyError();
+    const text = `${refusal.name} ${refusal.code} ${refusal.message}`.toLowerCase();
+    for (const secret of [home.toLowerCase(), String(process.pid), "spend-ledger.jsonl", "child-root", "account", "scope", "request"]) {
+      expect(text).not.toContain(secret);
+    }
+    writeFileSync(holder.releaseMarker, "release");
+    await childResult(holder.child);
+  }, SPAWN_BUDGET_MS);
+
+  test("diagnostics do not construct or create ledger files", () => {
+    leases.push(acquireSpendLedgerOwner());
+    expect(spendLedgerDiagnosticsSnapshot()).toEqual({
+      ownership: "held",
+      initialized: false,
+      configured: false,
+      degraded: false,
+      persistFailures: 0,
+      corruptRecords: 0,
+    });
+    expect(existsSync(join(home, SPEND_LEDGER_JOURNAL_FILENAME))).toBe(false);
+    expect(existsSync(join(home, SPEND_LEDGER_SALT_FILENAME))).toBe(false);
+  });
+});
+
+describe("backing file identity", () => {
+  test("a fresh state directory is claimed before its database exists, so it stays removable", () => {
+    // Config ownership refuses to claim a directory that already has contents, and the owner
+    // database lives inside that directory. Creating the database first therefore left a fresh
+    // home with no owner marker and no manifest at all, so nothing recorded the database or its
+    // sidecars and a later uninstall could not remove them.
+    expect(existsSync(home)).toBe(false);
+    acquireSpendLedgerOwner().release();
+
+    expect(existsSync(join(home, CONFIG_OWNER_FILE))).toBe(true);
+    const manifest = JSON.parse(
+      readFileSync(join(home, CONFIG_UNINSTALL_MANIFEST), "utf8"),
+    ) as { paths: string[] };
+    expect(manifest.paths).toContain(SPEND_LEDGER_OWNER_FILENAME);
+    for (const sidecar of ["-journal", "-wal", "-shm"]) {
+      expect(manifest.paths).toContain(`${SPEND_LEDGER_OWNER_FILENAME}${sidecar}`);
+    }
+
+    // The point of recording them: an uninstall can now take the whole directory back.
+    expect(removeOwnedConfigState(home).status).toBe("removed");
+    expect(existsSync(home)).toBe(false);
+  });
+
+  const expectBackingAliasesRefused = (kind: "hardlink" | "symlink"): void => {
+    const first = acquireSpendLedgerOwner(home);
+    sharedSpendLedger().reserve({
+      sendId: "first",
+      scopes: { rootId: "first-root" },
+      inputTokens: 1,
+      outputCeilingTokens: 1,
+    });
+    first.release();
+    resetSharedSpendLedgerForTest();
+
+    for (const filename of [SPEND_LEDGER_JOURNAL_FILENAME, SPEND_LEDGER_SALT_FILENAME]) {
+      const otherHome = join(root, `${kind}-${filename}`);
+      const prepared = acquireSpendLedgerOwner(otherHome);
+      prepared.release();
+      const source = join(home, filename);
+      const destination = join(otherHome, filename);
+      if (kind === "hardlink") linkSync(source, destination);
+      else symlinkSync(source, destination);
+      const owner = acquireSpendLedgerOwner(otherHome);
+      process.env.OPENCODEX_HOME = otherHome;
+      let failure: unknown;
+      try { sharedSpendLedger(); } catch (error) { failure = error; }
+      expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+      expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_UNAVAILABLE");
+      owner.release();
+      resetSharedSpendLedgerForTest();
+    }
+  };
+
+  test("hard-linked owner files fail closed", () => {
+    const linkedHome = join(root, "owner-hardlink");
+    mkdirSync(linkedHome, { recursive: true });
+    const target = join(root, "owner-hardlink-target");
+    writeFileSync(target, "owner");
+    linkSync(target, join(linkedHome, SPEND_LEDGER_OWNER_FILENAME));
+    let failure: unknown;
+    try { acquireSpendLedgerOwner(linkedHome); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_UNAVAILABLE");
+  });
+
+  test.skipIf(process.platform === "win32")("symbolically linked owner files fail closed", () => {
+    const linkedHome = join(root, "owner-symlink");
+    mkdirSync(linkedHome, { recursive: true });
+    const target = join(root, "owner-symlink-target");
+    writeFileSync(target, "owner");
+    symlinkSync(target, join(linkedHome, SPEND_LEDGER_OWNER_FILENAME));
+    let failure: unknown;
+    try { acquireSpendLedgerOwner(linkedHome); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_UNAVAILABLE");
+  });
+
+  test("invalid or unusable owner databases fail closed", () => {
+    const invalidHome = join(root, "owner-invalid");
+    mkdirSync(invalidHome, { recursive: true });
+    writeFileSync(join(invalidHome, SPEND_LEDGER_OWNER_FILENAME), "not sqlite");
+    let invalid: unknown;
+    try { acquireSpendLedgerOwner(invalidHome); } catch (error) { invalid = error; }
+    expect(invalid).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((invalid as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_UNAVAILABLE");
+
+    const unusableHome = join(root, "owner-unusable");
+    mkdirSync(join(unusableHome, SPEND_LEDGER_OWNER_FILENAME), { recursive: true });
+    let unusable: unknown;
+    try { acquireSpendLedgerOwner(unusableHome); } catch (error) { unusable = error; }
+    expect(unusable).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((unusable as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_UNAVAILABLE");
+  });
+
+  test("linked journals and salts cannot cross independent homes", () => {
+    expectBackingAliasesRefused("hardlink");
+  });
+
+  test.skipIf(process.platform === "win32")("symbolically linked journals and salts fail closed", () => {
+    expectBackingAliasesRefused("symlink");
+  });
+
+  test("the shared ledger requires a live lease", () => {
+    let failure: unknown;
+    try { sharedSpendLedger(); } catch (error) { failure = error; }
+    expect(failure).toBeInstanceOf(SpendLedgerOwnerError);
+    expect((failure as SpendLedgerOwnerError).code).toBe("SPEND_LEDGER_OWNER_NOT_HELD");
+  });
+});
diff --git a/tests/lib/transport-null-body.test.ts b/tests/lib/transport-null-body.test.ts
new file mode 100644
index 00000000000..7f1f4f00c00
--- /dev/null
+++ b/tests/lib/transport-null-body.test.ts
@@ -0,0 +1,210 @@
+import { describe, expect, test } from "bun:test";
+import { createConnection, createServer as createTcpServer, type AddressInfo, type Server as TcpServer, type Socket } from "node:net";
+import { pinnedHttpGet } from "../../src/lib/pinned-http";
+import { socks5Fetch } from "../../src/lib/socks5-fetch";
+
+const openSockets = new WeakMap<object, Set<Socket>>();
+
+async function listen(server: TcpServer): Promise<number> {
+  const sockets = new Set<Socket>();
+  openSockets.set(server, sockets);
+  server.on("connection", socket => {
+    sockets.add(socket);
+    socket.once("error", () => { /* a destroyed transport resets its peer */ });
+    socket.once("close", () => sockets.delete(socket));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  return (server.address() as AddressInfo).port;
+}
+
+async function close(server: TcpServer): Promise<void> {
+  for (const socket of openSockets.get(server) ?? []) socket.destroy();
+  await new Promise<void>(resolve => server.close(() => resolve()));
+}
+
+/** A no-auth SOCKS5 peer that connects to the loopback port the request names and pipes both ways. */
+function socksProxy(): TcpServer {
+  return createTcpServer(socket => {
+    let stage: "greeting" | "connect" = "greeting";
+    let buffer = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      buffer = Buffer.concat([buffer, chunk]);
+      while (true) {
+        if (stage === "greeting") {
+          if (buffer.length < 2 || buffer.length < 2 + buffer[1]!) return;
+          buffer = buffer.subarray(2 + buffer[1]!);
+          socket.write(Buffer.from([0x05, 0x00]));
+          stage = "connect";
+          continue;
+        }
+        if (buffer.length < 7) return;
+        const hostnameLength = buffer[4]!;
+        const requestLength = 7 + hostnameLength;
+        if (buffer.length < requestLength) return;
+        const port = buffer.readUInt16BE(5 + hostnameLength);
+        buffer = buffer.subarray(requestLength);
+        const target = createConnection({ host: "127.0.0.1", port }, () => {
+          socket.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 127, 0, 0, 1, 0, 1]));
+          socket.removeListener("data", onData);
+          if (buffer.length > 0) socket.unshift(buffer);
+          socket.pipe(target);
+          target.pipe(socket);
+        });
+        target.once("error", error => socket.destroy(error));
+        return;
+      }
+    };
+    socket.on("data", onData);
+    socket.once("error", () => { /* the proxy is torn down with its peers */ });
+  });
+}
+
+/**
+ * A peer that answers one fixed raw response head and then keeps the connection open.
+ *
+ * Keep-alive is the point of the fixture rather than an incidental detail: a transport that
+ * streams a null-body status settles only when the peer closes, so a peer that never closes is
+ * what separates "resolved with no body" from "resolved because the connection went away".
+ */
+function replyingTarget(reply: string, capture?: (socket: Socket) => void): TcpServer {
+  return createTcpServer(socket => {
+    capture?.(socket);
+    socket.once("error", () => { /* the caller may reset this peer */ });
+    let request = Buffer.alloc(0);
+    socket.on("data", chunk => {
+      request = Buffer.concat([request, chunk]);
+      if (!request.toString("latin1").includes("\r\n\r\n")) return;
+      socket.write(reply);
+    });
+  });
+}
+
+/**
+ * Wait for a socket to be observably destroyed, under a bounded deadline.
+ *
+ * The contract is that the transport releases the connection, not that it does so inside any
+ * particular window, so this waits for the state the contract promises and fails only when it
+ * never arrives. A fixed sleep would assert something about machine load instead.
+ */
+async function awaitDestroyed(socket: Socket | undefined, timeoutMs = 2_000): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (socket?.destroyed !== true && Date.now() < deadline) await Bun.sleep(5);
+  return socket?.destroyed === true;
+}
+
+function pinnedGet(port: number, path: string): Promise<Response> {
+  return pinnedHttpGet(
+    `http://provider.invalid:${port}${path}`,
+    { address: "127.0.0.1", family: 4 },
+    undefined,
+    // Bounded so a transport that waits for a body that is never coming fails as a timeout
+    // rather than hanging the suite for the sixty-second default.
+    { idleTimeoutMs: 5_000 },
+  );
+}
+
+describe("null-body statuses on the raw outbound transports", () => {
+  test("the pinned transport answers 204 with a null body while the peer holds the connection", async () => {
+    const target = replyingTarget("HTTP/1.1 204 No Content\r\nConnection: keep-alive\r\n\r\n");
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/no-content");
+      expect(response.status).toBe(204);
+      expect(response.body).toBeNull();
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("the pinned transport answers 205 without decoding or refusing its representation headers", async () => {
+    // A 205 may still describe the representation it would have sent. There are no coded bytes
+    // to undo, so the coding is neither applied nor treated as an unreadable response.
+    const target = replyingTarget(
+      "HTTP/1.1 205 Reset Content\r\nContent-Encoding: br\r\nConnection: keep-alive\r\n\r\n",
+    );
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/reset");
+      expect(response.status).toBe(205);
+      expect(response.body).toBeNull();
+      expect(response.headers.get("content-encoding")).toBe("br");
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("an ordinary pinned 200 still streams its body", async () => {
+    const target = replyingTarget(
+      "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\n\r\n{\"ok\":true}",
+    );
+    const port = await listen(target);
+    try {
+      const response = await pinnedGet(port, "/ok");
+      expect(response.status).toBe(200);
+      expect(await response.json()).toEqual({ ok: true });
+    } finally {
+      await close(target);
+    }
+  });
+
+  test("the SOCKS transport answers 205 with no body and releases the tunnel", async () => {
+    let targetConnection: Socket | undefined;
+    const target = replyingTarget(
+      "HTTP/1.1 205 Reset Content\r\nConnection: keep-alive\r\n\r\n",
+      socket => { targetConnection = socket; },
+    );
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    try {
+      const response = await socks5Fetch(
+        `http://provider.invalid:${targetPort}/reset`,
+        undefined,
+        `socks5://127.0.0.1:${proxyPort}`,
+      );
+      expect(response.status).toBe(205);
+      expect(response.body).toBeNull();
+      // The peer asked to keep the connection alive, so an observed close is the transport
+      // releasing it rather than the fixture tearing it down.
+      expect(await awaitDestroyed(targetConnection)).toBe(true);
+    } finally {
+      targetConnection?.destroy();
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+  test("the SOCKS transport answers HEAD with no body even when the peer advertises one", async () => {
+    let targetConnection: Socket | undefined;
+    /*
+     * A HEAD answer carries the headers the GET would have carried, including the length of a
+     * body it will never send. Reading that many bytes would park the transport on a body that is
+     * not coming, with the answer already in hand.
+     */
+    const target = replyingTarget(
+      "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 128\r\nConnection: keep-alive\r\n\r\n",
+      socket => { targetConnection = socket; },
+    );
+    const proxy = socksProxy();
+    const [targetPort, proxyPort] = await Promise.all([listen(target), listen(proxy)]);
+    try {
+      const response = await socks5Fetch(
+        "http://provider.invalid:" + targetPort + "/head",
+        { method: "HEAD" },
+        "socks5://127.0.0.1:" + proxyPort,
+      );
+      expect(response.status).toBe(200);
+      expect(response.body).toBeNull();
+      // The advertised length survives: it describes the representation, and a caller reading
+      // these headers is entitled to it.
+      expect(response.headers.get("content-length")).toBe("128");
+      // The peer asked to keep the connection alive, so an observed close is the transport
+      // releasing it rather than the fixture tearing it down.
+      expect(await awaitDestroyed(targetConnection)).toBe(true);
+    } finally {
+      targetConnection?.destroy();
+      await Promise.all([close(proxy), close(target)]);
+    }
+  });
+
+});
diff --git a/tests/oauth/adapter-event-oauth-failover.test.ts b/tests/oauth/adapter-event-oauth-failover.test.ts
index 35fe353d455..2cd12caf122 100644
--- a/tests/oauth/adapter-event-oauth-failover.test.ts
+++ b/tests/oauth/adapter-event-oauth-failover.test.ts
@@ -6,6 +6,7 @@ import type { ProviderAdapter } from "../../src/adapters/base";
 import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
 import { getAccountSet, getCredential, saveCredential, setActiveAccount } from "../../src/oauth/store";
 import type { AdapterEvent, OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const actualResolver = await import("../../src/server/adapter-resolve");
@@ -57,6 +58,7 @@ mock.module("../../src/server/adapter-resolve", () => ({
 const { handleResponses } = await import("../../src/server/responses");
 const originalHome = process.env.OPENCODEX_HOME;
 let home = "";
+let releaseSpendHome: (() => void) | undefined;
 
 /**
  * `enabled: undefined` is the case that matters after #2568d — the key absent entirely, which is
@@ -100,6 +102,8 @@ async function seedAccounts(count: number): Promise<void> {
 beforeEach(() => {
   home = mkdtempSync(join(tmpdir(), "ocx-adapter-event-failover-"));
   process.env.OPENCODEX_HOME = home;
+  // Take the writer lease after this case installs its home so direct handler dispatch can open the spend journal.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearGenericFailoverHealth();
   attempts = [];
   attemptKeys = [];
@@ -111,6 +115,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearGenericFailoverHealth();
   if (originalHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/oauth/generic-oauth-failover.test.ts b/tests/oauth/generic-oauth-failover.test.ts
index a12a40dfc31..cc3f6f2e900 100644
--- a/tests/oauth/generic-oauth-failover.test.ts
+++ b/tests/oauth/generic-oauth-failover.test.ts
@@ -332,16 +332,32 @@ describe("sidecar on429 wiring", () => {
     // inline. Inlining is what produced the original defect: three sites each swapped `apiKey`
     // and only two of them remembered the routing metadata paired with it.
     expect(body).toContain("failoverAccountSnapshot(");
-    expect(body).toContain("applyFailoverSnapshot(snapshot)");
+    // The helper must also receive the iteration-local request the loop retries with — a bare
+    // `snapshot` call rebinds only the outer parsed, and the rotated Kiro context dies there.
+    expect(body).toContain("applyFailoverSnapshot(snapshot, retryParsed)");
     expect(body).not.toContain("apiKey: snapshot.accessToken");
   });
 
+  test("the shared hook rebinds the exact sidecar retry request", () => {
+    const start = coreSource.indexOf("const rotateSidecarProviderOn429 =");
+    expect(start).toBeGreaterThan(-1);
+    const body = coreSource.slice(start, coreSource.indexOf("\n  };", start));
+
+    // Both loops send the retry from an iteration-local shallow copy (iterParsed), so the hook
+    // must receive and rebind THAT request: the Kiro auth context through the shared snapshot
+    // helper, and the reasoning-replay/continuation scope through a second bind. Rebinding only
+    // the outer parsed leaves the rotated bearer paired with the failed account's metadata.
+    expect(body).toContain("retryParsed?: OcxParsedRequest");
+    expect(body).toContain("applyFailoverSnapshot(snapshot, retryParsed)");
+    expect(body).toContain("parsed: retryParsed");
+  });
+
   test("every rotation site applies the credential through the one shared helper", () => {
     // The pairing rules (Copilot's account-scoped origin, Antigravity's account-matched project,
     // Kiro's routing metadata) live in exactly one place. A fourth rotation site that swaps the
     // bearer by hand would reintroduce the mixed-identity bug this helper exists to prevent.
     const snapshotUses = coreSource.match(/failoverAccountSnapshot\(/g) ?? [];
-    const helperUses = coreSource.match(/applyFailoverSnapshot\(snapshot(?:, nextParsed)?\)/g) ?? [];
+    const helperUses = coreSource.match(/applyFailoverSnapshot\(snapshot(?:, (?:next|retry)Parsed)?\)/g) ?? [];
     // Five includes native Responses passthrough, which returns before the Chat bridge loop.
     // The explicit count keeps a newly added rotation site from skipping identity pairing.
     expect(snapshotUses.length).toBe(5);
@@ -609,6 +625,16 @@ describe("#695 the generic pool consumes its persisted strategy behind pool.kern
     expect(preferredInitialAccount(cfg, "xai")).toBe(sorted[1]!);
   });
 
+  test("fill-first treats a zero threshold as disabling proactive switching", async () => {
+    const ids = await seed(2);
+    const active = [...ids].sort((left, right) => left.localeCompare(right))[0]!;
+    await setActiveAccount("xai", active);
+    const cfg = kernelConfig("fill-first", { autoSwitchThreshold: 0 });
+
+    setCachedProviderAccountQuotaForTests("xai", active, { weeklyPercent: 100, updatedAt: Date.now() });
+    expect(preferredInitialAccount(cfg, "xai")).toBeNull();
+  });
+
   test("fill-first advances through the sorted roster, not the eligible subset", async () => {
     const ids = await seed(3);
     const sorted = [...ids].sort((left, right) => left.localeCompare(right));
diff --git a/tests/oauth/oauth-account-attribution.test.ts b/tests/oauth/oauth-account-attribution.test.ts
index ff6a838462c..68b444a983e 100644
--- a/tests/oauth/oauth-account-attribution.test.ts
+++ b/tests/oauth/oauth-account-attribution.test.ts
@@ -14,6 +14,7 @@ import { summarizeUsage } from "../../src/usage/summary";
 import type { RequestLogContext } from "../../src/server/request-log";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /**
@@ -66,9 +67,13 @@ async function withHome<T>(run: (home: string) => Promise<T>): Promise<T> {
   const prevCodex = process.env.CODEX_HOME;
   process.env.OPENCODEX_HOME = home;
   process.env.CODEX_HOME = home;
+  // Take the writer lease after this helper installs its home so direct handler dispatch can open the spend journal.
+  const releaseSpendHome = acquireOwnedSpendHome();
   try {
     return await run(home);
   } finally {
+    // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+    releaseSpendHome();
     globalThis.fetch = originalFetch;
     removeTreeWithRetry(home);
     if (prevOpencodex === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/oauth/oauth-callback-server.test.ts b/tests/oauth/oauth-callback-server.test.ts
index cd7a353a7f8..feeb4301895 100644
--- a/tests/oauth/oauth-callback-server.test.ts
+++ b/tests/oauth/oauth-callback-server.test.ts
@@ -89,6 +89,36 @@ describe("OAuth callback server defaults", () => {
     }
   });
 
+  test("manual-input loop rejects a code#state paste with a foreign suffix and re-prompts", async () => {
+    let prompts = 0;
+    const flow = new ManualFallbackFlow(
+      {
+        onManualCodeInput: async () => {
+          prompts += 1;
+          // First paste carries a state the flow never issued: the loop must
+          // discard it and ask again, not complete with the attacker's code.
+          return prompts === 1 ? "evil-code#WRONG" : `good-code#${flow.generated?.state}`;
+        },
+      },
+      {
+        preferredPort: 0,
+        callbackPath: "/callback",
+        callbackHostname: "127.0.0.1",
+        callbackBindHostname: "127.0.0.1",
+      },
+    );
+
+    const credential = await flow.login();
+
+    expect(prompts).toBe(2);
+    expect(flow.exchanged).toEqual({
+      code: "good-code",
+      state: flow.generated?.state,
+      redirectUri: flow.generated?.redirectUri,
+    });
+    expect(credential.access).toBe("access");
+  });
+
   test("fails closed when an exact redirect port is unavailable without manual input", async () => {
     const blocker = Bun.serve({
       hostname: "127.0.0.1",
diff --git a/tests/oauth/oauth-health.test.ts b/tests/oauth/oauth-health.test.ts
index 8b3aa068b6d..2f42bac60b8 100644
--- a/tests/oauth/oauth-health.test.ts
+++ b/tests/oauth/oauth-health.test.ts
@@ -166,6 +166,25 @@ describe("projectCodexAccountHealth", () => {
       .toEqual({ status: "healthy" });
   });
 
+  test.each([
+    ["http_status:401", "unauthorized"],
+    ["http_status:403", "forbidden"],
+  ] as const)("a stored verification failure surfaces %s as %s", async (validationError, reason) => {
+    withPoolStoreDir();
+    const { markCodexAccountValidationFailed, readCodexAccountRecord, saveCodexAccountCredential } =
+      await import("../../src/codex/account-store");
+    const accountId = "pool-stored-" + reason;
+    saveCodexAccountCredential(accountId, {
+      accessToken: "a", refreshToken: "r", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "cg",
+    }, { validationPending: true });
+    markCodexAccountValidationFailed(accountId, validationError, {
+      expectedGeneration: readCodexAccountRecord(accountId)!.generation,
+    });
+
+    expect(projectCodexAccountHealth({ accountId, needsReauth: false }))
+      .toEqual({ status: "reauth_required", reason });
+  });
+
   test("the CLI collector reports the terminal verdict too", async () => {
     withPoolStoreDir();
     const { markCodexAccountValidationFailed, readCodexAccountRecord, saveCodexAccountCredential } =
diff --git a/tests/oauth/oauth-manual-code.test.ts b/tests/oauth/oauth-manual-code.test.ts
index 766fcdce778..25aa20ed3e5 100644
--- a/tests/oauth/oauth-manual-code.test.ts
+++ b/tests/oauth/oauth-manual-code.test.ts
@@ -38,6 +38,36 @@ function fakeAccessToken(): string {
   return `${header}.${payload}.sig`;
 }
 
+/** Mock the xAI discovery + token endpoints; records the last token request body. */
+function installXaiFetchMock(): { getTokenBody: () => URLSearchParams | null; restore: () => void } {
+  const originalFetch = globalThis.fetch;
+  let tokenRequestBody: URLSearchParams | null = null;
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = String(input);
+    if (url.includes("openid-configuration")) {
+      return new Response(
+        JSON.stringify({
+          authorization_endpoint: "https://auth.x.ai/authorize",
+          token_endpoint: "https://auth.x.ai/oauth/token",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    }
+    if (url.includes("oauth/token")) {
+      tokenRequestBody = new URLSearchParams(String(init?.body ?? ""));
+      return new Response(
+        JSON.stringify({ access_token: fakeAccessToken(), refresh_token: "refresh-1", expires_in: 3600 }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    }
+    return originalFetch(input, init);
+  }) as typeof fetch;
+  return {
+    getTokenBody: () => tokenRequestBody,
+    restore: () => { globalThis.fetch = originalFetch; },
+  };
+}
+
 describe("parseCallbackInput kinds", () => {
   test("redirect URL -> kind url with code/state", () => {
     expect(parseCallbackInput("http://127.0.0.1:56121/callback?code=abc&state=xyz")).toEqual({
@@ -185,29 +215,7 @@ describe("OAuth manual login code fallback", () => {
   });
 
   test("manual paste completes the login using the ORIGINAL flow PKCE verifier", async () => {
-    const originalFetch = globalThis.fetch;
-    let tokenRequestBody: URLSearchParams | null = null;
-    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      if (url.includes("openid-configuration")) {
-        return new Response(
-          JSON.stringify({
-            authorization_endpoint: "https://auth.x.ai/authorize",
-            token_endpoint: "https://auth.x.ai/oauth/token",
-          }),
-          { status: 200, headers: { "Content-Type": "application/json" } },
-        );
-      }
-      if (url.includes("oauth/token")) {
-        tokenRequestBody = new URLSearchParams(String(init?.body ?? ""));
-        return new Response(
-          JSON.stringify({ access_token: fakeAccessToken(), refresh_token: "refresh-1", expires_in: 3600 }),
-          { status: 200, headers: { "Content-Type": "application/json" } },
-        );
-      }
-      return originalFetch(input, init);
-    }) as typeof fetch;
-
+    const mock = installXaiFetchMock();
     try {
       const started = await Promise.race([
         startLoginFlow("xai", { forceLogin: true }),
@@ -247,8 +255,15 @@ describe("OAuth manual login code fallback", () => {
       expect(fragmentNoState.ok).toBe(false);
       if (!fragmentNoState.ok) expect(fragmentNoState.error).toContain("missing the state");
 
+      // A raw code#state paste is state-bearing too: a mismatched suffix is
+      // rejected rather than bypassing validation.
+      const rawMismatch = submitManualLoginCode("xai", "evil-code#WRONG");
+      expect(rawMismatch.ok).toBe(false);
+      if (!rawMismatch.ok) expect(rawMismatch.error).toContain("state mismatch");
+
       // Correct paste: matching state completes the login via the original verifier.
-      const goodSubmit = submitManualLoginCode("xai", `${redirectUri}?code=pasted-auth-code&state=${state}`);
+      // The raw code#state form exercises the same gate for a state-bearing raw paste.
+      const goodSubmit = submitManualLoginCode("xai", `pasted-auth-code#${state}`);
       expect(goodSubmit).toEqual({ ok: true });
 
       // Background runLogin finishes: poll status until done.
@@ -262,8 +277,8 @@ describe("OAuth manual login code fallback", () => {
       expect(status.loggedIn).toBe(true);
 
       // Token exchange used the pasted code + the ORIGINAL PKCE verifier + redirect URI.
-      expect(tokenRequestBody).not.toBeNull();
-      const body = tokenRequestBody!;
+      const body = mock.getTokenBody()!;
+      expect(body).not.toBeNull();
       expect(body.get("grant_type")).toBe("authorization_code");
       expect(body.get("code")).toBe("pasted-auth-code");
       expect(body.get("redirect_uri")).toBe(redirectUri);
@@ -276,7 +291,47 @@ describe("OAuth manual login code fallback", () => {
       expect(existsSync(authFile)).toBe(true);
       expect(readFileSync(authFile, "utf8")).toContain("refresh-1");
     } finally {
-      globalThis.fetch = originalFetch;
+      mock.restore();
+      cancelLoginFlow("xai");
+      clearLoginState("xai");
+    }
+  });
+
+  test("manual paste of the full redirect URL completes the login", async () => {
+    const mock = installXaiFetchMock();
+
+    try {
+      const started = await Promise.race([
+        startLoginFlow("xai", { forceLogin: true }),
+        new Promise<never>((_, reject) => setTimeout(() => reject(new Error("startLoginFlow timed out")), 10_000)),
+      ]);
+      const authUrl = new URL(started.url);
+      const state = authUrl.searchParams.get("state")!;
+      const challenge = authUrl.searchParams.get("code_challenge")!;
+      const redirectUri = authUrl.searchParams.get("redirect_uri")!;
+
+      // The full redirect URL is the other accepted success form: its state
+      // parameter must match the state this attempt issued.
+      const goodSubmit = submitManualLoginCode("xai", `${redirectUri}?code=pasted-url-code&state=${state}`);
+      expect(goodSubmit).toEqual({ ok: true });
+
+      const statusDeadline = Date.now() + 10_000;
+      while (!getLoginStatus("xai").done && Date.now() < statusDeadline) {
+        await new Promise(r => setTimeout(r, 50));
+      }
+      const status = getLoginStatus("xai");
+      expect(status.done).toBe(true);
+      expect(status.error).toBeUndefined();
+      expect(status.loggedIn).toBe(true);
+
+      const body = mock.getTokenBody();
+      expect(body).not.toBeNull();
+      expect(body!.get("code")).toBe("pasted-url-code");
+      expect(body!.get("redirect_uri")).toBe(redirectUri);
+      const verifier = body!.get("code_verifier")!;
+      expect(b64url(createHash("sha256").update(verifier).digest())).toBe(challenge);
+    } finally {
+      mock.restore();
       cancelLoginFlow("xai");
       clearLoginState("xai");
     }
diff --git a/tests/providers/alibaba-token-plan-responses-optin.test.ts b/tests/providers/alibaba-token-plan-responses-optin.test.ts
new file mode 100644
index 00000000000..67daf0c7df4
--- /dev/null
+++ b/tests/providers/alibaba-token-plan-responses-optin.test.ts
@@ -0,0 +1,144 @@
+/**
+ * Alibaba Token Plan (Beijing) serves the same models over both Chat Completions and an
+ * OpenAI-compatible Responses API on the same /compatible-mode/v1 base, and Alibaba ships an
+ * official Codex integration guide on wire_api = "responses" (#5097). Three models carry live
+ * end-to-end evidence on that gateway: qwen3.8-flash, qwen3.7-plus and glm-5.3.
+ *
+ * That evidence buys a documented OPT-IN, not a default. The registry deliberately declares no
+ * modelWireDefaults for this entry, because flipping the wire would change the upstream for
+ * every existing Codex user of those models with no config change, and one delta is still
+ * unresolved: the entry preserves plaintext reasoning content on the Chat wire through
+ * preserveReasoningContentModels, but the Responses serializer reads the separate
+ * preserveResponsesReasoningContent flag, which this entry does not set. On the Responses wire
+ * those models would therefore replay with blanked reasoning content, which is strictly less
+ * state than they carry today. Z.AI and DeepSeek set both flags for exactly this reason.
+ *
+ * These cases lock the opt-in so it cannot silently regress, and lock the precondition so a
+ * later default flip cannot land without the Responses-side preservation beside it.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+import { providerConfigSeed } from "../../src/providers/derive";
+import { getProviderRegistryEntry } from "../../src/providers/registry";
+import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve";
+import { handleResponses } from "../../src/server/responses/core";
+import { ALIBABA_TOKEN_PLAN_PRESERVE_REASONING } from "../../src/providers/registry/model-seeds";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+const LIVE_VERIFIED = ["qwen3.8-flash", "qwen3.7-plus", "glm-5.3"] as const;
+const INBOUNDS = ["responses", "chat", "anthropic"] as const;
+
+function tokenPlanProvider(): OcxProviderConfig {
+  return { ...providerConfigSeed(getProviderRegistryEntry("alibaba-token-plan")!), apiKey: "sk-test" };
+}
+
+describe("the Token Plan wire default is unchanged", () => {
+  for (const model of LIVE_VERIFIED) {
+    test(`${model} stays on the provider chat wire for every inbound`, () => {
+      for (const inbound of INBOUNDS) {
+        expect(resolveWireProtocolOverride("alibaba-token-plan", model, tokenPlanProvider(), inbound).adapter)
+          .toBe("openai-chat");
+      }
+    });
+  }
+
+  test("the entry declares no model wire defaults", () => {
+    expect(getProviderRegistryEntry("alibaba-token-plan")!.modelWireDefaults).toBeUndefined();
+  });
+});
+
+describe("the documented Responses opt-in resolves and reaches the native wire", () => {
+  for (const model of LIVE_VERIFIED) {
+    test(`modelAdapters selects openai-responses for ${model}`, () => {
+      const provider = { ...tokenPlanProvider(), modelAdapters: { [model]: "openai-responses" } };
+      const resolved = resolveWireProtocolOverride("alibaba-token-plan", model, provider, "responses");
+      expect(resolved.adapter).toBe("openai-responses");
+      expect(resolved.apiKey).toBe("sk-test");
+      expect(resolved.baseUrl).toBe("https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1");
+    });
+  }
+
+  test("an unrelated provider is untouched by the opt-in", () => {
+    const other: OcxProviderConfig = { adapter: "openai-chat", baseUrl: "https://example.com/v1", apiKey: "sk-test" };
+    for (const inbound of INBOUNDS) {
+      expect(resolveWireProtocolOverride("some-custom", "qwen3.8-flash", other, inbound).adapter)
+        .toBe("openai-chat");
+    }
+  });
+});
+
+describe("the opt-in survives the handleResponses replay", () => {
+  const originalFetch = globalThis.fetch;
+  let releaseSpendHome: (() => void) | undefined;
+
+  afterEach(() => {
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
+
+  // A resolver-only assertion would pass even if the replay flipped the wire back, so the
+  // upstream URL the request actually reached is what these cases read.
+  async function drive(model: string, modelAdapters?: Record<string, string>): Promise<string> {
+    const urls: string[] = [];
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      urls.push(String(input));
+      return new Response("data: [DONE]\n\n", {
+        status: 200,
+        headers: { "content-type": "text/event-stream" },
+      });
+    }) as typeof fetch;
+    const provider = modelAdapters ? { ...tokenPlanProvider(), modelAdapters } : tokenPlanProvider();
+    const config = { providers: { "alibaba-token-plan": provider } } as unknown as OcxConfig;
+    releaseSpendHome ??= acquireOwnedSpendHome();
+    await handleResponses(
+      new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model: `alibaba-token-plan/${model}`, input: "ping", stream: true }),
+      }),
+      config,
+      { model: "", provider: "" },
+      { inboundWire: "responses" },
+    );
+    return urls[0] ?? "";
+  }
+
+  test("qwen3.8-flash reaches /responses once opted in", async () => {
+    const url = await drive("qwen3.8-flash", { "qwen3.8-flash": "openai-responses" });
+    expect(url).toContain("token-plan.cn-beijing.maas.aliyuncs.com");
+    expect(url).toContain("/responses");
+    expect(url).not.toContain("chat/completions");
+  });
+
+  test("qwen3.8-flash reaches /chat/completions without the opt-in", async () => {
+    const url = await drive("qwen3.8-flash");
+    expect(url).toContain("token-plan.cn-beijing.maas.aliyuncs.com");
+    expect(url).toContain("chat/completions");
+  });
+});
+
+describe("a Responses default flip must carry Responses-side reasoning preservation", () => {
+  test("the Chat wire already preserves reasoning content for the live-verified models", () => {
+    for (const model of LIVE_VERIFIED) {
+      expect(ALIBABA_TOKEN_PLAN_PRESERVE_REASONING).toContain(model);
+    }
+    expect(getProviderRegistryEntry("alibaba-token-plan")!.preserveReasoningContentModels)
+      .toEqual(ALIBABA_TOKEN_PLAN_PRESERVE_REASONING);
+  });
+
+  // The guard, not a restatement of the case above: preserveReasoningContentModels is read by the
+  // Chat adapter only. If this entry ever declares a Responses wire default, the Responses
+  // serializer's own flag has to be set too, or the pinned models silently start replaying with
+  // blanked reasoning content.
+  test("declaring a Responses wire default without the Responses flag fails here", () => {
+    const entry = getProviderRegistryEntry("alibaba-token-plan")!;
+    const pinsResponses = Object.values(entry.modelWireDefaults ?? {})
+      .some(declared => (typeof declared === "string" ? declared : declared.wire) === "openai-responses");
+    if (!pinsResponses) {
+      expect(entry.preserveResponsesReasoningContent).toBeUndefined();
+      return;
+    }
+    expect(entry.preserveResponsesReasoningContent).toBe(true);
+  });
+});
diff --git a/tests/providers/codebuddy-adapter.test.ts b/tests/providers/codebuddy-adapter.test.ts
index fc784fe0987..ea877f4a3eb 100644
--- a/tests/providers/codebuddy-adapter.test.ts
+++ b/tests/providers/codebuddy-adapter.test.ts
@@ -15,6 +15,7 @@ const enc = new TextEncoder();
 beforeEach(() => clearCodeBuddyBinaryCache());
 
 interface FakeChild extends EventEmitter {
+  pid?: number;
   stdout: Readable;
   stderr: Readable;
   stdin: Writable;
@@ -614,8 +615,80 @@ describe("codebuddy runTurn streams a headless turn", () => {
     expect(events.some(e => e.type === "done")).toBe(false);
   });
 
+  test("a Windows abort terminates the cmd shim process tree", async () => {
+    const controller = new AbortController();
+    const stdoutStream = new Readable({
+      read() { setTimeout(() => controller.abort(), 5); },
+    });
+    const child = new EventEmitter() as FakeChild;
+    child.pid = 4242;
+    child.stdout = stdoutStream;
+    child.stderr = Readable.from([]);
+    child.written = [];
+    child.stdin = new Writable({ write(_c, _e, cb) { cb(); } });
+    child.killed = false;
+    child.exitCode = null;
+    const directSignals: string[] = [];
+    child.kill = signal => { directSignals.push(signal ?? "SIGTERM"); return true; };
+    const killedTrees: number[] = [];
+
+    const adapter = createCodeBuddyAdapter(provider(), {
+      platform: "win32",
+      spawn: () => child as unknown as ChildProcess,
+      which: () => "C:\\npm\\codebuddy.cmd",
+      killWindowsProcessTree: pid => {
+        killedTrees.push(pid);
+        child.exitCode = 1;
+        child.emit("close", 1);
+      },
+      killGraceMs: 20,
+    });
+    const events = await run(adapter, parsed(), incoming(controller.signal));
+
+    expect(killedTrees).toEqual([4242]);
+    expect(directSignals).toEqual([]);
+    expect(events).toContainEqual(expect.objectContaining({ type: "error", retryable: false }));
+  });
+
   test("a timeout destroys a stalled stdout stream and returns even when close never arrives", async () => {
+    type TimingPhase = "entry" | "spawn" | "sigterm" | "stdout_close" | "stdout_error" | "timeout" | "return";
+    type TimingClassification =
+      | "within_budget"
+      | "pre_spawn_late"
+      | "timeout_dispatch_missing"
+      | "timeout_dispatch_late"
+      | "timeout_event_missing"
+      | "stdout_settlement_missing"
+      | "stdout_settlement_late"
+      | "reap_or_return_late";
+    const phaseOrder: readonly TimingPhase[] = [
+      "entry", "spawn", "sigterm", "stdout_close", "stdout_error", "timeout", "return",
+    ];
+    const phaseMs: Partial<Record<TimingPhase, number>> = {};
+    let startedAt = 0;
+    const boundedElapsed = (): number => Math.min(1_000, Math.max(0, Date.now() - startedAt));
+    const mark = (phase: TimingPhase): void => { phaseMs[phase] ??= boundedElapsed(); };
+    const classify = (elapsed: number): TimingClassification => {
+      if (elapsed < 250) return "within_budget";
+      if ((phaseMs.spawn ?? 0) >= 250) return "pre_spawn_late";
+      if (phaseMs.sigterm === undefined) return "timeout_dispatch_missing";
+      if (phaseMs.sigterm >= 250) return "timeout_dispatch_late";
+      if (phaseMs.timeout === undefined) return "timeout_event_missing";
+      const streamSettledAt = Math.min(
+        phaseMs.stdout_close ?? Number.POSITIVE_INFINITY,
+        phaseMs.stdout_error ?? Number.POSITIVE_INFINITY,
+      );
+      if (!Number.isFinite(streamSettledAt)) return "stdout_settlement_missing";
+      if (streamSettledAt >= 250) return "stdout_settlement_late";
+      return "reap_or_return_late";
+    };
+    const diagnostic = (elapsed: number): string => {
+      const phases = phaseOrder.map(phase => `${phase}_ms=${phaseMs[phase] ?? -1}`).join(",");
+      return `codebuddy_timeout_timing classification=${classify(elapsed)} total_ms=${elapsed} ${phases}`;
+    };
     const stdoutStream = new Readable({ read() { /* stays open until timeout destroys it */ } });
+    stdoutStream.once("close", () => mark("stdout_close"));
+    stdoutStream.once("error", () => mark("stdout_error"));
     const child = new EventEmitter() as FakeChild;
     child.stdout = stdoutStream;
     child.stderr = Readable.from([]);
@@ -625,22 +698,34 @@ describe("codebuddy runTurn streams a headless turn", () => {
     child.exitCode = null;
     const signals: string[] = [];
     child.kill = (sig?: string) => {
+      if ((sig ?? "SIGTERM") === "SIGTERM") mark("sigterm");
       child.killed = true;
       signals.push(sig ?? "SIGTERM");
       return true;
     };
 
     const adapter = createCodeBuddyAdapter(provider(), {
-      spawn: () => child as unknown as ChildProcess,
+      spawn: () => {
+        mark("spawn");
+        return child as unknown as ChildProcess;
+      },
       which: () => "/usr/bin/codebuddy",
       timeoutMs: 10,
       killGraceMs: 10,
       reapTimeoutMs: 35,
     });
-    const startedAt = Date.now();
-    const events = await run(adapter, parsed());
+    startedAt = Date.now();
+    mark("entry");
+    const events: AdapterEvent[] = [];
+    await adapter.runTurn!(parsed(), incoming(), event => {
+      if (event.type === "error" && event.status === 504 && event.code === "timeout") mark("timeout");
+      events.push(event);
+    });
+    mark("return");
+    // The measured assertion uses the raw elapsed time; clamping would hide a genuine overrun.
+    const elapsed = Date.now() - startedAt;
 
-    expect(Date.now() - startedAt).toBeLessThan(250);
+    expect(elapsed, diagnostic(elapsed)).toBeLessThan(250);
     expect(stdoutStream.destroyed).toBe(true);
     expect(signals).toContain("SIGTERM");
     expect(events).toContainEqual(expect.objectContaining({ type: "error", status: 504, code: "timeout" }));
diff --git a/tests/providers/command-code-provider.test.ts b/tests/providers/command-code-provider.test.ts
index 91980f5fd54..692bbf45586 100644
--- a/tests/providers/command-code-provider.test.ts
+++ b/tests/providers/command-code-provider.test.ts
@@ -750,6 +750,127 @@ describe("Command Code provider", () => {
     expect(commandCodeReasoningEfforts("deepseek/deepseek-v4-flash")).toEqual(["high"]);
   });
 
+  /*
+   * #5096: the shipped table is a default, not a ceiling configuration cannot reach past.
+   *
+   * The adapter used to read `commandCodeReasoningEfforts() ?? configuredReasoningEfforts()`,
+   * so a model WITH a row ignored `providers.command-code.modelReasoningEfforts` while a model
+   * WITHOUT one honoured it. The catalog never agreed with that: it advertises the picker from
+   * `configuredReasoningEfforts`, so an operator who widened a pinned row saw the wider ladder
+   * offered in Codex and then watched the adapter strip the rung on the way out.
+   *
+   * The seeded copy is the trap, and it is why the override is a declared flag rather than an
+   * inference. `providerConfigSeed` writes the whole shipped table into every materialized
+   * preset, and enrichment and routing both keep a persisted row over the current seed, so
+   * neither the presence of a row nor its difference from today's table proves a human wrote it.
+   * `modelReasoningEffortsAuthoritative` is never written by seeding, so its presence does.
+   */
+  test("an authoritative operator ladder reaches the wire", async () => {
+    // Shipped: deepseek/deepseek-v4.1-flash is ["high", "max"], so xhigh is aliased down to max.
+    expect(commandCodeReasoningEfforts("deepseek/deepseek-v4.1-flash")).toEqual(["high", "max"]);
+    const shipped = await builtRequest({
+      ...parsed("deepseek/deepseek-v4.1-flash"),
+      options: { reasoning: "xhigh", maxOutputTokens: 100 },
+    });
+    expect(JSON.parse(shipped.body).params.reasoning_effort).toBe("max");
+
+    const widened = createCommandCodeAdapter({
+      ...provider,
+      modelReasoningEffortsAuthoritative: true,
+      modelReasoningEfforts: { "deepseek/deepseek-v4.1-flash": ["low", "medium", "high", "xhigh", "max"] },
+    } as OcxProviderConfig);
+    const built = await widened.buildRequest({
+      ...parsed("deepseek/deepseek-v4.1-flash"),
+      options: { reasoning: "xhigh", maxOutputTokens: 100 },
+    });
+    expect(JSON.parse(built.body).params.reasoning_effort).toBe("xhigh");
+
+    // Narrowing works in the same direction: an operator who removes a rung loses it.
+    const narrowed = createCommandCodeAdapter({
+      ...provider,
+      modelReasoningEffortsAuthoritative: true,
+      modelReasoningEfforts: { "deepseek/deepseek-v4.1-flash": ["high"] },
+    } as OcxProviderConfig);
+    const stripped = await narrowed.buildRequest({
+      ...parsed("deepseek/deepseek-v4.1-flash"),
+      options: { reasoning: "max", maxOutputTokens: 100 },
+    });
+    expect(JSON.parse(stripped.body).params).not.toHaveProperty("reasoning_effort");
+
+    // ultra is aliased to max only when the ladder does NOT advertise it, matching xhigh. An
+    // authoritative ladder offering ultra therefore sends ultra rather than quietly sending max.
+    const withUltra = createCommandCodeAdapter({
+      ...provider,
+      modelReasoningEffortsAuthoritative: true,
+      modelReasoningEfforts: { "deepseek/deepseek-v4-flash": ["high", "max", "ultra"] },
+    } as OcxProviderConfig);
+    const ultra = await withUltra.buildRequest({ ...parsed(), options: { reasoning: "ultra", maxOutputTokens: 100 } });
+    expect(JSON.parse(ultra.body).params.reasoning_effort).toBe("ultra");
+  });
+
+  // The flag is what makes this safe. A preset carries the seeded table, and a row written by an
+  // older release keeps its old value through enrichment and routing, so a value comparison would
+  // start reading a stale seed as operator intent the moment the shipped table is corrected.
+  // Without the flag, a configured row — seeded, stale, or hand-written — changes nothing.
+  test("a configured ladder is inert without the authoritative flag", async () => {
+    const entry = PROVIDER_REGISTRY.find(row => row.id === "command-code")!;
+    const cases = [
+      ["deepseek/deepseek-v4.1-flash", "xhigh"],
+      ["deepseek/deepseek-v4-flash", "ultra"],
+      ["google/gemini-3.7-flash", "max"],
+      ["zai-org/GLM-5.3", "low"],
+      ["meta/muse-spark-1.3", "xhigh"],
+    ] as const;
+    const seeded = createCommandCodeAdapter({
+      ...provider,
+      modelReasoningEfforts: { ...entry.modelReasoningEfforts },
+    } as OcxProviderConfig);
+    // A stale row: every shipped ladder widened, but nobody declared it authoritative.
+    const stale = createCommandCodeAdapter({
+      ...provider,
+      modelReasoningEfforts: Object.fromEntries(
+        Object.keys(entry.modelReasoningEfforts ?? {}).map(id => [id, ["low", "medium", "high", "xhigh", "max"]]),
+      ),
+    } as OcxProviderConfig);
+    for (const [modelId, reasoning] of cases) {
+      const options = { reasoning, maxOutputTokens: 100 };
+      const expected = JSON.parse((await builtRequest({ ...parsed(modelId), options })).body).params.reasoning_effort;
+      for (const [label, adapter] of [["seeded", seeded], ["stale", stale]] as const) {
+        const built = await adapter.buildRequest({ ...parsed(modelId), options });
+        expect(JSON.parse(built.body).params.reasoning_effort, `${label} ${modelId} @ ${reasoning}`).toEqual(expected);
+      }
+    }
+  });
+
+  test("an operator-authorized rung surfaces the upstream rejection instead of replaying without it", async () => {
+    const requests: string[] = [];
+    const fetch = (async (url: string | URL | Request) => {
+      requests.push(String(url));
+      if (String(url).includes("commandcode.ai/models/")) {
+        return new Response("Reasoning efforts high are supported; no other reasoning settings.");
+      }
+      return new Response(JSON.stringify({ error: "unsupported reasoning_effort" }), { status: 400 });
+    }) as typeof globalThis.fetch;
+    const adapter = createCommandCodeAdapter({
+      ...provider,
+      fetch,
+      modelReasoningEffortsAuthoritative: true,
+      modelReasoningEfforts: { "deepseek/deepseek-v4-flash": ["low", "medium", "high", "xhigh", "max"] },
+    } as OcxProviderConfig);
+    const request = await adapter.buildRequest({ ...parsed(), options: { reasoning: "xhigh", maxOutputTokens: 100 } });
+    expect(JSON.parse(request.body).params.reasoning_effort).toBe("xhigh");
+
+    const budget = createRequestExecutionBudget();
+    const { dispose } = budgetOwner(budget);
+    try {
+      const response = await adapter.fetchResponse!(request, { sendBudget: budget });
+      expect(response.status).toBe(400);
+      // One generate call and no profile fetch: the downgrade is skipped, not merely unsuccessful.
+      expect(requests.filter(url => url.endsWith("/alpha/generate"))).toHaveLength(1);
+      expect(requests.some(url => url.includes("commandcode.ai/models/"))).toBe(false);
+    } finally { dispose(); }
+  });
+
   // Pins the profileUrl of each id added for #2647 — nothing more.
   //
   // Be clear about what this does NOT prove: the stubbed response below returns
diff --git a/tests/providers/cursor/cursor-effort-rows.test.ts b/tests/providers/cursor/cursor-effort-rows.test.ts
index ea97860228b..d3f4f922365 100644
--- a/tests/providers/cursor/cursor-effort-rows.test.ts
+++ b/tests/providers/cursor/cursor-effort-rows.test.ts
@@ -21,6 +21,7 @@ import { startServer } from "../../../src/server";
 import type { RequestLogContext } from "../../../src/server/request-log";
 import type { OcxConfig } from "../../../src/types";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 import { SERVER_BUDGET_MS } from "../../helpers/test-budget";
 
 setDefaultTimeout(SERVER_BUDGET_MS);
@@ -206,6 +207,9 @@ describe("Cursor effort variant rows", () => {
 
   test("Responses effort rows route the base model and pass through the existing cap", async () => {
     const upstream = mockChatUpstream();
+    // Case-local, never file-wide: this file also starts a real server elsewhere, and that
+    // server takes the same lease. A lease held across those cases would refuse their startup.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const config = ingressConfig(`${upstream.server.url.toString().replace(/\/$/u, "")}/v1`);
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
@@ -225,11 +229,15 @@ describe("Cursor effort variant rows", () => {
       });
     } finally {
       upstream.server.stop(true);
+      // The fake upstreams stop first: a turn still settling against the journal must not
+      // outlive the lease that owns it.
+      releaseSpendHome();
     }
   });
 
   test("Chat effort rows use Responses normalization instead of the native-chat shortcut", async () => {
     const upstream = mockChatUpstream();
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const config = ingressConfig(`${upstream.server.url.toString().replace(/\/$/u, "")}/v1`);
       const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
@@ -249,11 +257,13 @@ describe("Cursor effort variant rows", () => {
       });
     } finally {
       upstream.server.stop(true);
+      releaseSpendHome();
     }
   });
 
   test("Messages effort rows resolve after route directives and before native passthrough", async () => {
     const upstream = mockChatUpstream();
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const config = ingressConfig(`${upstream.server.url.toString().replace(/\/$/u, "")}/v1`);
       const response = await handleClaudeMessages(new Request("http://localhost/v1/messages", {
@@ -279,6 +289,84 @@ describe("Cursor effort variant rows", () => {
       });
     } finally {
       upstream.server.stop(true);
+      releaseSpendHome();
+    }
+  });
+
+  test("mixed-case aliases ending in an effort stay on their configured provider", async () => {
+    const intended = mockChatUpstream();
+    const fallback = mockChatUpstream();
+    const releaseSpendHome = acquireOwnedSpendHome();
+    try {
+      const config: OcxConfig = {
+        port: 0,
+        cursorEffortRows: true,
+        defaultProvider: "fallback",
+        providers: {
+          intended: {
+            adapter: "openai-chat",
+            baseUrl: `${intended.server.url.toString().replace(/\/$/u, "")}/v1`,
+            apiKey: "fixture-intended-key",
+            allowPrivateNetwork: true,
+            liveModels: false,
+            models: ["private-model"],
+            modelAliases: { "private-model": "Sensitive--high" },
+          },
+          fallback: {
+            adapter: "openai-chat",
+            baseUrl: `${fallback.server.url.toString().replace(/\/$/u, "")}/v1`,
+            apiKey: "fixture-fallback-key",
+            allowPrivateNetwork: true,
+            liveModels: false,
+            models: ["sensitive"],
+          },
+        },
+      };
+      const logCtx = (): RequestLogContext => ({ model: "", provider: "" });
+      const responses = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: childHeaders,
+        body: JSON.stringify({ model: "sensitive--high", stream: false, input: "hello" }),
+      }), config, logCtx());
+      expect(responses.status).toBe(200);
+      await responses.text();
+
+      const chat = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
+        method: "POST",
+        headers: childHeaders,
+        body: JSON.stringify({
+          model: "sensitive--high",
+          stream: false,
+          messages: [{ role: "user", content: "hello" }],
+        }),
+      }), config, logCtx());
+      expect(chat.status).toBe(200);
+      await chat.text();
+
+      const messages = await handleClaudeMessages(new Request("http://localhost/v1/messages", {
+        method: "POST",
+        headers: {
+          ...childHeaders,
+          "x-api-key": "native-fixture-credential",
+          "anthropic-version": "2023-06-01",
+        },
+        body: JSON.stringify({
+          model: "sensitive--high",
+          max_tokens: 128,
+          stream: false,
+          messages: [{ role: "user", content: "hello" }],
+        }),
+      }), config, logCtx());
+      expect(messages.status).toBe(200);
+      await messages.text();
+
+      expect(intended.captured).toHaveLength(3);
+      expect(intended.captured.every(body => body.model === "private-model")).toBe(true);
+      expect(fallback.captured).toHaveLength(0);
+    } finally {
+      intended.server.stop(true);
+      fallback.server.stop(true);
+      releaseSpendHome();
     }
   });
 
diff --git a/tests/providers/cursor/cursor-stream-health.test.ts b/tests/providers/cursor/cursor-stream-health.test.ts
index 27a6cdac432..b36bb036646 100644
--- a/tests/providers/cursor/cursor-stream-health.test.ts
+++ b/tests/providers/cursor/cursor-stream-health.test.ts
@@ -12,7 +12,7 @@ import {
 import { encodeConnectFrame } from "../../../src/adapters/cursor/framing";
 import { createLiveCursorTransport } from "../../../src/adapters/cursor/live-transport";
 import { createTestTranslatorBudget } from "../../helpers/translator-budget";
-import { isolationBudgetMs, watchdogMs } from "../../helpers/ci-watchdog";
+import { watchdogMs } from "../../helpers/ci-watchdog";
 import type { CursorRunRequest, CursorServerMessage } from "../../../src/adapters/cursor/types";
 
 /**
@@ -100,6 +100,58 @@ function runRequest(): CursorRunRequest {
   } as CursorRunRequest;
 }
 
+/**
+ * A clock the test advances by hand, for the T04 watchdog only.
+ *
+ * The watchdog's re-arming contract cannot be stated against real timers without also
+ * asserting that the machine keeps up: the only way to show a deadline did NOT expire is to
+ * keep a synthetic server delivering frames faster than the silence budget for several
+ * multiples of it, and a loaded runner that pauses longer than one budget fails the assertion
+ * while the watchdog is behaving correctly. Virtual time removes that term. Timers fire only
+ * from `advanceTo`, so contention can delay a frame's arrival — which the test waits for —
+ * without any deadline passing.
+ */
+function manualStreamHealthClock() {
+  type Pending = { at: number; callback: () => void };
+  const pending = new Map<number, Pending>();
+  let now = 0;
+  let nextHandle = 1;
+  return {
+    clock: {
+      now: () => now,
+      setTimeout: (callback: () => void, ms: number) => {
+        const handle = nextHandle++;
+        pending.set(handle, { at: now + Math.max(0, ms), callback });
+        return handle as unknown as ReturnType<typeof setTimeout>;
+      },
+      clearTimeout: (timer: ReturnType<typeof setTimeout>) => {
+        pending.delete(timer as unknown as number);
+      },
+    },
+    /** Move virtual time to `target`, running every timer due at or before it in deadline order. */
+    advanceTo(target: number): void {
+      // The bound is deliberate. A watchdog that re-armed an ALREADY expired deadline would keep
+      // scheduling a zero-delay timer, and this loop is synchronous, so Bun's per-test timeout could
+      // never interrupt it: one mutation would wedge the whole lane instead of reddening one case.
+      for (let fired = 0; ; fired += 1) {
+        if (fired > 1_000) {
+          throw new Error("stream-health clock fired 1000 timers without draining: an expired deadline is being re-armed");
+        }
+        const due = [...pending.entries()]
+          .filter(([, timer]) => timer.at <= target)
+          .sort((left, right) => left[1].at - right[1].at)[0];
+        if (!due) break;
+        pending.delete(due[0]);
+        now = Math.max(now, due[1].at);
+        due[1].callback();
+      }
+      now = Math.max(now, target);
+    },
+    now: () => now,
+    armed: () => pending.size,
+  };
+}
+
 async function drain(
   baseUrl: string,
   knobs: { streamSilenceFailMs?: number; streamHeartbeatOnlyFailMs?: number },
@@ -134,14 +186,9 @@ async function drain(
 }
 
 describe("Cursor inbound stream-health watchdog (T04)", () => {
-  // Scale once: the load helper applies a floor, so scaling each deadline separately
-  // would collapse the two clocks to the same value in CI.
-  const silenceMs = isolationBudgetMs(1_000);
-  const heartbeatOnlyMs = 2 * silenceMs;
-  const progressDurationMs = 3 * silenceMs;
-  // Include the existing two-second first-frame allowance and leave time for cleanup.
-  const fixtureLimitMs = 4 * silenceMs + 2_000;
-  const timeoutMs = Math.max(watchdogMs(15_000), fixtureLimitMs + silenceMs);
+  // Bounds a hung case; no assertion here is stated against elapsed real time, so this
+  // never has to cover a synthetic server outrunning a deadline.
+  const caseTimeoutMs = watchdogMs(15_000);
 
   test("silence after the first frame fails the turn with the stall error", async () => {
     await withH2Server(stream => {
@@ -156,80 +203,264 @@ describe("Cursor inbound stream-health watchdog (T04)", () => {
     });
   }, 15_000);
 
-  test("heartbeat-only traffic survives the silence threshold but fails at the heartbeat-only threshold", async () => {
+  test("the silence deadline wins when it is the earlier of the two", async () => {
+    // The case above proves a genuine stall fails the turn on real timers; it cannot prove WHICH
+    // deadline did it, because a longer one arriving later still produces the same message inside
+    // the case timeout. That distinction is the `min(silence, progress)` rule, and dropping it
+    // would relax production silence detection from 30s to 90s while every real-timer case stayed
+    // green. Virtual time pins it: the turn must fail exactly at S, with nothing left armed.
+    const virtualSilenceMs = 1_000;
+    const virtualHeartbeatOnlyMs = 10 * virtualSilenceMs;
+    const timing = manualStreamHealthClock();
+    const connected = Promise.withResolvers<http2.ServerHttp2Stream>();
+    let armedBeforeDeadline: number | undefined;
+    let armedAtDeadline: number | undefined;
+    let failure: Error | undefined;
     await withH2Server(stream => {
       stream.on("error", () => {});
       stream.respond({ ":status": 200, "content-type": "application/connect+proto" });
-      stream.write(Buffer.from(textDeltaFrame("hi")));
-      // Frequent heartbeats/checkpoints keep the silence clock fresh while the
-      // longer heartbeat-only clock must still expire under a loaded test runner.
-      const ping = setInterval(() => {
-        try {
-          stream.write(Buffer.from(heartbeatFrame()));
-          stream.write(Buffer.from(checkpointFrame()));
-        } catch { clearInterval(ping); }
-      }, 40);
-      const limit = setTimeout(() => stream.close(), fixtureLimitMs);
-      stream.on("close", () => {
-        clearInterval(ping);
-        clearTimeout(limit);
+      connected.resolve(stream);
+    }, async baseUrl => {
+      const transport = createLiveCursorTransport({
+        provider: { adapter: "cursor", baseUrl, apiKey: "test-token" },
+        translatorBudget: createTestTranslatorBudget(),
+        firstFrameTimeoutMs: watchdogMs(15_000),
+        streamSilenceFailMs: virtualSilenceMs,
+        streamHeartbeatOnlyFailMs: virtualHeartbeatOnlyMs,
+        streamHealthClock: timing.clock,
       });
+      const iterator = transport.run(runRequest())[Symbol.asyncIterator]();
+      try {
+        const opened = iterator.next();
+        const server = await connected.promise;
+        server.write(Buffer.from(textDeltaFrame("hi")));
+        let first = await opened;
+        while (!first.done && first.value.type !== "text") first = await iterator.next();
+        if (first.done) throw new Error("stream ended before the first text arrived");
+        // then: silence. One frame stamped both clocks, so S is strictly the earlier deadline.
+        timing.advanceTo(virtualSilenceMs - 1);
+        armedBeforeDeadline = timing.armed();
+        timing.advanceTo(virtualSilenceMs);
+        armedAtDeadline = timing.armed();
+        // Cross the progress deadline too, so a watchdog that ignored S reports itself instead of
+        // leaving this case to hang to its own timeout.
+        timing.advanceTo(virtualHeartbeatOnlyMs + 1);
+        for (;;) {
+          const result = await iterator.next();
+          if (result.done) break;
+        }
+      } catch (err) {
+        failure = err instanceof Error ? err : new Error(String(err));
+      } finally {
+        await transport.close?.();
+      }
+    });
+    expect(failure).toBeDefined();
+    expect(failure!.message).toContain("no inbound frames");
+    expect(failure!.message).not.toContain("heartbeat-only");
+    // The watchdog identifies itself: the two branches share this prefix.
+    expect(failure!.message).toContain("Cursor stream stalled");
+    // Armed one tick before S and gone at S: the deadline was S, not the progress budget.
+    expect(armedBeforeDeadline).toBe(1);
+    expect(armedAtDeadline).toBe(0);
+  }, caseTimeoutMs);
+
+  test("liveness-only traffic keeps the silence clock fresh and still fails at the heartbeat-only threshold", async () => {
+    // Which clock expires is the contract. Stating it against real timers also states that a real
+    // interval outran a real deadline: the case had to keep liveness frames arriving with no gap
+    // longer than the silence budget for the whole heartbeat-only window, and a runner that pauses
+    // longer than one budget made the SILENCE watchdog win while both watchdogs behaved correctly.
+    // Virtual time removes that term — timers fire only from `advanceTo`, so contention can delay a
+    // frame's arrival (which this case waits for) without any deadline passing. Same seam #5131 used
+    // for the re-arming case below; production budgets and every other timer are untouched.
+    const virtualSilenceMs = 1_000;
+    const virtualHeartbeatOnlyMs = 2 * virtualSilenceMs;
+    const timing = manualStreamHealthClock();
+    const connected = Promise.withResolvers<http2.ServerHttp2Stream>();
+    const messages: CursorServerMessage[] = [];
+    const armedAfterLiveness: number[] = [];
+    let armedAfterDeadline: number | undefined;
+    let failure: Error | undefined;
+    await withH2Server(stream => {
+      stream.on("error", () => {});
+      stream.respond({ ":status": 200, "content-type": "application/connect+proto" });
+      connected.resolve(stream);
     }, async baseUrl => {
-      const { failure } = await drain(baseUrl, {
-        streamSilenceFailMs: silenceMs,
-        streamHeartbeatOnlyFailMs: heartbeatOnlyMs,
+      const transport = createLiveCursorTransport({
+        provider: { adapter: "cursor", baseUrl, apiKey: "test-token" },
+        translatorBudget: createTestTranslatorBudget(),
+        // Stays on the real clock: it owns dial and first response, not this contract.
+        firstFrameTimeoutMs: watchdogMs(15_000),
+        streamSilenceFailMs: virtualSilenceMs,
+        streamHeartbeatOnlyFailMs: virtualHeartbeatOnlyMs,
+        streamHealthClock: timing.clock,
       });
+      const iterator = transport.run(runRequest())[Symbol.asyncIterator]();
+      try {
+        // The first next() dials and puts the request on the wire.
+        const opened = iterator.next();
+        const server = await connected.promise;
+        const nextOfType = async (
+          type: CursorServerMessage["type"],
+          pending?: Promise<IteratorResult<CursorServerMessage>>,
+        ) => {
+          let result = await (pending ?? iterator.next());
+          while (!result.done && result.value.type !== type) {
+            messages.push(result.value);
+            result = await iterator.next();
+          }
+          if (result.done) throw new Error(`stream ended before a ${type} message arrived`);
+          messages.push(result.value);
+        };
+        // One meaningful frame stamps both clocks and arms the watchdog.
+        server.write(Buffer.from(textDeltaFrame("hi")));
+        await nextOfType("text", opened);
+        // Advance BEFORE writing so each pair lands at that virtual instant, just under the silence
+        // deadline the previous frame set. A checkpoint is a progress frame, so it yields a
+        // `heartbeat` message; the bare heartbeat frame yields nothing outward. The frame chain is
+        // serialized, so awaiting the checkpoint's message proves both were decoded and the
+        // watchdog re-armed from the later of them.
+        for (const landing of [900, 1_800]) {
+          timing.advanceTo(landing);
+          server.write(Buffer.from(heartbeatFrame()));
+          server.write(Buffer.from(checkpointFrame()));
+          await nextOfType("heartbeat");
+          armedAfterLiveness.push(timing.armed());
+        }
+        // Silence was refreshed at 1800 and the progress clock never was, so 2S can only be the
+        // heartbeat-only deadline.
+        timing.advanceTo(virtualHeartbeatOnlyMs);
+        armedAfterDeadline = timing.armed();
+        // Had liveness frames wrongly refreshed the progress clock, nothing fires at 2S and the only
+        // surviving deadline is silence at 1800 + S. Cross it so this case reports which watchdog won
+        // instead of hanging to its own timeout.
+        timing.advanceTo(1_800 + virtualSilenceMs + 100);
+        for (;;) {
+          const result = await iterator.next();
+          if (result.done) break;
+          messages.push(result.value);
+        }
+      } catch (err) {
+        failure = err instanceof Error ? err : new Error(String(err));
+      } finally {
+        await transport.close?.();
+      }
+    });
+    expect(failure).toBeDefined();
+    // Say which watchdog won. A bare toContain reported only the expected substring, which reads as
+    // "the heartbeat-only watchdog is broken" when the real story was the silence watchdog firing first.
+    expect(failure!.message).toContain("heartbeat-only");
+    expect(failure!.message).not.toContain("no inbound frames");
+    expect(failure!.message).toContain("Cursor stream stalled");
+    // The heartbeat-only deadline fired at exactly 2S: nothing was left armed behind it.
+    expect(armedAfterDeadline).toBe(0);
+    // Liveness frames refreshed the silence clock and left one timer armed, never a stacked pair.
+    expect(armedAfterLiveness).toEqual([1, 1]);
+    expect(messages.some(message => message.type === "heartbeat")).toBe(true);
+  }, caseTimeoutMs);
+
+  test("the progress clock fires on real timers when the silence budget is out of reach", async () => {
+    // The firing half needs no seam. With a silence budget two orders of magnitude beyond the
+    // progress budget, the only deadline in reach is the progress one, so ordinary load delays this
+    // case rather than changing its outcome: a pause long enough to cross 60s of silence as well,
+    // and so be reported as silence instead, has already blown the case's own 15s limit. The
+    // production default clock (Date.now plus the global timers) stays on the heartbeat-only path.
+    // What this pins is that the progress budget alone can fail a turn through that clock, and that
+    // the reported branch is selected by which budget was crossed
+    // rather than by whether liveness frames were seen. What it cannot state is stated under the
+    // injected clock above: that the deadline is the minimum of both clocks, and that liveness
+    // frames refresh the silence clock. Both of those are "a deadline did not expire" claims.
+    await withH2Server(stream => {
+      stream.on("error", () => {});
+      stream.respond({ ":status": 200, "content-type": "application/connect+proto" });
+      stream.write(Buffer.from(textDeltaFrame("hi")));
+      // then: silence — never end the stream
+    }, async baseUrl => {
+      const { failure } = await drain(baseUrl, { streamSilenceFailMs: 60_000, streamHeartbeatOnlyFailMs: 600 });
       expect(failure).toBeDefined();
-      // Assert on the message, and say which watchdog won when the wrong one does.
-      // A bare toContain here reported only the expected substring, which reads as
-      // "the heartbeat-only watchdog is broken" when the real story is that the
-      // silence watchdog fired first on a loaded runner.
       expect(failure!.message).toContain("heartbeat-only");
+      expect(failure!.message).not.toContain("no inbound frames");
     });
-  }, timeoutMs);
+  }, 15_000);
 
   test("meaningful frames keep resetting both clocks; turnEnded finishes cleanly", async () => {
-    let firstTextReceivedAt: number | undefined;
-    let completedProgressSpan = false;
+    // Virtual budgets: nothing here is scaled for CI, because no real interval has to beat them.
+    const virtualSilenceMs = 1_000;
+    const virtualHeartbeatOnlyMs = 2 * virtualSilenceMs;
+    const timing = manualStreamHealthClock();
+    const connected = Promise.withResolvers<http2.ServerHttp2Stream>();
+    const messages: CursorServerMessage[] = [];
+    const armedAfterFrame: number[] = [];
+    let armedAfterTurnEnded: number | undefined;
+    let failure: Error | undefined;
     await withH2Server(stream => {
       stream.on("error", () => {});
       stream.respond({ ":status": 200, "content-type": "application/connect+proto" });
-      stream.write(Buffer.from(textDeltaFrame("part-0")));
-      const latestEndAt = performance.now() + fixtureLimitMs;
-      let count = 0;
-      const tick = setInterval(() => {
-        count += 1;
-        try {
-          const now = performance.now();
-          const progressComplete = firstTextReceivedAt !== undefined
-            && now - firstTextReceivedAt >= progressDurationMs;
-          if (progressComplete || now >= latestEndAt) {
-            completedProgressSpan = progressComplete;
-            stream.write(Buffer.from(turnEndedFrame()));
-            stream.end();
-            clearInterval(tick);
-          } else {
-            stream.write(Buffer.from(textDeltaFrame(`part-${count}`)));
+      connected.resolve(stream);
+    }, async baseUrl => {
+      const transport = createLiveCursorTransport({
+        provider: { adapter: "cursor", baseUrl, apiKey: "test-token" },
+        translatorBudget: createTestTranslatorBudget(),
+        // Stays on the real clock: it owns dial and first response, not this contract. Generous
+        // so a slow local dial cannot pre-empt the case; a real hang is bounded by the timeout.
+        firstFrameTimeoutMs: watchdogMs(15_000),
+        streamSilenceFailMs: virtualSilenceMs,
+        streamHeartbeatOnlyFailMs: virtualHeartbeatOnlyMs,
+        streamHealthClock: timing.clock,
+      });
+      const iterator = transport.run(runRequest())[Symbol.asyncIterator]();
+      try {
+        // The first next() dials and puts the request on the wire.
+        const opened = iterator.next();
+        const server = await connected.promise;
+        const textFrame = async (label: string, pending?: Promise<IteratorResult<CursorServerMessage>>) => {
+          server.write(Buffer.from(textDeltaFrame(label)));
+          let result = await (pending ?? iterator.next());
+          while (!result.done && result.value.type !== "text") {
+            messages.push(result.value);
+            result = await iterator.next();
           }
-        } catch {
-          clearInterval(tick);
-          stream.destroy();
+          if (result.done) throw new Error(`stream ended before the ${label} text arrived`);
+          messages.push(result.value);
+          // Awaiting the yielded message is the synchronization: noteInboundFrame has run by the
+          // time the frame it decoded reaches the consumer, so the re-armed timer is observable.
+          armedAfterFrame.push(timing.armed());
+        };
+        await textFrame("part-0", opened);
+        // Every frame lands just under the deadline the previous one set, and the four of them
+        // carry virtual time past both non-resetting deadlines (S and 2S). That is the whole
+        // claim: each deadline is recomputed from the newest frame, not from the first one.
+        const landings = [900, 1_800, 2_700];
+        for (let index = 0; index < landings.length; index += 1) {
+          timing.advanceTo(landings[index]!);
+          await textFrame(`part-${index + 1}`);
         }
-      }, 100);
-      stream.on("close", () => clearInterval(tick));
-    }, async baseUrl => {
-      // Observe progress for 3S after receipt: both non-resetting deadlines (S and 2S)
-      // would expire before turnEnded, even when the first text reaches us late.
-      const { messages, failure } = await drain(baseUrl, {
-        streamSilenceFailMs: silenceMs,
-        streamHeartbeatOnlyFailMs: heartbeatOnlyMs,
-      }, () => { firstTextReceivedAt = performance.now(); });
-      expect(failure).toBeUndefined();
-      expect(completedProgressSpan).toBe(true);
-      expect(messages.some(message => message.type === "text")).toBe(true);
-      expect(messages.some(message => message.type === "done")).toBe(true);
+        server.write(Buffer.from(turnEndedFrame()));
+        server.end();
+        for (;;) {
+          const result = await iterator.next();
+          if (result.done) break;
+          messages.push(result.value);
+        }
+        // Read before close(), which would clear the timer on its own.
+        armedAfterTurnEnded = timing.armed();
+      } catch (err) {
+        failure = err instanceof Error ? err : new Error(String(err));
+      } finally {
+        await transport.close?.();
+      }
     });
-  }, timeoutMs);
+    expect(failure).toBeUndefined();
+    // One timer after every frame: the previous one was cleared rather than left stacked.
+    expect(armedAfterFrame).toEqual([1, 1, 1, 1]);
+    expect(timing.now()).toBeGreaterThan(virtualHeartbeatOnlyMs);
+    expect(messages.some(message => message.type === "text")).toBe(true);
+    expect(messages.some(message => message.type === "done")).toBe(true);
+    // turnEnded disarmed the watchdog, so no deadline survives the turn to fail it later.
+    expect(armedAfterTurnEnded).toBe(0);
+    timing.advanceTo(timing.now() + 10 * virtualHeartbeatOnlyMs);
+    expect(failure).toBeUndefined();
+  }, caseTimeoutMs);
 
   test("turnEnded disarms the watchdog even when the server holds the stream open", async () => {
     await withH2Server(stream => {
diff --git a/tests/providers/cursor/cursor-tool-suspended-checkpoint.test.ts b/tests/providers/cursor/cursor-tool-suspended-checkpoint.test.ts
index a365327a067..85c92eb8eb9 100644
--- a/tests/providers/cursor/cursor-tool-suspended-checkpoint.test.ts
+++ b/tests/providers/cursor/cursor-tool-suspended-checkpoint.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { createCursorAdapter as createCursorAdapterProduction } from "../../../src/adapters/cursor";
 import { clearCursorCheckpointsForTests, cursorCheckpointShape, getCursorCheckpoint } from "../../../src/adapters/cursor/checkpoint-store";
+import { createCursorRequest } from "../../../src/adapters/cursor/request-builder";
 import { create, toBinary } from "@bufbuild/protobuf";
 import { ConversationStateStructureSchema } from "../../../src/adapters/cursor/gen/agent_pb";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
@@ -55,7 +56,25 @@ describe("tool-suspended checkpoint commit (devlog 260826 050)", () => {
     if (done?.type !== "done") throw new Error("expected done");
     expect(done.providerState?.cursor?.checkpointRef).toBeDefined();
     expect(done.providerState?.cursor?.checkpointUsable).toBe(false);
-    expect(getCursorCheckpoint(done.providerState?.cursor?.checkpointRef)).toBeDefined();
+    expect(getCursorCheckpoint(done.providerState?.cursor?.checkpointRef)?.toolSuspended).toBe(true);
+
+    // A ref-less prefix lookup sees the suspension on the snapshot itself: a request
+    // whose trailing message is not a toolResult must not resume bytes that upstream
+    // serialized mid-tool-call.
+    const retry = createCursorRequest(body("cursor/grok-4.6"));
+    expect(retry.continuationMode).toBe("full-replay");
+    expect(retry.checkpointInvalidationReason).toBe("trailing_tool_result");
+
+    const continuation = body("cursor/grok-4.6");
+    continuation.context.messages.push({
+      role: "toolResult",
+      toolCallId: "call_x",
+      content: "sunny",
+      timestamp: 2,
+    });
+    const resumed = createCursorRequest(continuation);
+    expect(resumed.continuationMode).toBe("checkpoint");
+    expect(resumed.checkpointBytes).toEqual(checkpointBytes);
     clearCursorCheckpointsForTests();
   });
 
diff --git a/tests/providers/cursor/cursor-ultra-mode.test.ts b/tests/providers/cursor/cursor-ultra-mode.test.ts
index 57587c290b4..963bff6f842 100644
--- a/tests/providers/cursor/cursor-ultra-mode.test.ts
+++ b/tests/providers/cursor/cursor-ultra-mode.test.ts
@@ -83,13 +83,20 @@ describe("cursor ultra (-1m / Max Mode) toggle (devlog 260826 070)", () => {
     expect(decoded.modelDetails?.maxMode ?? false).toBe(false);
   });
 
-  test("account filter admits the synthetic row through its base availability", () => {
+  test("account filter admits the synthetic row only with base and Max Mode availability", () => {
     const configured = [{ id: "kimi-k3-1m" }, { id: "kimi-k3" }];
     const live = ["kimi-k3-high", "kimi-k3-max"];
-    const filtered = filterCursorConfiguredModelsByLiveDiscovery(configured, live);
+    const filtered = filterCursorConfiguredModelsByLiveDiscovery(configured, live, ["kimi-k3-max"]);
     expect(filtered.map(model => model.id)).toEqual(["kimi-k3-1m", "kimi-k3"]);
   });
 
+  test("account filter hides the synthetic row without discovered Max Mode capability", () => {
+    const configured = [{ id: "kimi-k3-1m" }, { id: "kimi-k3" }];
+    const live = ["kimi-k3-high", "kimi-k3-max"];
+    const filtered = filterCursorConfiguredModelsByLiveDiscovery(configured, live);
+    expect(filtered.map(model => model.id)).toEqual(["kimi-k3"]);
+  });
+
   test("ultra id set stays narrow and every entry rides its base's static row", () => {
     for (const id of CURSOR_ULTRA_1M_MODEL_IDS) {
       const base = id.slice(0, -"-1m".length);
diff --git a/tests/providers/cyber-policy-error-fidelity.test.ts b/tests/providers/cyber-policy-error-fidelity.test.ts
index bff86a295ac..7adc39f3f22 100644
--- a/tests/providers/cyber-policy-error-fidelity.test.ts
+++ b/tests/providers/cyber-policy-error-fidelity.test.ts
@@ -17,6 +17,7 @@ import { formatPassthroughUpstreamError } from "../../src/server/responses/passt
 import { consumeComboFailure } from "../../src/server/responses/core";
 import { handleResponses } from "../../src/server/responses";
 import type { AdapterEvent, OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { createTestTranslatorBudget, withTestTranslatorBudget } from "../helpers/translator-budget";
 
 const createOpenAIChatAdapter = (...args: Parameters<typeof createOpenAIChatAdapterProduction>) =>
@@ -219,6 +220,8 @@ describe("cyber_policy error fidelity", () => {
         },
       },
     } as OcxConfig;
+    // Taken after the inherited test home is in effect so physical dispatch can open its ledger.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -235,6 +238,8 @@ describe("cyber_policy error fidelity", () => {
         },
       });
     } finally {
+      // Released before surrounding teardown can replace the home and strand its live ledger.
+      releaseSpendHome();
       upstream.stop(true);
     }
   });
@@ -475,4 +480,3 @@ describe("#2488 nested policy identity is not hidden by an outer envelope", () =
     expect(failure.response.status).toBe(502);
   });
 });
-
diff --git a/tests/providers/deepseek-inbound-wire.test.ts b/tests/providers/deepseek-inbound-wire.test.ts
index fa2b686a2df..0db58c6a6f6 100644
--- a/tests/providers/deepseek-inbound-wire.test.ts
+++ b/tests/providers/deepseek-inbound-wire.test.ts
@@ -25,6 +25,7 @@ import { MAX_SYNTHESIZED_OUTPUT_ITEMS } from "../../src/server/responses-json-ev
 import type { ResponsesTerminalRepairScheduler } from "../../src/server/responses-terminal-repair";
 import { sendResponseToWebSocket } from "../../src/server/ws-bridge";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { withTestTranslatorBudget } from "../helpers/translator-budget";
 
 const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) =>
@@ -33,6 +34,13 @@ const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResp
 const MODEL = "deepseek-v4-flash";
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
+// Release before the next case so a failed dispatch cannot leave an ownership conflict.
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
 
 class ManualTerminalScheduler implements ResponsesTerminalRepairScheduler {
   private current = 0;
@@ -165,7 +173,10 @@ describe("DeepSeek wire selection is scoped to the inbound protocol", () => {
 
 describe("the inbound scope survives the handleResponses replay", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    dropSpendHome();
+    globalThis.fetch = originalFetch;
+  });
 
   function captureUpstreamRequests(): Array<{ url: string; body: Record<string, unknown> }> {
     const requests: Array<{ url: string; body: Record<string, unknown> }> = [];
@@ -190,7 +201,8 @@ describe("the inbound scope survives the handleResponses replay", () => {
   ): Promise<{ url: string; body: Record<string, unknown> }> {
     const requests = captureUpstreamRequests();
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
-    await handleResponses(
+    takeSpendHome();
+    const turn = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -203,6 +215,9 @@ describe("the inbound scope survives the handleResponses replay", () => {
         ...(inboundTransport === undefined ? {} : { inboundTransport }),
       },
     );
+    // The turn's body is a live stream. Releasing it here means no reader is still attached
+    // when the lease is dropped, which is what turns a finished case into a pending one.
+    await turn.body?.cancel();
     return requests[0] ?? { url: "", body: {} };
   }
 
@@ -250,6 +265,7 @@ describe("the inbound scope survives the handleResponses replay", () => {
       abortSignal: testAbort.signal,
       responsesTerminalRepairScheduler: scheduler,
     } as Parameters<typeof handleResponses>[3];
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -329,6 +345,7 @@ describe("the inbound scope survives the handleResponses replay", () => {
     }) as typeof fetch;
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
     const abort = new AbortController();
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -441,6 +458,7 @@ describe("the inbound scope survives the handleResponses replay", () => {
 
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
     const deadline = AbortSignal.timeout(5_000);
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -498,6 +516,7 @@ describe("the inbound scope survives the handleResponses replay", () => {
     // The plain provider seed carries no explicit repair config; the registry's
     // { repairInvalidIds: true } policy must reach the live route via backfill.
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -525,6 +544,7 @@ describe("the inbound scope survives the handleResponses replay", () => {
     })) as typeof fetch;
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
     const abort = new AbortController();
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -610,6 +630,7 @@ describe("the bounded-JSON mechanism stays alive behind a synthetic registry ent
     });
   });
   afterEach(() => {
+    dropSpendHome();
     globalThis.fetch = originalFetch;
     const index = mutableRegistry.findIndex(entry => entry.id === FIXTURE_ID);
     if (index >= 0) mutableRegistry.splice(index, 1);
@@ -655,6 +676,7 @@ describe("the bounded-JSON mechanism stays alive behind a synthetic registry ent
     options: { stream?: boolean; websocket?: boolean } = {},
   ): Promise<Response> {
     const config = { providers: { [FIXTURE_ID]: provider } } as unknown as OcxConfig;
+    takeSpendHome();
     return handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/providers/deepseek-responses-item-id-repair.test.ts b/tests/providers/deepseek-responses-item-id-repair.test.ts
index ed95f2394ce..fad25426610 100644
--- a/tests/providers/deepseek-responses-item-id-repair.test.ts
+++ b/tests/providers/deepseek-responses-item-id-repair.test.ts
@@ -8,6 +8,7 @@ import {
 } from "../../src/server/responses-item-id-repair";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
 
 const UUID_MSG = "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d";
@@ -166,7 +167,13 @@ describe("registry-derived DeepSeek repair policy (#938)", () => {
 
 describe("streamed HTTP path carries canonical ids (#938)", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  let releaseSpendHome: (() => void) | undefined;
+  afterEach(() => {
+    // Release first so a failed stream cannot leak writer ownership into the next case.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   test("the relayed SSE contains no upstream UUID item ids (un-enriched saved seed)", async () => {
     // The live path must backfill the registry policy through routedProviderConfig —
@@ -199,6 +206,8 @@ describe("streamed HTTP path carries canonical ids (#938)", () => {
     }) as typeof fetch;
 
     const config = { providers: { deepseek: plainSeed } } as unknown as OcxConfig;
+    // Direct dispatch needs the writer lease to prevent spend-ledger ownership failures.
+    releaseSpendHome = acquireOwnedSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/providers/devin-adapter.test.ts b/tests/providers/devin-adapter.test.ts
index a50a3d96e4d..7407252db2a 100644
--- a/tests/providers/devin-adapter.test.ts
+++ b/tests/providers/devin-adapter.test.ts
@@ -483,9 +483,8 @@ describe("devin adapter api-server host resolution (#4503)", () => {
     home = mkdtempSync(join(tmpdir(), "ocx-devin-host-"));
     process.env.OPENCODEX_HOME = home;
     seenUrls = [];
-    // This adapter's transport fetches through the global fetch — it does not
-    // consume IncomingMeta.providerFetch — so the stub observes every upstream
-    // URL the turn dispatches to.
+    // No providerFetch is supplied by this direct adapter test, so inference falls back to the
+    // global fetch alongside catalog/JWT RPCs and this stub observes every upstream URL.
     globalThis.fetch = (async (input: RequestInfo | URL) => {
       seenUrls.push(String(input));
       return new Response("down", { status: 500 });
diff --git a/tests/providers/devin-cli-authmode-migration.test.ts b/tests/providers/devin-cli-authmode-migration.test.ts
index 01f66a28cf2..6861f08f3c6 100644
--- a/tests/providers/devin-cli-authmode-migration.test.ts
+++ b/tests/providers/devin-cli-authmode-migration.test.ts
@@ -12,7 +12,7 @@ describe("devin-cli retired-adapter migration", () => {
   // devin-provider-merge-migration.ts: the `devin-cli` registry entry is gone,
   // so the PROVIDER_REGISTRY lookup that gated the local -> oauth rewrite here
   // could never fire again. What remains is the adapter repair, which must
-  // keep working for custom-named rows that no registry pin protects.
+  // fail closed for custom-named rows that no registry pin protects.
 
   test("rewrites the registry-id row that still names the removed ACP adapter", () => {
     // The ACP adapter is gone, so the saved id is no longer constructible. The
@@ -25,20 +25,21 @@ describe("devin-cli retired-adapter migration", () => {
     expect(p.warnings.join(" ")).toContain("devin-cli -> devin");
   });
 
-  test("converts a custom-named ACP row, which no registry pin protects", () => {
-    // `devin-acp` was the documented escape hatch. Nothing pins a custom name,
-    // so after the removal this row is the one that would throw
-    // `Unknown adapter: devin-cli` on every request.
+  test("leaves a custom-named ACP row unchanged pending explicit authentication", () => {
     const config = {
       providers: {
         "devin-acp": { adapter: "devin-cli", baseUrl: "https://cli.devin.ai" },
       },
     } as unknown as Parameters<typeof projectDevinCliAuthMode>[0];
     const p = projectDevinCliAuthMode(config);
-    expect(p.changed).toBe(true);
-    expect(p.config.providers!["devin-acp"]!.adapter).toBe("devin");
-    expect(p.config.providers!["devin-acp"]!.baseUrl).toBe("https://server.codeium.com");
-    expect(p.warnings.join(" ")).toContain("devin-acp");
+    expect(p.changed).toBe(false);
+    expect(p.config.providers!["devin-acp"]).toEqual({
+      adapter: "devin-cli",
+      baseUrl: "https://cli.devin.ai",
+    });
+    expect(p.warnings.join(" ")).toContain('left custom provider "devin-acp" unchanged');
+    expect(p.warnings.join(" ")).toContain("not migrated");
+    expect(p.warnings.join(" ")).toContain("configure Devin authentication explicitly");
   });
 
   test("leaves a non-ACP baseUrl alone while still retiring the adapter", () => {
diff --git a/tests/providers/devin-hardening.test.ts b/tests/providers/devin-hardening.test.ts
index 319b1330614..0e9323b5be3 100644
--- a/tests/providers/devin-hardening.test.ts
+++ b/tests/providers/devin-hardening.test.ts
@@ -12,6 +12,8 @@ import { connectTrailerHttpStatus } from "../../src/adapters/devin/cloud-direct/
 import { devinErrorClassification, mergeDevinUsage } from "../../src/adapters/devin";
 import { iterFields } from "../../src/adapters/devin/cloud-direct/wire";
 import { buildMetadata, normalizeDevinSessionToken } from "../../src/adapters/devin/cloud-direct/metadata";
+import { parseRequest } from "../../src/responses/parser";
+import { encodeReasoningEnvelope } from "../../src/responses/reasoning-envelope";
 
 /** Tag -> field for one encoded proto message. */
 function iterFieldMap(buf: Buffer): Record<number, { wire: number; value: unknown }> {
@@ -496,6 +498,128 @@ describe("devin reasoning replay", () => {
     expect(history.find(m => m.role === "assistant")?.thinking).toBe("only thought");
   });
 
+  test("independently signed blocks replay every chain and go unsigned rather than mispaired", () => {
+    // The wire carries one thinking/signature pair. Sending every block's text under the last
+    // block's signature attests words that signature never covered; sending only the last
+    // block's text to keep the pair throws away reasoning the turn actually produced. #11 takes
+    // the whole chain and #12 is omitted, because no single attestation covers the joined text.
+    const history = mapOcxMessagesToDevin(parsedWith([
+      {
+        role: "assistant",
+        content: [
+          { type: "thinking", thinking: "first thought", signature: "sig-first" },
+          { type: "thinking", thinking: "final thought", signature: "sig-final" },
+        ],
+      },
+    ]));
+    expect(history[0]?.thinking).toBe("first thought\nfinal thought");
+    expect(history[0]?.signature).toBeUndefined();
+
+    // One signed block is the ordinary shape and still pairs: the text replayed IS the text
+    // the signature attests, so dropping #12 here would lose a valid attestation for nothing.
+    const single = mapOcxMessagesToDevin(parsedWith([
+      { role: "assistant", content: [{ type: "thinking", thinking: "only thought", signature: "sig-only" }] },
+    ]));
+    expect(single[0]?.thinking).toBe("only thought");
+    expect(single[0]?.signature).toBe("sig-only");
+
+    // A signed block followed by an unsigned one is the same ambiguity in the other direction.
+    const unsignedLast = mapOcxMessagesToDevin(parsedWith([
+      {
+        role: "assistant",
+        content: [
+          { type: "thinking", thinking: "signed thought", signature: "sig-signed" },
+          { type: "thinking", thinking: "unsigned thought" },
+        ],
+      },
+    ]));
+    expect(unsignedLast[0]?.thinking).toBe("signed thought\nunsigned thought");
+    expect(unsignedLast[0]?.signature).toBeUndefined();
+  });
+
+  test("a signature-only tail block cannot steal the pair or drop the turn", () => {
+    // Encrypted-only reasoning parts (thinking: "" + signature) are real: the
+    // Responses parser emits them for opaque blobs. Picking one as the replay
+    // unit used to send a signature with no thinking and drop a reasoning-only
+    // turn outright. Fed through the real parser: direct part injection used to
+    // bypass the shapes replay actually carries (including the unsigned-item
+    // signature dump covered below).
+    const reasoningOnly = mapOcxMessagesToDevin(parseRequest({
+      model: "swe-2",
+      input: [
+        { type: "reasoning", id: "rs_signed", summary: [], encrypted_content: encodeReasoningEnvelope({ txt: "signed thought", sig: "sig-signed" }) },
+        { type: "reasoning", id: "rs_orphan", summary: [], encrypted_content: encodeReasoningEnvelope({ sig: "sig-orphan" }) },
+      ],
+    }));
+    expect(reasoningOnly[0]?.thinking).toBe("signed thought");
+    expect(reasoningOnly[0]?.signature).toBe("sig-signed");
+
+    const trailingText = mapOcxMessagesToDevin(parseRequest({
+      model: "swe-2",
+      input: [
+        { type: "reasoning", id: "rs_signed", summary: [], encrypted_content: encodeReasoningEnvelope({ txt: "signed thought", sig: "sig-signed" }) },
+        { type: "reasoning", id: "rs_orphan", summary: [], encrypted_content: encodeReasoningEnvelope({ sig: "sig-orphan" }) },
+        { type: "message", role: "assistant", content: [{ type: "output_text", text: "answer" }] },
+      ],
+    }));
+    const assistant = trailingText.find(m => m.role === "assistant");
+    expect(assistant?.thinking).toBe("signed thought");
+    expect(assistant?.signature).toBe("sig-signed");
+    expect(assistant?.content).toBe("answer");
+  });
+
+  test("an unsigned reasoning part's serialized item is never sent as the signature", () => {
+    // The parser stores JSON.stringify(reasoningItem) on an unsigned thinking
+    // part so the opaque item survives a same-provider round trip. Cognition's
+    // #12 expects the service's own issued token, so the dump must be dropped
+    // at the field boundary rather than relayed as an attestation.
+    const parsed = parseRequest({
+      model: "swe-2",
+      input: [
+        { type: "reasoning", id: "rs_unsigned", summary: [{ type: "summary_text", text: "unsigned thought" }] },
+        { type: "message", role: "assistant", content: [{ type: "output_text", text: "answer" }] },
+      ],
+    });
+    const thinkingPart = parsed.context.messages
+      .find(m => m.role === "assistant")?.content
+      .find(p => p.type === "thinking") as { signature?: string } | undefined;
+    const dumped = JSON.parse(thinkingPart?.signature ?? "null") as { type?: string } | null;
+    expect(dumped?.type).toBe("reasoning");
+
+    const history = mapOcxMessagesToDevin(parsed);
+    const assistant = history.find(m => m.role === "assistant");
+    expect(assistant?.thinking).toBe("unsigned thought");
+    expect(assistant?.signature).toBeUndefined();
+
+    const unsignedReq = buildGetChatMessageRequestForTests({
+      apiKey: "devin-session-token$x",
+      modelUid: "swe-2",
+      messages: history,
+      cascadeId: "c",
+    } as never);
+    const unsignedPrompts = fieldsOf(unsignedReq)[3] ?? [];
+    const unsignedPrompt = unsignedPrompts.map(fieldsOf).find(p => p[11]);
+    expect(unsignedPrompt?.[11]?.[0]?.toString("utf8")).toBe("unsigned thought");
+    expect(unsignedPrompt?.[12]).toBeUndefined();
+  });
+
+  test("an opaque signature the service issued still rides #12 whatever its spelling", () => {
+    // The counter-case to the one above: #12 is opaque, so the field boundary denies exactly
+    // one known shape — the parser's own serialized reasoning item — and nothing else. An
+    // allow-list written around Anthropic's base64 spelling would silently drop both of these,
+    // which is why this adapter does not borrow one.
+    for (const signature of [
+      "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0aG91Z2h0In0.c2lnbmF0dXJl",
+      '{"type":"attestation","issuer":"cognition","v":1}',
+      "sig with spaces and + slashes/",
+    ]) {
+      const history = mapOcxMessagesToDevin(parsedWith([
+        { role: "assistant", content: [{ type: "thinking", thinking: "thought", signature }] },
+      ]));
+      expect(history.find(m => m.role === "assistant")?.signature).toBe(signature);
+    }
+  });
+
   test("the encoded prompt carries thinking at #11 and its signature at #12", () => {
     const req = buildGetChatMessageRequestForTests({
       apiKey: "devin-session-token$x",
diff --git a/tests/providers/devin-image-passthrough.test.ts b/tests/providers/devin-image-passthrough.test.ts
index e9445abe2f4..b9a5ec57e54 100644
--- a/tests/providers/devin-image-passthrough.test.ts
+++ b/tests/providers/devin-image-passthrough.test.ts
@@ -53,6 +53,17 @@ describe("user image passthrough", () => {
     const user = items.find(i => i.role === "user")!;
     expect(user.content).toEqual([{ type: "text", text: "[image url: https://example.com/pic.png]" }]);
   });
+
+  test("an oversized remote image URL is not copied into prompt text", () => {
+    const attackerControlledSuffix = "a".repeat(9_000);
+    const items = mapOcxMessagesToDevin(parsedWith([{
+      role: "user",
+      content: [{ type: "image", imageUrl: `https://example.com/${attackerControlledSuffix}` }],
+    }]));
+    const user = items.find(i => i.role === "user")!;
+    expect(user.content).toEqual([{ type: "text", text: "[image omitted: unsupported or oversized URL]" }]);
+    expect(JSON.stringify(user.content)).not.toContain(attackerControlledSuffix);
+  });
 });
 
 describe("tool-result image passthrough", () => {
diff --git a/tests/providers/devin-stated-reset-hardening.test.ts b/tests/providers/devin-stated-reset-hardening.test.ts
index 0dac8ed0e32..2618b920414 100644
--- a/tests/providers/devin-stated-reset-hardening.test.ts
+++ b/tests/providers/devin-stated-reset-hardening.test.ts
@@ -74,14 +74,20 @@ describe("Devin cumulative stated-reset allowance", () => {
   test("cancellation at the sleep-completion boundary prevents replay", async () => {
     const controller = new AbortController();
     let calls = 0;
-    const stream = async function* (): AsyncGenerator<CloudChatEvent> {
+    let inferenceSends = 0;
+    const stream = async function* (req: CloudChatRequest): AsyncGenerator<CloudChatEvent> {
       calls += 1;
+      await req.executor!("https://example.invalid/GetChatMessage");
       throw cap("reset in 1 second");
     };
     await expect(drain(streamChatEventsWithResetRetry({ ...request, signal: controller.signal }, {
       stream, sleep: async () => { controller.abort(); },
+      execution: {
+        executor: (async () => { inferenceSends += 1; return new Response(); }) as typeof fetch,
+      },
     }))).rejects.toHaveProperty("name", "AbortError");
     expect(calls).toBe(1);
+    expect(inferenceSends).toBe(1);
   });
 
   test.each([
@@ -91,13 +97,21 @@ describe("Devin cumulative stated-reset allowance", () => {
     { kind: "reasoning_signature", signature: "sig" },
   ] as CloudChatEvent[])("never retries after an event: %j", async event => {
     let calls = 0;
-    const stream = async function* (): AsyncGenerator<CloudChatEvent> {
+    let inferenceSends = 0;
+    const stream = async function* (req: CloudChatRequest): AsyncGenerator<CloudChatEvent> {
       calls += 1;
+      await req.executor!("https://example.invalid/GetChatMessage");
       yield event;
       throw cap("reset in 1 second");
     };
-    await expect(drain(streamChatEventsWithResetRetry(request, { stream }))).rejects.toThrow("reset in 1 second");
+    await expect(drain(streamChatEventsWithResetRetry(request, {
+      stream,
+      execution: {
+        executor: (async () => { inferenceSends += 1; return new Response(); }) as typeof fetch,
+      },
+    }))).rejects.toThrow("reset in 1 second");
     expect(calls).toBe(1);
+    expect(inferenceSends).toBe(1);
   });
 
   test("explicit zero disables waiting; overlarge overrides stay bounded", () => {
diff --git a/tests/providers/devin-stated-reset-retry.test.ts b/tests/providers/devin-stated-reset-retry.test.ts
index 18e7ef9ce6b..305372ad0ee 100644
--- a/tests/providers/devin-stated-reset-retry.test.ts
+++ b/tests/providers/devin-stated-reset-retry.test.ts
@@ -7,6 +7,7 @@
 import { describe, expect, test } from "bun:test";
 import { CloudChatError, type CloudChatEvent, type CloudChatRequest } from "../../src/adapters/devin/cloud-direct";
 import { streamChatEventsWithResetRetry } from "../../src/adapters/devin/cloud-direct/stated-reset-retry";
+import { createRequestExecutionBudget } from "../../src/lib/request-execution-budget";
 
 const REQ = { apiKey: "k", apiServerUrl: "https://example.invalid", modelUid: "swe-2", messages: [] } as unknown as CloudChatRequest;
 
@@ -27,6 +28,77 @@ async function drain(source: AsyncGenerator<CloudChatEvent>): Promise<CloudChatE
 }
 
 describe("streamChatEventsWithResetRetry", () => {
+  test("admits and reports every inference POST through one shared budget", async () => {
+    let spendReservations = 0;
+    let spendRefunds = 0;
+    const budget = createRequestExecutionBudget({
+      maxTotalModelSends: 3, baseSendAllowance: 3, finalRecoveryAllowance: 0,
+      maxAlternateTargetSends: 0, maxTargetTransitions: 0,
+    }, "devin-reset-accounting", {
+      charge: () => { spendReservations += 1; return true; },
+      refund: () => { spendRefunds += 1; },
+    });
+    const sends: number[] = [];
+    const usedDuringWait: number[] = [];
+    const observed: Array<{ ordinal: number; recovery?: string }> = [];
+    let attempts = 0;
+    const stream = (req: CloudChatRequest) => (async function* (): AsyncGenerator<CloudChatEvent> {
+      attempts += 1;
+      await req.executor!("https://example.invalid/GetChatMessage");
+      if (attempts < 3) throw new CloudChatError("reset in 1 second", "resource_exhausted", "t", 429);
+      yield { kind: "finish", reason: "stop" } as CloudChatEvent;
+    })();
+
+    await drain(streamChatEventsWithResetRetry(REQ, {
+      stream,
+      sleep: async () => { usedDuringWait.push(budget.used); },
+      execution: {
+        executor: (async () => { sends.push(sends.length + 1); return new Response(); }) as typeof fetch,
+        sendBudget: budget,
+        onPhysicalSend: send => { observed.push(send); },
+      },
+    }));
+
+    expect(sends).toEqual([1, 2, 3]);
+    expect(budget.used).toBe(3);
+    expect(usedDuringWait).toEqual([1, 2]);
+    expect(spendReservations).toBe(3);
+    expect(spendRefunds).toBe(0);
+    expect(observed).toEqual([
+      { ordinal: 1 },
+      { ordinal: 2, recovery: "rate-limit-429" },
+      { ordinal: 3, recovery: "rate-limit-429" },
+    ]);
+  });
+
+  test("a refused replay performs no inference I/O and preserves the provider 429", async () => {
+    const budget = createRequestExecutionBudget({
+      maxTotalModelSends: 1, baseSendAllowance: 1, finalRecoveryAllowance: 0,
+      maxAlternateTargetSends: 0, maxTargetTransitions: 0,
+    }, "devin-reset-refusal");
+    const refusal = new CloudChatError("Your limit will reset in 1 second", "resource_exhausted", "trace", 429);
+    const withheld: string[] = [];
+    let inferenceSends = 0;
+    const stream = (req: CloudChatRequest) => (async function* (): AsyncGenerator<CloudChatEvent> {
+      await req.executor!("https://example.invalid/GetChatMessage");
+      throw refusal;
+    })();
+
+    await expect(drain(streamChatEventsWithResetRetry(REQ, {
+      stream,
+      sleep: async () => {},
+      execution: {
+        executor: (async () => { inferenceSends += 1; return new Response(); }) as typeof fetch,
+        sendBudget: budget,
+        onRecoveryWithheld: event => { withheld.push(event.reason); },
+      },
+    }))).rejects.toBe(refusal);
+
+    expect(inferenceSends).toBe(1);
+    expect(budget.used).toBe(1);
+    expect(withheld).toEqual(["retry-send-budget"]);
+  });
+
   test("waits the stated delay and replays a zero-event 429", async () => {
     const waits: number[] = [];
     let calls = 0;
diff --git a/tests/providers/flash-route-image-modalities.test.ts b/tests/providers/flash-route-image-modalities.test.ts
index a5f74edffe2..5f728b2c20d 100644
--- a/tests/providers/flash-route-image-modalities.test.ts
+++ b/tests/providers/flash-route-image-modalities.test.ts
@@ -35,7 +35,14 @@ import { nativeOpenAiAutoCompactTokenLimit } from "../../src/codex/catalog/metad
 import type { CatalogModel, OcxConfig, OcxProviderConfig } from "../../src/types";
 
 const OPENCODE_GO_NATIVE = "glm-5.3-flash";
-const OPENCODE_GO_SIDECAR = "deepseek-v4.1-flash";
+/**
+ * Reclassified on 2026-09-19: this route used to be the sidecar-covered counterexample, and was
+ * probed natively multimodal on the Zen Go gateway. The name says "deepseek" rather than
+ * "sidecar"/"native" so a future reclassification does not leave a lying identifier behind.
+ */
+const OPENCODE_GO_DEEPSEEK = "deepseek-v4.1-flash";
+/** The sibling route on the same gateway that genuinely rejects images upstream. */
+const OPENCODE_GO_DEEPSEEK_TEXT_ONLY = "deepseek-v4-flash";
 const COMMAND_CODE_NATIVE = "z-ai/glm-5.3-flash";
 const COMMAND_CODE_DEEPSEEK = "deepseek/deepseek-v4.1-flash";
 
@@ -50,10 +57,24 @@ describe("flash-route registry modality declarations (#4505)", () => {
   // WHY: the combo collapse starts at the registry — if any of the four routes
   // loses its declaration the member row reaches the catalog with no modalities
   // and the intersection floor drops the whole combo back to ["text"].
-  test("opencode-go declares glm-5.3-flash native vision and deepseek-v4.1-flash text-only", () => {
+  test("opencode-go declares both flash routes image-capable (deepseek probed 2026-09-19)", () => {
     const entry = PROVIDER_REGISTRY.find(e => e.id === "opencode-go");
     expect(entry?.modelInputModalities?.[OPENCODE_GO_NATIVE]).toEqual(["text", "image"]);
-    expect(entry?.modelInputModalities?.[OPENCODE_GO_SIDECAR]).toEqual(["text"]);
+    // Promoted from the text-only list on 2026-09-19: the route accepted an image_url part and
+    // described a four-band colour chart in the correct order. Its sibling below did not.
+    expect(entry?.modelInputModalities?.[OPENCODE_GO_DEEPSEEK]).toEqual(["text", "image"]);
+    // The sibling carries no positive declaration — its classification comes from the
+    // noVisionModels list asserted in the test below, which is the half that survives.
+    expect(entry?.modelInputModalities?.[OPENCODE_GO_DEEPSEEK_TEXT_ONLY]).toBeUndefined();
+  });
+
+  test("the reclassified route is no longer a sidecar consumer", () => {
+    // The negative half matters as much as the positive one: a registry correction that left the
+    // id in noVisionModels would still strip images, because the predicate reads that list first.
+    const entry = PROVIDER_REGISTRY.find(e => e.id === "opencode-go");
+    expect(entry?.noVisionModels ?? []).not.toContain(OPENCODE_GO_DEEPSEEK);
+    // The sibling keeps its classification — it rejects image_url with HTTP 400 upstream.
+    expect(entry?.noVisionModels ?? []).toContain(OPENCODE_GO_DEEPSEEK_TEXT_ONLY);
   });
 
   test("command-code declares both flash routes image-capable (deepseek probed 2026-09-18)", () => {
@@ -67,17 +88,17 @@ describe("flash-route registry modality declarations (#4505)", () => {
 
 describe("flash-route native vs sidecar distinction (#4505)", () => {
   // WHY: the issue requires routes needing a sidecar to stay distinguishable
-  // from native vision. The distinction must follow measured upstream behavior:
-  // command-code's route now carries probe evidence (user message + tool
-  // result) for native reading, while opencode-go's route has none and stays on
-  // the sidecar path.
+  // from native vision. The distinction must follow measured upstream behavior.
+  // After the 2026-09-19 probe all four routes read images natively; the sibling
+  // opencode-go deepseek-v4-flash is what still exercises the sidecar path here.
   test("the two glm-5.3-flash routes are NOT sidecar consumers (native VLM)", () => {
     expect(isModelVisionSidecarConsumer(seeded("opencode-go"), OPENCODE_GO_NATIVE)).toBe(false);
     expect(isModelVisionSidecarConsumer(seeded("command-code"), COMMAND_CODE_NATIVE)).toBe(false);
   });
 
-  test("opencode-go's deepseek route is a sidecar consumer; command-code's is native", () => {
-    expect(isModelVisionSidecarConsumer(seeded("opencode-go"), OPENCODE_GO_SIDECAR)).toBe(true);
+  test("the reclassified opencode-go deepseek route is native; its sibling stays on the sidecar", () => {
+    expect(isModelVisionSidecarConsumer(seeded("opencode-go"), OPENCODE_GO_DEEPSEEK)).toBe(false);
+    expect(isModelVisionSidecarConsumer(seeded("opencode-go"), OPENCODE_GO_DEEPSEEK_TEXT_ONLY)).toBe(true);
     expect(isModelVisionSidecarConsumer(seeded("command-code"), COMMAND_CODE_DEEPSEEK)).toBe(false);
   });
 });
@@ -85,11 +106,21 @@ describe("flash-route native vs sidecar distinction (#4505)", () => {
 describe("flash-route catalog advertisement (#4505)", () => {
   // WHY: the Codex app gates attachments client-side on input_modalities, so the
   // catalog row is where the combo's image capability is actually won or lost.
-  // The opencode-go DeepSeek row picks up "image" from the sidecar hint; the
-  // command-code row now carries a native declaration.
-  test("applyProviderConfigHints advertises image for sidecar-covered deepseek-v4.1-flash on opencode-go", () => {
+  // The opencode-go DeepSeek row now carries its own image declaration; the
+  // command-code row carries a native one.
+  test("applyProviderConfigHints advertises image for deepseek-v4.1-flash on opencode-go", () => {
+    const hinted = applyProviderConfigHints("opencode-go", seeded("opencode-go"), {
+      id: OPENCODE_GO_DEEPSEEK,
+      provider: "opencode-go",
+    });
+    expect(hinted.inputModalities).toEqual(["text", "image"]);
+  });
+
+  test("the text-only sibling still picks up image from the sidecar hint", () => {
+    // The hint pass must keep widening a sidecar-covered row, or the app would block the
+    // attachment before the sidecar can describe it.
     const hinted = applyProviderConfigHints("opencode-go", seeded("opencode-go"), {
-      id: OPENCODE_GO_SIDECAR,
+      id: OPENCODE_GO_DEEPSEEK_TEXT_ONLY,
       provider: "opencode-go",
     });
     expect(hinted.inputModalities).toEqual(["text", "image"]);
@@ -98,7 +129,7 @@ describe("flash-route catalog advertisement (#4505)", () => {
   test("applyProviderConfigHints advertises image for all four routes", () => {
     const cases: Array<[string, string]> = [
       ["opencode-go", OPENCODE_GO_NATIVE],
-      ["opencode-go", OPENCODE_GO_SIDECAR],
+      ["opencode-go", OPENCODE_GO_DEEPSEEK],
       ["command-code", COMMAND_CODE_NATIVE],
       ["command-code", COMMAND_CODE_DEEPSEEK],
     ];
@@ -118,7 +149,7 @@ describe("flash-route combo intersection (#4505)", () => {
   const combo = {
     targets: [
       { provider: "opencode-go", model: OPENCODE_GO_NATIVE },
-      { provider: "opencode-go", model: OPENCODE_GO_SIDECAR },
+      { provider: "opencode-go", model: OPENCODE_GO_DEEPSEEK },
       { provider: "command-code", model: COMMAND_CODE_NATIVE },
       { provider: "command-code", model: COMMAND_CODE_DEEPSEEK },
     ],
@@ -135,7 +166,7 @@ describe("flash-route combo intersection (#4505)", () => {
   test("a combo over the four advertised-image routes keeps image input", () => {
     const members = [
       hintedMember("opencode-go", OPENCODE_GO_NATIVE),
-      hintedMember("opencode-go", OPENCODE_GO_SIDECAR),
+      hintedMember("opencode-go", OPENCODE_GO_DEEPSEEK),
       hintedMember("command-code", COMMAND_CODE_NATIVE),
       hintedMember("command-code", COMMAND_CODE_DEEPSEEK),
     ];
@@ -149,7 +180,7 @@ describe("flash-route combo intersection (#4505)", () => {
     // accept an attachment one leg silently drops.
     const members = [
       hintedMember("opencode-go", OPENCODE_GO_NATIVE),
-      hintedMember("opencode-go", OPENCODE_GO_SIDECAR),
+      hintedMember("opencode-go", OPENCODE_GO_DEEPSEEK),
       hintedMember("command-code", COMMAND_CODE_NATIVE),
       { ...hintedMember("command-code", COMMAND_CODE_DEEPSEEK), inputModalities: ["text"] },
     ];
diff --git a/tests/providers/github-copilot/github-copilot-account-origin.test.ts b/tests/providers/github-copilot/github-copilot-account-origin.test.ts
index 4da89c816ee..845d3e29cb5 100644
--- a/tests/providers/github-copilot/github-copilot-account-origin.test.ts
+++ b/tests/providers/github-copilot/github-copilot-account-origin.test.ts
@@ -9,6 +9,7 @@ import { saveConfig } from "../../../src/config";
 import { setActiveProviderApiKey } from "../../../src/providers/api-keys";
 import type { OcxConfig } from "../../../src/types";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 
 const ACCOUNT_A_ORIGIN = "https://a.githubcopilot.com";
 const ACCOUNT_B_ORIGIN = "https://b.githubcopilot.com";
@@ -187,15 +188,24 @@ function installFetch(options: {
   return { dispatches };
 }
 
+let releaseSpendHome: (() => void) | undefined;
+
 beforeEach(() => {
   beforeBuildReturns = undefined;
   beforePacingReturns = undefined;
   home = mkdtempSync(join(tmpdir(), "ocx-copilot-origin-"));
   process.env.OPENCODEX_HOME = home;
   clearGenericFailoverHealth();
+  // Dispatches without starting a server, so it takes the spend-journal lease itself. Taken
+  // last because the lease binds the home in effect at the moment it is taken.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(() => {
+  // Released before this case's home is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearGenericFailoverHealth();
   if (originalHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/providers/github-copilot/github-copilot-stream-contract.test.ts b/tests/providers/github-copilot/github-copilot-stream-contract.test.ts
index 21ba36336e7..29340342b28 100644
--- a/tests/providers/github-copilot/github-copilot-stream-contract.test.ts
+++ b/tests/providers/github-copilot/github-copilot-stream-contract.test.ts
@@ -11,6 +11,9 @@ import { providerConfigSeed } from "../../../src/providers/derive";
 import { getProviderRegistryEntry } from "../../../src/providers/registry";
 import { handleResponses } from "../../../src/server/responses/core";
 import type { OcxConfig, OcxProviderConfig } from "../../../src/types";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
 
 interface SseEvent {
   event?: string;
@@ -164,6 +167,9 @@ describe("GitHub Copilot Responses client stream contract", () => {
   const originalFetch = globalThis.fetch;
 
   afterEach(() => {
+    // Release the preload-home lease before later teardown can replace or remove that home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
   });
 
@@ -177,6 +183,8 @@ describe("GitHub Copilot Responses client stream contract", () => {
       providers: { "github-copilot": copilotProvider() },
     } as unknown as OcxConfig;
 
+    // Direct dispatch needs the writer lease that startServer normally owns for this home.
+    releaseSpendHome = acquireOwnedSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/providers/github-copilot/github-copilot-wire-defaults.test.ts b/tests/providers/github-copilot/github-copilot-wire-defaults.test.ts
index 50019d02cf7..bdf8a6e2dbc 100644
--- a/tests/providers/github-copilot/github-copilot-wire-defaults.test.ts
+++ b/tests/providers/github-copilot/github-copilot-wire-defaults.test.ts
@@ -17,6 +17,9 @@ import { getProviderRegistryEntry } from "../../../src/providers/registry";
 import { resolveWireProtocolOverride } from "../../../src/server/adapter-resolve";
 import { handleResponses } from "../../../src/server/responses/core";
 import type { OcxConfig, OcxProviderConfig } from "../../../src/types";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
 
 const RESPONSES_ONLY = [
   "gpt-5.3-codex",
@@ -137,7 +140,12 @@ describe("the registry default is isolated to the copilot provider", () => {
 
 describe("the wire default survives the handleResponses replay", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Release the preload-home lease before later teardown can replace or remove that home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   function captureUpstreamUrl(): string[] {
     const urls: string[] = [];
@@ -154,6 +162,8 @@ describe("the wire default survives the handleResponses replay", () => {
   async function drive(model: string, inboundWire?: "responses" | "chat" | "anthropic"): Promise<string> {
     const urls = captureUpstreamUrl();
     const config = { providers: { "github-copilot": copilotProvider() } } as unknown as OcxConfig;
+    // Direct dispatch needs the writer lease that startServer normally owns for this home.
+    releaseSpendHome = acquireOwnedSpendHome();
     await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/providers/kiro/kiro-auth-context-continuation.test.ts b/tests/providers/kiro/kiro-auth-context-continuation.test.ts
index 83e22d0b48f..567ce21ffde 100644
--- a/tests/providers/kiro/kiro-auth-context-continuation.test.ts
+++ b/tests/providers/kiro/kiro-auth-context-continuation.test.ts
@@ -15,6 +15,7 @@ import { clearGenericFailoverHealth } from "../../../src/oauth/generic-account-f
 import { getAccountSet, saveCredential, setActiveAccount } from "../../../src/oauth/store";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../../src/types";
 import { removeTreeWithRetry } from "../../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../../helpers/owned-spend-home";
 
 const previousHome = process.env.OPENCODEX_HOME;
 let testHome = "";
@@ -84,15 +85,24 @@ beforeAll(async () => {
   ({ handleResponses } = await import("../../../src/server/responses"));
 });
 
+let releaseSpendHome: (() => void) | undefined;
+
 beforeEach(() => {
   testHome = mkdtempSync(join(tmpdir(), "ocx-kiro-continuation-auth-"));
   process.env.OPENCODEX_HOME = testHome;
   kiroBuilds = [];
   clearAnthropicAccountPoolState();
   clearGenericFailoverHealth();
+  // Dispatches without starting a server, so it takes the spend-journal lease itself. Taken
+  // last because the lease binds the home in effect at the moment it is taken.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(() => {
+  // Released before this case's home is removed: an open lease inside a directory being
+  // deleted fails the removal on Windows and leaves an unlinked live database on POSIX.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   clearAnthropicAccountPoolState();
   clearGenericFailoverHealth();
   removeTreeWithRetry(testHome);
diff --git a/tests/providers/meta-muse-oauth.test.ts b/tests/providers/meta-muse-oauth.test.ts
index 08f824fc531..c70c4b2a76b 100644
--- a/tests/providers/meta-muse-oauth.test.ts
+++ b/tests/providers/meta-muse-oauth.test.ts
@@ -9,12 +9,18 @@
  * reaches a message or a status object.
  */
 import { describe, expect, test } from "bun:test";
+import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
 import { OAUTH_PROVIDERS } from "../../src/oauth";
 import { loginMetaMuse, refreshMetaMuseToken } from "../../src/oauth/meta-muse";
+import { providerConfigSeed } from "../../src/providers/derive";
 import { getProviderRegistryEntry } from "../../src/providers/registry";
 import { supportsPerAccountQuota } from "../../src/providers/quota";
 import { routeModel } from "../../src/router";
-import type { OcxConfig } from "../../src/types";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { withTestTranslatorBudget } from "../helpers/translator-budget";
+
+const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) =>
+  withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args));
 
 const MODELS = ["muse-spark-1.3", "muse-spark-1.3-contributor"] as const;
 
@@ -54,15 +60,30 @@ describe("meta-muse registry entry", () => {
     expect(entry().oauthId).toBe("meta-muse");
   });
 
-  test("reuses the ladder, window, modalities and identity wire map from the key provider", () => {
+  test("adds max to the Muse credential ladder while reusing the model metadata", () => {
     for (const id of MODELS) {
-      expect(entry().modelReasoningEfforts?.[id]).toEqual(["minimal", "low", "medium", "high", "xhigh"]);
+      expect(entry().modelReasoningEfforts?.[id]).toEqual(["minimal", "low", "medium", "high", "xhigh", "max"]);
       expect(entry().modelReasoningEffortMap?.[id]?.minimal).toBe("minimal");
+      expect(entry().modelReasoningEffortMap?.[id]?.max).toBe("max");
       expect(entry().modelContextWindows?.[id]).toBe(1_048_576);
       expect(entry().modelInputModalities?.[id]).toEqual(["text", "image"]);
     }
   });
 
+  test("max reaches the Responses wire unchanged", () => {
+    const provider = { ...providerConfigSeed(entry()), apiKey: "meta-test-key" } as OcxProviderConfig;
+    const request = createResponsesPassthroughAdapter(provider).buildRequest({
+      modelId: "muse-spark-1.3-contributor",
+      context: { messages: [] },
+      stream: false,
+      options: { reasoning: "max" },
+      _rawBody: { model: "muse-spark-1.3-contributor", input: "ping", reasoning: { effort: "max" } },
+    }, { headers: new Headers({ "user-agent": "grok-build/test" }) });
+    const body = JSON.parse(request.body) as { reasoning?: { effort?: string } };
+    expect(body.reasoning?.effort).toBe("max");
+    expect(new Headers(request.headers).get("user-agent")).toBe("muse-build/1.3.0 (opencodex compatibility)");
+  });
+
   test("keeps live discovery off — the real roster carries image and voice models", () => {
     expect(entry().liveModels).toBeFalsy();
     expect(entry().models).toEqual([...MODELS]);
diff --git a/tests/providers/model-rename-migration.test.ts b/tests/providers/model-rename-migration.test.ts
index 34801e8b21b..be52a3da6ab 100644
--- a/tests/providers/model-rename-migration.test.ts
+++ b/tests/providers/model-rename-migration.test.ts
@@ -9,6 +9,12 @@ import {
 } from "../../src/providers/model-rename-migration";
 import { runModelRenameStartupMigration } from "../../src/providers/model-rename-startup";
 import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { providerConfigSeed } from "../../src/providers/derive";
+import { reconcileOAuthProviders } from "../../src/oauth";
+import {
+  ANTIGRAVITY_MODELS,
+  ANTIGRAVITY_MODEL_CONTEXT_WINDOWS,
+} from "../../src/providers/antigravity-models";
 import { getConfigPath, loadConfig, saveConfig, setPersistedConfigMutationBeforeCommitForTests } from "../../src/config";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
@@ -276,3 +282,137 @@ describe("model rename startup persistence", () => {
     expect(live.providers.untouched).toBe(liveUntouched);
   });
 });
+
+// ── Issue #5066: the migration has to converge, not re-announce itself on every boot ──
+//
+// The reporter saw the same nine `[model-rename-migration]` lines at every `ocx start`. Nothing
+// in the projection, the persistence or the in-memory fallback was broken; the migration was
+// losing to the second half of its own boot. `startServer` runs it and then
+// `reconcileOAuthProviders`, and the Antigravity OAuth preset carries
+// `ANTIGRAVITY_MODEL_CONTEXT_WINDOWS`, which derives a window for every compatibility alias —
+// all nine retired Flash ids among them. `applyOAuthPresetCatalog` copies that record over the
+// saved one whenever the two differ, so reconciliation restored precisely the keys the rename
+// had removed, and the next boot found them and said so again.
+//
+// It also explains the count: nine messages for a user who never chose nine models, because the
+// ids came from the registry rather than from anything they had selected.
+describe("registry-seeded metadata does not re-arm the rename (#5066)", () => {
+  const homes: string[] = [];
+  const originalHome = process.env.OPENCODEX_HOME;
+
+  function isolate(prefix: string): void {
+    const home = mkdtempSync(join(tmpdir(), prefix));
+    homes.push(home);
+    process.env.OPENCODEX_HOME = home;
+  }
+
+  afterEach(() => {
+    if (originalHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = originalHome;
+    for (const home of homes.splice(0)) removeTreeWithRetry(home);
+  });
+
+  /**
+   * A saved Antigravity row carrying one genuinely stale user selection.
+   *
+   * `modelContextWindows` is deliberately absent. The point of the fixture is to watch
+   * reconciliation introduce it between the two boots rather than to assume it is there.
+   */
+  function antigravityRow(): Record<string, unknown> {
+    return {
+      adapter: "google",
+      baseUrl: "https://daily-cloudcode-pa.googleapis.com",
+      authMode: "oauth",
+      googleMode: "cloud-code-assist",
+      liveModels: true,
+      defaultModel: "gemini-3.8-flash",
+      models: [...ANTIGRAVITY_MODELS],
+      // Reconciliation does not carry `selectedModels`, so this one is the migration’s to fix
+      // — once.
+      selectedModels: ["gemini-3.6-flash-high"],
+    };
+  }
+
+  function antigravityConfig(): OcxConfig {
+    return {
+      port: 10100,
+      defaultProvider: "google-antigravity",
+      providers: { "google-antigravity": antigravityRow() },
+    } as unknown as OcxConfig;
+  }
+
+  /** The rename lines a boot prints, in order. */
+  function renameLines(boot: () => void): string[] {
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      boot();
+      return warn.mock.calls
+        .map(([first]) => (typeof first === "string" ? first : ""))
+        .filter(line => line.startsWith("[model-rename-migration] renamed "));
+    } finally {
+      warn.mockRestore();
+    }
+  }
+
+  // RED on dev, at the last assertion: the second boot reprints nine lines, and so does the
+  // third, and every one after it.
+  test("the second boot after reconciliation renames nothing and prints nothing", () => {
+    isolate("ocx-antigravity-rename-loop-");
+    saveConfig(antigravityConfig());
+
+    // Boot one, in startServer’s order: migrate, then reconcile the OAuth presets.
+    const first = renameLines(() => {
+      reconcileOAuthProviders(runModelRenameStartupMigration(loadConfig()));
+    });
+    expect(first).toHaveLength(1);
+    expect(first.join("\n")).toContain("google-antigravity/gemini-3.6-flash-high");
+
+    const afterFirstBoot = loadConfig().providers["google-antigravity"]!;
+    // The writer between the two boots, caught in the act: reconciliation put the registry’s
+    // own record on disk, retired keys and all. The next boot must not read that as a repair
+    // the user is still owed.
+    expect(Object.keys(afterFirstBoot.modelContextWindows ?? {})).toContain("gemini-3.6-flash");
+    // What the migration did own stayed fixed.
+    expect(afterFirstBoot.selectedModels).toEqual(["gemini-3.7-flash"]);
+
+    const second = renameLines(() => { runModelRenameStartupMigration(loadConfig()); });
+    expect(second).toEqual([]);
+  });
+
+  test("a registry-published id survives in metadata while a user selection is still repaired", () => {
+    const reconciled = {
+      ...antigravityRow(),
+      modelContextWindows: { ...ANTIGRAVITY_MODEL_CONTEXT_WINDOWS },
+    };
+    const config = { providers: { "google-antigravity": reconciled } } as unknown as OcxConfig;
+
+    const { config: out, changed, warnings } = projectModelRenames(config);
+    const prov = out.providers["google-antigravity"]!;
+
+    expect(changed).toBe(true);
+    expect(warnings).toHaveLength(1);
+    expect(prov.selectedModels).toEqual(["gemini-3.7-flash"]);
+    // Left alone on purpose: a request that still names the retired id routes to 3.7 and needs
+    // a window under the id it asked for, and reconciliation would rewrite this record anyway.
+    expect(prov.modelContextWindows?.["gemini-3.6-flash"]).toBe(1_048_576);
+  });
+
+  // The general form of the defect, applied to every rename this file ships: a provider row the
+  // registry itself produced must never be something the migration wants to rewrite. When it is,
+  // the two halves of the boot disagree forever and the user pays for it in log noise.
+  const seedCases: [string, ModelRename][] = MODEL_RENAMES.map(
+    rename => [`${rename.provider}/${rename.from}`, rename],
+  );
+  test.each(seedCases)("the registry seed for %s is not something the migration rewrites", (_label, rename) => {
+    const entry = PROVIDER_REGISTRY.find(row => row.id === rename.provider);
+    expect(entry, `registry entry missing for ${rename.provider}`).toBeDefined();
+    const seeded = {
+      providers: { [rename.provider]: providerConfigSeed(entry!) },
+    } as unknown as OcxConfig;
+
+    const { changed, warnings } = projectModelRenames(seeded, [rename]);
+
+    expect(warnings).toEqual([]);
+    expect(changed).toBe(false);
+  });
+});
diff --git a/tests/providers/muse-key-quota.test.ts b/tests/providers/muse-key-quota.test.ts
index 5908483c98c..7fda5b485fd 100644
--- a/tests/providers/muse-key-quota.test.ts
+++ b/tests/providers/muse-key-quota.test.ts
@@ -155,19 +155,35 @@ describe("muse key quota probe", () => {
 });
 
 describe("muse model api version header", () => {
-  test("the registry row declares it", () => {
-    expect(getProviderRegistryEntry("meta-muse")?.staticHeaders).toEqual({ "x-api-version": "1.0.0" });
+  test("the registry row declares the Muse compatibility headers", () => {
+    expect(getProviderRegistryEntry("meta-muse")?.staticHeaders).toEqual({
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "x-api-version": "1.0.0",
+    });
   });
 
   test("a user-set header of the same name still wins", () => {
     const entry = getProviderRegistryEntry("meta-muse");
     const merged = mergeRegistryStaticHeaders(entry?.staticHeaders, { "X-Api-Version": "9.9.9" });
-    expect(merged).toEqual({ "X-Api-Version": "9.9.9" });
+    expect(merged).toEqual({
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "X-Api-Version": "9.9.9",
+    });
   });
 
   test("it is merged in when the user sets an unrelated header", () => {
     const entry = getProviderRegistryEntry("meta-muse");
     const merged = mergeRegistryStaticHeaders(entry?.staticHeaders, { "X-Trace": "1" });
-    expect(merged).toEqual({ "X-Trace": "1", "x-api-version": "1.0.0" });
+    expect(merged).toEqual({
+      "User-Agent": "muse-build/1.3.0 (opencodex compatibility)",
+      "X-Trace": "1",
+      "x-api-version": "1.0.0",
+    });
+  });
+
+  test("a user-set User-Agent still wins", () => {
+    const entry = getProviderRegistryEntry("meta-muse");
+    const merged = mergeRegistryStaticHeaders(entry?.staticHeaders, { "user-agent": "custom-client/1.0" });
+    expect(merged).toEqual({ "user-agent": "custom-client/1.0", "x-api-version": "1.0.0" });
   });
 });
diff --git a/tests/providers/opencode-cli.test.ts b/tests/providers/opencode-cli.test.ts
index fc0fc0625b5..671d00a9155 100644
--- a/tests/providers/opencode-cli.test.ts
+++ b/tests/providers/opencode-cli.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, spyOn, test } from "bun:test";
 import * as directHttp from "../../src/server/direct-local-http";
+import { opencodeCatalogToken } from "../../src/lib/admin-secrets";
 import * as childProcess from "node:child_process";
 import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -263,7 +264,7 @@ describe("ocx opencode proxy model catalog", () => {
       port: 10123, hostname: "127.0.0.1", pid: null, source: "config",
     });
     const fetcher = spyOn(directHttp, "directLocalHttpFetch").mockImplementation(async (input, init) => {
-      expect(new Headers(init?.headers).get("x-opencodex-api-key")).toBe("fixture-admin-token");
+      expect(new Headers(init?.headers).get("x-opencodex-api-key")).toBe(opencodeCatalogToken("fixture-admin-token"));
       expect(String(input)).toBe("http://127.0.0.1:10123/api/models");
       expect(JSON.parse(readFileSync(configPath, "utf8")).providers.pending.initialModelSelection.status).toBe("pending");
       writeFileSync(configPath, JSON.stringify(ready));
diff --git a/tests/providers/opencode-go-grok46-responses.test.ts b/tests/providers/opencode-go-grok46-responses.test.ts
index d35fa6cf8c1..cadea0a9b5a 100644
--- a/tests/providers/opencode-go-grok46-responses.test.ts
+++ b/tests/providers/opencode-go-grok46-responses.test.ts
@@ -26,6 +26,7 @@ function buildRequest(
   modelId: string,
   rawBody: Record<string, unknown>,
   configuredProvider = provider(),
+  replayPrefixLength?: number,
 ) {
   return createResponsesPassthroughAdapter(configuredProvider).buildRequest({
     modelId,
@@ -33,6 +34,7 @@ function buildRequest(
     stream: true,
     options: {},
     _rawBody: { model: modelId, input: "ping", ...rawBody },
+    ...(replayPrefixLength === undefined ? {} : { _replayPrefixLen: replayPrefixLength }),
   }, { headers: new Headers() });
 }
 
@@ -201,6 +203,26 @@ describe("OpenCode Go additional_tools placement", () => {
       .toMatchObject({ input: [], tools: [], tool_choice: "none" });
   });
 
+  test("does not promote additional tools restored from continuation history", () => {
+    const historicalWeb = { type: "web_search" };
+    const request = buildRequest("gpt-5.6-luna", {
+      tools: [],
+      input: [
+        { type: "additional_tools", tools: [historicalWeb] },
+        { type: "message", role: "assistant", content: "history" },
+        { type: "message", role: "user", content: "continue" },
+      ],
+    }, provider(), 2);
+
+    expect(JSON.parse(request.body)).toMatchObject({
+      input: [
+        { type: "message", role: "assistant", content: "history" },
+        { type: "message", role: "user", content: "continue" },
+      ],
+      tools: [],
+    });
+  });
+
   test("activates tools loaded by tool search before moving their catalog", () => {
     const sent = build("gpt-5.6-luna", { input: [
       { type: "additional_tools", tools: [{ ...lookup, defer_loading: true }] },
diff --git a/tests/providers/opencode-go-luna-wire.test.ts b/tests/providers/opencode-go-luna-wire.test.ts
index 7866ec94150..a07c66ff2de 100644
--- a/tests/providers/opencode-go-luna-wire.test.ts
+++ b/tests/providers/opencode-go-luna-wire.test.ts
@@ -13,9 +13,15 @@ import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses";
 import { parseRequest } from "../../src/responses/parser";
 import { withTestTranslatorBudget } from "../helpers/translator-budget";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const MODEL = "gpt-5.6-luna";
 const GO_RESPONSES_MODELS = [MODEL, "grok-4.6", "muse-spark-1.3-contributor"];
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct dispatch needs the writer lease that startServer normally owns for this home.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
 
 function opencodeGo(overrides: Partial<OcxProviderConfig> = {}): OcxProviderConfig {
   const entry = getProviderRegistryEntry("opencode-go");
@@ -102,7 +108,11 @@ describe("OpenCode Go stateless Responses", () => {
 
 describe("OpenCode Go stateless reasoning and continuation routes", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Release the preload-home lease before later teardown can replace or remove that home.
+    dropSpendHome();
+    globalThis.fetch = originalFetch;
+  });
 
   const continuations = [
     { id: "full", name: "full history", fullHistory: true, summary: "auto" },
@@ -147,6 +157,7 @@ describe("OpenCode Go stateless reasoning and continuation routes", () => {
       }) as typeof fetch;
       const config = { providers: { "opencode-go": opencodeGo() } } as unknown as OcxConfig;
       const drive = async (body: Record<string, unknown>) => {
+        takeSpendHome();
         const response = await handleResponses(new Request("http://localhost/v1/responses", {
           method: "POST", headers: { "content-type": "application/json" },
           body: JSON.stringify({ model: `opencode-go/${model}`, stream: streaming, reasoning: { summary: continuation.summary },
@@ -214,7 +225,10 @@ describe("OpenCode Go stateless reasoning and continuation routes", () => {
 
 describe("OpenCode Go Luna Responses route (#1482)", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    dropSpendHome();
+    globalThis.fetch = originalFetch;
+  });
 
   test("handleResponses sends Luna to the documented /responses endpoint", async () => {
     const requests: Array<{ url: string; body: Record<string, unknown> }> = [];
@@ -234,6 +248,7 @@ describe("OpenCode Go Luna Responses route (#1482)", () => {
     const config = {
       providers: { "opencode-go": opencodeGo() },
     } as unknown as OcxConfig;
+    takeSpendHome();
     const response = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/providers/opencode-go-session-header.test.ts b/tests/providers/opencode-go-session-header.test.ts
index 4f51b581c02..bedf4358909 100644
--- a/tests/providers/opencode-go-session-header.test.ts
+++ b/tests/providers/opencode-go-session-header.test.ts
@@ -9,6 +9,7 @@ import { getOrAllocateRequestSessionLane } from "../../src/server/request-log-co
 import { handleChatCompletions } from "../../src/server/chat-completions";
 import { handleClaudeMessages } from "../../src/server/claude-messages";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const MUSE_MODEL = "muse-spark-1.3-contributor";
 const CHAT_MODEL = "glm-5.2";
@@ -28,6 +29,13 @@ const RESPONSES_SESSION_VECTORS = {
   prefixed: "ocx_c974cef031af8717276b933929f0c073",
   codex: "ocx_a0cfe09ee92e4bfa2e560579bc46c50e",
 } as const;
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
+// Release before the next case so a failed dispatch cannot leave an ownership conflict.
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
 
 function opencodeGo(overrides: Partial<OcxProviderConfig> = {}): OcxProviderConfig {
   const entry = getProviderRegistryEntry("opencode-go");
@@ -96,6 +104,7 @@ async function captureRequest(input: {
   const config = {
     providers: { [providerName]: input.provider ?? opencodeGo() },
   } as unknown as OcxConfig;
+  takeSpendHome();
   const response = input.claude ? await handleClaudeMessages(
     new Request("http://localhost/v1/messages", {
       method: "POST",
@@ -136,7 +145,10 @@ async function captureRequest(input: {
 
 describe("OpenCode Go session affinity (#3344)", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    dropSpendHome();
+    globalThis.fetch = originalFetch;
+  });
 
   for (const model of [CHAT_MODEL, MUSE_MODEL]) {
     // The policy target is deliberately renamed, so provider-name wire defaults do not apply;
@@ -183,6 +195,7 @@ describe("OpenCode Go session affinity (#3344)", () => {
         // Preliminary route checks the first target; dispatch independently picks Go.
         entropy.mockReturnValueOnce(0);
         try {
+          takeSpendHome();
           const response = await handleClaudeMessages(new Request("http://localhost/v1/messages", {
             method: "POST", headers: { "content-type": "application/json", ...identity.headers } as Record<string, string>,
             body: JSON.stringify({ model: "combo/affinity", max_tokens: 64, stream: false,
@@ -243,6 +256,7 @@ describe("OpenCode Go session affinity (#3344)", () => {
       } as unknown as OcxConfig;
       const entropy = spyOn(Math, "random").mockReturnValue(0.9).mockReturnValueOnce(0);
       try {
+        takeSpendHome();
         const response = await handleClaudeMessages(new Request("http://localhost/v1/messages", {
           method: "POST", headers: { "content-type": "application/json", [SESSION_HEADER]: "client-session-a" },
           body: JSON.stringify({ model: "combo/affinity", max_tokens: 64, stream: false,
@@ -580,7 +594,8 @@ describe("OpenCode Go affinity across the policy fallback retry (#4172)", () =>
   async function runPolicyFallback(req: Request): Promise<Request[]> {
     const seen: Request[] = [];
     let attempts = 0;
-    const runCore = (async (coreReq: Request, _config: unknown, logCtx: { routeDecision?: unknown }) => {
+    const runCore = (async (coreReq: Request, _config: unknown, logCtx: { routeDecision?: unknown }, options?: { onRequestBodyParsed?: (body: unknown) => void }) => {
+      options?.onRequestBodyParsed?.(await coreReq.json());
       seen.push(coreReq);
       logCtx.routeDecision = policyTrace;
       attempts += 1;
diff --git a/tests/providers/opencode-management-transport.test.ts b/tests/providers/opencode-management-transport.test.ts
index 0a861599539..f98ab7c1d9f 100644
--- a/tests/providers/opencode-management-transport.test.ts
+++ b/tests/providers/opencode-management-transport.test.ts
@@ -8,6 +8,8 @@ import * as liveness from "../../src/server/proxy-liveness";
 import { buildOpencodeEnv, buildOpencodeProviderBlocksFromCatalog, cmdOpencode, fetchOpencodeProxyModels } from "../../src/cli/opencode";
 import { OPENCODE_API_KEY_ENV } from "../../src/clients/config-export";
 import type { OcxConfig } from "../../src/types";
+import { opencodeCatalogToken } from "../../src/lib/admin-secrets";
+import { requireManagementAuth, type ManagementAuthState } from "../../src/server/management-auth";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import { SERVER_BUDGET_MS } from "../helpers/test-budget";
 
@@ -113,7 +115,7 @@ test.each(["environment", "file", "missing", "unauthorized", "redirect", "ingres
     const finder = spyOn(liveness, "findLiveProxy").mockResolvedValue({ port: 10123, hostname: mode === "ingress" ? "192.0.2.1" : "127.0.0.1", pid: null, source: "config" });
     const request = spyOn(directHttp, "directLocalHttpFetch").mockImplementation(async (input, init) => {
       expect(String(input)).toBe(`http://127.0.0.1:${mode === "ingress" ? 10124 : 10123}/api/models`);
-      expect(new Headers(init?.headers).get("x-opencodex-api-key")).toBe(mode === "file" ? fileAdmin : admin);
+      expect(new Headers(init?.headers).get("x-opencodex-api-key")).toBe(opencodeCatalogToken(mode === "file" ? fileAdmin : admin));
       return mode === "unauthorized" ? new Response(null, { status: 401 }) : mode === "redirect" ? new Response(null, { status: 302 }) : Response.json(rows);
     });
     let childEnv: NodeJS.ProcessEnv | undefined;
@@ -138,6 +140,22 @@ test.each(["environment", "file", "missing", "unauthorized", "redirect", "ingres
     } finally { err.mockRestore(); spawn.mockRestore(); request.mockRestore(); finder.mockRestore(); }
   });
 
+test("captured catalog credential cannot authorize another management route", () => {
+  const state: ManagementAuthState = {
+    available: true,
+    token: admin,
+    source: "environment",
+    sessions: new Map(),
+    pairingGrants: new Map(),
+  };
+  const credential = opencodeCatalogToken(admin);
+  const headers = { "x-opencodex-api-key": credential };
+  expect(requireManagementAuth(new Request("http://127.0.0.1/api/models", { headers }), state)).toBeNull();
+  expect(requireManagementAuth(new Request("http://127.0.0.1/api/models?extra=1", { headers }), state)?.status).toBe(401);
+  expect(requireManagementAuth(new Request("http://127.0.0.1/api/config", { headers }), state)?.status).toBe(401);
+  expect(requireManagementAuth(new Request("http://127.0.0.1/api/stop", { method: "POST", headers }), state)?.status).toBe(401);
+});
+
 test("case-insensitive inherited admin names are removed without changing other child variables", () => {
   const blocks = buildOpencodeProviderBlocksFromCatalog(12345, [], undefined, config);
   const env = buildOpencodeEnv(blocks, dataKey, { opencodex_admin_auth_token: admin, KEEP: "value" });
diff --git a/tests/providers/opencode-muse-terminal-repair.test.ts b/tests/providers/opencode-muse-terminal-repair.test.ts
new file mode 100644
index 00000000000..93787b65373
--- /dev/null
+++ b/tests/providers/opencode-muse-terminal-repair.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import {
+  getProviderRegistryEntry,
+  providerModelResponsesTerminalRepair,
+} from "../../src/providers/registry";
+
+describe("OpenCode muse-spark terminal repair registry policy", () => {
+  test("opencode-go exposes 5s grace repair for muse-spark models", () => {
+    const entry = getProviderRegistryEntry("opencode-go");
+    expect(entry).toBeDefined();
+
+    for (const modelId of ["muse-spark-1.2-contributor", "muse-spark-1.3-contributor"]) {
+      const policy = providerModelResponsesTerminalRepair(
+        "opencode-go",
+        { baseUrl: "https://opencode.ai/zen/go/v1", adapter: "openai-chat", authMode: "key" },
+        modelId,
+      );
+      expect(policy).toEqual({ graceMs: 5_000 });
+    }
+  });
+
+  test("opencode-zen exposes 5s grace repair for free muse-spark models", () => {
+    const entry = getProviderRegistryEntry("opencode-zen");
+    expect(entry).toBeDefined();
+
+    for (const modelId of ["muse-spark-1.2-contributor-free", "muse-spark-1.3-contributor-free"]) {
+      const policy = providerModelResponsesTerminalRepair(
+        "opencode-zen",
+        { baseUrl: "https://opencode.ai/zen/v1", adapter: "openai-chat", authMode: "key" },
+        modelId,
+      );
+      expect(policy).toEqual({ graceMs: 5_000 });
+    }
+  });
+});
diff --git a/tests/providers/provider-account-quota.test.ts b/tests/providers/provider-account-quota.test.ts
index 2ac6489e839..2ddae55d6dd 100644
--- a/tests/providers/provider-account-quota.test.ts
+++ b/tests/providers/provider-account-quota.test.ts
@@ -829,6 +829,8 @@ describe("google-antigravity per-account quota (#1082)", () => {
   test.each([
     [new PinnedHttpError("connect_timeout", "private-error"), "timeout"],
     [new PinnedHttpError("output_byte_limit", "private-error"), "response_unusable"],
+    [new PinnedHttpError("unsupported_content_encoding", "private-error"), "response_unusable"],
+    [new PinnedHttpError("content_decode_failed", "private-error"), "response_unusable"],
     [new DOMException("private-error", "TimeoutError"), "timeout"],
     [new Error("private-error"), "transport_error"],
   ] as const)("typed fallback failure maps to %s", async (error, failure) => {
diff --git a/tests/providers/provider-outbound.test.ts b/tests/providers/provider-outbound.test.ts
index f1613f3703c..c0d5f59a2a9 100644
--- a/tests/providers/provider-outbound.test.ts
+++ b/tests/providers/provider-outbound.test.ts
@@ -54,6 +54,33 @@ function directDependencies(
 }
 
 describe("provider outbound GET transport", () => {
+  test("a written fetch value is configuration, not an executor to call", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = directDependencies(new Response('{"data":[]}', {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    }));
+
+    /*
+     * A provider entry keeps unknown configuration keys, so an operator can write `fetch` into
+     * config.json and it arrives here as a string. Treating a present value as callable threw
+     * inside discovery and failed that provider for a reason nothing in its configuration
+     * explains. A configured value means the built-in transport, which is what pins the peer.
+     */
+    const written = { baseUrl: "https://provider.example/v1", fetch: "https://not-an-executor.example" };
+    const response = await providerOutboundGet(
+      "written-fetch",
+      written as unknown as Parameters<typeof providerOutboundGet>[1],
+      "https://provider.example/v1/models",
+      { headers: { authorization: "Bearer test-key" } },
+      dependencies,
+    );
+
+    expect(await response.json()).toEqual({ data: [] });
+    expect(captured.address).toBe("93.184.216.34");
+  });
+
   test("direct HTTPS connects only to the validated address with TLS verification", async () => {
     for (const key of proxyKeys) delete process.env[key];
     const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
@@ -559,3 +586,173 @@ describe("effectiveProxyFor picks the variable Bun fetch actually honours", () =
     expect(effectiveProxyFor(new URL("ftp://x/"), { HTTPS_PROXY: "http://p:7", HTTP_PROXY: "http://p:7" })).toBeNull();
   });
 });
+
+describe("provider outbound default User-Agent", () => {
+  function userAgentDependencies(response: Response): {
+    dependencies: ProviderOutboundDependencies;
+    captured: { headers?: HeadersInit };
+  } {
+    const captured: { headers?: HeadersInit } = {};
+    return {
+      captured,
+      dependencies: {
+        resolveAddresses: mock(async () => ({
+          hostname: "provider.example",
+          addresses: [{ address: "93.184.216.34", family: 4 }],
+          privateNetwork: false,
+        })),
+        pinnedGet: mock(async (_url, _pinned, _signal, requestOptions) => {
+          captured.headers = requestOptions?.headers;
+          return response;
+        }),
+        pinnedPost: mock(async (_url, _pinned, _body, _signal, requestOptions) => {
+          captured.headers = requestOptions?.headers;
+          return response;
+        }),
+      },
+    };
+  }
+
+  test("direct GET fills opencodex when no caller names a User-Agent", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response('{"data":[]}', { status: 200 }));
+
+    const response = await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      { headers: { authorization: "Bearer test-key" } },
+      dependencies,
+    );
+
+    expect(response.status).toBe(200);
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+    expect(new Headers(captured.headers).get("authorization")).toBe("Bearer test-key");
+  });
+
+  test("a caller User-Agent is kept without a second User-Agent beside it", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      { headers: { authorization: "Bearer test-key", "user-agent": "gateway-agent/1.0" } },
+      dependencies,
+    );
+
+    expect(Object.keys(captured.headers as Record<string, string>).filter(name => name.toLowerCase() === "user-agent"))
+      .toEqual(["user-agent"]);
+    expect(new Headers(captured.headers).get("user-agent")).toBe("gateway-agent/1.0");
+  });
+
+  test("no headers at all still sends the default", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      {},
+      dependencies,
+    );
+
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+  });
+
+  test("the POST diagnostic path gets the same default", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundPost } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    const response = await providerOutboundPost(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/discovery",
+      { headers: { authorization: "Bearer test-key" }, body: "{}" },
+      dependencies,
+    );
+
+    expect(response.status).toBe(200);
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+  });
+  test("a Headers object without a User-Agent gets the default", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      { headers: new Headers({ authorization: "Bearer test-key" }) },
+      dependencies,
+    );
+
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+    expect(new Headers(captured.headers).get("authorization")).toBe("Bearer test-key");
+  });
+
+  test("an array-form header list without a User-Agent gets the default", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      { headers: [["authorization", "Bearer test-key"]] },
+      dependencies,
+    );
+
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+    expect(new Headers(captured.headers).get("authorization")).toBe("Bearer test-key");
+  });
+
+  test("a Headers object keeps its own User-Agent", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+    const { dependencies, captured } = userAgentDependencies(new Response(null, { status: 200 }));
+
+    await providerOutboundGet(
+      "custom",
+      { baseUrl: "https://provider.example/v1" },
+      "https://provider.example/v1/models",
+      { headers: new Headers({ "user-agent": "vendor-agent/1.0" }) },
+      dependencies,
+    );
+
+    expect(new Headers(captured.headers).get("user-agent")).toBe("vendor-agent/1.0");
+  });
+
+  // The pinned transport is not the only way out of this wrapper. A provider that carries its
+  // own executor bypasses `pinnedGet`/`pinnedPost` entirely, so a fill applied only on the
+  // pinned path would leave that branch UA-less and still 403 behind the same WAF. Asserting the
+  // init the executor actually receives is what keeps the default from being pinned-path-only.
+  test("a caller-owned executor receives the same default", async () => {
+    for (const key of proxyKeys) delete process.env[key];
+    const captured: { headers?: HeadersInit } = {};
+    const override = mock(async (_url: string | URL | Request, init?: RequestInit) => {
+      captured.headers = init?.headers;
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+    const { providerOutboundGet } = await import("../../src/lib/provider-outbound");
+
+    await providerOutboundGet(
+      "override",
+      { baseUrl: "https://override.example/v1", fetch: override } as { baseUrl: string; fetch: typeof fetch },
+      "https://override.example/v1/models",
+      { headers: { authorization: "Bearer test-key" } },
+    );
+
+    expect(override).toHaveBeenCalledTimes(1);
+    expect(new Headers(captured.headers).get("user-agent")).toBe("opencodex");
+    expect(new Headers(captured.headers).get("authorization")).toBe("Bearer test-key");
+  });
+});
diff --git a/tests/providers/provider-registry-parity.test.ts b/tests/providers/provider-registry-parity.test.ts
index fe67c9ac99d..094eb8f1cb1 100644
--- a/tests/providers/provider-registry-parity.test.ts
+++ b/tests/providers/provider-registry-parity.test.ts
@@ -16,6 +16,12 @@ import {
   providerConfigSeed,
 } from "../../src/providers/derive";
 import { PROVIDER_REGISTRY, registryEntryForProviderDestination } from "../../src/providers/registry";
+import {
+  REGISTRY_FIELD_MODEL_ID_ROLES,
+  registryModelIdKeys,
+} from "../../src/providers/registry/model-ids";
+import type { ProviderRegistryEntry } from "../../src/providers/registry/types";
+import { META_MUSE_MODELS } from "../../src/providers/registry/model-seeds";
 import { FREE_PROVIDER_DIRECTORY } from "../../src/providers/free-directory";
 import { applyProviderConfigHints } from "../../src/codex/catalog";
 import { routeModel } from "../../src/router";
@@ -58,6 +64,120 @@ describe("provider registry parity", () => {
     expect(new Set(ids).size).toBe(ids.length);
   });
 
+  test("every field carried by the shipped registry has a model-id role classification", () => {
+    // This is the runtime half. The module's satisfies clause is the compile-time half, so
+    // together they catch both a new interface field and a shipped entry carrying an unclassified field.
+    const classifiedFields = new Set(Object.keys(REGISTRY_FIELD_MODEL_ID_ROLES));
+    for (const entry of PROVIDER_REGISTRY) {
+      for (const field of Object.keys(entry)) {
+        expect(classifiedFields.has(field), `${entry.id}.${field}`).toBe(true);
+      }
+    }
+  });
+
+  test("every direct model-id map is collected independently", () => {
+    const cases = [
+      ["modelWireDefaults", "openai-chat"],
+      ["modelResponsesUpstreamStreaming", false],
+      ["modelResponsesTerminalRepair", { graceMs: 25 }],
+      ["modelSupportsServiceTier", true],
+      ["modelSupportsReasoningSummaries", false],
+      ["modelSupportsVerbosity", true],
+      ["modelContextWindows", 100_000],
+      ["modelDisplayNames", "Synthetic display name"],
+      ["modelInputModalities", ["text"]],
+      ["modelMaxOutputTokens", 8_000],
+      ["modelReasoningEfforts", ["low"]],
+      ["modelDefaultReasoningEfforts", "low"],
+      ["modelReasoningEffortMap", { low: "low" }],
+      ["virtualModels", { wireModelId: "wire-target", reasoningMode: "pro" }],
+      ["modelMaxInputTokens", 90_000],
+    ] as const;
+
+    for (const [field, value] of cases) {
+      const modelId = `vendor/${field}`;
+      const entry = {
+        id: `fixture-${field}`,
+        label: `Fixture ${field}`,
+        adapter: "openai-chat",
+        baseUrl: "https://registry-model-id.fixture.example/v1",
+        authKind: "key",
+        [field]: { [modelId]: value },
+      } as ProviderRegistryEntry;
+      expect(registryModelIdKeys(entry), field).toEqual([modelId]);
+    }
+  });
+
+  test("non-model records contribute no selector identities", () => {
+    const entry = {
+      id: "fixture-non-model-records",
+      label: "Fixture non-model records",
+      adapter: "openai-chat",
+      baseUrl: "https://registry-model-id.fixture.example/v1",
+      authKind: "key",
+      staticHeaders: { "x-model/header": "value" },
+      reasoningEffortMap: { "effort/label": "high" },
+      responsesItemIdRepair: {
+        message: ["message/value"],
+        reasoning: ["reasoning/value"],
+        repairMissingTerminalIds: true,
+      },
+    } as ProviderRegistryEntry;
+    expect(registryModelIdKeys(entry)).toEqual([]);
+  });
+
+  test("virtual models contribute selectable keys but never wire target values", () => {
+    const entry = {
+      id: "fixture-virtual-model",
+      label: "Fixture virtual model",
+      adapter: "openai-chat",
+      baseUrl: "https://registry-model-id.fixture.example/v1",
+      authKind: "key",
+      virtualModels: {
+        "client/selectable": { wireModelId: "wire/target", reasoningMode: "pro" },
+      },
+    } as ProviderRegistryEntry;
+    expect(registryModelIdKeys(entry)).toEqual(["client/selectable"]);
+    expect(registryModelIdKeys(entry)).not.toContain("wire/target");
+  });
+
+  test("deduplication keeps registry-field order and the first occurrence", () => {
+    const entry = {
+      id: "fixture-stable-deduplication",
+      label: "Fixture stable deduplication",
+      adapter: "openai-chat",
+      baseUrl: "https://registry-model-id.fixture.example/v1",
+      authKind: "key",
+      modelWireDefaults: {
+        "first/model": "openai-chat",
+        "shared/model": "openai-chat",
+      },
+      modelResponsesUpstreamStreaming: {
+        "shared/model": false,
+        "second/model": false,
+      },
+      modelContextWindows: {
+        "third/model": 100_000,
+        "shared/model": 100_000,
+      },
+    } as ProviderRegistryEntry;
+    expect(registryModelIdKeys(entry)).toEqual([
+      "first/model",
+      "shared/model",
+      "second/model",
+      "third/model",
+    ]);
+  });
+
+  test("a shipped entry's ids are recovered from its classified maps, not its models list", () => {
+    const metaMuse = PROVIDER_REGISTRY.find(entry => entry.id === "meta-muse")!;
+    // meta-muse declares these ids in BOTH its models list and its context-window, modality and
+    // effort maps. The helper never reads models, so recovering them here is evidence the maps
+    // were read. Compared against the seed the entry is built from rather than a copied literal,
+    // so adding a Muse model does not fail this case for the wrong reason.
+    expect(registryModelIdKeys(metaMuse)).toEqual([...META_MUSE_MODELS]);
+  });
+
   test("key-login export is derived from the registry", () => {
     expect(KEY_LOGIN_PROVIDERS).toEqual(deriveKeyLoginMap());
     expect(Object.keys(KEY_LOGIN_PROVIDERS)).toEqual(EXPECTED_KEY_PROVIDER_IDS);
@@ -71,15 +191,20 @@ describe("provider registry parity", () => {
       escapeBuiltinToolNames: true,
     });
     expect(KEY_LOGIN_PROVIDERS.umans.noVisionModels).toContain("umans-glm-5.2");
-    // Zen Go text-only models are vision-sidecar covered; Kimi K2.7 Code is multimodal and must NOT be listed.
+    // Zen Go text-only models are vision-sidecar covered; Kimi K2.7 Code is multimodal and must NOT
+    // be listed. deepseek-v4.1-flash was removed on 2026-09-19 after it was probed natively
+    // multimodal on this gateway; its sibling deepseek-v4-flash still rejects image_url upstream.
     expect(KEY_LOGIN_PROVIDERS["opencode-go"].noVisionModels).toEqual([
       "glm-5.3",
       "glm-5.2", "glm-5", "glm-5.1",
-      "deepseek-v4.1-flash", "deepseek-v4-flash",
+      "deepseek-v4-flash",
       "mimo-v2-pro", "mimo-v2.5-pro",
       "minimax-m2.5", "minimax-m2.7",
       "qwen3.7-max",
     ]);
+    expect(KEY_LOGIN_PROVIDERS["opencode-go"].noVisionModels).not.toContain("deepseek-v4.1-flash");
+    expect(KEY_LOGIN_PROVIDERS["opencode-go"].modelInputModalities?.["deepseek-v4.1-flash"])
+      .toEqual(["text", "image"]);
     expect(KEY_LOGIN_PROVIDERS["opencode-go"].noVisionModels).not.toContain("kimi-k2.7-code");
     // #1338 / #1415: the Zen gateway rejects json_schema on its DeepSeek routes. The three
     // presets that share that gateway carry the narrow opt-out as a registry-only seed, so
@@ -120,7 +245,11 @@ describe("provider registry parity", () => {
 
     const zenGo = PROVIDER_REGISTRY.find(entry => entry.id === "opencode-go");
     expect(zenGo?.preserveReasoningContentModels).toContain("deepseek-v4.1-flash");
-    expect(zenGo?.noVisionModels).toContain("deepseek-v4.1-flash");
+    // Reclassified 2026-09-19: this route reads images natively on the Zen Go gateway, so it left
+    // the sidecar list and gained a positive image declaration. Its sibling stays behind.
+    expect(zenGo?.noVisionModels).not.toContain("deepseek-v4.1-flash");
+    expect(zenGo?.noVisionModels).toContain("deepseek-v4-flash");
+    expect(zenGo?.modelInputModalities?.["deepseek-v4.1-flash"]).toEqual(["text", "image"]);
     expect(Object.keys(zenGo?.modelReasoningEfforts ?? {})).toContain("deepseek-v4.1-flash");
     expect(zenGo?.modelContextWindows?.["deepseek-v4.1-flash"]).toBe(1_048_576);
 
@@ -477,11 +606,15 @@ describe("provider registry parity", () => {
     for (const model of ["deepseek-chat", "deepseek-reasoner", "deepseek-v4-flash"]) {
       expect(isModelVisionSidecarConsumer(provider, model)).toBe(true);
     }
-    for (const id of ["opencode-go", "opencode-zen"]) {
-      const gateway = providerConfigSeed(PROVIDER_REGISTRY.find(entry => entry.id === id)!);
-      expect(isModelVisionSidecarConsumer(gateway, "deepseek-v4.1-flash")).toBe(true);
-      expect(isModelVisionSidecarConsumer(gateway, "deepseek-v4-flash")).toBe(true);
-    }
+    // Only the Go tier was probed (2026-09-19) and only for deepseek-v4.1-flash. The sibling
+    // id on the same tier still rejects image_url, and the Zen tiers could not be measured at
+    // all (HTTP 402), so an unverified tier keeps its existing classification.
+    const goGateway = providerConfigSeed(PROVIDER_REGISTRY.find(entry => entry.id === "opencode-go")!);
+    expect(isModelVisionSidecarConsumer(goGateway, "deepseek-v4.1-flash")).toBe(false);
+    expect(isModelVisionSidecarConsumer(goGateway, "deepseek-v4-flash")).toBe(true);
+    const zenGateway = providerConfigSeed(PROVIDER_REGISTRY.find(entry => entry.id === "opencode-zen")!);
+    expect(isModelVisionSidecarConsumer(zenGateway, "deepseek-v4.1-flash")).toBe(true);
+    expect(isModelVisionSidecarConsumer(zenGateway, "deepseek-v4-flash")).toBe(true);
     const free = providerConfigSeed(PROVIDER_REGISTRY.find(entry => entry.id === "opencode-free")!);
     expect(isModelVisionSidecarConsumer(free, "deepseek-v4-flash-free")).toBe(true);
     // Saved providers without explicit modality overrides inherit the fix during routing.
diff --git a/tests/providers/rate-limit-retry.test.ts b/tests/providers/rate-limit-retry.test.ts
index b351057055b..e028f6abc67 100644
--- a/tests/providers/rate-limit-retry.test.ts
+++ b/tests/providers/rate-limit-retry.test.ts
@@ -5,6 +5,9 @@ import {
 } from "../../src/providers/key-failover";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
 
 describe("rateLimitRetryPolicyFor", () => {
   test("null when absent or explicitly disabled", () => {
@@ -45,6 +48,67 @@ describe("rateLimitRetryPolicyFor", () => {
     });
   });
 
+  test("falls back to a patient policy for the OpenCode Go destination without the knob", () => {
+    expect(rateLimitRetryPolicyFor({
+      baseUrl: "https://opencode.ai/zen/go/v1",
+      adapter: "openai-chat",
+    } as OcxProviderConfig)).toEqual({
+      enabled: true,
+      attempts: 6,
+      intervalMs: 10_000,
+      maxIntervalMs: 60_000,
+      respectRetryAfter: true,
+    });
+    // Explicit opt-out still wins on the Go destination.
+    expect(rateLimitRetryPolicyFor({
+      baseUrl: "https://opencode.ai/zen/go/v1",
+      adapter: "openai-chat",
+      retryOn429: { enabled: false },
+    } as OcxProviderConfig)).toBeNull();
+    // Explicit values normalize against the generic defaults, not the Go fallback.
+    expect(rateLimitRetryPolicyFor({
+      baseUrl: "https://opencode.ai/zen/go/v1",
+      adapter: "openai-chat",
+      retryOn429: { attempts: 2 },
+    } as OcxProviderConfig)).toMatchObject({ attempts: 2, intervalMs: 5_000 });
+  });
+
+  test("matches the Go destination canonically: host case and default ports", () => {
+    const patient = {
+      enabled: true,
+      attempts: 6,
+      intervalMs: 10_000,
+      maxIntervalMs: 60_000,
+      respectRetryAfter: true,
+    };
+    for (const baseUrl of [
+      "https://opencode.ai/zen/go/v1/",
+      "https://OpenCode.ai/zen/go/v1",
+      "https://opencode.AI/zen/go/v1",
+      "https://opencode.ai:443/zen/go/v1",
+    ]) {
+      expect(rateLimitRetryPolicyFor({ baseUrl, adapter: "openai-chat" } as OcxProviderConfig)).toEqual(patient);
+    }
+    // Userinfo, query strings, and look-alike hosts still refuse the fallback.
+    // The userinfo case is assembled through the URL setters instead of written inline.
+    // privacy:scan reads source text, so inline userinfo in a test file is
+    // indistinguishable from a real address to its email detector, and it blocked the
+    // shared gates job on dev. Widening isAllowedEmail would have been the other way out
+    // and the wrong one: the allowlist is what keeps the detector honest. The serialized
+    // href below is byte-identical to the literal it replaces, so the input under test
+    // is unchanged.
+    const userinfoBaseUrl = new URL("https://opencode.ai/zen/go/v1");
+    userinfoBaseUrl.username = "user";
+    userinfoBaseUrl.password = ["pa", "ss"].join("");
+    for (const baseUrl of [
+      "https://opencode.ai/zen/go/v1?x=1",
+      userinfoBaseUrl.href,
+      "https://opencode.ai.evil.net/zen/go/v1",
+    ]) {
+      expect(rateLimitRetryPolicyFor({ baseUrl, adapter: "openai-chat" } as OcxProviderConfig)).toBeNull();
+    }
+  });
+
   test("honors explicit values", () => {
     expect(rateLimitRetryPolicyFor({
       retryOn429: { attempts: 10, intervalMs: 1_000, maxIntervalMs: 5_000, respectRetryAfter: false },
@@ -115,9 +179,51 @@ describe("retry loop client-abort handling", () => {
   const originalFetch = globalThis.fetch;
 
   afterEach(() => {
+    // Release the preload-home lease before later teardown can replace or remove that home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
   });
 
+  test("opencode-go fallback replays burst 429s on the same key, then surfaces 429", async () => {
+    let sends = 0;
+    globalThis.fetch = (async (input) => {
+      const url = input instanceof Request ? input.url : String(input);
+      if (url.includes("opencode.ai/zen/go")) {
+        sends += 1;
+        return new Response(JSON.stringify({ error: { message: "rate limited" } }), {
+          status: 429,
+          headers: { "content-type": "application/json", "retry-after": "0" },
+        });
+      }
+      return originalFetch(input as never, undefined as never);
+    }) as typeof fetch;
+
+    const config = {
+      port: 0,
+      defaultProvider: "opencode-go",
+      providers: {
+        "opencode-go": {
+          adapter: "openai-chat",
+          baseUrl: "https://opencode.ai/zen/go/v1",
+          authMode: "key",
+          apiKey: "key-alpha-000111222333",
+        },
+      },
+    } as OcxConfig;
+
+    // Direct dispatch needs the writer lease that startServer normally owns for this home.
+    releaseSpendHome = acquireOwnedSpendHome();
+    const response = await handleResponses(new Request("http://localhost/v1/responses", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ model: "opencode-go/muse-spark-1.3-contributor", input: "hello", stream: false }),
+    }), config, { model: "opencode-go/muse-spark-1.3-contributor", provider: "opencode-go" }, {});
+
+    expect(sends).toBe(3);
+    expect(response.status).toBe(429);
+  });
+
   test("abort during the wait interrupts the sleep, cancels the 429 body, and returns 499 without replaying", async () => {
     let sends = 0;
     let upstreamBodyCancelled = false;
@@ -155,6 +261,7 @@ describe("retry loop client-abort handling", () => {
     } as OcxConfig;
 
     const abort = new AbortController();
+    releaseSpendHome = acquireOwnedSpendHome();
     const pending = handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -211,6 +318,7 @@ describe("retry loop client-abort handling", () => {
     } as OcxConfig;
 
     const abort = new AbortController();
+    releaseSpendHome = acquireOwnedSpendHome();
     const pending = handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { "content-type": "application/json" },
diff --git a/tests/providers/resolved-model-policy.test.ts b/tests/providers/resolved-model-policy.test.ts
new file mode 100644
index 00000000000..99ecc9411bc
--- /dev/null
+++ b/tests/providers/resolved-model-policy.test.ts
@@ -0,0 +1,799 @@
+import { describe, expect, test } from "bun:test";
+import type { OcxProviderConfig } from "../../src/types";
+import { captureWireAdapterHardPins } from "../../src/types";
+import type { ProviderRegistryEntry } from "../../src/providers/registry/types";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { effectiveProviderAliasDecision, resolveModelAlias } from "../../src/providers/default-aliases";
+import { resolveOpenAiVirtualModel } from "../../src/providers/openai-virtual-models";
+import { routedProviderConfig } from "../../src/router";
+import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve";
+import { applyProviderConfigHints } from "../../src/codex/catalog/model-hints";
+import { captureFastPolicyAuthority } from "../../src/providers/service-tier";
+import {
+  clampObservedModelLimits,
+  resolveModelPolicy,
+} from "../../src/providers/resolved-model-policy";
+
+const MODEL = "vendor/model-a";
+
+function registry(overrides: Partial<ProviderRegistryEntry> = {}): ProviderRegistryEntry {
+  return {
+    id: "fixture-provider",
+    label: "Fixture provider",
+    adapter: "openai-chat",
+    baseUrl: "https://registry.invalid/v1",
+    authKind: "key",
+    contextWindow: 120_000,
+    modelContextWindows: { [MODEL]: 100_000, "registry-only": 90_000 },
+    modelInputModalities: { [MODEL]: ["text", "image"] },
+    modelMaxInputTokens: { [MODEL]: 80_000 },
+    modelMaxOutputTokens: { [MODEL]: 16_000 },
+    modelReasoningEfforts: { [MODEL]: ["low", "high"] },
+    modelDefaultReasoningEfforts: { [MODEL]: "high" },
+    modelSupportsReasoningSummaries: { [MODEL]: true },
+    modelSupportsVerbosity: { [MODEL]: true },
+    modelSupportsServiceTier: { [MODEL]: true },
+    staticHeaders: { "X-Registry": "registry", "User-Agent": "registry-agent" },
+    parallelToolCalls: true,
+    showThinkingSummary: true,
+    alias: "registry-alias",
+    ...overrides,
+  };
+}
+
+function provider(overrides: Partial<OcxProviderConfig> = {}): OcxProviderConfig {
+  return {
+    adapter: "openai-chat",
+    baseUrl: "https://registry.invalid/v1",
+    authMode: "key",
+    ...overrides,
+  };
+}
+
+function resolve(
+  configured: OcxProviderConfig,
+  entry: ProviderRegistryEntry | undefined = registry(),
+  transportMatchedRegistry = true,
+) {
+  return resolveModelPolicy({
+    providerName: "fixture-provider",
+    modelId: MODEL,
+    provider: configured,
+    registryEntry: entry,
+    transportMatchedRegistry,
+  });
+}
+
+describe("resolved static model policy parity", () => {
+  test("representative registry maps stay byte-equivalent to the current route merge", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => {
+      if (candidate.allowBaseUrlOverride || /\{[^}]*\}/.test(candidate.baseUrl)) return false;
+      const shared = Object.keys(candidate.modelContextWindows ?? {}).find(modelId => (
+        candidate.modelMaxOutputTokens?.[modelId] !== undefined
+        && candidate.modelReasoningEfforts?.[modelId] !== undefined
+      ));
+      return shared !== undefined;
+    });
+    expect(entry).toBeDefined();
+    const modelId = Object.keys(entry!.modelContextWindows!).find(candidate => (
+      entry!.modelMaxOutputTokens?.[candidate] !== undefined
+      && entry!.modelReasoningEfforts?.[candidate] !== undefined
+    ))!;
+    const configured = provider({
+      adapter: entry!.adapter,
+      baseUrl: entry!.baseUrl,
+      authMode: entry!.authKind,
+    });
+    const current = routedProviderConfig(entry!.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry!.id,
+      modelId,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    });
+    expect(JSON.stringify({
+      context: policy.provider.modelContextWindows,
+      output: policy.provider.modelMaxOutputTokens,
+      efforts: policy.provider.modelReasoningEfforts,
+    })).toBe(JSON.stringify({
+      context: current.modelContextWindows,
+      output: current.modelMaxOutputTokens,
+      efforts: current.modelReasoningEfforts,
+    }));
+  });
+
+  test("registry defaults match the current registry-first route projection", () => {
+    const policy = resolve(provider());
+    expect({
+      adapter: policy.provider.adapter,
+      baseUrl: policy.provider.baseUrl,
+      contextWindow: policy.model.contextWindow,
+      inputModalities: policy.model.inputModalities,
+      maxInputTokens: policy.model.maxInputTokens,
+      maxOutputTokens: policy.model.maxOutputTokens,
+      reasoningEfforts: policy.model.reasoningEfforts,
+      defaultReasoningEffort: policy.model.defaultReasoningEffort,
+      summaries: policy.model.supportsReasoningSummaries,
+      verbosity: policy.model.supportsVerbosity,
+      serviceTier: policy.model.supportsServiceTier,
+      alias: policy.effectiveAlias,
+    }).toEqual({
+      adapter: "openai-chat",
+      baseUrl: "https://registry.invalid/v1",
+      contextWindow: 100_000,
+      inputModalities: ["text", "image"],
+      maxInputTokens: 80_000,
+      maxOutputTokens: 16_000,
+      reasoningEfforts: ["low", "high"],
+      defaultReasoningEffort: "high",
+      summaries: true,
+      verbosity: true,
+      serviceTier: true,
+      alias: "registry-alias",
+    });
+    expect(policy.provenance.model.contextWindow).toBe("registry");
+    expect(policy.provenance.alias).toBe("registry");
+  });
+
+  test("operator values win per model while registry-only siblings survive", () => {
+    const configured = provider({
+      modelContextWindows: { [MODEL]: 70_000, "operator-only": 60_000 },
+      modelInputModalities: { [MODEL]: ["text"] },
+      modelMaxInputTokens: { [MODEL]: 50_000 },
+      modelMaxOutputTokens: { [MODEL]: 8_000 },
+      modelReasoningEfforts: { [MODEL]: [] },
+      modelDefaultReasoningEfforts: { [MODEL]: "low" },
+      modelSupportsReasoningSummaries: { [MODEL]: false },
+      modelSupportsVerbosity: { [MODEL]: false },
+      modelSupportsServiceTier: { [MODEL]: false },
+      headers: { "user-agent": "operator-agent", "X-Operator": "operator" },
+      parallelToolCalls: false,
+      showThinkingSummary: false,
+      alias: "operator-alias",
+    });
+    const policy = resolve(configured);
+    expect(policy.provider.modelContextWindows).toEqual({
+      [MODEL]: 70_000,
+      "registry-only": 90_000,
+      "operator-only": 60_000,
+    });
+    expect(policy.provider.headers).toEqual({
+      "user-agent": "operator-agent",
+      "X-Operator": "operator",
+      "X-Registry": "registry",
+    });
+    expect(policy.model).toMatchObject({
+      contextWindow: 70_000,
+      inputModalities: ["text"],
+      maxInputTokens: 50_000,
+      maxOutputTokens: 8_000,
+      reasoningEfforts: [],
+      defaultReasoningEffort: "low",
+      supportsReasoningSummaries: false,
+      supportsVerbosity: false,
+      supportsServiceTier: false,
+    });
+    expect(policy.provider.parallelToolCalls).toBe(false);
+    expect(policy.provider.showThinkingSummary).toBe(false);
+    expect(policy.effectiveAlias).toBe("operator-alias");
+    expect(policy.provenance.model.supportsReasoningSummaries).toBe("operator");
+  });
+
+  test("nonempty explicit capability modalities outrank the registry map", () => {
+    const configured = provider({ modelCapabilities: { [MODEL]: { inputModalities: ["audio"] } } });
+    const policy = resolveModelPolicy({
+      providerName: "fixture-provider",
+      modelId: MODEL,
+      provider: configured,
+      registryEntry: registry(),
+      transportMatchedRegistry: true,
+      modelCapabilities: configured.modelCapabilities![MODEL],
+    });
+    const current = applyProviderConfigHints("fixture-provider", configured, { provider: "fixture-provider", id: MODEL });
+    expect(policy.model.inputModalities).toEqual(["audio"]);
+    expect(policy.model.inputModalities).toEqual(current.inputModalities);
+    expect(policy.provenance.model.inputModalities).toBe("operator-capability");
+  });
+
+  test("empty explicit capability modalities fall through to the registry map", () => {
+    const policy = resolveModelPolicy({
+      providerName: "fixture-provider",
+      modelId: MODEL,
+      provider: provider(),
+      registryEntry: registry(),
+      transportMatchedRegistry: true,
+      modelCapabilities: { inputModalities: [] },
+    });
+    expect(policy.model.inputModalities).toEqual(["text", "image"]);
+    expect(policy.provenance.model.inputModalities).toBe("registry");
+  });
+
+  test("absent explicit capabilities preserve the current registry-map winner", () => {
+    const policy = resolve(provider());
+    expect(policy.model.inputModalities).toEqual(["text", "image"]);
+    expect(policy.provenance.model.inputModalities).toBe("registry");
+  });
+
+  test("cleared exact capability restores colon-family legacy modalities", () => {
+    const modelId = "ModelA:variant";
+    const configured = provider({
+      modelInputModalities: { ModelA: ["audio"] },
+      modelCapabilities: { [modelId]: { inputModalities: ["text", "image"] } },
+    });
+    const withExactCapability = resolveModelPolicy({
+      providerName: "custom",
+      modelId,
+      provider: configured,
+      transportMatchedRegistry: false,
+      modelCapabilities: configured.modelCapabilities![modelId],
+    });
+    expect(withExactCapability.model.inputModalities).toEqual(["text", "image"]);
+    delete configured.modelCapabilities![modelId];
+    const cleared = resolveModelPolicy({
+      providerName: "custom",
+      modelId,
+      provider: configured,
+      transportMatchedRegistry: false,
+    });
+    expect(cleared.model.inputModalities).toEqual(["audio"]);
+    expect(cleared.provenance.model.inputModalities).toBe("operator");
+  });
+
+  test("colon-family legacy modalities resolve without an exact capability declaration", () => {
+    const policy = resolveModelPolicy({
+      providerName: "custom",
+      modelId: "ModelA:variant",
+      provider: provider({ modelInputModalities: { ModelA: ["audio"] } }),
+      transportMatchedRegistry: false,
+    });
+    expect(policy.model.inputModalities).toEqual(["audio"]);
+    expect(policy.provenance.model.inputModalities).toBe("operator");
+  });
+
+  test("registry exact key beats operator family with matching provenance", () => {
+    const modelId = "ModelA:variant";
+    const entry = registry({ modelInputModalities: { [modelId]: ["text", "image"] } });
+    const configured = provider({ modelInputModalities: { ModelA: ["audio"] } });
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    });
+    expect(policy.model.inputModalities).toEqual(["text", "image"]);
+    expect(policy.provenance.model.inputModalities).toBe("registry");
+  });
+
+  test("captured effective auth admits a usable key override without credential material", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => (
+      candidate.authKind === "oauth" && candidate.allowKeyAuthOverride === true
+    ))!;
+    const configured = provider({
+      adapter: entry.adapter,
+      baseUrl: entry.baseUrl,
+      authMode: "key",
+      apiKey: "usable-private-key",
+    });
+    const authority = routedProviderConfig(entry.id, configured);
+    expect(authority.authMode).toBe("key");
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId: entry.defaultModel ?? MODEL,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+      effectiveAuth: { authMode: authority.authMode! },
+    });
+    expect(policy.provider.authMode).toBe(authority.authMode);
+    expect(policy.provenance.provider.authMode).toBe("captured-auth");
+    expect(JSON.stringify(policy)).not.toContain("usable-private-key");
+  });
+
+  test("captured unresolved key authority falls back to registry OAuth", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => (
+      candidate.authKind === "oauth" && candidate.allowKeyAuthOverride === true
+    ))!;
+    const envName = "OCX_TEST_RESOLVED_POLICY_MISSING_KEY";
+    const previous = process.env[envName];
+    delete process.env[envName];
+    try {
+      const reference = `\${${envName}}`;
+      const configured = provider({
+        adapter: entry.adapter,
+        baseUrl: entry.baseUrl,
+        authMode: "key",
+        apiKey: reference,
+      });
+      const authority = routedProviderConfig(entry.id, configured);
+      expect(authority.authMode).toBe("oauth");
+      const policy = resolveModelPolicy({
+        providerName: entry.id,
+        modelId: entry.defaultModel ?? MODEL,
+        provider: configured,
+        registryEntry: entry,
+        transportMatchedRegistry: true,
+        effectiveAuth: { authMode: authority.authMode! },
+      });
+      expect(policy.provider.authMode).toBe(authority.authMode);
+      expect(policy.provenance.provider.authMode).toBe("captured-auth");
+      expect(JSON.stringify(policy)).not.toContain(reference);
+    } finally {
+      if (previous === undefined) delete process.env[envName];
+      else process.env[envName] = previous;
+    }
+  });
+
+  test("a custom transport receives no registry policy", () => {
+    const configured = provider({
+      baseUrl: "https://custom.invalid/v1",
+      contextWindow: 42_000,
+      apiKey: "private-fixture-value",
+      modelSupportsVerbosity: { [MODEL]: false },
+    });
+    const policy = resolve(configured, registry(), false);
+    expect(policy.transportMatchedRegistry).toBe(false);
+    expect(policy.provider.baseUrl).toBe("https://custom.invalid/v1");
+    expect(policy.provider.contextWindow).toBe(42_000);
+    expect(policy.model.contextWindow).toBe(42_000);
+    expect(policy.model.supportsVerbosity).toBe(false);
+    expect(JSON.stringify(policy)).not.toContain("private-fixture-value");
+    expect(policy.provenance.model.contextWindow).toBe("operator");
+  });
+
+  test("unknown capabilities stay absent rather than becoming false or empty", () => {
+    const policy = resolveModelPolicy({
+      providerName: "custom",
+      modelId: "unknown-model",
+      provider: provider({ baseUrl: "https://custom.invalid/v1" }),
+      transportMatchedRegistry: false,
+    });
+    expect(policy.model).toEqual({ adapter: "openai-chat" });
+    expect(policy.model.contextWindow).toBeUndefined();
+    expect(policy.model.reasoningEfforts).toBeUndefined();
+    expect(policy.model.supportsReasoningSummaries).toBeUndefined();
+    expect(policy.provenance.model.contextWindow).toBe("unknown");
+  });
+
+  test("discovered limits remain call-local and are clamped by frozen static caps", () => {
+    const configured = provider({
+      modelContextWindows: { [MODEL]: 70_000 },
+      modelMaxInputTokens: { [MODEL]: 50_000 },
+      modelMaxOutputTokens: { [MODEL]: 8_000 },
+    });
+    const policy = resolve(configured);
+    const widened = clampObservedModelLimits(policy.model, {
+      contextWindow: 90_000,
+      maxInputTokens: 60_000,
+      maxOutputTokens: 12_000,
+    });
+    const narrowed = clampObservedModelLimits(policy.model, {
+      contextWindow: 40_000,
+      maxInputTokens: 30_000,
+      maxOutputTokens: 4_000,
+    });
+    expect(widened).toEqual({ contextWindow: 70_000, maxInputTokens: 50_000, maxOutputTokens: 8_000 });
+    expect(narrowed).toEqual({ contextWindow: 40_000, maxInputTokens: 30_000, maxOutputTokens: 4_000 });
+    const current = applyProviderConfigHints("fixture-provider", configured, {
+      provider: "fixture-provider",
+      id: MODEL,
+      contextWindow: 90_000,
+      maxInputTokens: 60_000,
+      maxOutputTokens: 12_000,
+    });
+    expect(widened).toEqual({
+      contextWindow: current.contextWindow,
+      maxInputTokens: current.maxInputTokens,
+      maxOutputTokens: current.maxOutputTokens,
+    });
+    expect(policy.model).toMatchObject({ contextWindow: 70_000, maxInputTokens: 50_000, maxOutputTokens: 8_000 });
+    // The frozen policy legitimately retains the registry map's "registry-only": 90_000 entry,
+    // so a blanket substring ban cannot prove the observed clamp stayed out. Prove non-mutation
+    // instead: deep-frozen snapshot equality across both clamp calls, exact model caps, the
+    // registry-only entry retained, and no observed fields on the model projection.
+    const beforeSnapshot = JSON.stringify(policy);
+    clampObservedModelLimits(policy.model, { contextWindow: 90_000, maxInputTokens: 60_000, maxOutputTokens: 12_000 });
+    clampObservedModelLimits(policy.model, { contextWindow: 40_000, maxInputTokens: 30_000, maxOutputTokens: 4_000 });
+    expect(JSON.stringify(policy)).toBe(beforeSnapshot);
+    expect(policy.provider.modelContextWindows?.["registry-only"]).toBe(90_000);
+    expect(policy.model).not.toHaveProperty("observedContextWindow");
+  });
+
+  test("hard pins outrank explicit model adapters and registry wire defaults", () => {
+    const modelId = Object.keys(captureWireAdapterHardPins("opencode-go"))[0]!;
+    const entry = registry({
+      id: "opencode-go",
+      modelWireDefaults: { [modelId]: "openai-responses" },
+    });
+    const policy = resolveModelPolicy({
+      providerName: "opencode-go",
+      modelId,
+      provider: provider({ modelAdapters: { [modelId]: "openai-chat" } }),
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    });
+    expect(policy.model.adapter).toBe("anthropic");
+    expect(policy.provenance.model.adapter).toBe("hard-pin");
+    expect(policy.model.adapter).toBe(resolveWireProtocolOverride(
+      "opencode-go",
+      modelId,
+      provider({ modelAdapters: { [modelId]: "openai-chat" } }),
+    ).adapter);
+  });
+
+  test("explicit wire override beats a registry default and an explicit provider adapter opts out", () => {
+    const entry = registry({ modelWireDefaults: { [MODEL]: "openai-responses" } });
+    const explicit = resolve(provider({ modelAdapters: { [MODEL]: "openai-responses" } }), entry);
+    const optOut = resolve(provider({ modelAdapters: { [MODEL]: "openai-chat" } }), entry);
+    expect(explicit.model.adapter).toBe("openai-responses");
+    expect(explicit.provenance.model.adapter).toBe("operator");
+    expect(optOut.model.adapter).toBe("openai-chat");
+    expect(optOut.provenance.model.adapter).toBe("operator");
+  });
+
+  test("captured alias decisions preserve explicit null and registry provenance", () => {
+    const disabled = resolveModelPolicy({
+      providerName: "fixture-provider",
+      modelId: MODEL,
+      provider: provider(),
+      registryEntry: registry(),
+      transportMatchedRegistry: true,
+      effectiveAlias: null,
+      effectiveAliasSource: "operator",
+    });
+    const capturedRegistry = resolveModelPolicy({
+      providerName: "fixture-provider",
+      modelId: MODEL,
+      provider: provider(),
+      registryEntry: registry(),
+      transportMatchedRegistry: true,
+      effectiveAlias: "registry-alias",
+      effectiveAliasSource: "registry",
+    });
+    expect(disabled.effectiveAlias).toBeNull();
+    expect(disabled.provenance.alias).toBe("operator");
+    expect(capturedRegistry.effectiveAlias).toBe("registry-alias");
+    expect(capturedRegistry.provenance.alias).toBe("registry");
+  });
+
+  test("captured registry alias matches the current collision-aware decision", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.alias !== undefined)!;
+    const configured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind });
+    const config = { providers: { [entry.id]: configured } };
+    const current = effectiveProviderAliasDecision(entry.id, configured, config);
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId: entry.defaultModel ?? "fixture-model",
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+      effectiveAlias: current,
+      effectiveAliasSource: "registry",
+    });
+    expect(policy.effectiveAlias).toBe(current);
+    expect(policy.provenance.alias).toBe("registry");
+  });
+
+  test("model alias policy resolves against the post-alias native identity", () => {
+    const configured = provider({ modelAliases: { [MODEL]: "short-selector" } });
+    const resolved = resolveModelAlias({ defaultModelAliases: false }, configured, [MODEL], "short-selector");
+    expect(resolved).toBe(MODEL);
+    const policy = resolveModelPolicy({
+      providerName: "fixture-provider",
+      modelId: resolved!,
+      provider: configured,
+      registryEntry: registry(),
+      transportMatchedRegistry: true,
+    });
+    expect(policy.modelId).toBe(MODEL);
+    expect(policy.model.contextWindow).toBe(100_000);
+  });
+
+  test("virtual model policy resolves against the post-rewrite wire identity", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.virtualModels !== undefined)!;
+    const selectedModelId = Object.keys(entry.virtualModels!)[0]!;
+    const resolution = resolveOpenAiVirtualModel(entry.id, selectedModelId)!;
+    const configured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind });
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId: resolution.wireModelId,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    });
+    expect(policy.modelId).toBe(resolution.wireModelId);
+    expect(policy.modelId).not.toBe(resolution.selectedModelId);
+  });
+
+  test("repeat resolution is deeply equal, frozen, and detached", () => {
+    const configured = provider({ modelInputModalities: { [MODEL]: ["text"] } });
+    const entry = registry();
+    const input = {
+      providerName: "fixture-provider",
+      modelId: MODEL,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    } as const;
+    const first = resolveModelPolicy(input);
+    const second = resolveModelPolicy(input);
+    expect(first).toEqual(second);
+    expect(first).not.toBe(second);
+    expect(first.provider).not.toBe(second.provider);
+    expect(first.model).not.toBe(second.model);
+    expect(first.model.inputModalities).not.toBe(second.model.inputModalities);
+    expect(Object.isFrozen(first)).toBe(true);
+    expect(Object.isFrozen(second)).toBe(true);
+  });
+
+  test("stale direct-effort budget classification matches current route repair", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === "alibaba-token-plan")!;
+    const directModel = entry.directReasoningEffortModels![0]!;
+    const configured = provider({
+      adapter: entry.adapter,
+      baseUrl: entry.baseUrl,
+      authMode: entry.authKind,
+      thinkingBudgetModels: [directModel, ...(entry.thinkingBudgetModels ?? [])],
+    });
+    const current = routedProviderConfig(entry.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId: directModel, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(policy.provider.thinkingBudgetModels).toEqual(current.thinkingBudgetModels);
+    expect(policy.provider.modelReasoningEfforts?.[directModel]).toEqual(current.modelReasoningEfforts?.[directModel]);
+    expect(policy.provider.modelDefaultReasoningEfforts?.[directModel]).toEqual(current.modelDefaultReasoningEfforts?.[directModel]);
+    expect(policy.provider.modelReasoningEffortMap?.[directModel]).toEqual(current.modelReasoningEffortMap?.[directModel]);
+  });
+
+  test.each(["cline-pass", "mimo-free"])("%s stale live discovery matches static route authority", id => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === id)!;
+    const configured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind, liveModels: true });
+    const current = routedProviderConfig(id, configured);
+    const policy = resolveModelPolicy({
+      providerName: id, modelId: entry.defaultModel ?? MODEL, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+      effectiveAuth: { authMode: current.authMode! },
+    });
+    expect(policy.provider.liveModels).toBe(current.liveModels);
+    expect(policy.provider.liveModels).toBe(false);
+  });
+
+  test("historical ClinePass ladder matches current route repair", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === "cline-pass")!;
+    const configured = provider({
+      adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind,
+      reasoningWireFormat: "gateway-object", reasoningEfforts: ["low"],
+    });
+    const current = routedProviderConfig(entry.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId: entry.defaultModel!, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(policy.provider.reasoningEfforts).toEqual(current.reasoningEfforts);
+  });
+
+  test("custom ClinePass destination keeps an intentional low-only gateway ladder", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === "cline-pass")!;
+    const configured = provider({
+      adapter: entry.adapter,
+      baseUrl: "https://custom-cline-pass.invalid/v1",
+      authMode: entry.authKind,
+      reasoningWireFormat: "gateway-object",
+      reasoningEfforts: ["low"],
+    });
+    const current = routedProviderConfig(entry.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId: entry.defaultModel!,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: false,
+    });
+    expect(policy.provider.reasoningEfforts).toEqual(current.reasoningEfforts);
+    expect(policy.provider.reasoningEfforts).toEqual(["low"]);
+    expect(policy.provenance.provider.reasoningEfforts).toBe("operator");
+  });
+
+  test("Anthropic numeric-family context matches current catalog fallback", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => (
+      candidate.adapter === "anthropic" && Object.keys(candidate.modelContextWindows ?? {}).length > 0
+    ))!;
+    const family = Object.keys(entry.modelContextWindows!)[0]!;
+    const pointRelease = `${family}-20260919`;
+    const configured = provider({
+      adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind,
+      modelContextWindows: { ...entry.modelContextWindows },
+    });
+    const current = applyProviderConfigHints(entry.id, configured, { provider: entry.id, id: pointRelease });
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId: pointRelease, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(policy.model.contextWindow).toBe(current.contextWindow);
+  });
+
+  test("resolved max input never exceeds the resolved context", () => {
+    const configured = provider({ modelContextWindows: { [MODEL]: 70_000 }, modelMaxInputTokens: { [MODEL]: 90_000 } });
+    const policy = resolveModelPolicy({
+      providerName: "custom", modelId: MODEL,
+      provider: configured,
+      transportMatchedRegistry: false,
+    });
+    const current = applyProviderConfigHints("custom", configured, { provider: "custom", id: MODEL });
+    expect(policy.model.maxInputTokens).toBe(current.maxInputTokens);
+    expect(policy.model).toMatchObject({ contextWindow: 70_000, maxInputTokens: 70_000 });
+    expect(clampObservedModelLimits(policy.model, { maxInputTokens: 80_000 }))
+      .toMatchObject({ contextWindow: 70_000, maxInputTokens: 70_000 });
+  });
+
+  test("override URL rejection and template fallback match current routing", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.allowBaseUrlOverride === true)!;
+    const configured = provider({ adapter: entry.adapter, baseUrl: "{unresolved}", authMode: entry.authKind });
+    expect(() => routedProviderConfig(entry.id, configured)).toThrow(/Invalid baseUrl/);
+    expect(() => resolveModelPolicy({
+      providerName: entry.id, modelId: entry.defaultModel ?? MODEL, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    })).toThrow(/Invalid baseUrl/);
+    const template = registry({ baseUrl: "https://{region}.invalid/v1", allowBaseUrlOverride: false });
+    const fallback = resolveModelPolicy({
+      providerName: template.id, modelId: MODEL,
+      provider: provider({ baseUrl: "{unresolved}" }), registryEntry: template, transportMatchedRegistry: true,
+    });
+    expect(fallback.provider.baseUrl).toBe(template.baseUrl);
+    expect(fallback.provenance.provider.baseUrl).toBe("registry");
+  });
+
+  test("absent override URL matches current Invalid baseUrl oracle while templates fall back", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.allowBaseUrlOverride === true)!;
+    const absent = { adapter: entry.adapter, authMode: entry.authKind } as OcxProviderConfig;
+    expect(() => routedProviderConfig(entry.id, absent))
+      .toThrow(`Invalid baseUrl for provider "${entry.id}": expected a nonblank URL without unresolved placeholders`);
+    expect(() => resolveModelPolicy({
+      providerName: entry.id,
+      modelId: entry.defaultModel ?? MODEL,
+      provider: absent,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+    })).toThrow(`Invalid baseUrl for provider "${entry.id}": expected a nonblank URL without unresolved placeholders`);
+    const template = registry({ baseUrl: "https://{region}.invalid/v1", allowBaseUrlOverride: false });
+    const templateAbsent = { adapter: template.adapter, authMode: template.authKind } as OcxProviderConfig;
+    const fallback = resolveModelPolicy({
+      providerName: template.id,
+      modelId: MODEL,
+      provider: templateAbsent,
+      registryEntry: template,
+      transportMatchedRegistry: true,
+    });
+    expect(fallback.provider.baseUrl).toBe(template.baseUrl);
+    expect(fallback.provenance.provider.baseUrl).toBe("registry");
+  });
+
+  test("captured key-auth service-tier overlay matches current authority and preserves false", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.keyAuthServiceTier !== undefined)!;
+    const modelId = Object.keys(entry.keyAuthServiceTier?.modelSupportsServiceTier ?? entry.modelSupportsServiceTier ?? {})[0] ?? MODEL;
+    const keyConfigured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: "key" });
+    const keyAuthority = captureFastPolicyAuthority(entry.id, keyConfigured, true);
+    const keyPolicy = resolveModelPolicy({
+      providerName: entry.id, modelId, provider: keyConfigured,
+      registryEntry: entry, transportMatchedRegistry: true, effectiveAuth: { authMode: "key" },
+    });
+    const oauthPolicy = resolveModelPolicy({
+      providerName: entry.id, modelId,
+      provider: provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: "oauth" }),
+      registryEntry: entry, transportMatchedRegistry: true, effectiveAuth: { authMode: "oauth" },
+    });
+    expect(keyPolicy.provider.supportsServiceTier).toBe(keyAuthority.capability.provider);
+    expect(keyPolicy.provider.supportsServiceTier).not.toBe(oauthPolicy.provider.supportsServiceTier);
+    const configured = provider({
+      adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: "key",
+      supportsServiceTier: false, chatServiceTier: false,
+      modelSupportsServiceTier: { [modelId]: false },
+    });
+    const authority = captureFastPolicyAuthority(entry.id, configured, true);
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true, effectiveAuth: { authMode: "key" },
+    });
+    expect(policy.provider.supportsServiceTier).toBe(authority.capability.provider);
+    expect(policy.provider.chatServiceTier).toBe(authority.capability.chatServiceTier);
+    expect(policy.model.supportsServiceTier).toBe(authority.capability.models[modelId]);
+    expect(policy.model.supportsServiceTier).toBe(false);
+  });
+
+  test("unlisted key-auth model inherits provider service tier with registry provenance", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.id === "xai")!;
+    const modelId = "grok-4.20-multi-agent-0309";
+    expect(entry.modelSupportsServiceTier?.[modelId]).toBeUndefined();
+    const configured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: "key" });
+    const authority = captureFastPolicyAuthority(entry.id, configured, true);
+    const policy = resolveModelPolicy({
+      providerName: entry.id,
+      modelId,
+      provider: configured,
+      registryEntry: entry,
+      transportMatchedRegistry: true,
+      effectiveAuth: { authMode: "key" },
+    });
+    expect(policy.model.supportsServiceTier).toBe(authority.capability.provider);
+    expect(policy.model.supportsServiceTier).toBe(true);
+    expect(policy.provenance.model.supportsServiceTier).toBe("registry");
+  });
+
+  test("provider default output fallback and provenance match current route", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.defaultMaxOutputTokens !== undefined)!;
+    const configured = provider({ adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind });
+    const current = routedProviderConfig(entry.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId: entry.defaultModel ?? MODEL, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(policy.model.maxOutputTokens).toBe(current.defaultMaxOutputTokens);
+    expect(policy.provenance.model.maxOutputTokens).toBe("registry");
+  });
+
+  test("lower-cap merge is scoped to the canonical API-key provider", () => {
+    const apiEntry = PROVIDER_REGISTRY.find(candidate => candidate.id === "openai-apikey")!;
+    const apiModel = Object.keys(apiEntry.modelMaxInputTokens ?? {})[0]!;
+    const apiConfigured = provider({
+      adapter: apiEntry.adapter, baseUrl: apiEntry.baseUrl, authMode: apiEntry.authKind,
+      modelContextWindows: { [apiModel]: apiEntry.modelContextWindows![apiModel]! + 1_000 },
+      modelMaxInputTokens: { [apiModel]: apiEntry.modelMaxInputTokens![apiModel]! + 1_000 },
+    });
+    const apiCurrent = routedProviderConfig(apiEntry.id, apiConfigured);
+    const api = resolveModelPolicy({
+      providerName: apiEntry.id, modelId: apiModel, provider: apiConfigured,
+      registryEntry: apiEntry, transportMatchedRegistry: true,
+    });
+    expect(api.model.contextWindow).toBe(apiCurrent.modelContextWindows?.[apiModel]);
+    expect(api.model.maxInputTokens).toBe(apiCurrent.modelMaxInputTokens?.[apiModel]);
+    const entry = PROVIDER_REGISTRY.find(candidate => (
+      candidate.id !== "openai-apikey" && Object.keys(candidate.modelContextWindows ?? {}).length > 0
+    ))!;
+    const modelId = Object.keys(entry.modelContextWindows!)[0]!;
+    const configured = provider({
+      adapter: entry.adapter, baseUrl: entry.baseUrl, authMode: entry.authKind,
+      modelContextWindows: { [modelId]: entry.modelContextWindows![modelId]! + 1_000 },
+    });
+    const ordinaryCurrent = routedProviderConfig(entry.id, configured);
+    const ordinary = resolveModelPolicy({
+      providerName: entry.id, modelId, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(ordinary.model.contextWindow).toBe(ordinaryCurrent.modelContextWindows?.[modelId]);
+  });
+
+  test("selected base URL carries operator provenance", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.allowBaseUrlOverride === true)!;
+    const configured = provider({
+      adapter: entry.adapter, baseUrl: "https://operator.invalid/v1", authMode: entry.authKind,
+    });
+    const current = routedProviderConfig(entry.id, configured);
+    const policy = resolveModelPolicy({
+      providerName: entry.id, modelId: MODEL, provider: configured,
+      registryEntry: entry, transportMatchedRegistry: true,
+    });
+    expect(policy.provider.baseUrl).toBe(current.baseUrl);
+    expect(policy.provenance.provider.baseUrl).toBe("operator");
+  });
+
+  test("result is detached, recursively frozen, and excludes mutable request evidence", () => {
+    const configured = provider({
+      apiKey: "secret-value",
+      _apiKeyAttempt: { entryId: "account-like-private-id" },
+      modelInputModalities: { [MODEL]: ["text"] },
+    });
+    const entry = registry();
+    const policy = resolve(configured, entry);
+    configured.modelInputModalities![MODEL]!.push("audio");
+    entry.modelContextWindows![MODEL] = 1;
+    expect(policy.model.inputModalities).toEqual(["text"]);
+    expect(policy.model.contextWindow).toBe(100_000);
+    expect(Object.isFrozen(policy)).toBe(true);
+    expect(Object.isFrozen(policy.provider)).toBe(true);
+    expect(Object.isFrozen(policy.model.inputModalities)).toBe(true);
+    expect(JSON.stringify(policy)).not.toContain("secret-value");
+    expect(JSON.stringify(policy)).not.toContain("account-like-private-id");
+  });
+});
diff --git a/tests/providers/upstream-transient-retry.test.ts b/tests/providers/upstream-transient-retry.test.ts
index 956496e44e4..516f31850a6 100644
--- a/tests/providers/upstream-transient-retry.test.ts
+++ b/tests/providers/upstream-transient-retry.test.ts
@@ -9,6 +9,7 @@ import {
 import { transientRetryPolicyFor } from "../../src/providers/key-failover";
 import { handleChatCompletions } from "../../src/server/chat-completions";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 function bodyResponse(status: number, headers?: Record<string, string>): Response {
   // ReadableStream body so cancel() is observable.
@@ -290,24 +291,31 @@ describe("native Chat completions and the replay refusal", () => {
       },
     } as unknown as OcxConfig;
 
-    const response = await handleChatCompletions(
-      new Request("http://localhost/v1/chat/completions", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "replay-refusal-fixture/model",
-          messages: [{ role: "user", content: "ping" }],
+    // Taken after the inherited test home is in effect so native Chat can record its send.
+    const releaseSpendHome = acquireOwnedSpendHome();
+    try {
+      const response = await handleChatCompletions(
+        new Request("http://localhost/v1/chat/completions", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            model: "replay-refusal-fixture/model",
+            messages: [{ role: "user", content: "ping" }],
+          }),
         }),
-      }),
-      config,
-      { model: "", provider: "" },
-    );
+        config,
+        { model: "", provider: "" },
+      );
 
-    expect(sends).toBe(1);
-    expect(response.status).toBe(429);
-    expect(response.headers.get("Retry-After")).toBeNull();
-    expect(await response.json()).toMatchObject({
-      error: { code: "upstream_reset_replay_refused" },
-    });
+      expect(sends).toBe(1);
+      expect(response.status).toBe(429);
+      expect(response.headers.get("Retry-After")).toBeNull();
+      expect(await response.json()).toMatchObject({
+        error: { code: "upstream_reset_replay_refused" },
+      });
+    } finally {
+      // Released after the response body is consumed so no stream retains the ledger owner.
+      releaseSpendHome();
+    }
   });
 });
diff --git a/tests/providers/vision-classification-seed-repair.test.ts b/tests/providers/vision-classification-seed-repair.test.ts
new file mode 100644
index 00000000000..88cea682c9e
--- /dev/null
+++ b/tests/providers/vision-classification-seed-repair.test.ts
@@ -0,0 +1,158 @@
+/**
+ * The saved-config half of the OpenCode Go DeepSeek reclassification.
+ *
+ * `enrichProviderFromRegistry` is fill-only and asymmetric: `noVisionModels` is filled
+ * all-or-nothing and `modelInputModalities` is filled per-key BENEATH the saved value. A config
+ * saved while the registry called `deepseek-v4.1-flash` text-only therefore keeps BOTH halves of
+ * that claim forever, and images are stripped for a route that reads them (probed 2026-09-19).
+ * Correcting the registry alone fixes new installs only.
+ */
+import { describe, expect, test } from "bun:test";
+import {
+  projectStaleVisionClassifications,
+  STALE_VISION_CLASSIFICATIONS,
+} from "../../src/providers/stale-vision-classification-migration";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { requiresVisionPreprocessing } from "../../src/vision/plan";
+import type { OcxConfig } from "../../src/types";
+
+const MODEL = "deepseek-v4.1-flash";
+const SIBLING = "deepseek-v4-flash";
+
+/** A config saved while the stale seed was current. */
+function staleConfig(
+  modalities: Record<string, string[]> = { [MODEL]: ["text"], [SIBLING]: ["text"] },
+  noVisionModels: string[] = [MODEL, SIBLING],
+  adapter = "openai-chat",
+  baseUrl = "https://opencode.ai/zen/go/v1",
+): OcxConfig {
+  return {
+    providers: {
+      "opencode-go": { adapter, baseUrl, modelInputModalities: { ...modalities }, noVisionModels: [...noVisionModels] },
+    },
+  } as unknown as OcxConfig;
+}
+
+describe("stale vision classification migration", () => {
+  test("repairs both halves of the stale claim", () => {
+    // Modalities alone would not be enough: the sidecar predicate checks noVisionModels FIRST and
+    // short-circuits, so a row left in that list stays text-only however it is declared.
+    const config = staleConfig();
+    const projection = projectStaleVisionClassifications(config);
+    expect(projection.changed).toBe(true);
+    expect(projection.config.providers!["opencode-go"]!.modelInputModalities![MODEL]).toEqual(["text", "image"]);
+    expect(projection.config.providers!["opencode-go"]!.noVisionModels).not.toContain(MODEL);
+    expect(projection.warnings.join(" ")).toContain(MODEL);
+  });
+
+  test("leaves the sibling route classified text-only", () => {
+    // deepseek-v4-flash still answers HTTP 400 "Model only supports text input" on this gateway.
+    // A migration that widened the whole list would strip a real protection.
+    const projection = projectStaleVisionClassifications(staleConfig());
+    expect(projection.config.providers!["opencode-go"]!.modelInputModalities![SIBLING]).toEqual(["text"]);
+    expect(projection.config.providers!["opencode-go"]!.noVisionModels).toContain(SIBLING);
+  });
+
+  test("leaves a modality value the operator chose alone", () => {
+    // The guard is an exact match on the stale declaration. Anything else is a deliberate
+    // override and outranks this migration.
+    const projection = projectStaleVisionClassifications(
+      staleConfig({ [MODEL]: ["text", "audio"], [SIBLING]: ["text"] }),
+    );
+    expect(projection.changed).toBe(false);
+    expect(projection.config.providers!["opencode-go"]!.modelInputModalities![MODEL]).toEqual(["text", "audio"]);
+  });
+
+  test("finishes a half-repaired row whose name is still listed", () => {
+    // The sidecar predicate reads noVisionModels BEFORE the modality list, so a row whose
+    // modalities were already corrected but whose name is still listed keeps stripping images.
+    // Leaving it alone was the gap the maintainer review found on #5164.
+    const projection = projectStaleVisionClassifications(
+      staleConfig({ [MODEL]: ["text", "image"], [SIBLING]: ["text"] }),
+    );
+    expect(projection.changed).toBe(true);
+    expect(projection.config.providers!["opencode-go"]!.modelInputModalities![MODEL]).toEqual(["text", "image"]);
+    expect(projection.config.providers!["opencode-go"]!.noVisionModels).not.toContain(MODEL);
+    // The sibling keeps both halves: its modalities are not the migrated value, so nothing fires.
+    expect(projection.config.providers!["opencode-go"]!.noVisionModels).toContain(SIBLING);
+    expect(projection.warnings.join(" ")).toContain("dropped from noVisionModels");
+  });
+
+  test("leaves a listed name without a readable modality declaration alone", () => {
+    // Ambiguous on purpose: a half-finished repair and an entry the operator added by hand look
+    // identical without the paired value, so the projection does not guess. Flagged to the
+    // maintainer as an open question rather than decided here.
+    const config = staleConfig({ [SIBLING]: ["text"] });
+    const projection = projectStaleVisionClassifications(config);
+    expect(projection.changed).toBe(false);
+    expect(projection.config.providers!["opencode-go"]!.noVisionModels).toContain(MODEL);
+  });
+
+  test("never writes the dedicated modelCapabilities axis", () => {
+    // `modelCapabilities` outranks every source this projection touches, so it is where a
+    // deliberate text-only override survives a restart. A repair that also rewrote it would make
+    // the operator's own `--text-only` decision unrecoverable.
+    const config = staleConfig();
+    config.providers!["opencode-go"]!.modelCapabilities = { [MODEL]: { inputModalities: ["text"] } };
+    const projection = projectStaleVisionClassifications(config);
+    expect(projection.config.providers!["opencode-go"]!.modelCapabilities![MODEL]!.inputModalities).toEqual(["text"]);
+    // The axis only matters because it is read FIRST on the request path: the repair rewrites the
+    // modality list and drops the name from `noVisionModels` around it, and the operator's
+    // declaration still routes the image through the vision sidecar rather than to the model.
+    const row = projection.config.providers!["opencode-go"]!;
+    expect(row.modelInputModalities![MODEL]).toEqual(["text", "image"]);
+    expect(row.noVisionModels ?? []).not.toContain(MODEL);
+    expect(requiresVisionPreprocessing({ providers: { "opencode-go": row } }, row, MODEL, "opencode-go")).toBe(true);
+  });
+
+  test("skips a row that no longer carries the registry adapter", () => {
+    const projection = projectStaleVisionClassifications(staleConfig(undefined, undefined, "anthropic"));
+    expect(projection.changed).toBe(false);
+  });
+
+  test("follows the registry's destination rule where a preset opts into it", () => {
+    // baseten is a key preset with preserveCustomDestination, so the registry owns a same-named row
+    // only while it still points at the registry destination — the rule enrichProviderFromRegistry
+    // applies before it writes registry metadata. Claiming such a row by name alone would rewrite
+    // capability for an endpoint the registry does not describe.
+    const entry = { provider: "baseten", model: MODEL, fromModalities: ["text"], toModalities: ["text", "image"] };
+    const atRegistry = {
+      adapter: "openai-chat",
+      baseUrl: "https://inference.baseten.co/v1",
+      modelInputModalities: { [MODEL]: ["text"] },
+      noVisionModels: [MODEL],
+    };
+    const atOwnHost = { ...atRegistry, baseUrl: "https://operator-gateway.example/v1" };
+    const config = (row: typeof atRegistry): OcxConfig => ({ providers: { baseten: row } } as unknown as OcxConfig);
+    expect(projectStaleVisionClassifications(config(atRegistry), [entry]).changed).toBe(true);
+    expect(projectStaleVisionClassifications(config(atOwnHost), [entry]).changed).toBe(false);
+  });
+
+  test("still repairs a pinned preset row at any destination", () => {
+    // opencode-go is an existing key preset without preserveCustomDestination: the registry claims
+    // that id itself, and enrichment fills its seed into such a row for the same reason. The
+    // projection follows that policy instead of inventing a narrower one of its own.
+    const projection = projectStaleVisionClassifications(
+      staleConfig(undefined, undefined, "openai-chat", "https://operator-gateway.example/v1"),
+    );
+    expect(projection.changed).toBe(true);
+  });
+
+  test("is a no-op on a config without the provider", () => {
+    const projection = projectStaleVisionClassifications({ providers: {} } as unknown as OcxConfig);
+    expect(projection.changed).toBe(false);
+    expect(projection.warnings).toEqual([]);
+  });
+
+  test("every entry names a real correction the registry now carries", () => {
+    // Guards against an entry that repairs a value the registry never claimed, or one whose
+    // target the registry does not declare — either would be a silent no-op forever.
+    for (const entry of STALE_VISION_CLASSIFICATIONS) {
+      const registry = PROVIDER_REGISTRY.find(row => row.id === entry.provider);
+      expect(registry, entry.provider).toBeDefined();
+      expect(registry?.modelInputModalities?.[entry.model], entry.model).toEqual(entry.toModalities);
+      expect(registry?.noVisionModels ?? [], entry.model).not.toContain(entry.model);
+      expect(entry.fromModalities).not.toEqual(entry.toModalities);
+    }
+  });
+});
diff --git a/tests/providers/xai/grok-effort-inject.test.ts b/tests/providers/xai/grok-effort-inject.test.ts
index 179bfc5dae8..64764fd22d8 100644
--- a/tests/providers/xai/grok-effort-inject.test.ts
+++ b/tests/providers/xai/grok-effort-inject.test.ts
@@ -109,6 +109,20 @@ describe("Grok inject model catalog", () => {
     expect(sol?.contextWindow).toBe(500_000);
     expect(sol?.reasoningEfforts).toEqual(nativeReasoningEfforts(NATIVE_SOL));
   });
+
+  test("forwards Meta Muse max into the Grok picker", () => {
+    const routed: CatalogModel = {
+      provider: "meta-muse",
+      id: "muse-spark-1.3-contributor",
+      contextWindow: 1_048_576,
+      reasoningEfforts: ["minimal", "low", "medium", "high", "xhigh", "max"],
+    };
+    const block = buildGrokManagedBlock(10100, buildGrokInjectModels(baseConfig(), [routed]));
+    const table = tableByModelId(parseModels(block), "meta-muse/muse-spark-1.3-contributor");
+    expect(table.reasoning_efforts?.map(row => row.value)).toEqual([
+      "minimal", "low", "medium", "high", "xhigh", "max",
+    ]);
+  });
 });
 
 describe("Grok managed-block thinking-intensity injection", () => {
diff --git a/tests/providers/xai/grok-reset-coupons.test.ts b/tests/providers/xai/grok-reset-coupons.test.ts
index 62143568405..e61d5e62e88 100644
--- a/tests/providers/xai/grok-reset-coupons.test.ts
+++ b/tests/providers/xai/grok-reset-coupons.test.ts
@@ -11,6 +11,7 @@ import {
 import {
   getGrokRemainingResets,
   decodeGetRemainingResetsResponse,
+  decodeVarint,
   encodeRedeemResetRequest,
   encodeVarint,
   GROK_GET_REMAINING_RESETS_ENDPOINT,
@@ -135,6 +136,78 @@ describe("grok reset coupons", () => {
     expect(tokens[0].validityEnd).toBe(new Date(1728788400 * 1000).toISOString());
   });
 
+  it("rejects oversized and truncated protobuf lengths", () => {
+    const oversizedLength = new Uint8Array([0x52, 0x80, 0x80, 0x80, 0x80, 0x08]);
+    expect(() => decodeGetRemainingResetsResponse(oversizedLength)).toThrow(
+      "Invalid protobuf length-delimited field",
+    );
+
+    expect(() => decodeVarint(new Uint8Array([0x80]), 0)).toThrow("Truncated protobuf varint");
+  });
+
+  it("rejects protobuf varints beyond the JavaScript safe integer range", () => {
+    const maxSafe = decodeVarint(encodeVarint(BigInt(Number.MAX_SAFE_INTEGER)), 0);
+    expect(maxSafe.value).toBe(Number.MAX_SAFE_INTEGER);
+
+    const unsafeVarint = encodeVarint(BigInt(Number.MAX_SAFE_INTEGER) + 1n);
+    expect(() => decodeVarint(unsafeVarint, 0)).toThrow(
+      "Protobuf varint exceeds JavaScript safe integer range",
+    );
+
+    const unsafeLength = new Uint8Array(1 + unsafeVarint.length);
+    unsafeLength[0] = 0x52; // field 10, wire type 2
+    unsafeLength.set(unsafeVarint, 1);
+    expect(() => decodeGetRemainingResetsResponse(unsafeLength)).toThrow(
+      "Protobuf varint exceeds JavaScript safe integer range",
+    );
+  });
+
+  it("rejects an overlong varint whose continuation bytes carry no payload", () => {
+    // The safe-integer guard cannot bound the length on its own: a continuation byte with no
+    // payload bits contributes a part of zero, which is a safe integer, so twenty 0x80 bytes
+    // followed by 0x00 decoded as a valid zero. An overlong zero length is what turns a
+    // malformed body into an empty coupon list reported as success.
+    const overlongZero = new Uint8Array([...new Array(20).fill(0x80), 0x00]);
+    expect(() => decodeVarint(overlongZero, 0)).toThrow("Overlong protobuf varint");
+
+    // The bound is a protocol limit, not a value limit: a ten-byte varint carrying real
+    // payload still fails for its value, which is the guard above it.
+    const tenBytePayload = new Uint8Array([0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01]);
+    expect(() => decodeVarint(tenBytePayload, 0)).toThrow(
+      "Protobuf varint exceeds JavaScript safe integer range",
+    );
+
+    // A legal single-byte zero is unaffected.
+    expect(decodeVarint(new Uint8Array([0x00]), 0)).toEqual({ value: 0, bytesRead: 1 });
+  });
+
+  it("fails the read rather than returning coupons decoded from a malformed response", async () => {
+    // Field 10, wire type 2, declaring 127 bytes when none follow. This is the shape the
+    // bounds check exists for, asserted where the callers actually consume it: both routes in
+    // src/server/management/grok-coupon-routes.ts wrap getGrokRemainingResets in try/catch and
+    // answer 502, so the read must throw rather than hand them a tokenId recovered from a
+    // short subarray.
+    const malformed = new Uint8Array([0x52, 0x7f]);
+    const mockFetch: typeof globalThis.fetch = async () => {
+      const data = encodeGrpcWebEnvelope(malformed);
+      const trailer = new TextEncoder().encode("grpc-status:0\r\n");
+      const trailerEnvelope = new Uint8Array(5 + trailer.length);
+      trailerEnvelope[0] = 0x80;
+      new DataView(trailerEnvelope.buffer).setUint32(1, trailer.length, false);
+      trailerEnvelope.set(trailer, 5);
+      const body = new Uint8Array(data.length + trailerEnvelope.length);
+      body.set(data, 0);
+      body.set(trailerEnvelope, data.length);
+      return new Response(body, {
+        status: 200,
+        headers: { "content-type": "application/grpc-web+proto" },
+      });
+    };
+
+    await expect(getGrokRemainingResets({ accessToken: "mock-access-token-12345", fetchFn: mockFetch }))
+      .rejects.toThrow("Invalid protobuf length-delimited field");
+  });
+
   it("asserts auth headers and tokenAuth compatibility header on request", async () => {
     let capturedHeaders: Headers | undefined;
     let capturedBody: Uint8Array | undefined;
diff --git a/tests/providers/zai-reasoning-replay.test.ts b/tests/providers/zai-reasoning-replay.test.ts
new file mode 100644
index 00000000000..909b735f81d
--- /dev/null
+++ b/tests/providers/zai-reasoning-replay.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, test } from "bun:test";
+import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
+import { enrichProviderFromRegistry, providerConfigSeed } from "../../src/providers/derive";
+import { getProviderRegistryEntry } from "../../src/providers/registry";
+import { withTestTranslatorBudget } from "../helpers/translator-budget";
+
+const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) =>
+  withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args));
+
+describe("Z.AI Responses reasoning replay", () => {
+  test("preserves plaintext reasoning and never inherits the Volcengine drop capability", async () => {
+    const provider = {
+      ...providerConfigSeed(getProviderRegistryEntry("zai")!),
+      apiKey: "test-key",
+    };
+    enrichProviderFromRegistry("zai", provider);
+    expect(provider.preserveResponsesReasoningContent).toBe(true);
+    expect(provider.dropResponsesReasoningItems).toBeUndefined();
+
+    const request = await createResponsesPassthroughAdapter(provider).buildRequest({
+      modelId: "glm-5.3",
+      context: { messages: [] },
+      stream: true,
+      options: {},
+      _rawBody: {
+        model: "glm-5.3",
+        input: [
+          {
+            type: "reasoning",
+            id: "rs_1",
+            summary: [],
+            content: [{ type: "reasoning_text", text: "keep this plaintext reasoning" }],
+          },
+          { type: "function_call", call_id: "call_1", name: "echo", arguments: "{}" },
+          { type: "function_call_output", call_id: "call_1", output: "ok" },
+        ],
+      },
+    }, { headers: new Headers() });
+
+    const body = JSON.parse(request.body) as { input: Array<Record<string, unknown>> };
+    expect(body.input).toHaveLength(3);
+    expect(body.input[0]).toMatchObject({
+      type: "reasoning",
+      content: [{ type: "reasoning_text", text: "keep this plaintext reasoning" }],
+    });
+  });
+});
diff --git a/tests/responses/chat-completions-endpoint.test.ts b/tests/responses/chat-completions-endpoint.test.ts
index d23a857b8b0..b87b3177779 100644
--- a/tests/responses/chat-completions-endpoint.test.ts
+++ b/tests/responses/chat-completions-endpoint.test.ts
@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { loadConfig, saveConfig } from "../../src/config";
 import { startServer } from "../../src/server";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { ownedServiceHomeInspection } from "../helpers/owned-service-home-inspection";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
@@ -60,6 +61,11 @@ let previousHome: string | undefined;
 let isolatedCodexHome: IsolatedCodexHome | null = null;
 const originalFetch = globalThis.fetch;
 
+// A case that calls a handler directly never takes the writer lease startServer takes, so its
+// dispatch is refused. Never file-wide: most cases here start a real server that takes it too.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
   isolatedCodexHome = installIsolatedCodexHome("ocx-chat-completions-");
@@ -69,6 +75,8 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   resetProviderRequestPacingForTest();
   if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = previousHome;
@@ -367,6 +375,7 @@ async function driveChatFallbackServiceTier(
       },
     },
   } as OcxConfig;
+  takeSpendHome();
   const response = await handleChatCompletions(
     new Request("http://localhost/v1/chat/completions", {
       method: "POST",
@@ -973,8 +982,10 @@ test("chat-native consumes pacing before the response-header timeout starts", as
     }),
   });
 
+  takeSpendHome();
   const first = await handleChatCompletions(request(), config, {} as Parameters<typeof handleChatCompletions>[2]);
   expect(first.status).toBe(200);
+  takeSpendHome();
   const secondPending = handleChatCompletions(request(), config, {} as Parameters<typeof handleChatCompletions>[2]);
   await Bun.sleep(5);
   expect(starts).toBe(1);
@@ -1004,6 +1015,7 @@ test("chat-native stays outside the Responses empty-completion retry guard", asy
   } as Partial<OcxProviderConfig> & { fetch: typeof globalThis.fetch });
   config.emptyCompletionRetry = true;
 
+  takeSpendHome();
   const response = await handleChatCompletions(
     new Request("http://localhost/v1/chat/completions", {
       method: "POST",
@@ -1632,6 +1644,7 @@ test("chat-native client cancellation cancels the upstream stream and logs 499",
       body: JSON.stringify({ model: "mock/test-model", stream: true, messages: [{ role: "user", content: "hi" }] }),
     });
     const logCtx = {} as Parameters<typeof handleChatCompletions>[2];
+    takeSpendHome();
     const response = await handleChatCompletions(
       request,
       mockConfig("https://provider.example/v1"),
@@ -1683,6 +1696,7 @@ test("chat-native request abort releases its active-turn lease and logs 499", as
       body: JSON.stringify({ model: "mock/test-model", stream: true, messages: [{ role: "user", content: "hi" }] }),
       signal: clientAbort.signal,
     });
+    takeSpendHome();
     const response = await handleChatCompletions(
       request,
       mockConfig("https://provider.example/v1"),
@@ -1722,6 +1736,7 @@ test("chat-native cancelled non-streaming SSE returns 499 instead of partial suc
       readStarted();
     },
   }), { headers: { "content-type": "text/event-stream" } })) as typeof fetch;
+  takeSpendHome();
   const result = handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
     method: "POST", signal: clientAbort.signal,
     headers: { "content-type": "application/json" },
@@ -1755,6 +1770,7 @@ test("chat-native SSE enforces configured stall timeout despite non-progress fra
     cancel() { cancels += 1; clearInterval(timer); },
   }), { headers: { "content-type": "text/event-stream" } })) as typeof fetch;
   try {
+    takeSpendHome();
     const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
       method: "POST", signal: clientAbort.signal,
       headers: { "content-type": "application/json" },
@@ -1854,6 +1870,7 @@ test("chat-native valid terminal retains precedence over a late non-streaming ab
     },
     cancel() { clientAbort.abort("late cancellation after terminal"); },
   }), { headers: { "content-type": "text/event-stream" } })) as typeof fetch;
+  takeSpendHome();
   const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
     method: "POST", signal: clientAbort.signal, headers: { "content-type": "application/json" },
     body: JSON.stringify({ model: "mock/test-model", stream: false, messages: [{ role: "user", content: "hi" }] }),
@@ -1872,6 +1889,7 @@ test("chat-native non-streaming SSE reports a typed stall failure instead of par
     },
     cancel() { cancels += 1; },
   }), { headers: { "content-type": "text/event-stream" } })) as typeof fetch;
+  takeSpendHome();
   const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
     method: "POST", headers: { "content-type": "application/json" },
     body: JSON.stringify({ model: "mock/test-model", stream: false, messages: [{ role: "user", content: "hi" }] }),
@@ -1918,6 +1936,7 @@ test("chat-native non-streaming SSE collects CRLF multiline and split UTF-8 fram
       controller.close();
     },
   }), { headers: { "content-type": "text/event-stream" } })) as typeof fetch;
+  takeSpendHome();
   const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
     method: "POST", headers: { "content-type": "application/json" },
     body: JSON.stringify({ model: "mock/test-model", stream: false, messages: [{ role: "user", content: "hi" }] }),
@@ -1942,6 +1961,7 @@ test("chat-native direct streaming without an admission lease does not record a
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ model: "mock/test-model", stream: true, messages: [{ role: "user", content: "hi" }] }),
     });
+    takeSpendHome();
     const response = await handleChatCompletions(
       request,
       mockConfig("https://provider.example/v1"),
diff --git a/tests/responses/chat-conversation-affinity.test.ts b/tests/responses/chat-conversation-affinity.test.ts
index 97c599b3088..3254c709042 100644
--- a/tests/responses/chat-conversation-affinity.test.ts
+++ b/tests/responses/chat-conversation-affinity.test.ts
@@ -6,6 +6,7 @@ import { handleChatCompletions } from "../../src/server/chat-completions";
 import type { OcxConfig } from "../../src/types";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 // #3433 transport contract only: these client-assigned fixture IDs are not a capture of Hermes.
@@ -14,14 +15,20 @@ const identityHeaders = ["session_id", "session-id", "thread-id", "x-codex-paren
 let isolated: IsolatedCodexHome;
 let home: string;
 let previousHome: string | undefined;
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   isolated = installIsolatedCodexHome("ocx-chat-identity-");
   previousHome = process.env.OPENCODEX_HOME;
   home = mkdtempSync(join(tmpdir(), "ocx-chat-identity-config-"));
   process.env.OPENCODEX_HOME = home;
+  // Taken after this case installs its home so direct Chat dispatch owns that journal.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 afterEach(() => {
+  // Released before this case restores and removes its home so no live database is unlinked.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   isolated.restore();
   if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/responses/chat-json-sse-fallback.test.ts b/tests/responses/chat-json-sse-fallback.test.ts
index e3fc1bb8711..bc357fa5403 100644
--- a/tests/responses/chat-json-sse-fallback.test.ts
+++ b/tests/responses/chat-json-sse-fallback.test.ts
@@ -6,9 +6,21 @@ import { responsesJsonToChatCompletion, collectChatCompletion, responsesSseToCha
 import { jsonCompletionSse } from "../../src/server/chat-native-sse";
 import { getRequestLogEntries } from "../../src/server/request-log";
 import { readUsageEntries } from "../../src/usage/log";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 let upstream: ReturnType<typeof Bun.serve> | undefined;
-afterEach(async () => { await upstream?.stop(true); upstream = undefined; });
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => {
+  // Taken only for direct Chat dispatches so mixed pure-converter cases do not open the journal.
+  releaseSpendHome ??= acquireOwnedSpendHome();
+};
+afterEach(async () => {
+  // Released first so a failed assertion cannot leave the inherited sandbox lease live.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  await upstream?.stop(true);
+  upstream = undefined;
+});
 
 interface Chunk {
   choices: Array<{ index: number; delta: {
@@ -34,6 +46,7 @@ async function streamFixture(output: unknown[], status = "completed", cancel = f
     adapter: "openai-responses", baseUrl: `http://127.0.0.1:${upstream.port}/v1`,
     authMode: "key", apiKey: "fixture-key", allowPrivateNetwork: true, models: ["model"],
   } } };
+  takeSpendHome();
   const response = await handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
     method: "POST", headers: { "content-type": "application/json" },
     body: JSON.stringify({ model: "fixture/model", stream: !delivery.jsonFinish, messages: [{ role: "user", content: "fixture" }],
@@ -327,6 +340,7 @@ describe("service_tier echo relay", () => {
       body: JSON.stringify({ model: "fixture/model", stream, messages: [{ role: "user", content: "ping" }] }),
     }), config, { model: "", provider: "" }, { requestId: `tier-relay-${stream}`, start: Date.now() });
 
+    takeSpendHome();
     const jsonResponse = await post(false);
     expect(jsonResponse.status).toBe(200);
     expect(await jsonResponse.json()).toMatchObject({ service_tier: "priority", choices: [{ finish_reason: "stop" }] });
diff --git a/tests/responses/chat-refusal.test.ts b/tests/responses/chat-refusal.test.ts
index 27f6ff86efd..9e2a81eff74 100644
--- a/tests/responses/chat-refusal.test.ts
+++ b/tests/responses/chat-refusal.test.ts
@@ -9,6 +9,7 @@ import { jsonCompletionSse, nativeChatSse } from "../../src/server/chat-native-s
 import type { OcxConfig } from "../../src/types";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { resetProviderRequestPacingForTest } from "../../src/providers/request-pacing";
 
 type Rec = Record<string, unknown>;
@@ -400,13 +401,19 @@ describe("refusal handler delivery matrix", () => {
   const originalFetch = globalThis.fetch;
   let isolatedHome: IsolatedCodexHome | undefined;
   let previousOcxHome: string | undefined;
+  let releaseSpendHome: (() => void) | undefined;
   beforeEach(() => {
     previousOcxHome = process.env.OPENCODEX_HOME;
     isolatedHome = installIsolatedCodexHome("ocx-refusal-fixture-");
     process.env.OPENCODEX_HOME = isolatedHome.path;
+    // Taken after this matrix installs its home so direct Chat dispatch owns that journal.
+    releaseSpendHome = acquireOwnedSpendHome();
     globalThis.fetch = (async () => { throw new Error("unstubbed external transport"); }) as typeof fetch;
   });
   afterEach(() => {
+    // Released before the matrix restores its home so no live database survives teardown.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
     resetProviderRequestPacingForTest();
     if (previousOcxHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/responses/empty-completion-core.test.ts b/tests/responses/empty-completion-core.test.ts
index 6ec5541f123..6a645c8da54 100644
--- a/tests/responses/empty-completion-core.test.ts
+++ b/tests/responses/empty-completion-core.test.ts
@@ -8,6 +8,7 @@ import {
 } from "../../src/providers/request-pacing";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const actualResolver = await import("../../src/server/adapter-resolve");
 const actualResolveAdapter = actualResolver.resolveAdapter;
@@ -20,6 +21,10 @@ let builtBodies: string[] = [];
 let customRunTurn: ProviderAdapter["runTurn"] | undefined;
 let passthroughFetchCalls = 0;
 let bodyObservationReleaseCalls = 0;
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct dispatch needs the writer lease that startServer normally owns for this home.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 function attemptAt(index: number): AdapterEvent[] {
   return attemptEvents[index] ?? [{ type: "error", message: `missing fixture attempt ${index}` }];
@@ -165,6 +170,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release the preload-home lease before later teardown can replace or remove that home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   resetProviderRequestPacingForTest();
   delete process.env.OCX_EMPTY_COMPLETION_RETRY;
 });
@@ -176,6 +184,7 @@ describe("empty-completion core integration", () => {
     // and that transport already falls back to HTTP SSE for exactly these bodies (#2473), with
     // an 18.2 MB HTTP 200 observed in #2426. Unset must mean "send it", not "guess a ceiling".
     const logCtx: RequestLogContext = { model: "", provider: "" };
+    takeSpendHome();
     const response = await handleResponses(
       request(false, "x".repeat(20 * 1024 * 1024)),
       config("test-passthrough"),
@@ -220,6 +229,7 @@ describe("empty-completion core integration", () => {
   });
 
   test("a normal-sized passthrough body still reaches upstream", async () => {
+    takeSpendHome();
     const response = await handleResponses(
       request(false),
       config("test-passthrough", { maxUpstreamBodyBytes: 4_096 }),
@@ -232,6 +242,7 @@ describe("empty-completion core integration", () => {
   });
 
   test("an explicit zero limit lets an oversized turn reach upstream", async () => {
+    takeSpendHome();
     const response = await handleResponses(
       request(false, "x".repeat(512)),
       config("test-passthrough", { maxUpstreamBodyBytes: 0 }),
@@ -266,6 +277,7 @@ describe("empty-completion core integration", () => {
       emit({ type: "done" });
     };
 
+    takeSpendHome();
     const response = await handleResponses(request(true), paced, { model: "", provider: "" });
     expect(response.status).toBe(200);
     const reader = response.body!.getReader();
@@ -297,6 +309,7 @@ describe("empty-completion core integration", () => {
       ];
       const logCtx: RequestLogContext = { model: "", provider: "" };
 
+      takeSpendHome();
       const response = await handleResponses(request(stream), config("test-run-turn"), logCtx);
       const body = await response.text();
 
@@ -319,6 +332,7 @@ describe("empty-completion core integration", () => {
       ];
       const logCtx: RequestLogContext = { model: "", provider: "" };
 
+      takeSpendHome();
       const response = await handleResponses(request(stream), config("test-http"), logCtx);
       const body = await response.text();
 
@@ -352,6 +366,7 @@ describe("empty-completion core integration", () => {
     const paced = config("test-http");
     paced.providers.fixture!.requestPacing = { enabled: true, minIntervalMs: 100 };
 
+    takeSpendHome();
     const response = await handleResponses(request(false), paced, { model: "", provider: "" });
     expect(response.status).toBe(200);
     expect(httpCalls).toBe(2);
@@ -369,6 +384,7 @@ describe("empty-completion core integration", () => {
     const tierGated = config("test-http");
     tierGated.providers.fixture!.supportsServiceTier = false;
 
+    takeSpendHome();
     const response = await handleResponses(
       request(false, "please answer", { service_tier: "priority" }),
       tierGated,
@@ -388,6 +404,7 @@ describe("empty-completion core integration", () => {
     const disabled = config("test-run-turn");
     delete disabled.emptyCompletionRetry;
 
+    takeSpendHome();
     const response = await handleResponses(request(false), disabled, { model: "", provider: "" });
     await response.text();
 
@@ -410,6 +427,7 @@ describe("empty-completion core integration", () => {
       emit({ type: "done" });
     };
 
+    takeSpendHome();
     const response = await handleResponses(
       request(true),
       config("test-run-turn", { stallTimeoutSec: 0.05 }),
@@ -424,6 +442,7 @@ describe("empty-completion core integration", () => {
 
   test("combo and routed-compaction turns are excluded from the retry", async () => {
     attemptEvents = [[{ type: "done" }], [{ type: "text_delta", text: "must not run" }, { type: "done" }]];
+    takeSpendHome();
     const combo = await handleResponses(
       request(false),
       config("test-run-turn"),
@@ -472,6 +491,7 @@ describe("empty-completion core integration", () => {
       }),
     });
 
+    takeSpendHome();
     const response = await handleResponses(req, guarded, { model: "", provider: "" });
     const body = await response.text();
 
diff --git a/tests/responses/fresh-connection-optout.test.ts b/tests/responses/fresh-connection-optout.test.ts
index 944afbd222a..0cde659563e 100644
--- a/tests/responses/fresh-connection-optout.test.ts
+++ b/tests/responses/fresh-connection-optout.test.ts
@@ -9,6 +9,7 @@ import { handleResponses } from "../../src/server/responses";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 describe("wantsFreshConnection", () => {
   test("returns false when env is unset or empty", () => {
@@ -277,6 +278,8 @@ describe("the OAuth dispatch boundary", () => {
     process.env.OPENCODEX_HOME = home;
     process.env.CODEX_HOME = home;
     process.env.OCX_FRESH_CONNECTION_HOSTS = freshHost;
+    // Taken after this case installs its home so the direct dispatch owns that journal.
+    const releaseSpendHome = acquireOwnedSpendHome();
     const sends: Array<{ url: string; init?: RequestInit }> = [];
 
     try {
@@ -330,6 +333,8 @@ describe("the OAuth dispatch boundary", () => {
         expect(headers.get("x-grok-req-id")).toBeTruthy();
       }
     } finally {
+      // Released before restoring or removing the home so Windows can delete its lease files.
+      releaseSpendHome();
       globalThis.fetch = nativeFetch;
       if (previousHosts === undefined) delete process.env.OCX_FRESH_CONNECTION_HOSTS;
       else process.env.OCX_FRESH_CONNECTION_HOSTS = previousHosts;
diff --git a/tests/responses/openai-responses-passthrough.test.ts b/tests/responses/openai-responses-passthrough.test.ts
index 42ace1b77a1..f9c2029f38a 100644
--- a/tests/responses/openai-responses-passthrough.test.ts
+++ b/tests/responses/openai-responses-passthrough.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { Buffer } from "node:buffer";
 import { createOpenAIChatAdapter } from "../../src/adapters/openai-chat";
 import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
@@ -22,9 +22,17 @@ import {
 import { createTranslatorBudget } from "../../src/lib/translator-budget";
 import type { AdapterEvent, OcxConfig } from "../../src/types";
 import { withTestTranslatorBudget } from "../helpers/translator-budget";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { buildKeyAuthUrl } from "../helpers/passthrough-key-url";
 import { restoreRoutedNamespaceCalls } from "../../src/responses/namespace-tool-compat";
 import { restoreRoutedCustomCalls } from "../../src/responses/custom-tool-compat";
 
+// A case that calls handleResponses directly never takes the writer lease startServer takes, so
+// its dispatch is refused. Dropped in teardown so a throwing case cannot leave the lease behind.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+afterEach(() => { releaseSpendHome?.(); releaseSpendHome = undefined; });
+
 const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) =>
   withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args));
 
@@ -559,6 +567,7 @@ test("noncanonical Responses preserves provider-owned safety-buffering hints", a
         dropCodexSafetyBuffering: true,
         providers: { fixture: providerConfig },
       } as OcxConfig;
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -692,23 +701,6 @@ test("passthrough serialized-body observation releases after the request settles
   budget.dispose();
 });
 
-function buildKeyAuthUrl(baseUrl: string, responsesPath?: string): string {
-  const adapter = createResponsesPassthroughAdapter({
-    adapter: "openai-responses",
-    baseUrl,
-    authMode: "key" as const,
-    apiKey: "sk-test",
-    ...(responsesPath === undefined ? {} : { responsesPath }),
-  });
-  return adapter.buildRequest({
-    modelId: "test-model",
-    context: { messages: [] },
-    stream: true,
-    options: {},
-    _rawBody: { model: "test-model", input: "ping" },
-  }, { headers: new Headers() }).url;
-}
-
 describe("OpenAI Responses key-auth URL construction", () => {
   test("BUG-R289 preserves legacy /v1/responses URL when responsesPath is absent", () => {
     for (const [baseUrl, expectedUrl] of [
@@ -4283,6 +4275,7 @@ describe("routed namespace and custom-tool identity", () => {
     });
 
     try {
+      takeSpendHome();
       const jsonResponse = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -4303,6 +4296,7 @@ describe("routed namespace and custom-tool identity", () => {
         arguments: "{}",
       });
 
+      takeSpendHome();
       const sseResponse = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -4367,6 +4361,7 @@ describe("routed namespace and custom-tool identity", () => {
     }) as typeof fetch;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -4713,11 +4708,15 @@ describe("raw usage passthrough on the forward path (#41980 parity, #37138 adjac
     stream,
     input: [{ role: "user", content: [{ type: "input_text", text: "hi" }] }],
   });
-  const call = (stream: boolean) => handleResponses(new Request("http://localhost/v1/responses", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: requestBody(stream),
-  }), config, { model: "", provider: "" });
+  // Inside the arrow: taken beside it, at collection time, the first teardown drops it for good.
+  const call = (stream: boolean) => {
+    takeSpendHome();
+    return handleResponses(new Request("http://localhost/v1/responses", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: requestBody(stream),
+    }), config, { model: "", provider: "" });
+  };
 
   test("streamed response.completed with usage extras reaches the client byte-identical", async () => {
     const savedFetch = globalThis.fetch;
@@ -4794,6 +4793,7 @@ test("canonical Responses hint suppression is opt-in at the request boundary", a
       const config = { port: 0, dropCodexSafetyBuffering, providers: { openai: {
         ...provider, codexAccountMode: "direct", upstreamWebsocket: false,
       } } } as OcxConfig;
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST", headers: { "content-type": "application/json", authorization: "Bearer fixture-forward-token" },
         body: JSON.stringify({ model: "openai/gpt-5.6-sol", input: "ping", stream: true }),
diff --git a/tests/responses/passthrough-abort.test.ts b/tests/responses/passthrough-abort.test.ts
index 97eaf771b35..bbdd622d3db 100644
--- a/tests/responses/passthrough-abort.test.ts
+++ b/tests/responses/passthrough-abort.test.ts
@@ -59,7 +59,9 @@ describe("passthrough relayWithAbort (RC2, passthrough path)", () => {
       capsSource.indexOf("export function selectEagerPath"),
     );
 
-    expect(sseBranch).toContain("const terminalRepairPolicy = providerModelResponsesTerminalRepair(");
+    // The captured static policy now supplies the repair decision; the real platform gate and
+    // pure native relay invariants below are unchanged.
+    expect(sseBranch).toContain("const terminalRepairPolicy = route.staticPolicy.model.responsesTerminalRepair;");
     expect(sseBranch).toContain("const passthroughSseBody = terminalRepairPolicy");
     expect(sseBranch).toContain(": upstreamResponse.body;");
     // Native tee stays inside the bounded observer. The production owner passes
diff --git a/tests/responses/responses-account-label.test.ts b/tests/responses/responses-account-label.test.ts
index 08dacdc59f3..bfccb8afb10 100644
--- a/tests/responses/responses-account-label.test.ts
+++ b/tests/responses/responses-account-label.test.ts
@@ -15,10 +15,15 @@ import type { RequestLogContext } from "../../src/server/request-log";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { CodexWsMetadata } from "../../src/server/responses/codex-ws-metadata";
 import { applyAccountQuotaFromUpstreamHeaders, getAccountQuotaHistory } from "../../src/codex/quota";
 
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
+
+// Taken only by callbacks that physically dispatch, after withPoolHome installs their home.
+const takeSpendHome = (): void => { releaseSpendHome = acquireOwnedSpendHome(); };
 
 function poolConfig(accountIds: string[]): OcxConfig {
   return {
@@ -80,6 +85,9 @@ async function withPoolHome<T>(run: (home: string) => Promise<T>): Promise<T> {
   try {
     return await run(home);
   } finally {
+    // Released before the helper removes or restores the home so its lease cannot outlive it.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     globalThis.fetch = originalFetch;
     clearCodexUpstreamHealth();
     clearThreadAccountMap();
@@ -133,6 +141,7 @@ describe("Responses account usage attribution", () => {
     const originalWebSocket = globalThis.WebSocket;
     try {
       await withPoolHome(async home => {
+        takeSpendHome();
         writeFileSync(join(home, "auth.json"), JSON.stringify({
           tokens: { access_token: "main-access-token", account_id: "main-account" },
         }));
@@ -198,6 +207,7 @@ describe("Responses account usage attribution", () => {
     const finalQuotaAllowed = new Promise<void>(resolve => { releaseFinalQuota = resolve; });
     try {
       await withPoolHome(async () => {
+        takeSpendHome();
         savePoolCredential("pool-ws-replaced");
         class MetadataSocket {
           listeners = new Map<string, Array<(event: unknown) => void>>();
@@ -255,6 +265,7 @@ describe("Responses account usage attribution", () => {
 
   test("main-pool and legacy added accounts carry their effective labels", async () => {
     await withPoolHome(async home => {
+      takeSpendHome();
       writeFileSync(join(home, "auth.json"), JSON.stringify({
         tokens: { access_token: "main-access-token", account_id: "main-account" },
       }));
@@ -280,6 +291,7 @@ describe("Responses account usage attribution", () => {
 
   test("a pre-stream quota retry updates attribution to the serving alternate account", async () => {
     await withPoolHome(async () => {
+      takeSpendHome();
       const config = poolConfig(["pool-a", "pool-b"]);
       for (const id of ["pool-a", "pool-b"]) {
         savePoolCredential(id);
@@ -310,6 +322,7 @@ describe("Responses account usage attribution", () => {
 
   test("a quota message wrapped in HTTP 502 cools the account and retries an alternate", async () => {
     await withPoolHome(async () => {
+      takeSpendHome();
       const config = poolConfig(["pool-a", "pool-b"]);
       for (const id of ["pool-a", "pool-b"]) {
         savePoolCredential(id);
@@ -349,6 +362,7 @@ describe("Responses account usage attribution", () => {
   // refused nothing -- and the cooldown outlives the request that invented it.
   test("a refused reset replay is not quota evidence and invites no client retry", async () => {
     await withPoolHome(async () => {
+      takeSpendHome();
       const config = poolConfig(["pool-a"]);
       savePoolCredential("pool-a");
       updateAccountQuota("pool-a", 10);
@@ -372,6 +386,7 @@ describe("Responses account usage attribution", () => {
 
   test("a wrapped quota failure cools a sole account when no alternate exists", async () => {
     await withPoolHome(async () => {
+      takeSpendHome();
       const config = poolConfig(["pool-a"]);
       savePoolCredential("pool-a");
       updateAccountQuota("pool-a", 10);
diff --git a/tests/responses/responses-compact-handoff-admission.test.ts b/tests/responses/responses-compact-handoff-admission.test.ts
index 5fcb2aa67e3..3ebe8c78706 100644
--- a/tests/responses/responses-compact-handoff-admission.test.ts
+++ b/tests/responses/responses-compact-handoff-admission.test.ts
@@ -8,6 +8,7 @@ import { clearCodexUpstreamHealth } from "../../src/codex/routing";
 import { clearUpstreamHostHealth } from "../../src/codex/upstream-host-health";
 import { handleResponsesCompact } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const originalFetch = globalThis.fetch;
@@ -44,7 +45,7 @@ describe("compact handoff route admission namespacing", () => {
     } as OcxConfig;
   }
 
-  function withPoolEnv<T>(run: (config: OcxConfig) => Promise<T>): Promise<T> {
+  async function withPoolEnv<T>(run: (config: OcxConfig) => Promise<T>): Promise<T> {
     const testDir = mkdtempSync(join(tmpdir(), "ocx-compact-handoff-admission-"));
     const previousOpencodexHome = process.env.OPENCODEX_HOME;
     const previousCodexHome = process.env.CODEX_HOME;
@@ -60,7 +61,13 @@ describe("compact handoff route admission namespacing", () => {
       chatgptAccountId: "pool_acc",
     });
     updateAccountQuota("pool-a", 10);
-    return run(poolConfig()).finally(() => {
+    // Taken after this helper installs its home so direct compact dispatch owns that journal.
+    const releaseSpendHome = acquireOwnedSpendHome();
+    try {
+      return await run(poolConfig());
+    } finally {
+      // Released before this helper restores and removes its home so no live database is unlinked.
+      releaseSpendHome();
       globalThis.fetch = originalFetch;
       clearCodexUpstreamHealth();
       clearUpstreamHostHealth();
@@ -70,7 +77,7 @@ describe("compact handoff route admission namespacing", () => {
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
       if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
       else process.env.CODEX_HOME = previousCodexHome;
-    });
+    }
   }
 
   function compactionRequest(
@@ -155,8 +162,12 @@ describe("compact handoff route admission namespacing", () => {
 
       // The owner stores the deepseek route under (its principal, this lane).
       const stored = await compact("deepseek/deepseek-v4-flash", owner);
-      expect(stored.status).toBe(200);
-      expect(calls).toEqual([{ model: "deepseek-v4-flash", nativeCompact: false }]);
+      try {
+        expect(stored.status).toBe(200);
+        expect(calls).toEqual([{ model: "deepseek-v4-flash", nativeCompact: false }]);
+      } finally {
+        await stored.body?.cancel();
+      }
 
       // A different admitted principal re-sending the same lane header must not
       // claim it: every attempt stays on the requested model's native compact.
@@ -171,16 +182,24 @@ describe("compact handoff route admission namespacing", () => {
       ] as const) {
         calls.length = 0;
         const res = await compact("openai-apikey/gpt-5.6-sol", intruder);
-        expect(res.status).toBe(502);
-        expect(calls.length).toBeGreaterThan(0);
-        expect(calls.every(call => call.model === "gpt-5.6-sol" && call.nativeCompact)).toBe(true);
+        try {
+          expect(res.status).toBe(502);
+          expect(calls.length).toBeGreaterThan(0);
+          expect(calls.every(call => call.model === "gpt-5.6-sol" && call.nativeCompact)).toBe(true);
+        } finally {
+          await res.body?.cancel();
+        }
       }
 
       // The owner's own quota-blocked retry still finds the route and hands off.
       calls.length = 0;
       const handoff = await compact("openai-apikey/gpt-5.6-sol", owner);
-      expect(handoff.status).toBe(200);
-      expect(calls.at(-1)).toEqual({ model: "deepseek-v4-flash", nativeCompact: false });
+      try {
+        expect(handoff.status).toBe(200);
+        expect(calls.at(-1)).toEqual({ model: "deepseek-v4-flash", nativeCompact: false });
+      } finally {
+        await handoff.body?.cancel();
+      }
     });
     // Five request sequences ride the transient-502 retry ladder; the default
     // 5s budget is not enough on a contended host.
diff --git a/tests/responses/responses-compaction-override.test.ts b/tests/responses/responses-compaction-override.test.ts
new file mode 100644
index 00000000000..7e682afe1cb
--- /dev/null
+++ b/tests/responses/responses-compaction-override.test.ts
@@ -0,0 +1,656 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { applyCompactionRoutingOverride } from "../../src/server/responses/compaction-routing";
+import { handleResponses, handleResponsesCompact } from "../../src/server/responses";
+import { clearCompactHandoffRoutesForTests } from "../../src/server/responses/compact";
+import { decodeCompactionSummary, SUMMARY_PREFIX } from "../../src/responses/compaction";
+import { getDefaultConfig, validateConfigCandidate } from "../../src/config";
+import { routeCompactionModel } from "../../src/router";
+import { configSchema } from "../../src/config/schema/config-schema";
+import { warnDegradedCompactionRouting } from "../../src/config/load-degrade";
+import { clearComboSelectionState, clearComboTargetCooldowns } from "../../src/combos";
+import { clearComboRecallForTests, recallComboForLane, rememberComboForLane } from "../../src/server/responses/combo-session-recall";
+import { sessionLaneIdFromRequest } from "../../src/server/request-log-conversation";
+import { captureConfigGeneration } from "../../src/lib/state-store-sweeper";
+import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import type { OcxConfig } from "../../src/types";
+
+const originalFetch = globalThis.fetch;
+/**
+ * `startServer` takes the spend-journal writer lease before anything can serve, so an ordinary
+ * turn dispatched straight into the handler owns no state directory and the ledger refuses to
+ * write for it (#5157). Compaction handoffs draw on the parent request's reservation and so did
+ * not notice; every plain turn in this file did.
+ */
+let releaseSpendHome: (() => void) | undefined;
+const metadata = (trigger = "manual", request_kind = "compaction") =>
+  JSON.stringify({ request_kind, compaction: { trigger } });
+
+function config(): OcxConfig {
+  return {
+    ...getDefaultConfig(),
+    defaultProvider: "gateway",
+    providers: {
+      gateway: {
+        adapter: "openai-responses", authMode: "key",
+        baseUrl: "https://gateway.example/v1", apiKey: "fixture-key",
+      },
+    },
+    compactionRouting: { model: "gateway/cheap", reasoningEffort: "low" },
+  };
+}
+
+function body(compact = true): Record<string, any> {
+  return {
+    model: "gateway/normal", stream: false,
+    reasoning: { effort: "high", summary: "auto" },
+    input: [
+      { type: "message", role: "user", content: [{ type: "input_text", text: "Keep the task state." }] },
+      ...(compact ? [{ type: "compaction_trigger" }] : []),
+    ],
+  };
+}
+
+function request(value: unknown, trigger?: string, path = "responses"): Request {
+  return new Request(`http://localhost/v1/${path}`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json", session_id: "compaction-routing-fixture",
+      ...(trigger ? { "x-codex-turn-metadata": metadata(trigger) } : {}),
+    },
+    body: JSON.stringify(value),
+  });
+}
+
+function completion(summary = "Retain progress and resume the task."): Record<string, unknown> {
+  return {
+    id: "resp_manual_fixture", status: "completed",
+    output: [{ type: "message", role: "assistant", content: [{ type: "output_text", text: summary }] }],
+    usage: { input_tokens: 10, output_tokens: 5, total_tokens: 15 },
+  };
+}
+
+function upstreamCompletion(input: Record<string, unknown>): Response {
+  const response = { ...completion(), model: input.model };
+  return input.stream
+    ? new Response(`event: response.completed\ndata: ${JSON.stringify({ type: "response.completed", response })}\n\n`, {
+      headers: { "content-type": "text/event-stream" },
+    })
+    : Response.json(response);
+}
+
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+
+afterEach(() => {
+  // Released first, before any other teardown touches the state directory.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  globalThis.fetch = originalFetch;
+  clearComboSelectionState();
+  clearComboTargetCooldowns();
+  clearComboRecallForTests();
+  clearCompactHandoffRoutesForTests();
+});
+
+describe("manual compaction request selection", () => {
+  test.each(["header", "body", "both"])("uses explicit manual metadata from %s", location => {
+    const input = body();
+    const history = structuredClone(input.input);
+    const headers = new Headers();
+    if (location !== "body") headers.set("x-codex-turn-metadata", metadata());
+    if (location !== "header") input.client_metadata = { "x-codex-turn-metadata": metadata() };
+    expect(applyCompactionRoutingOverride(input, headers, config())).toEqual({ sourceModel: "gateway/normal" });
+    expect(input.model).toBe("gateway/cheap");
+    expect(input.reasoning).toEqual({ effort: "low", summary: "auto" });
+    expect(input.input).toEqual(history);
+  });
+
+  test.each([
+    undefined, "{", "null", "[]", metadata("auto"), metadata("manual", "turn"),
+    JSON.stringify({ compaction: { trigger: "manual" } }),
+    JSON.stringify({ request_kind: "compaction" }),
+  ])("does not override absent, malformed, automatic or ordinary metadata: %s", value => {
+    const input = body();
+    const before = structuredClone(input);
+    const headers = new Headers(value === undefined ? {} : { "x-codex-turn-metadata": value });
+    expect(applyCompactionRoutingOverride(input, headers, config())).toBeNull();
+    expect(input).toEqual(before);
+  });
+
+  test("conflicting metadata cannot override automatic compaction", () => {
+    for (const [header, embedded] of [[metadata(), metadata("auto")], [metadata("auto"), metadata()], [metadata(), "{"], ["{", metadata()]]) {
+      const input = { ...body(), client_metadata: { "x-codex-turn-metadata": embedded } };
+      expect(applyCompactionRoutingOverride(input, new Headers({ "x-codex-turn-metadata": header! }), config())).toBeNull();
+      expect(input.model).toBe("gateway/normal");
+    }
+  });
+
+  test("WebSocket frames use their own trigger and never reuse handshake metadata", () => {
+    for (const [handshake, frame, expected] of [
+      ["auto", "manual", true], ["manual", "auto", false], ["manual", undefined, false],
+    ] as const) {
+      const input = body();
+      if (frame) input.client_metadata = { "x-codex-turn-metadata": metadata(frame) };
+      const headers = new Headers({ "x-codex-turn-metadata": metadata(handshake) });
+      expect(applyCompactionRoutingOverride(input, headers, config(), { transport: "websocket" })).toEqual(expected ? { sourceModel: "gateway/normal" } : null);
+      expect(input.model).toBe(expected ? "gateway/cheap" : "gateway/normal");
+    }
+  });
+
+  test("model-only configuration preserves the caller's reasoning", () => {
+    const input = body();
+    const settings = config();
+    settings.compactionRouting = { model: "gateway/cheap" };
+    expect(applyCompactionRoutingOverride(input, new Headers({ "x-codex-turn-metadata": metadata() }), settings)).toEqual({ sourceModel: "gateway/normal" });
+    expect(input.reasoning).toEqual({ effort: "high", summary: "auto" });
+    expect(settings.compactionRouting).toEqual({ model: "gateway/cheap" });
+  });
+
+  test("unset configuration preserves manual compaction", () => {
+    const input = body();
+    const before = structuredClone(input);
+    const settings = config();
+    delete settings.compactionRouting;
+    expect(applyCompactionRoutingOverride(input, new Headers({ "x-codex-turn-metadata": metadata() }), settings)).toBeNull();
+    expect(input).toEqual(before);
+  });
+
+  test("manual metadata on an ordinary turn never rewrites the request", () => {
+    const input = body(false);
+    const before = structuredClone(input);
+    const headers = new Headers({ "x-codex-turn-metadata": metadata() });
+    expect(applyCompactionRoutingOverride(input, headers, config())).toBeNull();
+    expect(applyCompactionRoutingOverride(input, headers, config(), { endpoint: "responses" })).toBeNull();
+    expect(input).toEqual(before);
+    expect(applyCompactionRoutingOverride(input, headers, config(), { endpoint: "compact" })).toEqual({ sourceModel: "gateway/normal" });
+    expect(input.model).toBe("gateway/cheap");
+  });
+});
+
+
+describe("manual compaction config", () => {
+  test("validates optional settings without resetting providers on malformed hand edits", () => {
+    expect(validateConfigCandidate(config()).ok).toBe(true);
+    for (const value of [null, {}, [], "cheap", { model: " " }, { model: 42 },
+      { model: "gateway/cheap", reasoningEffort: "invalid" }, { model: "gateway/cheap", typo: true }]) {
+      const raw = { ...config(), compactionRouting: value };
+      expect(validateConfigCandidate(raw).ok).toBe(false);
+      const loaded = configSchema.parse(raw);
+      expect(loaded.compactionRouting).toBeUndefined();
+      expect(loaded.providers).toEqual(config().providers);
+    }
+  });
+
+  test("a dropped hand-edited block warns at load; valid or absent blocks stay silent", () => {
+    const warnings: string[] = [];
+    const original = console.warn;
+    console.warn = (message: unknown) => { warnings.push(String(message)); };
+    try {
+      const invalid = { ...config(), compactionRouting: { model: "gateway/cheap", reasoningEffort: "Low" } };
+      warnDegradedCompactionRouting(invalid, configSchema.parse(invalid) as OcxConfig);
+      expect(warnings).toHaveLength(1);
+      expect(warnings[0]).toContain("compactionRouting is invalid");
+      warnDegradedCompactionRouting(config(), configSchema.parse(config()) as OcxConfig);
+      const absent = config();
+      delete absent.compactionRouting;
+      warnDegradedCompactionRouting(absent, configSchema.parse(absent) as OcxConfig);
+      expect(warnings).toHaveLength(1);
+    } finally {
+      console.warn = original;
+    }
+  });
+});
+
+describe("manual compaction reuses existing handlers", () => {
+  test("an ordinary turn carrying manual metadata stays on the conversation model", async () => {
+    const settings = config();
+    const calls: string[] = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push(input.model);
+      return upstreamCompletion(input);
+    }) as typeof fetch;
+    const response = await handleResponses(request(body(false), "manual"), settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    await response.text();
+    expect(calls).toEqual(["normal"]);
+  });
+
+  test.each(["v1", "v2", "v2-body", "v2-websocket"])("%s changes only the manual request and returns the existing summary format", async version => {
+    const settings = config();
+    const saved = structuredClone(settings);
+    const calls: Array<Record<string, any>> = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      calls.push(JSON.parse(String(init?.body)));
+      return Response.json(completion());
+    }) as typeof fetch;
+    const handler = version === "v1" ? handleResponsesCompact : handleResponses;
+    const input = body(version !== "v1");
+    if (version === "v2-body" || version === "v2-websocket") input.client_metadata = { "x-codex-turn-metadata": metadata() };
+    const manualRequest = request(input, version === "v2-body" ? undefined : version === "v2-websocket" ? "auto" : "manual");
+    const logCtx = { model: "", provider: "" } as { model: string; provider: string; requestedModel?: string };
+    const response = version === "v2-websocket"
+      ? await handleResponses(manualRequest, settings, logCtx, { inboundTransport: "websocket" })
+      : await handler(manualRequest, settings, logCtx);
+    const result = await response.json() as { output: Array<Record<string, any>> };
+    expect(response.status).toBe(200);
+    expect(logCtx.requestedModel).toBe("gateway/normal");
+    expect(logCtx.model).toBe("cheap");
+    expect(calls[0]!.model).toBe("cheap");
+    expect(calls[0]!.reasoning.effort).toBe("low");
+    if (version === "v1") expect(JSON.stringify(result.output)).toContain(SUMMARY_PREFIX);
+    else expect(decodeCompactionSummary(result.output.find(item => item.type === "compaction")!.encrypted_content)).toContain("Retain progress");
+
+    const automatic = await handler(request(body(version !== "v1"), "auto"), settings, { model: "", provider: "" });
+    expect(automatic.status).toBe(200);
+    await automatic.text();
+    const resumedBody = body(false);
+    resumedBody.input = [...result.output, ...resumedBody.input];
+    const resumed = await handleResponses(request(resumedBody), settings, { model: "", provider: "" });
+    expect(resumed.status).toBe(200);
+    await resumed.text();
+    expect(calls.map(call => [call.model, call.reasoning.effort])).toEqual([
+      ["cheap", "low"], ["normal", "high"], ["normal", "high"],
+    ]);
+    expect(JSON.stringify(calls[2]!.input)).toContain("Retain progress");
+    expect(JSON.stringify(calls[2]!.input)).not.toContain("ocx1:");
+    expect(settings).toEqual(saved);
+    expect(input.model).toBe("gateway/normal");
+  });
+
+  test("native v2 keeps caller authentication and forwards the existing compaction request", async () => {
+    const settings = config();
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.compactionRouting = { model: "gpt-5.6-luna", reasoningEffort: "low" };
+    const input = body();
+    input.model = "gpt-6-astra";
+    input.stream = true;
+    const req = request(input, "manual");
+    const authorization = `Bearer ${fakeChatGptJwt({ chatgpt_account_id: "fixture-account" })}`;
+    req.headers.set("authorization", authorization);
+    req.headers.set("chatgpt-account-id", "fixture-account");
+    const calls: Array<{ body: Record<string, any>; authorization: string | null }> = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      calls.push({ body: JSON.parse(String(init?.body)), authorization: new Headers(init?.headers).get("authorization") });
+      const response = { ...completion(), model: "gpt-5.6-luna", output: [{ type: "compaction", encrypted_content: "native-summary" }] };
+      return new Response(`event: response.completed\ndata: ${JSON.stringify({ type: "response.completed", response })}\n\n`, {
+        headers: { "content-type": "text/event-stream" },
+      });
+    }) as typeof fetch;
+    const response = await handleResponses(req, settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    expect(await response.text()).toContain("native-summary");
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.authorization).toBe(authorization);
+    expect(calls[0]!.body.model).toBe("gpt-5.6-luna");
+    expect(calls[0]!.body.reasoning.effort).toBe("low");
+    expect(calls[0]!.body.input).toContainEqual({ type: "compaction_trigger" });
+  });
+
+  test("same-provider native compact retains its existing endpoint and reasoning behavior", async () => {
+    const settings = config();
+    settings.providers["openai-apikey"] = {
+      adapter: "openai-responses", authMode: "key", baseUrl: "https://api.openai.com/v1", apiKey: "fixture-key",
+    };
+    settings.compactionRouting = { model: "openai-apikey/gpt-5.6-luna", reasoningEffort: "low" };
+    const calls: Array<{ url: string; body: Record<string, any> }> = [];
+    globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
+      calls.push({ url: String(input), body: JSON.parse(String(init?.body)) });
+      return Response.json({ output: [{ type: "compaction", encrypted_content: "native-summary" }] });
+    }) as typeof fetch;
+    const input = { ...body(false), model: "openai-apikey/gpt-6-astra" };
+    const response = await handleResponsesCompact(request(input, "manual", "responses/compact"), settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toMatchObject({ output: [{ type: "compaction", encrypted_content: "native-summary" }] });
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.url).toBe("https://api.openai.com/v1/responses/compact");
+    expect(calls[0]!.body.model).toBe("gpt-5.6-luna");
+    expect(calls[0]!.body.reasoning).toBeUndefined();
+  });
+
+  test.each(["v1", "v2"])("%s cross-provider override produces a summary the conversation model can replay", async version => {
+    const settings = config();
+    settings.providers["openai-apikey"] = {
+      adapter: "openai-responses", authMode: "key", baseUrl: "https://api.openai.com/v1", apiKey: "fixture-key",
+    };
+    settings.compactionRouting = { model: "openai-apikey/gpt-5.6-luna", reasoningEffort: "low" };
+    const calls: Array<{ url: string; body: Record<string, any> }> = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push({ url: String(url), body: input });
+      if (String(url).endsWith("/compact")) return Response.json({ output: [{ type: "compaction", encrypted_content: "native-ciphertext" }] });
+      return upstreamCompletion(input);
+    }) as typeof fetch;
+    const handler = version === "v1" ? handleResponsesCompact : handleResponses;
+    const response = await handler(request(body(version !== "v1"), "manual"), settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    const result = await response.json() as { output: Array<Record<string, any>> };
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.url).toBe("https://api.openai.com/v1/responses");
+    expect(calls[0]!.body.model).toBe("gpt-5.6-luna");
+    expect(calls[0]!.body.reasoning.effort).toBe("low");
+    expect(JSON.stringify(result.output)).not.toContain("native-ciphertext");
+    if (version === "v1") expect(JSON.stringify(result.output)).toContain(SUMMARY_PREFIX);
+    else expect(decodeCompactionSummary(result.output.find(item => item.type === "compaction")!.encrypted_content)).toContain("Retain progress");
+
+    const resumedBody = body(false);
+    resumedBody.input = [...result.output, ...resumedBody.input];
+    const resumed = await handleResponses(request(resumedBody), settings, { model: "", provider: "" });
+    expect(resumed.status).toBe(200);
+    await resumed.text();
+    expect(calls[1]!.url).toBe("https://gateway.example/v1/responses");
+    expect(calls[1]!.body.model).toBe("normal");
+    expect(JSON.stringify(calls[1]!.body.input)).toContain("Retain progress");
+    expect(JSON.stringify(calls[1]!.body.input)).not.toContain("cannot read");
+  });
+
+  test("same-provider override keeps a caller-supplied bearer; a cross-provider override drops it", async () => {
+    const settings = config();
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.compactionRouting = { model: "gpt-5.6-luna", reasoningEffort: "low" };
+    const seen: Array<string | null> = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      seen.push(new Headers(init?.headers).get("authorization"));
+      return upstreamCompletion(JSON.parse(String(init?.body)));
+    }) as typeof fetch;
+    for (const [sourceModel, expectedStatus] of [["gpt-6-astra", 200], ["gateway/normal", 401]] as const) {
+      const input = { ...body(), model: sourceModel, stream: true };
+      const req = request(input, "manual");
+      req.headers.set("authorization", "Bearer opaque-caller-token");
+      const response = await handleResponses(req, settings, { model: "", provider: "" });
+      expect(response.status).toBe(expectedStatus);
+      await response.text();
+    }
+    expect(seen).toEqual(["Bearer opaque-caller-token"]);
+  });
+
+  test("a ChatGPT target for a routed conversation runs the portable summarizer instead of native compaction", async () => {
+    const settings = config();
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.compactionRouting = { model: "gpt-5.6-luna", reasoningEffort: "low" };
+    const calls: Array<{ url: string; body: Record<string, any> }> = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push({ url: String(url), body: input });
+      if (String(url).endsWith("/compact") || JSON.stringify(input.input).includes("compaction_trigger")) {
+        const response = { ...completion(), model: input.model, output: [{ type: "compaction", encrypted_content: "native-ciphertext" }] };
+        return new Response(`event: response.completed\ndata: ${JSON.stringify({ type: "response.completed", response })}\n\n`, {
+          headers: { "content-type": "text/event-stream" },
+        });
+      }
+      return upstreamCompletion(input);
+    }) as typeof fetch;
+    const jwt = `Bearer ${fakeChatGptJwt({ chatgpt_account_id: "fixture-account" })}`;
+    for (const version of ["v1", "v2"] as const) {
+      calls.length = 0;
+      const req = request(body(version === "v2"), "manual", version === "v1" ? "responses/compact" : "responses");
+      req.headers.set("authorization", jwt);
+      req.headers.set("chatgpt-account-id", "fixture-account");
+      const handler = version === "v1" ? handleResponsesCompact : handleResponses;
+      const response = await handler(req, settings, { model: "", provider: "" });
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text).not.toContain("native-ciphertext");
+      const output = (JSON.parse(text) as { output: Array<Record<string, any>> }).output;
+      if (version === "v1") expect(JSON.stringify(output)).toContain(SUMMARY_PREFIX);
+      else expect(decodeCompactionSummary(output.find(item => item.type === "compaction")!.encrypted_content)).toContain("Retain progress");
+      expect(calls).toHaveLength(1);
+      expect(calls[0]!.url).toBe("https://chatgpt.com/backend-api/codex/responses");
+      expect(calls[0]!.body.model).toBe("gpt-5.6-luna");
+      expect(JSON.stringify(calls[0]!.body.input)).not.toContain("compaction_trigger");
+
+      const resumedBody = body(false);
+      resumedBody.input = [...output, ...resumedBody.input];
+      const resumed = await handleResponses(request(resumedBody), settings, { model: "", provider: "" });
+      expect(resumed.status).toBe(200);
+      await resumed.text();
+      expect(calls[1]!.url).toBe("https://gateway.example/v1/responses");
+      expect(JSON.stringify(calls[1]!.body.input)).toContain("Retain progress");
+    }
+  });
+
+  test("manual quota failure cannot borrow the conversation's automatic handoff target", async () => {
+    const settings = config();
+    settings.providers["openai-apikey"] = {
+      adapter: "openai-responses", authMode: "key", baseUrl: "https://api.openai.com/v1", apiKey: "fixture-key",
+    };
+    settings.compactionRouting = { model: "openai-apikey/gpt-5.6-luna" };
+    // The handoff route is keyed by (admission principal, lane): an admission-less caller is
+    // deliberately ineligible, so the control half of this case needs a real principal to have
+    // anything to borrow. See tests/responses/responses-compact-handoff-admission.test.ts.
+    const admission = {
+      kind: "configured", keyId: "compaction-override-client", source: "dedicated",
+      contextPrincipalId: "principal-compaction-override",
+    } as const;
+    const compact = (value: unknown, trigger: string) =>
+      handleResponsesCompact(request(value, trigger), settings, { model: "", provider: "" }, undefined, admission);
+    const calls: string[] = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push(input.model);
+      return String(url).endsWith("/compact")
+        ? Response.json({ error: { message: "quota exceeded", code: "insufficient_quota" } }, { status: 429 })
+        : upstreamCompletion(input);
+    }) as typeof fetch;
+    const seed = await compact(body(false), "auto");
+    expect(seed.status).toBe(200);
+    await seed.text();
+    const manual = await compact({ ...body(false), model: "openai-apikey/gpt-6-astra" }, "manual");
+    expect(manual.status).toBe(429);
+    await manual.text();
+    expect(calls).toEqual(["normal", "gpt-5.6-luna"]);
+
+    const automatic = await compact({ ...body(false), model: "openai-apikey/gpt-6-astra" }, "auto");
+    expect(automatic.status).toBe(200);
+    await automatic.text();
+    expect(calls).toEqual(["normal", "gpt-5.6-luna", "gpt-6-astra", "normal"]);
+  });
+
+  test.each(["v1", "v2"])("%s combo override preserves failover and the conversation's remembered combo", async version => {
+    const settings = config();
+    settings.combos = {
+      normal: { targets: [{ provider: "gateway", model: "normal" }] },
+      compact: { strategy: "failover", targets: [{ provider: "gateway", model: "unavailable" }, { provider: "gateway", model: "cheap" }] },
+    };
+    settings.compactionRouting = { model: "combo/compact", reasoningEffort: "low" };
+    const req = request(body(version !== "v1"), "manual");
+    const lane = sessionLaneIdFromRequest(req.headers);
+    rememberComboForLane(lane, "normal", { provider: "gateway", model: "normal" }, "normal", captureConfigGeneration());
+    const calls: string[] = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      const model = JSON.parse(String(init?.body)).model;
+      calls.push(model);
+      if (model === "unavailable") return Response.json({ error: {
+        type: "invalid_request_error", code: "unsupported_value", param: "reasoning.effort",
+        message: "Unsupported value: 'low' is not supported with this model. Supported values are: 'medium', 'high'.",
+      } }, { status: 400 });
+      return upstreamCompletion(JSON.parse(String(init?.body)));
+    }) as typeof fetch;
+    const handler = version === "v1" ? handleResponsesCompact : handleResponses;
+    const response = await handler(req, settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    await response.text();
+    expect(calls).toEqual(["unavailable", "cheap"]);
+    expect(recallComboForLane(settings, lane, "normal")).toBe("normal");
+  });
+
+  test("a bare source model remembered as a combo target takes the portable path even on a same-provider native override", async () => {
+    const settings = config();
+    settings.providers["openai-apikey"] = {
+      adapter: "openai-responses", authMode: "key", baseUrl: "https://api.openai.com/v1", apiKey: "fixture-key",
+    };
+    settings.combos = { fast: { targets: [{ provider: "gateway", model: "normal" }] } };
+    settings.defaultProvider = "openai-apikey";
+    settings.compactionRouting = { model: "openai-apikey/gpt-5.6-luna", reasoningEffort: "low" };
+    const req = request({ ...body(false), model: "normal" }, "manual", "responses/compact");
+    const lane = sessionLaneIdFromRequest(req.headers);
+    rememberComboForLane(lane, "fast", { provider: "gateway", model: "normal" }, "normal", captureConfigGeneration());
+    const calls: string[] = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      calls.push(String(url));
+      if (String(url).endsWith("/compact")) return Response.json({ output: [{ type: "compaction", encrypted_content: "native-ciphertext" }] });
+      return upstreamCompletion(JSON.parse(String(init?.body)));
+    }) as typeof fetch;
+    const response = await handleResponsesCompact(req, settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    const text = await response.text();
+    expect(text).not.toContain("native-ciphertext");
+    expect(text).toContain(SUMMARY_PREFIX);
+    expect(calls).toEqual(["https://api.openai.com/v1/responses"]);
+    expect(recallComboForLane(settings, lane, "normal")).toBe("fast");
+  });
+
+  test("a combo override whose same-provider child is canonical ChatGPT still runs the portable summarizer", async () => {
+    const settings = config();
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.combos = { compact: { targets: [{ provider: "openai", model: "gpt-5.6-luna" }] } };
+    settings.compactionRouting = { model: "combo/compact", reasoningEffort: "low" };
+    const calls: Array<{ url: string; input: string }> = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push({ url: String(url), input: JSON.stringify(input.input) });
+      if (calls.at(-1)!.input.includes("compaction_trigger")) {
+        const response = { ...completion(), model: input.model, output: [{ type: "compaction", encrypted_content: "native-ciphertext" }] };
+        return new Response(`event: response.completed\ndata: ${JSON.stringify({ type: "response.completed", response })}\n\n`, {
+          headers: { "content-type": "text/event-stream" },
+        });
+      }
+      return upstreamCompletion(input);
+    }) as typeof fetch;
+    const req = request({ ...body(), model: "gpt-6-astra" }, "manual");
+    req.headers.set("authorization", `Bearer ${fakeChatGptJwt({ chatgpt_account_id: "fixture-account" })}`);
+    req.headers.set("chatgpt-account-id", "fixture-account");
+    const response = await handleResponses(req, settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    const text = await response.text();
+    expect(text).not.toContain("native-ciphertext");
+    const output = (JSON.parse(text) as { output: Array<Record<string, any>> }).output;
+    expect(decodeCompactionSummary(output.find(item => item.type === "compaction")!.encrypted_content)).toContain("Retain progress");
+    expect(calls).toHaveLength(1);
+    expect(calls[0]!.url).toBe("https://chatgpt.com/backend-api/codex/responses");
+    expect(calls[0]!.input).not.toContain("compaction_trigger");
+  });
+});
+
+describe("compaction routing triggers", () => {
+  test.each([
+    [undefined, "manual", true], [undefined, "auto", false],
+    [["manual"], "manual", true], [["manual"], "auto", false],
+    [["auto"], "auto", true], [["auto"], "manual", false],
+    [["manual", "auto"], "manual", true], [["manual", "auto"], "auto", true],
+  ] as const)("triggers %s and a %s request override: %s", (triggers, trigger, covered) => {
+    const input = body();
+    const settings = config();
+    settings.compactionRouting = { model: "gateway/cheap", ...(triggers ? { triggers: [...triggers] } : {}) };
+    const headers = new Headers({ "x-codex-turn-metadata": metadata(trigger) });
+    expect(applyCompactionRoutingOverride(input, headers, settings)).toEqual(covered ? { sourceModel: "gateway/normal" } : null);
+    expect(input.model).toBe(covered ? "gateway/cheap" : "gateway/normal");
+  });
+
+  test("copies naming different covered triggers are rejected rather than reconciled", () => {
+    const settings = config();
+    settings.compactionRouting = { model: "gateway/cheap", triggers: ["manual", "auto"] };
+    for (const [header, embedded] of [["manual", "auto"], ["auto", "manual"]] as const) {
+      const input = { ...body(), client_metadata: { "x-codex-turn-metadata": metadata(embedded) } };
+      expect(applyCompactionRoutingOverride(input, new Headers({ "x-codex-turn-metadata": metadata(header) }), settings)).toBeNull();
+      expect(input.model).toBe("gateway/normal");
+    }
+  });
+
+  // Each row is wrapped: `test.each` spreads an array row into arguments, so a bare `[]` would
+  // run the case with no value at all.
+  test.each([[[]], [["manual", "manual"]], [["nope"]], [["manual", "nope"]], ["manual"], [{}], [null]])(
+    "a triggers value the schema rejects disables the block instead of widening it: %s", value => {
+      const settings = config();
+      settings.compactionRouting = { model: "gateway/cheap", triggers: value as never };
+      for (const trigger of ["manual", "auto"]) {
+        const input = body();
+        expect(applyCompactionRoutingOverride(input, new Headers({ "x-codex-turn-metadata": metadata(trigger) }), settings)).toBeNull();
+        expect(input.model).toBe("gateway/normal");
+      }
+      const raw = { ...config(), compactionRouting: { model: "gateway/cheap", triggers: value } };
+      expect(validateConfigCandidate(raw).ok).toBe(false);
+      expect(configSchema.parse(raw).compactionRouting).toBeUndefined();
+    });
+
+  test.each(["v1", "v2"])("%s: a named auto trigger is what releases the canonical OpenAI compaction reservation", async version => {
+    const settings = config();
+    // An enabled canonical provider is the condition #2901 left in place: a bare native
+    // compaction model stays reserved for it, and #5012 hit that while its quota was gone.
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.compactionRouting = { model: "gateway/cheap", triggers: ["auto"] };
+    const calls: Array<{ url: string; model: unknown }> = [];
+    globalThis.fetch = (async (url: unknown, init?: RequestInit) => {
+      const input = JSON.parse(String(init?.body));
+      calls.push({ url: String(url), model: input.model });
+      return String(url).startsWith("https://gateway.example")
+        ? Response.json(completion())
+        : Response.json({ error: { message: "The usage limit has been reached.", code: "rate_limit_exceeded" } }, { status: 429 });
+    }) as typeof fetch;
+
+    // The v1 native endpoint and the v2 compaction_trigger turn are separate entry points with
+    // separate gates, so the opt-in has to be proven on both.
+    const handler = version === "v1" ? handleResponsesCompact : handleResponses;
+    const input = { ...body(version !== "v1"), model: "gpt-5.6-luna" };
+    const routed = await handler(request(input, "auto"), settings, { model: "", provider: "" });
+    expect(routed.status).toBe(200);
+    await routed.text();
+    expect(calls).not.toHaveLength(0);
+    expect(calls.every(call => call.url.startsWith("https://gateway.example"))).toBe(true);
+    expect(calls[0]!.model).toBe("cheap");
+
+    // Without the opt-in the reservation still owns the bare native compaction model. Asserting
+    // the route directly, rather than only the absence of a gateway call, keeps this half from
+    // passing on a regression that fails before reaching any upstream at all.
+    calls.length = 0;
+    delete settings.compactionRouting;
+    expect(routeCompactionModel(settings, "gpt-5.6-luna").providerName).toBe("openai");
+    const reserved = await handler(request({ ...body(version !== "v1"), model: "gpt-5.6-luna" }, "auto"), settings, { model: "", provider: "" });
+    await reserved.text();
+    expect(calls.some(call => call.url.startsWith("https://gateway.example"))).toBe(false);
+  });
+
+  test("a cross-identity override does not forward the source backend's opaque state", async () => {
+    const settings = config();
+    settings.providers.openai = {
+      adapter: "openai-responses", authMode: "forward", codexAccountMode: "direct",
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+    };
+    settings.compactionRouting = { model: "gateway/cheap", triggers: ["manual", "auto"] };
+    const calls: Array<Record<string, unknown>> = [];
+    globalThis.fetch = (async (_input: unknown, init?: RequestInit) => {
+      calls.push(JSON.parse(String(init?.body)));
+      return Response.json(completion());
+    }) as typeof fetch;
+    const input = body();
+    input.model = "gpt-6-astra";
+    input.input = [
+      { type: "reasoning", summary: [], encrypted_content: "native-reasoning-blob" },
+      ...(input.input as unknown[]),
+    ];
+    const response = await handleResponses(request(input, "auto"), settings, { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    await response.text();
+    expect(calls).not.toHaveLength(0);
+    // gateway shares neither the credential nor the backend that minted this blob, so it cannot
+    // verify it; forwarding it leaks backend-private state and can fail the summarizing turn.
+    expect(JSON.stringify(calls[0])).not.toContain("native-reasoning-blob");
+  });
+});
diff --git a/tests/responses/responses-compaction-routing.test.ts b/tests/responses/responses-compaction-routing.test.ts
index 3250e696c6a..f111aafe71b 100644
--- a/tests/responses/responses-compaction-routing.test.ts
+++ b/tests/responses/responses-compaction-routing.test.ts
@@ -7,7 +7,7 @@ import { sessionLaneIdFromRequest } from "../../src/server/request-log-conversat
  * contract; every other gateway has to be driven as a plain summarizer, or Codex
  * fatals on a compaction turn that came back as an ordinary message.
  */
-import { afterEach, describe, expect, jest, spyOn, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, jest, spyOn, test } from "bun:test";
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -42,111 +42,24 @@ import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { clearComboRecallForTests, recallComboForLane, rememberComboForLane } from "../../src/server/responses/combo-session-recall";
 import { captureConfigGeneration } from "../../src/lib/state-store-sweeper";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { baseCompactionBody, compactionRequest, completedPayload, jsonResponse, keyProviderConfig, nativePoolConfig, sseResponse, twoAccountPoolConfig } from "../helpers/compaction-routing-fixtures";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
 
+// A case that calls a handler directly never runs startServer, so it never takes the
+// spend-journal writer lease and its dispatch is refused before it reaches its own contract.
+// Taken per dispatching block rather than for the whole file: five cases install a home of their
+// own inside the case body, and a lease binds the directory in effect when it was taken.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
+
 afterEach(() => {
+  dropSpendHome();
   globalThis.fetch = originalFetch;
 });
 
-function keyProviderConfig(overrides: Partial<OcxProviderConfig> = {}): OcxConfig {
-  return {
-    defaultProvider: "gw",
-    providers: {
-      gw: {
-        adapter: "openai-responses",
-        baseUrl: "https://gateway.example/v1",
-        authMode: "key",
-        apiKey: "test-key",
-        ...overrides,
-      },
-    },
-  } as unknown as OcxConfig;
-}
-
-function nativePoolConfig(): OcxConfig {
-  return {
-    defaultProvider: "openai",
-    activeCodexAccountId: "pool-a",
-    providers: {
-      openai: {
-        adapter: "openai-responses",
-        baseUrl: "https://chatgpt.com/backend-api/codex",
-        authMode: "forward",
-        codexAccountMode: "pool",
-      },
-    },
-    codexAccounts: [{
-      id: "pool-a",
-      email: "pool@example.test",
-      isMain: false,
-      chatgptAccountId: "pool_acc",
-    }],
-  } as OcxConfig;
-}
-
-/** Two-account pool: the alternate-attempt tests need somewhere for the retry to go. */
-function twoAccountPoolConfig(): OcxConfig {
-  const config = nativePoolConfig();
-  config.codexAccounts = [
-    { id: "pool-a", email: "a@example.test", isMain: false, chatgptAccountId: "pool_acc_a" },
-    { id: "pool-b", email: "b@example.test", isMain: false, chatgptAccountId: "pool_acc_b" },
-  ] as OcxConfig["codexAccounts"];
-  return config;
-}
-
-function compactionRequest(
-  body: Record<string, unknown>,
-  signal?: AbortSignal,
-  extraHeaders: Record<string, string> = {},
-): Request {
-  return new Request("http://localhost/v1/responses", {
-    method: "POST",
-    headers: { "content-type": "application/json", ...extraHeaders },
-    body: JSON.stringify(body),
-    signal,
-  });
-}
-
-function baseCompactionBody(extra: Record<string, unknown> = {}): Record<string, unknown> {
-  return {
-    model: "gw/some-model",
-    stream: false,
-    input: [
-      { type: "message", role: "user", content: [{ type: "input_text", text: "earlier turn" }] },
-      { type: "compaction_trigger" },
-    ],
-    tools: [{ type: "function", name: "shell" }],
-    tool_choice: "auto",
-    parallel_tool_calls: true,
-    ...extra,
-  };
-}
-
-function jsonResponse(payload: unknown): Response {
-  return new Response(JSON.stringify(payload), {
-    status: 200,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-function completedPayload(text: string): Record<string, unknown> {
-  return {
-    id: "resp_1",
-    status: "completed",
-    output: [{ type: "message", role: "assistant", content: [{ type: "output_text", text }] }],
-    usage: { input_tokens: 10, output_tokens: 5, total_tokens: 15 },
-  };
-}
-
-function sseResponse(events: Array<Record<string, unknown>>): Response {
-  const body = events.map(e => `event: ${String(e.type)}\ndata: ${JSON.stringify(e)}\n\n`).join("");
-  return new Response(body, {
-    status: 200,
-    headers: { "content-type": "text/event-stream" },
-  });
-}
-
 describe("supportsNativeResponsesCompactEndpoint (#422)", () => {
   const canonicalForward = {
     adapter: "openai-responses",
@@ -183,6 +96,7 @@ describe("supportsNativeResponsesCompactEndpoint (#422)", () => {
 });
 
 describe("Codex auth-context error parity (#2392)", () => {
+  beforeEach(takeSpendHome);
   const cases: Array<{
     label: string;
     createError: () => Error;
@@ -344,6 +258,7 @@ describe("Codex auth-context error parity (#2392)", () => {
 });
 
 describe("native compact usage reporting", () => {
+  beforeEach(takeSpendHome);
   test("the buffered upstream body fills the request log usage and stays intact for the client", async () => {
     const config = {
       defaultProvider: "openai-apikey",
@@ -374,6 +289,9 @@ describe("native compact usage reporting", () => {
     const previousOpencodexHome = process.env.OPENCODEX_HOME;
     const previousCodexHome = process.env.CODEX_HOME;
     process.env.OPENCODEX_HOME = testDir;
+    // This case serves from its own directory, so the block lease cannot cover it.
+    dropSpendHome();
+    takeSpendHome();
     process.env.CODEX_HOME = testDir;
     try {
       const mainConfig = nativePoolConfig();
@@ -402,6 +320,8 @@ describe("native compact usage reporting", () => {
     } finally {
       globalThis.fetch = originalFetch;
       clearAccountQuota();
+      // Released before the directory holding it is removed.
+      dropSpendHome();
       removeTreeWithRetry(testDir);
       if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
@@ -412,6 +332,7 @@ describe("native compact usage reporting", () => {
 });
 
 describe("native Codex pool compaction", () => {
+  beforeEach(takeSpendHome);
   test("ignores a retired Spark reset without cooling later compact requests", async () => {
     const testDir = mkdtempSync(join(tmpdir(), "ocx-compact-scope-"));
     const previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -421,6 +342,9 @@ describe("native Codex pool compaction", () => {
     let sparkPhase = true;
     try {
       process.env.OPENCODEX_HOME = testDir;
+      // This case serves from its own directory, so the block lease cannot cover it.
+      dropSpendHome();
+      takeSpendHome();
       process.env.CODEX_HOME = testDir;
       clearCodexUpstreamHealth();
       saveCodexAccountCredential("pool-a", {
@@ -471,6 +395,8 @@ describe("native Codex pool compaction", () => {
     } finally {
       globalThis.fetch = originalFetch;
       clearCodexUpstreamHealth();
+      // Released before the directory holding it is removed.
+      dropSpendHome();
       removeTreeWithRetry(testDir);
       if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
@@ -494,6 +420,9 @@ describe("native Codex pool compaction", () => {
     const bodyReleased = new Promise<void>(resolve => { releaseBody = resolve; });
     try {
       process.env.OPENCODEX_HOME = testDir;
+      // This case serves from its own directory, so the block lease cannot cover it.
+      dropSpendHome();
+      takeSpendHome();
       process.env.CODEX_HOME = testDir;
       Date.now = () => now;
       clearCodexUpstreamHealth();
@@ -541,6 +470,8 @@ describe("native Codex pool compaction", () => {
       Date.now = originalNow;
       globalThis.fetch = originalFetch;
       clearCodexUpstreamHealth();
+      // Released before the directory holding it is removed.
+      dropSpendHome();
       removeTreeWithRetry(testDir);
       if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
@@ -562,6 +493,9 @@ describe("native Codex pool compaction", () => {
     const fetchStarted = new Promise<void>(resolve => { markFetchStarted = resolve; });
     try {
       process.env.OPENCODEX_HOME = testDir;
+      // This case serves from its own directory, so the block lease cannot cover it.
+      dropSpendHome();
+      takeSpendHome();
       process.env.CODEX_HOME = testDir;
       Date.now = () => now;
       clearCodexUpstreamHealth();
@@ -606,6 +540,8 @@ describe("native Codex pool compaction", () => {
       Date.now = originalNow;
       globalThis.fetch = originalFetch;
       clearCodexUpstreamHealth();
+      // Released before the directory holding it is removed.
+      dropSpendHome();
       removeTreeWithRetry(testDir);
       if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
@@ -616,6 +552,7 @@ describe("native Codex pool compaction", () => {
 });
 
 describe("routed compaction for key-mode openai-responses (#422)", () => {
+  beforeEach(takeSpendHome);
   test("rewrites the wire: no trigger, no tools, summarizer prompt present", async () => {
     const bodies: Array<Record<string, unknown>> = [];
     globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
@@ -736,6 +673,7 @@ describe("routed compaction for key-mode openai-responses (#422)", () => {
 });
 
 describe("bare native compaction model without canonical openai (#2901)", () => {
+  beforeEach(takeSpendHome);
   /** A GitHub-Copilot-style operator: one third-party provider, no `openai` row at all. */
   function copilotOnlyConfig(): OcxConfig {
     return {
@@ -842,6 +780,7 @@ describe("bare native compaction model without canonical openai (#2901)", () =>
 });
 
 describe("compaction terminal handling (#422)", () => {
+  beforeEach(takeSpendHome);
   test("an upstream failure does not become an empty compaction", async () => {
     globalThis.fetch = (async () => jsonResponse({
       id: "resp_1",
@@ -924,11 +863,15 @@ describe("compaction terminal handling (#422)", () => {
  * fired, three means it recursed.
  */
 describe("compact alternate-account attempt (#913)", () => {
+  beforeEach(takeSpendHome);
   function withPoolEnv<T>(name: string, run: (config: OcxConfig) => Promise<T>): Promise<T> {
     const testDir = mkdtempSync(join(tmpdir(), name));
     const previousOpencodexHome = process.env.OPENCODEX_HOME;
     const previousCodexHome = process.env.CODEX_HOME;
     process.env.OPENCODEX_HOME = testDir;
+    // This case serves from its own directory, so the block lease cannot cover it.
+    dropSpendHome();
+    takeSpendHome();
     process.env.CODEX_HOME = testDir;
     clearCodexUpstreamHealth();
     clearUpstreamHostHealth();
@@ -947,6 +890,8 @@ describe("compact alternate-account attempt (#913)", () => {
       clearCodexUpstreamHealth();
       clearUpstreamHostHealth();
       clearAccountQuota();
+      // Released before the directory holding it is removed.
+      dropSpendHome();
       removeTreeWithRetry(testDir);
       if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousOpencodexHome;
@@ -1821,6 +1766,7 @@ describe("compact alternate-account attempt (#913)", () => {
 });
 
 describe("compaction combo recall after combo switch (#3891)", () => {
+  beforeEach(takeSpendHome);
   afterEach(() => clearComboRecallForTests());
 
   function comboTestConfig(): OcxConfig {
@@ -2270,6 +2216,7 @@ test("a no-eligible policy compact request persists the evaluation trace", async
  * already degrade an unpaired output to "[tool output for unknown call]" on their own.
  */
 describe("computer screenshot output translation boundary", () => {
+  beforeEach(takeSpendHome);
   const screenshot = {
     type: "computer_call_output", call_id: "call_screen",
     output: { type: "computer_screenshot", image_url: "https://example.com/screen.png" },
@@ -2368,9 +2315,14 @@ describe("computer screenshot output translation boundary", () => {
 });
 
 describe("external task-input envelopes (#3735)", () => {
-  // Synthetic charset/length fixture: short plaintext in this slot is deliberately
-  // normalized to input_text before parsing, so it cannot exercise opaque rejection.
-  const opaqueOutput = `g${"A".repeat(127)}`;
+  beforeEach(takeSpendHome);
+  const opaqueOutput = `${Buffer.concat([
+    Buffer.from([0x80]),
+    Buffer.alloc(8),
+    Buffer.alloc(16),
+    Buffer.alloc(16),
+    Buffer.alloc(32),
+  ]).toString("base64url")}==`;
   const external = (output: unknown = "external task input") => ({
     type: "function_call_output", id: "external-fixture", name: "handoff_input", namespace: "task_inbox", output,
   });
@@ -2378,8 +2330,9 @@ describe("external task-input envelopes (#3735)", () => {
     model: "gw/model", stream: false, input: [item],
   });
 
-  test("opaque negative fixtures survive the plaintext-slot classifier", () => {
+  test("only canonical Fernet structure survives the plaintext-slot classifier", () => {
     expect(looksLikeBackendCiphertext(opaqueOutput)).toBe(true);
+    expect(looksLikeBackendCiphertext(`gAAAAA${"A".repeat(189)}`)).toBe(false);
   });
 
   test("sends a complete envelope as user text without an orphan-tool marker", async () => {
@@ -2479,6 +2432,7 @@ describe("external task-input envelopes (#3735)", () => {
 });
 
 describe("established-history external task input (#3807)", () => {
+  beforeEach(takeSpendHome);
   // Synthetic complete envelope from the #3735 contract; #3807's history rendering
   // is not a captured outbound request. Keep the real tool pair distinct from delivery.
   const deliveryText = "  Follow up on the earlier tool result.\n";
@@ -2613,6 +2567,7 @@ describe("established-history external task input (#3807)", () => {
 });
 
 describe("unpaired tool result boundary (#3259)", () => {
+  beforeEach(takeSpendHome);
   function unpairedBody(item: Record<string, unknown>): Record<string, unknown> {
     return {
       model: "gw/some-model",
@@ -2730,6 +2685,7 @@ describe("unpaired tool result boundary (#3259)", () => {
 });
 
 describe("unusable-call_id task-input seed (#3807)", () => {
+  beforeEach(takeSpendHome);
   const seed = (extra: Record<string, unknown>) => ({
     type: "function_call_output", id: "fc_seed", name: "create_thread", namespace: "codex",
     output: "<codex_delegation>continue</codex_delegation>", ...extra,
diff --git a/tests/responses/responses-console-go-upload-retry.test.ts b/tests/responses/responses-console-go-upload-retry.test.ts
index 68fc1972ebc..75805f3c64e 100644
--- a/tests/responses/responses-console-go-upload-retry.test.ts
+++ b/tests/responses/responses-console-go-upload-retry.test.ts
@@ -6,6 +6,7 @@ import { markResponseNonReplayable } from "../../src/lib/upstream-retry";
 import { handleResponses } from "../../src/server/responses/core";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const originalFetch = globalThis.fetch;
@@ -32,13 +33,19 @@ const EFFORT_REFUSAL = JSON.stringify({
 });
 
 let testDir = "";
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   testDir = mkdtempSync(join(tmpdir(), "ocx-console-go-upload-retry-"));
   process.env.OPENCODEX_HOME = testDir;
+  // Take the writer lease after this case installs its home so direct handler dispatch can open the spend journal.
+  releaseSpendHome = acquireOwnedSpendHome();
 });
 
 afterEach(() => {
+  // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   if (originalOpenCodexHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = originalOpenCodexHome;
diff --git a/tests/responses/responses-custom-tool-repair-dispatch.test.ts b/tests/responses/responses-custom-tool-repair-dispatch.test.ts
new file mode 100644
index 00000000000..fd8d34349f4
--- /dev/null
+++ b/tests/responses/responses-custom-tool-repair-dispatch.test.ts
@@ -0,0 +1,979 @@
+/**
+ * The routed custom-tool repair contract as handleResponses actually serves it.
+ *
+ * Split out of responses-custom-tool-repair.test.ts, which keeps the cases that exercise the
+ * compat functions directly. These are the cases that dispatch, and a dispatching case needs the
+ * spend-journal writer lease that startServer would have taken; the file it came from is at its
+ * file-size cap and had no room to take it.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+import { handleResponses } from "../../src/server/responses";
+import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { CANONICAL_PATCH, DECORATED_PATCH, dataPayload, frame } from "../helpers/custom-tool-repair-fixtures";
+
+// Taken at each dispatch rather than per case, and dropped in teardown so a case that throws
+// mid-assertion cannot leave the lease behind for the next one to trip over.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+afterEach(() => { releaseSpendHome?.(); releaseSpendHome = undefined; });
+
+describe("routed Responses custom-tool repair through handleResponses", () => {
+  test("handleResponses sends an upstream-safe exec function and restores client SSE", async () => {
+    const savedFetch = globalThis.fetch;
+    let outboundBody: Record<string, unknown> | undefined;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_exec",
+      call_id: "call_exec",
+      name: "exec",
+      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
+      status: "completed",
+    };
+    const upstream = [
+      frame("response.output_item.added", { output_index: 0, item: { ...upstreamItem, arguments: "", status: "in_progress" } }),
+      frame("response.function_call_arguments.done", { output_index: 0, item_id: "fc_exec", arguments: upstreamItem.arguments }),
+      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+      frame("response.completed", { response: { id: "resp_1", status: "completed", output: [upstreamItem] } }),
+      "data: [DONE]",
+    ].join("\n\n") + "\n\n";
+    globalThis.fetch = (async (_input, init) => {
+      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: true,
+          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
+          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
+        }),
+      }), config, { model: "", provider: "" });
+      const clientSse = await response.text();
+      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
+
+      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "exec" });
+      expect(clientSse).toContain('"type":"custom_tool_call"');
+      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
+      expect(clientSse).toContain('"input":"const apps = await sky.list_apps();"');
+      expect(clientSse).not.toContain("response.function_call_arguments.done");
+      expect(clientSse).not.toContain('"type":"function_call"');
+      expect(clientSse).toContain("data: [DONE]");
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses lowers and restores apply_patch when the destination denies custom tools", async () => {
+    const savedFetch = globalThis.fetch;
+    let outboundBody: Record<string, unknown> | undefined;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_patch_next",
+      call_id: "call_patch_next",
+      name: "apply_patch",
+      arguments: JSON.stringify({ input: "*** Begin Patch\n*** End Patch" }),
+      status: "completed",
+    };
+    const upstream = [
+      frame("response.output_item.added", {
+        output_index: 0,
+        item: { ...upstreamItem, arguments: "", status: "in_progress" },
+      }),
+      frame("response.function_call_arguments.done", {
+        output_index: 0,
+        item_id: upstreamItem.id,
+        arguments: upstreamItem.arguments,
+      }),
+      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+      frame("response.completed", {
+        response: { id: "resp_patch", status: "completed", output: [upstreamItem] },
+      }),
+      "data: [DONE]",
+    ].join("\n\n") + "\n\n";
+    globalThis.fetch = (async (_input, init) => {
+      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+          supportsResponsesCustomTools: false,
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/grok-4.6",
+          stream: true,
+          input: [
+            {
+              type: "custom_tool_call",
+              id: "ctc_patch_prior",
+              call_id: "call_patch_prior",
+              name: "apply_patch",
+              input: "noop",
+            },
+            { type: "custom_tool_call_output", call_id: "call_patch_prior", output: "done" },
+          ],
+          tools: [{
+            type: "custom",
+            name: "apply_patch",
+            description: "Apply a patch",
+            format: { type: "grammar", syntax: "lark" },
+          }],
+        }),
+      }), config, { model: "", provider: "" });
+      const clientSse = await response.text();
+      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
+      const outboundInput = outboundBody?.input as Array<Record<string, unknown>> | undefined;
+
+      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "apply_patch" });
+      expect(outboundInput?.[0]).toMatchObject({
+        type: "function_call",
+        call_id: "call_patch_prior",
+        name: "apply_patch",
+        arguments: JSON.stringify({ input: "noop" }),
+      });
+      expect(outboundInput?.[1]).toMatchObject({
+        type: "function_call_output",
+        call_id: "call_patch_prior",
+        output: "done",
+      });
+      expect(clientSse).toContain('"type":"custom_tool_call"');
+      expect(clientSse).toContain('"id":"ctc_patch_next"');
+      expect(clientSse).toContain('"call_id":"call_patch_next"');
+      expect(clientSse).toContain('"name":"apply_patch"');
+      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
+      expect(clientSse).toContain("data: [DONE]");
+      expect(clientSse).not.toContain('"type":"function_call"');
+      expect(clientSse).not.toContain("response.function_call_arguments.done");
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses lowers apply_patch for a noncanonical forward destination that denies custom tools", async () => {
+    const savedFetch = globalThis.fetch;
+    let outboundBody: Record<string, unknown> | undefined;
+    let outboundAuthorization: string | null = null;
+    let outboundUrl = "";
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_patch_next",
+      call_id: "call_patch_next",
+      name: "apply_patch",
+      arguments: JSON.stringify({ input: "*** Begin Patch\n*** End Patch" }),
+      status: "completed",
+    };
+    const upstream = [
+      frame("response.output_item.added", {
+        output_index: 0,
+        item: { ...upstreamItem, arguments: "", status: "in_progress" },
+      }),
+      frame("response.function_call_arguments.done", {
+        output_index: 0,
+        item_id: upstreamItem.id,
+        arguments: upstreamItem.arguments,
+      }),
+      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+      frame("response.completed", {
+        response: { id: "resp_patch", status: "completed", output: [upstreamItem] },
+      }),
+      "data: [DONE]",
+    ].join("\n\n") + "\n\n";
+    globalThis.fetch = (async (input, init) => {
+      outboundUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      outboundAuthorization = new Headers(init?.headers).get("authorization");
+      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://provider.example/v1",
+          authMode: "forward",
+          headers: { authorization: "Bearer provider-static" },
+          supportsResponsesCustomTools: false,
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: "Bearer caller-secret" },
+        body: JSON.stringify({
+          model: "fixture/grok-4.6",
+          stream: true,
+          input: [
+            {
+              type: "custom_tool_call",
+              id: "ctc_patch_prior",
+              call_id: "call_patch_prior",
+              name: "apply_patch",
+              input: "noop",
+            },
+            { type: "custom_tool_call_output", call_id: "call_patch_prior", output: "done" },
+          ],
+          tools: [{
+            type: "custom",
+            name: "apply_patch",
+            description: "Apply a patch",
+            format: { type: "grammar", syntax: "lark" },
+          }],
+        }),
+      }), config, { model: "", provider: "" });
+      const clientSse = await response.text();
+      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
+      const outboundInput = outboundBody?.input as Array<Record<string, unknown>> | undefined;
+
+      expect(outboundUrl).toBe("https://provider.example/v1/responses");
+      expect(outboundAuthorization).toBe("Bearer provider-static");
+      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "apply_patch" });
+      expect(outboundInput?.[0]).toMatchObject({
+        type: "function_call",
+        call_id: "call_patch_prior",
+        name: "apply_patch",
+        arguments: JSON.stringify({ input: "noop" }),
+      });
+      expect(outboundInput?.[1]).toMatchObject({
+        type: "function_call_output",
+        call_id: "call_patch_prior",
+        output: "done",
+      });
+      expect(clientSse).toContain('"type":"custom_tool_call"');
+      expect(clientSse).toContain('"id":"ctc_patch_next"');
+      expect(clientSse).toContain('"call_id":"call_patch_next"');
+      expect(clientSse).toContain('"name":"apply_patch"');
+      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
+      expect(clientSse).toContain("data: [DONE]");
+      expect(clientSse).not.toContain('"type":"function_call"');
+      expect(clientSse).not.toContain("response.function_call_arguments.done");
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses continuation rewrites custom_tool_call_output and keeps call_id ordered", async () => {
+    const savedFetch = globalThis.fetch;
+    const outboundBodies: Array<Record<string, unknown>> = [];
+    const firstUpstreamItem = {
+      type: "function_call",
+      id: "fc_exec",
+      call_id: "call_exec",
+      name: "exec",
+      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
+      status: "completed",
+    };
+    const secondUpstreamMessage = {
+      type: "message",
+      id: "msg_2",
+      role: "assistant",
+      content: [{ type: "output_text", text: "27 apps" }],
+      status: "completed",
+    };
+    let turn = 0;
+    globalThis.fetch = (async (_input, init) => {
+      outboundBodies.push(JSON.parse(String(init?.body)) as Record<string, unknown>);
+      turn += 1;
+      if (turn === 1) {
+        const upstream = [
+          frame("response.output_item.added", { output_index: 0, item: { ...firstUpstreamItem, arguments: "", status: "in_progress" } }),
+          frame("response.function_call_arguments.done", { output_index: 0, item_id: "fc_exec", arguments: firstUpstreamItem.arguments }),
+          frame("response.output_item.done", { output_index: 0, item: firstUpstreamItem }),
+          frame("response.completed", { response: { id: "resp_1", status: "completed", output: [firstUpstreamItem] } }),
+          "data: [DONE]",
+        ].join("\n\n") + "\n\n";
+        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+      }
+      const upstream = [
+        frame("response.output_item.added", { output_index: 0, item: { ...secondUpstreamMessage, content: [], status: "in_progress" } }),
+        frame("response.output_item.done", { output_index: 0, item: secondUpstreamMessage }),
+        frame("response.completed", { response: { id: "resp_2", status: "completed", output: [secondUpstreamMessage] } }),
+        "data: [DONE]",
+      ].join("\n\n") + "\n\n";
+      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+    const tools = [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }];
+
+    try {
+      takeSpendHome();
+      const first = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: true,
+          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
+          tools,
+        }),
+      }), config, { model: "", provider: "" });
+      const firstSse = await first.text();
+      expect(firstSse).toContain('"type":"custom_tool_call"');
+      expect(firstSse).toContain('"call_id":"call_exec"');
+      expect(firstSse).not.toContain('"type":"function_call"');
+
+      takeSpendHome();
+      const second = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: true,
+          input: [
+            { role: "user", content: [{ type: "input_text", text: "list apps" }] },
+            {
+              type: "custom_tool_call",
+              id: "ctc_exec",
+              call_id: "call_exec",
+              name: "exec",
+              input: "const apps = await sky.list_apps();",
+            },
+            { type: "custom_tool_call_output", call_id: "call_exec", output: "27 apps" },
+            { type: "custom_tool_call_output", call_id: "call_other", output: "wrong pairing must stay distinct" },
+          ],
+          tools,
+        }),
+      }), config, { model: "", provider: "" });
+      const secondSse = await second.text();
+      const continuationInput = outboundBodies[1]?.input as Array<Record<string, unknown>>;
+      expect(outboundBodies).toHaveLength(2);
+      expect(continuationInput).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          type: "function_call",
+          call_id: "call_exec",
+          name: "exec",
+          arguments: JSON.stringify({ input: "const apps = await sky.list_apps();" }),
+        }),
+        expect.objectContaining({
+          type: "function_call_output",
+          call_id: "call_exec",
+          output: "27 apps",
+        }),
+      ]));
+      const execOutput = continuationInput.find(item => item.type === "function_call_output" && item.call_id === "call_exec");
+      const otherOutput = continuationInput.find(item => item.call_id === "call_other");
+      expect(execOutput).toMatchObject({ type: "function_call_output", output: "27 apps" });
+      expect(otherOutput).toMatchObject({ type: "custom_tool_call_output", call_id: "call_other" });
+      expect(continuationInput.filter(item => item.type === "function_call_output")).toHaveLength(1);
+      expect(secondSse).toContain('"text":"27 apps"');
+      expect(secondSse).toContain('"id":"resp_2"');
+      expect(secondSse).not.toContain('"type":"function_call"');
+      expect(secondSse.indexOf("resp_2")).toBeLessThan(secondSse.indexOf("data: [DONE]"));
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses restores routed custom calls in non-streaming JSON", async () => {
+    const savedFetch = globalThis.fetch;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_exec",
+      call_id: "call_exec",
+      name: "exec",
+      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
+      status: "completed",
+    };
+    globalThis.fetch = (async () => new Response(JSON.stringify({
+      id: "resp_json",
+      status: "completed",
+      output: [upstreamItem],
+    }), { headers: { "content-type": "application/json" } })) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: false,
+          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
+          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
+        }),
+      }), config, { model: "", provider: "" });
+      const body = await response.json() as { output: Array<Record<string, unknown>> };
+
+      expect(body.output[0]).toMatchObject({
+        type: "custom_tool_call",
+        id: "ctc_exec",
+        name: "exec",
+        input: "const apps = await sky.list_apps();",
+      });
+      expect(body.output[0]).not.toHaveProperty("arguments");
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses does not restore routed custom calls excluded by request policy", async () => {
+    const savedFetch = globalThis.fetch;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_exec",
+      call_id: "call_exec",
+      name: "exec",
+      arguments: "{\"input\":\"ignored policy\"}",
+      status: "completed",
+    };
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+    const execTool = {
+      type: "custom",
+      name: "exec",
+      description: "Run JavaScript",
+      format: { type: "grammar", syntax: "lark" },
+    };
+    const ordinaryTool = {
+      type: "function",
+      name: "ordinary",
+      description: "Ordinary function",
+      parameters: { type: "object" },
+    };
+    const cases: Array<{
+      name: string;
+      stream: boolean;
+      tools: Array<Record<string, unknown>>;
+      toolChoice?: unknown;
+      metadata?: unknown;
+      /** The upstream call names a tool this request never declared at all (#1700). */
+      undeclared?: boolean;
+    }> = [
+      {
+        name: "streaming none",
+        stream: true,
+        tools: [execTool],
+        toolChoice: "none",
+      },
+      {
+        name: "streaming allowlist",
+        stream: true,
+        tools: [execTool, ordinaryTool],
+        toolChoice: {
+          type: "allowed_tools",
+          mode: "required",
+          tools: [{ type: "function", name: "ordinary" }],
+        },
+      },
+      {
+        name: "named ordinary function",
+        stream: false,
+        tools: [execTool, ordinaryTool],
+        toolChoice: { type: "function", name: "ordinary" },
+      },
+      {
+        name: "custom-looking metadata without a declared tool",
+        stream: false,
+        tools: [ordinaryTool],
+        metadata: { nested: { type: "custom", name: "exec" } },
+        undeclared: true,
+      },
+    ];
+
+    globalThis.fetch = (async (_input, init) => {
+      const outboundBody = JSON.parse(String(init?.body)) as { stream?: boolean };
+      if (outboundBody.stream === true) {
+        const upstream = [
+          frame("response.output_item.added", {
+            output_index: 0,
+            item: { ...upstreamItem, arguments: "", status: "in_progress" },
+          }),
+          frame("response.function_call_arguments.done", {
+            output_index: 0,
+            item_id: "fc_exec",
+            arguments: upstreamItem.arguments,
+          }),
+          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+          frame("response.completed", {
+            response: { id: "resp_policy", status: "completed", output: [upstreamItem] },
+          }),
+          "data: [DONE]",
+        ].join("\n\n") + "\n\n";
+        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+      }
+      return new Response(JSON.stringify({
+        id: "resp_policy",
+        status: "completed",
+        output: [upstreamItem],
+      }), { headers: { "content-type": "application/json" } });
+    }) as typeof fetch;
+
+    try {
+      for (const policyCase of cases) {
+        takeSpendHome();
+        const response = await handleResponses(new Request("http://localhost/v1/responses", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            model: "fixture/deepseek-v4-flash",
+            stream: policyCase.stream,
+            input: [{ role: "user", content: [{ type: "input_text", text: policyCase.name }] }],
+            tools: policyCase.tools,
+            ...(policyCase.toolChoice !== undefined ? { tool_choice: policyCase.toolChoice } : {}),
+            ...(policyCase.metadata !== undefined ? { metadata: policyCase.metadata } : {}),
+          }),
+        }), config, { model: "", provider: "" });
+
+        if (policyCase.stream) {
+          const clientSse = await response.text();
+          expect(clientSse).toContain('"type":"function_call"');
+          expect(clientSse).toContain('"id":"fc_exec"');
+          expect(clientSse).toContain("response.function_call_arguments.done");
+          expect(clientSse).not.toContain("custom_tool_call");
+          expect(clientSse).not.toContain("ctc_exec");
+        } else if (policyCase.undeclared) {
+          // #1700: this request's catalog holds only `ordinary` — a metadata blob that merely
+          // looks like a tool declaration declares nothing — so a call to `exec` is refused
+          // instead of relayed. The restore contract still holds either way: it never became
+          // a custom_tool_call.
+          expect(response.status).toBe(502);
+          const body = await response.json() as { error: { message: string } };
+          expect(body.error.message).toContain('undeclared client tool "exec"');
+        } else {
+          const body = await response.json() as { output: Array<Record<string, unknown>> };
+          expect(body.output[0]).toEqual(upstreamItem);
+        }
+      }
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses preserves native apply_patch calls that were never converted", async () => {
+    const savedFetch = globalThis.fetch;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_patch",
+      call_id: "call_patch",
+      name: "apply_patch",
+      arguments: "{\"patch\":\"*** Begin Patch\"}",
+      status: "completed",
+    };
+    globalThis.fetch = (async () => new Response(JSON.stringify({
+      id: "resp_patch",
+      status: "completed",
+      output: [upstreamItem],
+    }), { headers: { "content-type": "application/json" } })) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: false,
+          input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
+          tools: [{
+            type: "custom",
+            name: "apply_patch",
+            description: "Apply a patch",
+            format: { type: "grammar", syntax: "lark" },
+          }],
+        }),
+      }), config, { model: "", provider: "" });
+      const body = await response.json() as { output: Array<Record<string, unknown>> };
+
+      expect(body.output[0]).toEqual(upstreamItem);
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses preserves disallowed native apply_patch input in JSON and SSE", async () => {
+    const savedFetch = globalThis.fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+    const upstreamItem = {
+      type: "custom_tool_call",
+      id: "ctc_patch",
+      call_id: "call_patch",
+      name: "apply_patch",
+      input: DECORATED_PATCH,
+      status: "completed",
+    };
+
+    globalThis.fetch = (async (_input, init) => {
+      const outbound = JSON.parse(String(init?.body)) as { stream?: boolean };
+      if (outbound.stream === true) {
+        const upstream = [
+          frame("response.output_item.added", {
+            output_index: 0,
+            item: { ...upstreamItem, input: "", status: "in_progress" },
+          }),
+          frame("response.custom_tool_call_input.done", {
+            output_index: 0,
+            item_id: "ctc_patch",
+            input: DECORATED_PATCH,
+          }),
+          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+          frame("response.completed", {
+            response: { id: "resp_patch_stream", status: "completed", output: [upstreamItem] },
+          }),
+          "data: [DONE]",
+        ].join("\n\n") + "\n\n";
+        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+      }
+      return Response.json({ id: "resp_patch_json", status: "completed", output: [upstreamItem] });
+    }) as typeof fetch;
+
+    try {
+      for (const stream of [false, true]) {
+        takeSpendHome();
+        const response = await handleResponses(new Request("http://localhost/v1/responses", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            model: "fixture/deepseek-v4-flash",
+            stream,
+            input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
+            tools: [
+              {
+                type: "custom",
+                name: "apply_patch",
+                description: "Apply a patch",
+                format: { type: "grammar", syntax: "lark" },
+              },
+              {
+                type: "function",
+                name: "ordinary",
+                description: "Ordinary function",
+                parameters: { type: "object" },
+              },
+            ],
+            tool_choice: stream
+              ? {
+                  type: "allowed_tools",
+                  mode: "required",
+                  tools: [{ type: "function", name: "ordinary" }],
+                }
+              : { type: "function", name: "ordinary" },
+          }),
+        }), config, { model: "", provider: "" });
+
+        if (!stream) {
+          const body = await response.json() as { output: Array<Record<string, unknown>> };
+          expect(body.output[0]).toEqual(upstreamItem);
+          continue;
+        }
+
+        const blocks = (await response.text()).split("\n\n").filter(block => block.includes("data: {"));
+        const payloads = blocks.map(dataPayload);
+        const inputDone = payloads.find(payload => payload.type === "response.custom_tool_call_input.done");
+        expect(inputDone).toMatchObject({ input: DECORATED_PATCH });
+        const itemDone = payloads.find(payload => payload.type === "response.output_item.done") as {
+          item?: Record<string, unknown>;
+        } | undefined;
+        expect(itemDone?.item).toMatchObject({ type: "custom_tool_call", input: DECORATED_PATCH });
+        const completed = payloads.find(payload => payload.type === "response.completed") as {
+          response?: { output?: Array<Record<string, unknown>> };
+        } | undefined;
+        expect(completed?.response?.output?.[0]).toMatchObject({ input: DECORATED_PATCH });
+      }
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses repairs authorized native apply_patch calls in JSON and SSE", async () => {
+    const savedFetch = globalThis.fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+        },
+      },
+    } as OcxConfig;
+    const upstreamItem = {
+      type: "custom_tool_call",
+      id: "ctc_patch",
+      call_id: "call_patch",
+      name: "apply_patch",
+      input: DECORATED_PATCH,
+      status: "completed",
+    };
+
+    globalThis.fetch = (async (_input, init) => {
+      const outbound = JSON.parse(String(init?.body)) as { stream?: boolean };
+      if (outbound.stream === true) {
+        const upstream = [
+          frame("response.output_item.added", {
+            output_index: 0,
+            item: { ...upstreamItem, input: "", status: "in_progress" },
+          }),
+          frame("response.custom_tool_call_input.done", {
+            output_index: 0,
+            item_id: "ctc_patch",
+            input: DECORATED_PATCH,
+          }),
+          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
+          frame("response.completed", {
+            response: { id: "resp_patch_stream", status: "completed", output: [upstreamItem] },
+          }),
+          "data: [DONE]",
+        ].join("\n\n") + "\n\n";
+        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
+      }
+      return Response.json({ id: "resp_patch_json", status: "completed", output: [upstreamItem] });
+    }) as typeof fetch;
+
+    try {
+      for (const stream of [false, true]) {
+        takeSpendHome();
+        const response = await handleResponses(new Request("http://localhost/v1/responses", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            model: "fixture/deepseek-v4-flash",
+            stream,
+            input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
+            tools: [{
+              type: "custom",
+              name: "apply_patch",
+              description: "Apply a patch",
+              format: { type: "grammar", syntax: "lark" },
+            }],
+          }),
+        }), config, { model: "", provider: "" });
+
+        if (!stream) {
+          const body = await response.json() as { output: Array<Record<string, unknown>> };
+          expect(body.output[0]).toMatchObject({
+            type: "custom_tool_call",
+            name: "apply_patch",
+            input: CANONICAL_PATCH,
+          });
+          continue;
+        }
+
+        const blocks = (await response.text()).split("\n\n").filter(block => block.includes("data: {"));
+        const payloads = blocks.map(dataPayload);
+        const inputDone = payloads.find(payload => payload.type === "response.custom_tool_call_input.done");
+        expect(inputDone).toMatchObject({ input: CANONICAL_PATCH });
+        const itemDone = payloads.find(payload => payload.type === "response.output_item.done") as {
+          item?: Record<string, unknown>;
+        } | undefined;
+        expect(itemDone?.item).toMatchObject({ type: "custom_tool_call", input: CANONICAL_PATCH });
+        const completed = payloads.find(payload => payload.type === "response.completed") as {
+          response?: { output?: Array<Record<string, unknown>> };
+        } | undefined;
+        expect(completed?.response?.output?.[0]).toMatchObject({ input: CANONICAL_PATCH });
+      }
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses does not restore a custom image tool replaced by hosted preference", async () => {
+    const savedFetch = globalThis.fetch;
+    let outboundBody: Record<string, unknown> | undefined;
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_image",
+      call_id: "call_image",
+      name: "image_gen.generate",
+      arguments: "{}",
+      status: "completed",
+    };
+    globalThis.fetch = (async (_input, init) => {
+      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      return new Response(JSON.stringify({
+        id: "resp_image",
+        status: "completed",
+        output: [upstreamItem],
+      }), { headers: { "content-type": "application/json" } });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://fixture.test/v1",
+          authMode: "key",
+          apiKey: "fixture-key",
+          modelPreferHostedTools: { "deepseek-v4-flash": ["image_generation"] },
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          model: "fixture/deepseek-v4-flash",
+          stream: false,
+          input: [{ role: "user", content: [{ type: "input_text", text: "draw" }] }],
+          tools: [{
+            type: "custom",
+            name: "image_gen.generate",
+            description: "Generate an image",
+            format: { type: "grammar", syntax: "lark" },
+          }],
+        }),
+      }), config, { model: "", provider: "" });
+      const body = await response.json() as { output: Array<Record<string, unknown>> };
+      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
+
+      expect(outboundTools).toEqual([{ type: "image_generation" }]);
+      expect(body.output[0]).toEqual(upstreamItem);
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+
+  test("handleResponses leaves custom tools native for forward-auth passthrough", async () => {
+    const savedFetch = globalThis.fetch;
+    let outboundBody: Record<string, unknown> | undefined;
+    let outboundAuthorization: string | null = null;
+    let outboundUrl = "";
+    const upstreamItem = {
+      type: "function_call",
+      id: "fc_exec",
+      call_id: "call_exec",
+      name: "exec",
+      arguments: "{\"input\":\"native\"}",
+      status: "completed",
+    };
+    globalThis.fetch = (async (input, init) => {
+      outboundUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
+      outboundAuthorization = new Headers(init?.headers).get("authorization");
+      return new Response(JSON.stringify({ id: "resp_forward", status: "completed", output: [upstreamItem] }), {
+        headers: { "content-type": "application/json" },
+      });
+    }) as typeof fetch;
+    const config = {
+      port: 0,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+        },
+      },
+    } as OcxConfig;
+
+    try {
+      takeSpendHome();
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: "Bearer caller-token" },
+        body: JSON.stringify({
+          model: "fixture/native-model",
+          stream: false,
+          input: "run",
+          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
+        }),
+      }), config, { model: "", provider: "" });
+      const clientBody = await response.json() as { output: Array<Record<string, unknown>> };
+      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
+
+      expect(outboundUrl).toBe("https://chatgpt.com/backend-api/codex/responses");
+      expect(outboundAuthorization).toBe("Bearer caller-token");
+      expect(outboundTools?.[0]).toMatchObject({ type: "custom", name: "exec" });
+      expect(clientBody.output[0]).toMatchObject({ type: "function_call", name: "exec" });
+      expect(clientBody.output[0]).not.toHaveProperty("input");
+    } finally {
+      globalThis.fetch = savedFetch;
+    }
+  });
+});
diff --git a/tests/responses/responses-custom-tool-repair.test.ts b/tests/responses/responses-custom-tool-repair.test.ts
index 98336d02416..3011f7c307c 100644
--- a/tests/responses/responses-custom-tool-repair.test.ts
+++ b/tests/responses/responses-custom-tool-repair.test.ts
@@ -6,23 +6,8 @@ import {
 } from "../../src/responses/custom-tool-compat";
 import { compileCodeModeHelperInput } from "../../src/responses/code-mode-helper-compat";
 import { createRoutedCustomToolRestoreBlockRewrite } from "../../src/server/responses-custom-tool-repair";
-import { handleResponses } from "../../src/server/responses";
-import type { OcxConfig } from "../../src/types";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
-
-function dataPayload(block: string): Record<string, unknown> {
-  const line = block.split(/\r?\n/).find(entry => entry.startsWith("data:"));
-  if (!line) throw new Error("missing SSE data line");
-  return JSON.parse(line.slice(5).trim()) as Record<string, unknown>;
-}
-
-function frame(event: string, payload: Record<string, unknown>): string {
-  return `event: ${event}\ndata: ${JSON.stringify({ type: event, ...payload })}`;
-}
-
-const DECORATED_PATCH = "*** Begin Patch ***\n*** Update File: README.md\n@@\n-old\n+new\n*** End Patch ***";
-const CANONICAL_PATCH = "*** Begin Patch\n*** Update File: README.md\n@@\n-old\n+new\n*** End Patch";
-const WRAPPED_DECORATED_PATCH = JSON.stringify({ input: DECORATED_PATCH });
+import { CANONICAL_PATCH, DECORATED_PATCH, WRAPPED_DECORATED_PATCH, dataPayload, frame } from "../helpers/custom-tool-repair-fixtures";
 
 describe("routed Responses custom-tool compatibility", () => {
   test("restores legacy structured shell aliases as executable unified-exec input", () => {
@@ -1195,949 +1180,4 @@ describe("routed Responses custom-tool compatibility", () => {
     rewrite.dispose?.();
   });
 
-  test("handleResponses sends an upstream-safe exec function and restores client SSE", async () => {
-    const savedFetch = globalThis.fetch;
-    let outboundBody: Record<string, unknown> | undefined;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_exec",
-      call_id: "call_exec",
-      name: "exec",
-      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
-      status: "completed",
-    };
-    const upstream = [
-      frame("response.output_item.added", { output_index: 0, item: { ...upstreamItem, arguments: "", status: "in_progress" } }),
-      frame("response.function_call_arguments.done", { output_index: 0, item_id: "fc_exec", arguments: upstreamItem.arguments }),
-      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-      frame("response.completed", { response: { id: "resp_1", status: "completed", output: [upstreamItem] } }),
-      "data: [DONE]",
-    ].join("\n\n") + "\n\n";
-    globalThis.fetch = (async (_input, init) => {
-      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
-      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: true,
-          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
-          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
-        }),
-      }), config, { model: "", provider: "" });
-      const clientSse = await response.text();
-      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
-
-      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "exec" });
-      expect(clientSse).toContain('"type":"custom_tool_call"');
-      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
-      expect(clientSse).toContain('"input":"const apps = await sky.list_apps();"');
-      expect(clientSse).not.toContain("response.function_call_arguments.done");
-      expect(clientSse).not.toContain('"type":"function_call"');
-      expect(clientSse).toContain("data: [DONE]");
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses lowers and restores apply_patch when the destination denies custom tools", async () => {
-    const savedFetch = globalThis.fetch;
-    let outboundBody: Record<string, unknown> | undefined;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_patch_next",
-      call_id: "call_patch_next",
-      name: "apply_patch",
-      arguments: JSON.stringify({ input: "*** Begin Patch\n*** End Patch" }),
-      status: "completed",
-    };
-    const upstream = [
-      frame("response.output_item.added", {
-        output_index: 0,
-        item: { ...upstreamItem, arguments: "", status: "in_progress" },
-      }),
-      frame("response.function_call_arguments.done", {
-        output_index: 0,
-        item_id: upstreamItem.id,
-        arguments: upstreamItem.arguments,
-      }),
-      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-      frame("response.completed", {
-        response: { id: "resp_patch", status: "completed", output: [upstreamItem] },
-      }),
-      "data: [DONE]",
-    ].join("\n\n") + "\n\n";
-    globalThis.fetch = (async (_input, init) => {
-      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
-      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-          supportsResponsesCustomTools: false,
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/grok-4.6",
-          stream: true,
-          input: [
-            {
-              type: "custom_tool_call",
-              id: "ctc_patch_prior",
-              call_id: "call_patch_prior",
-              name: "apply_patch",
-              input: "noop",
-            },
-            { type: "custom_tool_call_output", call_id: "call_patch_prior", output: "done" },
-          ],
-          tools: [{
-            type: "custom",
-            name: "apply_patch",
-            description: "Apply a patch",
-            format: { type: "grammar", syntax: "lark" },
-          }],
-        }),
-      }), config, { model: "", provider: "" });
-      const clientSse = await response.text();
-      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
-      const outboundInput = outboundBody?.input as Array<Record<string, unknown>> | undefined;
-
-      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "apply_patch" });
-      expect(outboundInput?.[0]).toMatchObject({
-        type: "function_call",
-        call_id: "call_patch_prior",
-        name: "apply_patch",
-        arguments: JSON.stringify({ input: "noop" }),
-      });
-      expect(outboundInput?.[1]).toMatchObject({
-        type: "function_call_output",
-        call_id: "call_patch_prior",
-        output: "done",
-      });
-      expect(clientSse).toContain('"type":"custom_tool_call"');
-      expect(clientSse).toContain('"id":"ctc_patch_next"');
-      expect(clientSse).toContain('"call_id":"call_patch_next"');
-      expect(clientSse).toContain('"name":"apply_patch"');
-      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
-      expect(clientSse).toContain("data: [DONE]");
-      expect(clientSse).not.toContain('"type":"function_call"');
-      expect(clientSse).not.toContain("response.function_call_arguments.done");
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses lowers apply_patch for a noncanonical forward destination that denies custom tools", async () => {
-    const savedFetch = globalThis.fetch;
-    let outboundBody: Record<string, unknown> | undefined;
-    let outboundAuthorization: string | null = null;
-    let outboundUrl = "";
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_patch_next",
-      call_id: "call_patch_next",
-      name: "apply_patch",
-      arguments: JSON.stringify({ input: "*** Begin Patch\n*** End Patch" }),
-      status: "completed",
-    };
-    const upstream = [
-      frame("response.output_item.added", {
-        output_index: 0,
-        item: { ...upstreamItem, arguments: "", status: "in_progress" },
-      }),
-      frame("response.function_call_arguments.done", {
-        output_index: 0,
-        item_id: upstreamItem.id,
-        arguments: upstreamItem.arguments,
-      }),
-      frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-      frame("response.completed", {
-        response: { id: "resp_patch", status: "completed", output: [upstreamItem] },
-      }),
-      "data: [DONE]",
-    ].join("\n\n") + "\n\n";
-    globalThis.fetch = (async (input, init) => {
-      outboundUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
-      outboundAuthorization = new Headers(init?.headers).get("authorization");
-      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://provider.example/v1",
-          authMode: "forward",
-          headers: { authorization: "Bearer provider-static" },
-          supportsResponsesCustomTools: false,
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json", authorization: "Bearer caller-secret" },
-        body: JSON.stringify({
-          model: "fixture/grok-4.6",
-          stream: true,
-          input: [
-            {
-              type: "custom_tool_call",
-              id: "ctc_patch_prior",
-              call_id: "call_patch_prior",
-              name: "apply_patch",
-              input: "noop",
-            },
-            { type: "custom_tool_call_output", call_id: "call_patch_prior", output: "done" },
-          ],
-          tools: [{
-            type: "custom",
-            name: "apply_patch",
-            description: "Apply a patch",
-            format: { type: "grammar", syntax: "lark" },
-          }],
-        }),
-      }), config, { model: "", provider: "" });
-      const clientSse = await response.text();
-      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
-      const outboundInput = outboundBody?.input as Array<Record<string, unknown>> | undefined;
-
-      expect(outboundUrl).toBe("https://provider.example/v1/responses");
-      expect(outboundAuthorization).toBe("Bearer provider-static");
-      expect(outboundTools?.[0]).toMatchObject({ type: "function", name: "apply_patch" });
-      expect(outboundInput?.[0]).toMatchObject({
-        type: "function_call",
-        call_id: "call_patch_prior",
-        name: "apply_patch",
-        arguments: JSON.stringify({ input: "noop" }),
-      });
-      expect(outboundInput?.[1]).toMatchObject({
-        type: "function_call_output",
-        call_id: "call_patch_prior",
-        output: "done",
-      });
-      expect(clientSse).toContain('"type":"custom_tool_call"');
-      expect(clientSse).toContain('"id":"ctc_patch_next"');
-      expect(clientSse).toContain('"call_id":"call_patch_next"');
-      expect(clientSse).toContain('"name":"apply_patch"');
-      expect(clientSse).toContain('"type":"response.custom_tool_call_input.done"');
-      expect(clientSse).toContain("data: [DONE]");
-      expect(clientSse).not.toContain('"type":"function_call"');
-      expect(clientSse).not.toContain("response.function_call_arguments.done");
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses continuation rewrites custom_tool_call_output and keeps call_id ordered", async () => {
-    const savedFetch = globalThis.fetch;
-    const outboundBodies: Array<Record<string, unknown>> = [];
-    const firstUpstreamItem = {
-      type: "function_call",
-      id: "fc_exec",
-      call_id: "call_exec",
-      name: "exec",
-      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
-      status: "completed",
-    };
-    const secondUpstreamMessage = {
-      type: "message",
-      id: "msg_2",
-      role: "assistant",
-      content: [{ type: "output_text", text: "27 apps" }],
-      status: "completed",
-    };
-    let turn = 0;
-    globalThis.fetch = (async (_input, init) => {
-      outboundBodies.push(JSON.parse(String(init?.body)) as Record<string, unknown>);
-      turn += 1;
-      if (turn === 1) {
-        const upstream = [
-          frame("response.output_item.added", { output_index: 0, item: { ...firstUpstreamItem, arguments: "", status: "in_progress" } }),
-          frame("response.function_call_arguments.done", { output_index: 0, item_id: "fc_exec", arguments: firstUpstreamItem.arguments }),
-          frame("response.output_item.done", { output_index: 0, item: firstUpstreamItem }),
-          frame("response.completed", { response: { id: "resp_1", status: "completed", output: [firstUpstreamItem] } }),
-          "data: [DONE]",
-        ].join("\n\n") + "\n\n";
-        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-      }
-      const upstream = [
-        frame("response.output_item.added", { output_index: 0, item: { ...secondUpstreamMessage, content: [], status: "in_progress" } }),
-        frame("response.output_item.done", { output_index: 0, item: secondUpstreamMessage }),
-        frame("response.completed", { response: { id: "resp_2", status: "completed", output: [secondUpstreamMessage] } }),
-        "data: [DONE]",
-      ].join("\n\n") + "\n\n";
-      return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-    const tools = [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }];
-
-    try {
-      const first = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: true,
-          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
-          tools,
-        }),
-      }), config, { model: "", provider: "" });
-      const firstSse = await first.text();
-      expect(firstSse).toContain('"type":"custom_tool_call"');
-      expect(firstSse).toContain('"call_id":"call_exec"');
-      expect(firstSse).not.toContain('"type":"function_call"');
-
-      const second = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: true,
-          input: [
-            { role: "user", content: [{ type: "input_text", text: "list apps" }] },
-            {
-              type: "custom_tool_call",
-              id: "ctc_exec",
-              call_id: "call_exec",
-              name: "exec",
-              input: "const apps = await sky.list_apps();",
-            },
-            { type: "custom_tool_call_output", call_id: "call_exec", output: "27 apps" },
-            { type: "custom_tool_call_output", call_id: "call_other", output: "wrong pairing must stay distinct" },
-          ],
-          tools,
-        }),
-      }), config, { model: "", provider: "" });
-      const secondSse = await second.text();
-      const continuationInput = outboundBodies[1]?.input as Array<Record<string, unknown>>;
-      expect(outboundBodies).toHaveLength(2);
-      expect(continuationInput).toEqual(expect.arrayContaining([
-        expect.objectContaining({
-          type: "function_call",
-          call_id: "call_exec",
-          name: "exec",
-          arguments: JSON.stringify({ input: "const apps = await sky.list_apps();" }),
-        }),
-        expect.objectContaining({
-          type: "function_call_output",
-          call_id: "call_exec",
-          output: "27 apps",
-        }),
-      ]));
-      const execOutput = continuationInput.find(item => item.type === "function_call_output" && item.call_id === "call_exec");
-      const otherOutput = continuationInput.find(item => item.call_id === "call_other");
-      expect(execOutput).toMatchObject({ type: "function_call_output", output: "27 apps" });
-      expect(otherOutput).toMatchObject({ type: "custom_tool_call_output", call_id: "call_other" });
-      expect(continuationInput.filter(item => item.type === "function_call_output")).toHaveLength(1);
-      expect(secondSse).toContain('"text":"27 apps"');
-      expect(secondSse).toContain('"id":"resp_2"');
-      expect(secondSse).not.toContain('"type":"function_call"');
-      expect(secondSse.indexOf("resp_2")).toBeLessThan(secondSse.indexOf("data: [DONE]"));
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses restores routed custom calls in non-streaming JSON", async () => {
-    const savedFetch = globalThis.fetch;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_exec",
-      call_id: "call_exec",
-      name: "exec",
-      arguments: "{\"input\":\"const apps = await sky.list_apps();\"}",
-      status: "completed",
-    };
-    globalThis.fetch = (async () => new Response(JSON.stringify({
-      id: "resp_json",
-      status: "completed",
-      output: [upstreamItem],
-    }), { headers: { "content-type": "application/json" } })) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: false,
-          input: [{ role: "user", content: [{ type: "input_text", text: "list apps" }] }],
-          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
-        }),
-      }), config, { model: "", provider: "" });
-      const body = await response.json() as { output: Array<Record<string, unknown>> };
-
-      expect(body.output[0]).toMatchObject({
-        type: "custom_tool_call",
-        id: "ctc_exec",
-        name: "exec",
-        input: "const apps = await sky.list_apps();",
-      });
-      expect(body.output[0]).not.toHaveProperty("arguments");
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses does not restore routed custom calls excluded by request policy", async () => {
-    const savedFetch = globalThis.fetch;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_exec",
-      call_id: "call_exec",
-      name: "exec",
-      arguments: "{\"input\":\"ignored policy\"}",
-      status: "completed",
-    };
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-    const execTool = {
-      type: "custom",
-      name: "exec",
-      description: "Run JavaScript",
-      format: { type: "grammar", syntax: "lark" },
-    };
-    const ordinaryTool = {
-      type: "function",
-      name: "ordinary",
-      description: "Ordinary function",
-      parameters: { type: "object" },
-    };
-    const cases: Array<{
-      name: string;
-      stream: boolean;
-      tools: Array<Record<string, unknown>>;
-      toolChoice?: unknown;
-      metadata?: unknown;
-      /** The upstream call names a tool this request never declared at all (#1700). */
-      undeclared?: boolean;
-    }> = [
-      {
-        name: "streaming none",
-        stream: true,
-        tools: [execTool],
-        toolChoice: "none",
-      },
-      {
-        name: "streaming allowlist",
-        stream: true,
-        tools: [execTool, ordinaryTool],
-        toolChoice: {
-          type: "allowed_tools",
-          mode: "required",
-          tools: [{ type: "function", name: "ordinary" }],
-        },
-      },
-      {
-        name: "named ordinary function",
-        stream: false,
-        tools: [execTool, ordinaryTool],
-        toolChoice: { type: "function", name: "ordinary" },
-      },
-      {
-        name: "custom-looking metadata without a declared tool",
-        stream: false,
-        tools: [ordinaryTool],
-        metadata: { nested: { type: "custom", name: "exec" } },
-        undeclared: true,
-      },
-    ];
-
-    globalThis.fetch = (async (_input, init) => {
-      const outboundBody = JSON.parse(String(init?.body)) as { stream?: boolean };
-      if (outboundBody.stream === true) {
-        const upstream = [
-          frame("response.output_item.added", {
-            output_index: 0,
-            item: { ...upstreamItem, arguments: "", status: "in_progress" },
-          }),
-          frame("response.function_call_arguments.done", {
-            output_index: 0,
-            item_id: "fc_exec",
-            arguments: upstreamItem.arguments,
-          }),
-          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-          frame("response.completed", {
-            response: { id: "resp_policy", status: "completed", output: [upstreamItem] },
-          }),
-          "data: [DONE]",
-        ].join("\n\n") + "\n\n";
-        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-      }
-      return new Response(JSON.stringify({
-        id: "resp_policy",
-        status: "completed",
-        output: [upstreamItem],
-      }), { headers: { "content-type": "application/json" } });
-    }) as typeof fetch;
-
-    try {
-      for (const policyCase of cases) {
-        const response = await handleResponses(new Request("http://localhost/v1/responses", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            model: "fixture/deepseek-v4-flash",
-            stream: policyCase.stream,
-            input: [{ role: "user", content: [{ type: "input_text", text: policyCase.name }] }],
-            tools: policyCase.tools,
-            ...(policyCase.toolChoice !== undefined ? { tool_choice: policyCase.toolChoice } : {}),
-            ...(policyCase.metadata !== undefined ? { metadata: policyCase.metadata } : {}),
-          }),
-        }), config, { model: "", provider: "" });
-
-        if (policyCase.stream) {
-          const clientSse = await response.text();
-          expect(clientSse).toContain('"type":"function_call"');
-          expect(clientSse).toContain('"id":"fc_exec"');
-          expect(clientSse).toContain("response.function_call_arguments.done");
-          expect(clientSse).not.toContain("custom_tool_call");
-          expect(clientSse).not.toContain("ctc_exec");
-        } else if (policyCase.undeclared) {
-          // #1700: this request's catalog holds only `ordinary` — a metadata blob that merely
-          // looks like a tool declaration declares nothing — so a call to `exec` is refused
-          // instead of relayed. The restore contract still holds either way: it never became
-          // a custom_tool_call.
-          expect(response.status).toBe(502);
-          const body = await response.json() as { error: { message: string } };
-          expect(body.error.message).toContain('undeclared client tool "exec"');
-        } else {
-          const body = await response.json() as { output: Array<Record<string, unknown>> };
-          expect(body.output[0]).toEqual(upstreamItem);
-        }
-      }
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses preserves native apply_patch calls that were never converted", async () => {
-    const savedFetch = globalThis.fetch;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_patch",
-      call_id: "call_patch",
-      name: "apply_patch",
-      arguments: "{\"patch\":\"*** Begin Patch\"}",
-      status: "completed",
-    };
-    globalThis.fetch = (async () => new Response(JSON.stringify({
-      id: "resp_patch",
-      status: "completed",
-      output: [upstreamItem],
-    }), { headers: { "content-type": "application/json" } })) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: false,
-          input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
-          tools: [{
-            type: "custom",
-            name: "apply_patch",
-            description: "Apply a patch",
-            format: { type: "grammar", syntax: "lark" },
-          }],
-        }),
-      }), config, { model: "", provider: "" });
-      const body = await response.json() as { output: Array<Record<string, unknown>> };
-
-      expect(body.output[0]).toEqual(upstreamItem);
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses preserves disallowed native apply_patch input in JSON and SSE", async () => {
-    const savedFetch = globalThis.fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-    const upstreamItem = {
-      type: "custom_tool_call",
-      id: "ctc_patch",
-      call_id: "call_patch",
-      name: "apply_patch",
-      input: DECORATED_PATCH,
-      status: "completed",
-    };
-
-    globalThis.fetch = (async (_input, init) => {
-      const outbound = JSON.parse(String(init?.body)) as { stream?: boolean };
-      if (outbound.stream === true) {
-        const upstream = [
-          frame("response.output_item.added", {
-            output_index: 0,
-            item: { ...upstreamItem, input: "", status: "in_progress" },
-          }),
-          frame("response.custom_tool_call_input.done", {
-            output_index: 0,
-            item_id: "ctc_patch",
-            input: DECORATED_PATCH,
-          }),
-          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-          frame("response.completed", {
-            response: { id: "resp_patch_stream", status: "completed", output: [upstreamItem] },
-          }),
-          "data: [DONE]",
-        ].join("\n\n") + "\n\n";
-        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-      }
-      return Response.json({ id: "resp_patch_json", status: "completed", output: [upstreamItem] });
-    }) as typeof fetch;
-
-    try {
-      for (const stream of [false, true]) {
-        const response = await handleResponses(new Request("http://localhost/v1/responses", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            model: "fixture/deepseek-v4-flash",
-            stream,
-            input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
-            tools: [
-              {
-                type: "custom",
-                name: "apply_patch",
-                description: "Apply a patch",
-                format: { type: "grammar", syntax: "lark" },
-              },
-              {
-                type: "function",
-                name: "ordinary",
-                description: "Ordinary function",
-                parameters: { type: "object" },
-              },
-            ],
-            tool_choice: stream
-              ? {
-                  type: "allowed_tools",
-                  mode: "required",
-                  tools: [{ type: "function", name: "ordinary" }],
-                }
-              : { type: "function", name: "ordinary" },
-          }),
-        }), config, { model: "", provider: "" });
-
-        if (!stream) {
-          const body = await response.json() as { output: Array<Record<string, unknown>> };
-          expect(body.output[0]).toEqual(upstreamItem);
-          continue;
-        }
-
-        const blocks = (await response.text()).split("\n\n").filter(block => block.includes("data: {"));
-        const payloads = blocks.map(dataPayload);
-        const inputDone = payloads.find(payload => payload.type === "response.custom_tool_call_input.done");
-        expect(inputDone).toMatchObject({ input: DECORATED_PATCH });
-        const itemDone = payloads.find(payload => payload.type === "response.output_item.done") as {
-          item?: Record<string, unknown>;
-        } | undefined;
-        expect(itemDone?.item).toMatchObject({ type: "custom_tool_call", input: DECORATED_PATCH });
-        const completed = payloads.find(payload => payload.type === "response.completed") as {
-          response?: { output?: Array<Record<string, unknown>> };
-        } | undefined;
-        expect(completed?.response?.output?.[0]).toMatchObject({ input: DECORATED_PATCH });
-      }
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses repairs authorized native apply_patch calls in JSON and SSE", async () => {
-    const savedFetch = globalThis.fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-        },
-      },
-    } as OcxConfig;
-    const upstreamItem = {
-      type: "custom_tool_call",
-      id: "ctc_patch",
-      call_id: "call_patch",
-      name: "apply_patch",
-      input: DECORATED_PATCH,
-      status: "completed",
-    };
-
-    globalThis.fetch = (async (_input, init) => {
-      const outbound = JSON.parse(String(init?.body)) as { stream?: boolean };
-      if (outbound.stream === true) {
-        const upstream = [
-          frame("response.output_item.added", {
-            output_index: 0,
-            item: { ...upstreamItem, input: "", status: "in_progress" },
-          }),
-          frame("response.custom_tool_call_input.done", {
-            output_index: 0,
-            item_id: "ctc_patch",
-            input: DECORATED_PATCH,
-          }),
-          frame("response.output_item.done", { output_index: 0, item: upstreamItem }),
-          frame("response.completed", {
-            response: { id: "resp_patch_stream", status: "completed", output: [upstreamItem] },
-          }),
-          "data: [DONE]",
-        ].join("\n\n") + "\n\n";
-        return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
-      }
-      return Response.json({ id: "resp_patch_json", status: "completed", output: [upstreamItem] });
-    }) as typeof fetch;
-
-    try {
-      for (const stream of [false, true]) {
-        const response = await handleResponses(new Request("http://localhost/v1/responses", {
-          method: "POST",
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({
-            model: "fixture/deepseek-v4-flash",
-            stream,
-            input: [{ role: "user", content: [{ type: "input_text", text: "patch" }] }],
-            tools: [{
-              type: "custom",
-              name: "apply_patch",
-              description: "Apply a patch",
-              format: { type: "grammar", syntax: "lark" },
-            }],
-          }),
-        }), config, { model: "", provider: "" });
-
-        if (!stream) {
-          const body = await response.json() as { output: Array<Record<string, unknown>> };
-          expect(body.output[0]).toMatchObject({
-            type: "custom_tool_call",
-            name: "apply_patch",
-            input: CANONICAL_PATCH,
-          });
-          continue;
-        }
-
-        const blocks = (await response.text()).split("\n\n").filter(block => block.includes("data: {"));
-        const payloads = blocks.map(dataPayload);
-        const inputDone = payloads.find(payload => payload.type === "response.custom_tool_call_input.done");
-        expect(inputDone).toMatchObject({ input: CANONICAL_PATCH });
-        const itemDone = payloads.find(payload => payload.type === "response.output_item.done") as {
-          item?: Record<string, unknown>;
-        } | undefined;
-        expect(itemDone?.item).toMatchObject({ type: "custom_tool_call", input: CANONICAL_PATCH });
-        const completed = payloads.find(payload => payload.type === "response.completed") as {
-          response?: { output?: Array<Record<string, unknown>> };
-        } | undefined;
-        expect(completed?.response?.output?.[0]).toMatchObject({ input: CANONICAL_PATCH });
-      }
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses does not restore a custom image tool replaced by hosted preference", async () => {
-    const savedFetch = globalThis.fetch;
-    let outboundBody: Record<string, unknown> | undefined;
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_image",
-      call_id: "call_image",
-      name: "image_gen.generate",
-      arguments: "{}",
-      status: "completed",
-    };
-    globalThis.fetch = (async (_input, init) => {
-      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
-      return new Response(JSON.stringify({
-        id: "resp_image",
-        status: "completed",
-        output: [upstreamItem],
-      }), { headers: { "content-type": "application/json" } });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://fixture.test/v1",
-          authMode: "key",
-          apiKey: "fixture-key",
-          modelPreferHostedTools: { "deepseek-v4-flash": ["image_generation"] },
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          model: "fixture/deepseek-v4-flash",
-          stream: false,
-          input: [{ role: "user", content: [{ type: "input_text", text: "draw" }] }],
-          tools: [{
-            type: "custom",
-            name: "image_gen.generate",
-            description: "Generate an image",
-            format: { type: "grammar", syntax: "lark" },
-          }],
-        }),
-      }), config, { model: "", provider: "" });
-      const body = await response.json() as { output: Array<Record<string, unknown>> };
-      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
-
-      expect(outboundTools).toEqual([{ type: "image_generation" }]);
-      expect(body.output[0]).toEqual(upstreamItem);
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
-
-  test("handleResponses leaves custom tools native for forward-auth passthrough", async () => {
-    const savedFetch = globalThis.fetch;
-    let outboundBody: Record<string, unknown> | undefined;
-    let outboundAuthorization: string | null = null;
-    let outboundUrl = "";
-    const upstreamItem = {
-      type: "function_call",
-      id: "fc_exec",
-      call_id: "call_exec",
-      name: "exec",
-      arguments: "{\"input\":\"native\"}",
-      status: "completed",
-    };
-    globalThis.fetch = (async (input, init) => {
-      outboundUrl = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
-      outboundBody = JSON.parse(String(init?.body)) as Record<string, unknown>;
-      outboundAuthorization = new Headers(init?.headers).get("authorization");
-      return new Response(JSON.stringify({ id: "resp_forward", status: "completed", output: [upstreamItem] }), {
-        headers: { "content-type": "application/json" },
-      });
-    }) as typeof fetch;
-    const config = {
-      port: 0,
-      defaultProvider: "fixture",
-      providers: {
-        fixture: {
-          adapter: "openai-responses",
-          baseUrl: "https://chatgpt.com/backend-api/codex",
-          authMode: "forward",
-        },
-      },
-    } as OcxConfig;
-
-    try {
-      const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST",
-        headers: { "content-type": "application/json", authorization: "Bearer caller-token" },
-        body: JSON.stringify({
-          model: "fixture/native-model",
-          stream: false,
-          input: "run",
-          tools: [{ type: "custom", name: "exec", description: "Run JavaScript", format: { type: "grammar", syntax: "lark" } }],
-        }),
-      }), config, { model: "", provider: "" });
-      const clientBody = await response.json() as { output: Array<Record<string, unknown>> };
-      const outboundTools = outboundBody?.tools as Array<Record<string, unknown>> | undefined;
-
-      expect(outboundUrl).toBe("https://chatgpt.com/backend-api/codex/responses");
-      expect(outboundAuthorization).toBe("Bearer caller-token");
-      expect(outboundTools?.[0]).toMatchObject({ type: "custom", name: "exec" });
-      expect(clientBody.output[0]).toMatchObject({ type: "function_call", name: "exec" });
-      expect(clientBody.output[0]).not.toHaveProperty("input");
-    } finally {
-      globalThis.fetch = savedFetch;
-    }
-  });
 });
diff --git a/tests/responses/responses-custom-tool-stream-consistency.test.ts b/tests/responses/responses-custom-tool-stream-consistency.test.ts
new file mode 100644
index 00000000000..c2144e57fc1
--- /dev/null
+++ b/tests/responses/responses-custom-tool-stream-consistency.test.ts
@@ -0,0 +1,220 @@
+import { describe, expect, test } from "bun:test";
+import { createRoutedCustomToolRestoreBlockRewrite } from "../../src/server/responses-custom-tool-repair";
+
+function dataPayload(block: string): Record<string, unknown> {
+  const line = block.split(/\r?\n/).find(entry => entry.startsWith("data:"));
+  if (!line) throw new Error("missing SSE data line");
+  return JSON.parse(line.slice(5).trim()) as Record<string, unknown>;
+}
+
+function frame(event: string, payload: Record<string, unknown>): string {
+  return `event: ${event}\ndata: ${JSON.stringify({ type: event, ...payload })}`;
+}
+
+type StreamResult = {
+  preview: string;
+  doneInput: string;
+  itemInput: string;
+  terminalInput: string;
+  identity: string[];
+};
+
+function restoreExecStream(argumentsText: string, fragments: readonly string[], tool = "exec"): StreamResult {
+  const rewrite = createRoutedCustomToolRestoreBlockRewrite(new Set([tool]));
+  try {
+    const added = rewrite(frame("response.output_item.added", {
+      output_index: 0,
+      item: {
+        type: "function_call",
+        id: `fc_${tool}`,
+        call_id: `call_${tool}`,
+        name: tool,
+        arguments: "",
+        status: "in_progress",
+      },
+    }));
+    const addedItem = dataPayload(added[0]!).item as Record<string, unknown>;
+    let preview = "";
+    for (const delta of fragments) {
+      const blocks = rewrite(frame("response.function_call_arguments.delta", {
+        output_index: 0,
+        item_id: `fc_${tool}`,
+        delta,
+      }));
+      for (const block of blocks) {
+        const payload = dataPayload(block);
+        if (payload.type === "response.custom_tool_call_input.delta") {
+          preview += String(payload.delta ?? "");
+        }
+      }
+    }
+
+    const done = rewrite(frame("response.function_call_arguments.done", {
+      output_index: 0,
+      item_id: `fc_${tool}`,
+      arguments: argumentsText,
+    }));
+    const itemDone = rewrite(frame("response.output_item.done", {
+      output_index: 0,
+      item: {
+        type: "function_call",
+        id: `fc_${tool}`,
+        call_id: `call_${tool}`,
+        name: tool,
+        arguments: argumentsText,
+        status: "completed",
+      },
+    }));
+    const terminal = rewrite(frame("response.completed", {
+      response: {
+        id: "resp_1",
+        status: "completed",
+        output: [{
+          type: "function_call",
+          id: `fc_${tool}`,
+          call_id: `call_${tool}`,
+          name: tool,
+          arguments: argumentsText,
+          status: "completed",
+        }],
+      },
+    }));
+    const donePayload = dataPayload(done[0]!);
+    const doneItem = dataPayload(itemDone[0]!).item as Record<string, unknown>;
+    const terminalResponse = dataPayload(terminal[0]!).response as { output: Array<Record<string, unknown>> };
+    const terminalItem = terminalResponse.output[0] ?? {};
+    return {
+      preview,
+      doneInput: String(donePayload.input),
+      itemInput: String(doneItem.input),
+      terminalInput: String(terminalItem.input),
+      identity: [
+        String(addedItem.id), String(donePayload.item_id),
+        String(doneItem.id), String(doneItem.call_id), String(doneItem.name),
+        String(terminalItem.id), String(terminalItem.call_id), String(terminalItem.name),
+      ],
+    };
+  } finally {
+    rewrite.dispose?.();
+  }
+}
+
+describe("routed Responses custom-tool stream consistency", () => {
+  test("holds a raw decorated apply_patch envelope at every split boundary", () => {
+    // Completion rewrites a decorated envelope through `normalizeApplyPatchDelimiters`, so any
+    // decorated marker published as a delta is a byte the authoritative item does not contain.
+    // Raw input reaches this path only because ordinary raw bodies now stream; the older routed
+    // decoder held every non-canonical shape and so never exposed this case.
+    const argumentsText = "*** Begin Patch ***\n*** Update File: a.txt ***\n+one\n*** End Patch ***";
+    for (let split = 0; split <= argumentsText.length; split++) {
+      const result = restoreExecStream(
+        argumentsText,
+        [argumentsText.slice(0, split), argumentsText.slice(split)],
+        "apply_patch",
+      );
+      expect(result.preview, `split ${split}`).toBe("");
+      expect(result.doneInput, `split ${split}`).toBe(result.itemInput);
+      expect(result.itemInput, `split ${split}`).toBe(result.terminalInput);
+      // The authoritative input is the normalized envelope, not the decorated bytes.
+      expect(result.doneInput, `split ${split}`).not.toBe(argumentsText);
+      expect(result.doneInput, `split ${split}`).toContain("*** Begin Patch");
+      expect(result.doneInput, `split ${split}`).not.toContain("*** Begin Patch ***");
+    }
+  });
+
+  test("publishes nothing for a wrapper carrying a literal control character", () => {
+    // A raw newline inside a JSON string makes the object unparseable, so completion keeps the
+    // whole wrapper as the input. Previewing the decoded value first would be the same
+    // disagreement a fenced body causes, reached through a different invalid spelling.
+    const argumentsText = '{"input":"one\ntwo"}';
+    const result = restoreExecStream(argumentsText, [argumentsText]);
+    expect(result.preview).toBe("");
+    expect(result.doneInput).toBe(argumentsText);
+    expect(result.itemInput).toBe(argumentsText);
+    expect(result.terminalInput).toBe(argumentsText);
+  });
+
+  test("holds a wrapped fenced exec body at every split boundary", () => {
+    const argumentsText = JSON.stringify({ input: "```js\ntext(1)\n```" });
+    for (let split = 0; split <= argumentsText.length; split++) {
+      const result = restoreExecStream(argumentsText, [
+        argumentsText.slice(0, split),
+        argumentsText.slice(split),
+      ]);
+      // Completion strips the outer fence, so publishing even one fence byte would make
+      // the preview impossible to reconcile with the authoritative item.
+      expect(result.preview, `split ${split}`).toBe("");
+      expect(result.doneInput, `split ${split}`).toBe("text(1)");
+      expect(result.itemInput, `split ${split}`).toBe("text(1)");
+      expect(result.terminalInput, `split ${split}`).toBe("text(1)");
+      expect(result.identity, `split ${split}`).toEqual([
+        "ctc_exec", "ctc_exec",
+        "ctc_exec", "call_exec", "exec",
+        "ctc_exec", "call_exec", "exec",
+      ]);
+    }
+  });
+
+  test("keeps ordinary raw exec input progressive", () => {
+    const result = restoreExecStream("text(1)", ["te", "xt", "(1)"]);
+    expect(result.preview).toBe("text(1)");
+    expect(result.doneInput).toBe("text(1)");
+    expect(result.itemInput).toBe("text(1)");
+    expect(result.terminalInput).toBe("text(1)");
+  });
+
+  test.each([
+    {
+      label: "single fallback key",
+      argumentsText: '{"code":"line\\nnext"}',
+      fragments: ['{"code":"line', '\\nnext"}'],
+      expected: "line\nnext",
+    },
+    {
+      label: "whitespace around the canonical wrapper",
+      argumentsText: ' \n { \t "input" \r : "spaced" }',
+      fragments: [' \n { \t "in', 'put" \r : "spa', 'ced" }'],
+      expected: "spaced",
+    },
+    {
+      label: "JSON escapes",
+      argumentsText: '{"input":"quote: \\\" slash: \\\\ tab: \\t"}',
+      fragments: ['{"input":"quote: \\', '\" slash: \\\\ tab: \\', 't"}'],
+      expected: 'quote: " slash: \\ tab: \t',
+    },
+    {
+      label: "split surrogate pair",
+      argumentsText: '{"input":"before \\uD83D\\uDE00 after"}',
+      fragments: ['{"input":"before \\uD83D', '\\uDE00 after"}'],
+      expected: "before 😀 after",
+    },
+  ])("keeps $label preview aligned with completion", ({ argumentsText, fragments, expected }) => {
+    const result = restoreExecStream(argumentsText, fragments);
+    expect(result.preview).toBe(expected);
+    expect(result.doneInput).toBe(expected);
+    expect(result.itemInput).toBe(expected);
+    expect(result.terminalInput).toBe(expected);
+  });
+
+  test("documents the duplicate input-key preview limit", () => {
+    const argumentsText = '{"input":"first","input":"second"}';
+    const result = restoreExecStream(argumentsText, ['{"input":"first', '","input":"second"}']);
+    // JSON.parse chooses the last duplicate key after the first value was already streamed.
+    // Avoiding this mismatch would require buffering every valid canonical wrapper.
+    expect(result.preview).toBe("first");
+    expect(result.doneInput).toBe("second");
+    expect(result.itemInput).toBe("second");
+    expect(result.terminalInput).toBe("second");
+  });
+
+  test("documents the late-invalid-wrapper preview limit", () => {
+    const argumentsText = '{"input":"safe\\q"}';
+    const result = restoreExecStream(argumentsText, ['{"input":"safe', '\\q"}']);
+    // Once a valid prefix is published there is no rewind. The undefined escape stops
+    // further preview, while completion preserves the raw unparseable argument text.
+    expect(result.preview).toBe("safe");
+    expect(result.doneInput).toBe(argumentsText);
+    expect(result.itemInput).toBe(argumentsText);
+    expect(result.terminalInput).toBe(argumentsText);
+  });
+});
diff --git a/tests/responses/responses-default-namespace-emit-normalize.test.ts b/tests/responses/responses-default-namespace-emit-normalize.test.ts
new file mode 100644
index 00000000000..5b7952468b9
--- /dev/null
+++ b/tests/responses/responses-default-namespace-emit-normalize.test.ts
@@ -0,0 +1,211 @@
+/**
+ * #5095: a routed Command Code Muse turn reached Codex App carrying
+ * `{"type":"function_call","name":"default.view_image"}`. Codex has no handler for that name, so
+ * it answered "unsupported call" and stored the item; every later request that replayed the
+ * history was then refused by the upstream name pattern
+ * (`Invalid 'input[877].name': string does not match pattern '^[a-zA-Z0-9_-]+$'`), which is what
+ * killed a side chat opened from an 11h43m parent task. One relayed item ends the conversation.
+ *
+ * The cause was two resolvers disagreeing rather than a missing mechanism. The passthrough guard
+ * RESOLVES an emitted name through `normalizeDeclaredToolName`, which maps a `default.`-prefixed
+ * code-mode helper onto the declared `exec` (#4412) as well as a `default.`-prefixed bare tool
+ * (#4176), so `default.view_image` was authorized. The emit-side rewrite
+ * (`normalizeDefaultNamespaceInItem`) knew only the bare-tool case, so it forwarded the name
+ * unchanged. These pin the agreement: the name the guard admits is the name the client receives.
+ *
+ * Kept out of `responses-undeclared-tool-guard.test.ts` because that file sits at its
+ * file-size-baseline cap, and caps only move down.
+ */
+import { describe, expect, test } from "bun:test";
+import {
+  collectDeclaredBareWireToolNames,
+  collectDeclaredWireToolNames,
+  createUndeclaredToolCallGuardBlockRewrite,
+  normalizeDefaultNamespaceInResponse,
+  undeclaredToolCallNameInResponse,
+  UNDECLARED_TOOL_CALL_ERROR_CODE,
+} from "../../src/server/responses-undeclared-tool-guard";
+import { isSchemaValidResponsesToolName } from "../../src/responses/tool-name-aliases";
+
+/** Codex code mode: the shell is one freeform `exec`; every helper lives inside it, undeclared. */
+const CODE_MODE_BODY = {
+  tools: [{ type: "custom", name: "exec", description: "code mode" }],
+} as const;
+
+/** The classic Codex catalog, where `view_image` is a declared top-level function. */
+const CLASSIC_BODY = {
+  tools: [
+    { type: "function", name: "view_image", parameters: { type: "object" } },
+    { type: "custom", name: "apply_patch" },
+  ],
+} as const;
+
+function declarationsOf(body: unknown): {
+  declared: ReadonlySet<string>;
+  declaredBare: ReadonlySet<string>;
+} {
+  return {
+    declared: collectDeclaredWireToolNames(body),
+    declaredBare: collectDeclaredBareWireToolNames(body),
+  };
+}
+
+function responseWith(...output: readonly unknown[]): Record<string, unknown> {
+  return { id: "resp_1", status: "completed", output };
+}
+
+function normalizedNames(body: unknown, ...output: readonly unknown[]): unknown {
+  const { declared, declaredBare } = declarationsOf(body);
+  const result = normalizeDefaultNamespaceInResponse(responseWith(...output), declared, declaredBare);
+  return (result.value as { output: Array<{ name?: unknown }> }).output.map(item => item.name);
+}
+
+function guardVerdict(body: unknown, item: unknown): string | undefined {
+  const { declared, declaredBare } = declarationsOf(body);
+  return undeclaredToolCallNameInResponse(responseWith(item), declared, undefined, undefined, declaredBare);
+}
+
+describe("schema-valid Responses tool names", () => {
+  test("the pattern the upstream enforces is what the emit boundary reads", () => {
+    expect(isSchemaValidResponsesToolName("view_image")).toBe(true);
+    expect(isSchemaValidResponsesToolName("exec")).toBe(true);
+    expect(isSchemaValidResponsesToolName("mcp__ctx7__get-docs")).toBe(true);
+    expect(isSchemaValidResponsesToolName("default.view_image")).toBe(false);
+    expect(isSchemaValidResponsesToolName("mcp__ctx7.get_docs")).toBe(false);
+    expect(isSchemaValidResponsesToolName("view image")).toBe(false);
+    expect(isSchemaValidResponsesToolName("")).toBe(false);
+  });
+});
+
+describe("default-namespaced helper names under a code-mode catalog", () => {
+  test("a dotted helper whose suffix resolves to the one declared tool is emitted as that tool", () => {
+    // The two names from the report, verbatim.
+    expect(normalizedNames(
+      CODE_MODE_BODY,
+      { type: "function_call", call_id: "c1", name: "default.view_image", arguments: "{}" },
+      { type: "function_call", call_id: "c2", name: "default.apply_patch", arguments: "{}" },
+    )).toEqual(["exec", "exec"]);
+  });
+
+  test("the guard already admitted these names, which is why they reached the client", () => {
+    expect(guardVerdict(CODE_MODE_BODY, {
+      type: "function_call", call_id: "c1", name: "default.view_image", arguments: "{}",
+    })).toBeUndefined();
+  });
+
+  test("every emitted name is one the upstream schema accepts", () => {
+    const names = normalizedNames(
+      CODE_MODE_BODY,
+      { type: "function_call", call_id: "c1", name: "default.view_image", arguments: "{}" },
+      { type: "function_call", call_id: "c2", name: "default.exec_command", arguments: "{}" },
+      { type: "function_call", call_id: "c3", name: "default.write_stdin", arguments: "{}" },
+    ) as string[];
+    for (const name of names) expect(isSchemaValidResponsesToolName(name)).toBe(true);
+  });
+
+  test("a dotted suffix that matches no declared tool is refused, not renamed", () => {
+    const item = { type: "function_call", call_id: "c1", name: "default.lookup", arguments: "{}" };
+    expect(normalizedNames(CODE_MODE_BODY, item)).toEqual(["default.lookup"]);
+    expect(guardVerdict(CODE_MODE_BODY, item)).toBe("default.lookup");
+  });
+});
+
+describe("names the emit boundary must not touch", () => {
+  test("a canonical declared name passes through byte-identical", () => {
+    const item = { type: "function_call", call_id: "c1", name: "view_image", arguments: "{}" };
+    const { declared, declaredBare } = declarationsOf(CLASSIC_BODY);
+    const response = responseWith(item);
+    const result = normalizeDefaultNamespaceInResponse(response, declared, declaredBare);
+    expect(result.changed).toBe(false);
+    expect(result.value).toBe(response);
+  });
+
+  test("a declared bare tool keeps the #4176 rewrite to the bare name, not to exec", () => {
+    expect(normalizedNames(
+      CLASSIC_BODY,
+      { type: "function_call", call_id: "c1", name: "default.view_image", arguments: "{}" },
+    )).toEqual(["view_image"]);
+  });
+
+  test("a dotted name the caller itself declared is a real identity and is left alone", () => {
+    // `default` here is a genuine namespace the request declared, so `default.view_image` is the
+    // flattened spelling of a tool the caller owns. Two declared identities claim the suffix
+    // `view_image`; rewriting either onto the other would dispatch a call the caller never made.
+    const ambiguous = {
+      tools: [
+        { type: "function", name: "view_image", parameters: { type: "object" } },
+        { type: "namespace", name: "default", tools: [{ type: "function", name: "view_image", parameters: { type: "object" } }] },
+      ],
+    };
+    const item = { type: "function_call", call_id: "c1", name: "default.view_image", arguments: "{}" };
+    const { declared, declaredBare } = declarationsOf(ambiguous);
+    expect(declared.has("default.view_image")).toBe(true);
+    const response = responseWith(item);
+    const result = normalizeDefaultNamespaceInResponse(response, declared, declaredBare);
+    expect(result.changed).toBe(false);
+    expect(result.value).toBe(response);
+  });
+
+  test("a name invalid for a reason other than the namespace is refused rather than guessed at", () => {
+    for (const name of ["view image", "view_image!", "exec/apply_patch"]) {
+      const item = { type: "function_call", call_id: "c1", name, arguments: "{}" };
+      expect(normalizedNames(CODE_MODE_BODY, item)).toEqual([name]);
+      expect(guardVerdict(CODE_MODE_BODY, item)).toBe(name);
+    }
+  });
+
+  test("a non-call item carrying a dotted name field is not a tool identity", () => {
+    const message = { type: "message", role: "assistant", content: [{ type: "output_text", text: "default.view_image" }] };
+    const { declared, declaredBare } = declarationsOf(CODE_MODE_BODY);
+    const response = responseWith(message);
+    expect(normalizeDefaultNamespaceInResponse(response, declared, declaredBare).value).toBe(response);
+  });
+});
+
+describe("a replay mixing damaged and undamaged items", () => {
+  test("only the damaged item changes and the rest are preserved value-identically", () => {
+    const undamagedOne = { type: "function_call", call_id: "c1", name: "view_image", arguments: "{\"path\":\"a.png\"}" };
+    const damaged = { type: "function_call", call_id: "c2", name: "default.apply_patch", arguments: "{}" };
+    const undamagedTwo = { type: "message", role: "assistant", content: [{ type: "output_text", text: "done" }] };
+    const { declared, declaredBare } = declarationsOf(CLASSIC_BODY);
+    const response = responseWith(undamagedOne, damaged, undamagedTwo);
+    const result = normalizeDefaultNamespaceInResponse(response, declared, declaredBare);
+    expect(result.changed).toBe(true);
+    const output = (result.value as { output: unknown[] }).output;
+    expect(output[0]).toBe(undamagedOne);
+    expect(output[1]).toEqual({ type: "function_call", call_id: "c2", name: "apply_patch", arguments: "{}" });
+    expect(output[2]).toBe(undamagedTwo);
+  });
+});
+
+describe("the streaming boundary the report actually crossed", () => {
+  const blocks = (rewrite: (block: string) => readonly string[], items: readonly unknown[]): string[] => {
+    const out: string[] = [];
+    for (const item of items) {
+      const payload = JSON.stringify({ type: "response.output_item.added", output_index: 0, item });
+      out.push(...rewrite(`event: response.output_item.added\ndata: ${payload}`));
+    }
+    return out;
+  };
+
+  test("the streamed item is rewritten to the authorized name", () => {
+    const { declared, declaredBare } = declarationsOf(CODE_MODE_BODY);
+    const rewrite = createUndeclaredToolCallGuardBlockRewrite(declared, undefined, undefined, declaredBare);
+    const emitted = blocks(rewrite, [
+      { type: "function_call", id: "fc_1", call_id: "c1", name: "default.view_image", arguments: "{}" },
+    ]);
+    expect(emitted).toHaveLength(1);
+    expect(emitted[0]).toContain('"name":"exec"');
+    expect(emitted[0]).not.toContain("default.view_image");
+  });
+
+  test("an unresolvable dotted name ends the turn instead of reaching the client", () => {
+    const { declared, declaredBare } = declarationsOf(CODE_MODE_BODY);
+    const rewrite = createUndeclaredToolCallGuardBlockRewrite(declared, undefined, undefined, declaredBare);
+    const emitted = blocks(rewrite, [
+      { type: "function_call", id: "fc_1", call_id: "c1", name: "default.lookup", arguments: "{}" },
+    ]);
+    expect(emitted.join("\n")).toContain(UNDECLARED_TOOL_CALL_ERROR_CODE);
+    expect(emitted.join("\n")).toContain("response.failed");
+  });
+});
diff --git a/tests/responses/responses-forward-incomplete-quota.test.ts b/tests/responses/responses-forward-incomplete-quota.test.ts
index 0d93e3d5e44..ee79fd9c182 100644
--- a/tests/responses/responses-forward-incomplete-quota.test.ts
+++ b/tests/responses/responses-forward-incomplete-quota.test.ts
@@ -26,6 +26,7 @@ import { isEagerRelaySseResponse } from "../../src/server/relay";
 import { sendResponseToWebSocket, type WsData } from "../../src/server/ws-bridge";
 import { installIsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { INTERNAL_DEADLINE_MS, SERVER_BUDGET_MS } from "../helpers/test-budget";
 
 const provider: OcxProviderConfig = {
@@ -116,6 +117,8 @@ async function exerciseSpawnReporter(path: ReporterPath): Promise<void> {
   const home = mkdtempSync(join(tmpdir(), "ocx-incomplete-quota-"));
   const codexHome = installIsolatedCodexHome("ocx-incomplete-quota-codex-");
   process.env.OPENCODEX_HOME = home;
+  // Taken after this reporter installs its home so every direct dispatch owns its journal.
+  const releaseSpendHome = acquireOwnedSpendHome();
   const accountId = "incomplete-quota-endpoint";
   const model = "gpt-test";
   const config: OcxConfig = {
@@ -303,6 +306,8 @@ async function exerciseSpawnReporter(path: ReporterPath): Promise<void> {
     expect(wsDispatches).toBe(path === "guarded-ws" ? 2 : 0);
     expect(httpDispatches).toBe(path === "guarded-ws" ? 0 : 2);
   } finally {
+    // Released before restoring or removing the home so the lease files are not left open.
+    releaseSpendHome();
     client?.close();
     await endpoint.stop(true);
     await upstream.stop(true);
diff --git a/tests/responses/responses-freeform-wrapper-keys.test.ts b/tests/responses/responses-freeform-wrapper-keys.test.ts
new file mode 100644
index 00000000000..8416692c0d8
--- /dev/null
+++ b/tests/responses/responses-freeform-wrapper-keys.test.ts
@@ -0,0 +1,169 @@
+import { describe, expect, test } from "bun:test";
+import { unwrapFreeformToolInput } from "../../src/responses/apply-patch-envelope";
+import { MAX_FREEFORM_WRAPPER_SCAN_CHARS } from "../../src/responses/freeform-wrapper-scan";
+import { progressiveFreeformInput } from "../../src/responses/progressive-freeform-input";
+
+/**
+ * #5151. The progressive decoder matched the buffer against the literal wrapper opening
+ * {"input":" so two spellings JSON.parse treats as the same wrapper matched nothing at all:
+ * a canonical key arriving after another property, and one written with a JSON escape. Both
+ * streamed the raw object as deltas and then completed as the unwrapped body, which is the
+ * delta/completion disagreement #5047 closed for compact wrappers and #5129 for whitespace.
+ *
+ * These cases live in their own file rather than in the two transport suites that exercise the
+ * same decoder: it is shared by the direct bridge and the routed restoration, so asserting it
+ * once here keeps one contract instead of duplicating it into two capped files.
+ */
+
+/**
+ * The delta each prefix publishes, using the rule BOTH callers apply: hold on null, and emit
+ * only the suffix of a value that still starts with what was already emitted. Nothing may
+ * rewind, so the concatenation is exactly what a client received.
+ *
+ * A value that does NOT extend what was emitted is recorded rather than quietly dropped. Both
+ * callers drop it, which is what makes the transports safe, but a test that only mirrored that
+ * would pass while the decoder proposed a retraction on some intermediate prefix. The proposal
+ * is the defect; the callers refusing it is the backstop.
+ */
+function stream(body: string, toolName: string): { deltas: string[]; retractions: string[] } {
+  const deltas: string[] = [];
+  const retractions: string[] = [];
+  let emitted = "";
+  for (let end = 1; end <= body.length; end++) {
+    const full = progressiveFreeformInput(body.slice(0, end), toolName);
+    if (full === null) continue;
+    if (!full.startsWith(emitted)) {
+      retractions.push(full);
+      continue;
+    }
+    if (full.length === emitted.length) continue;
+    deltas.push(full.slice(emitted.length));
+    emitted = full;
+  }
+  return { deltas, retractions };
+}
+
+const emissions = (body: string, toolName: string) => stream(body, toolName).deltas;
+const published = (body: string, toolName: string) => emissions(body, toolName).join("");
+
+describe("freeform wrapper keys the literal matcher could not see", () => {
+  // `progressive` records whether the value can be previewed before the object closes. It is
+  // the liveness half of the contract and it is asserted, because holding everything until
+  // completion would satisfy the agreement half on its own while quietly ending progressive
+  // streaming for the wrappers this change exists to preview.
+  const REORDERED_AND_ESCAPED: Array<[label: string, body: string, progressive: boolean]> = [
+    ["a scalar property before the canonical key", '{"metadata":1,"input":"cmd"}', true],
+    ["an escaped canonical key", '{"\\u0069nput":"cmd"}', true],
+    ["a nested preceding value", '{"a":[1,{"b":null},true],"input":"cmd"}', true],
+    ["both spellings at once", '{"note":"x","\\u0069nput":"cmd"}', true],
+    ["a preceding value holding a brace inside a string", '{"note":"}","input":"cmd"}', true],
+    ["whitespace around a reordered key", '{ "metadata" : 1 , "input" : "cmd" }', true],
+    // A fallback key only unwraps as the SINGLE string field, so a second field can still
+    // arrive and no prefix decides it. It is the one case here that must NOT preview.
+    ["an escaped fallback key", '{"\\u0063ode":"cmd"}', false],
+  ];
+
+  test("a reordered or escaped wrapper agrees with completion at every split", () => {
+    for (const [label, body, progressive] of REORDERED_AND_ESCAPED) {
+      const { deltas, retractions } = stream(body, "exec");
+      // The authoritative answer, read the way the completed item is read.
+      expect({ label, completed: unwrapFreeformToolInput(body, "exec") })
+        .toEqual({ label, completed: "cmd" });
+      // Characterwise, which covers every split boundary at once.
+      expect({ label, streamed: deltas.join("") }).toEqual({ label, streamed: "cmd" });
+      // And as one chunk, which is how a non-streaming upstream delivers it.
+      expect({ label, whole: progressiveFreeformInput(body, "exec") })
+        .toEqual({ label, whole: "cmd" });
+      // No prefix may even PROPOSE a value that does not extend what was already published.
+      expect({ label, retractions }).toEqual({ label, retractions: [] });
+      // A decidable wrapper previews as it arrives; an undecidable one publishes once.
+      expect({ label, multiple: deltas.length > 1 }).toEqual({ label, multiple: progressive });
+
+      // The defect was not a wrong total but wrapper syntax reaching the client and then being
+      // removed at completion, so assert the published bytes rather than only their sum.
+      for (const delta of deltas) {
+        expect({ label, delta, leaked: delta.includes("{") || delta.includes('"') })
+          .toEqual({ label, delta, leaked: false });
+      }
+    }
+  });
+
+  test("bodies that are not wrappers keep their original bytes", () => {
+    // Two string fallback fields: completion declines to guess. A non-string canonical value is
+    // not a wrapper either. Both must reach the client byte-exact, not as a repaired body.
+    for (const body of ['{"code":"a","script":"b"}', '{"code":1}', '{"input":1}', "{}"]) {
+      expect({ body, completed: unwrapFreeformToolInput(body, "exec") })
+        .toEqual({ body, completed: body });
+      const { deltas, retractions } = stream(body, "exec");
+      expect({ body, streamed: deltas.join("") }).toEqual({ body, streamed: body });
+      expect({ body, retractions }).toEqual({ body, retractions: [] });
+    }
+
+    // Tool-name negative: code is a fallback key only for the tools that own the grammar, so
+    // the same object is an ordinary body for any other freeform tool.
+    expect(unwrapFreeformToolInput('{"code":"a"}', "")).toBe('{"code":"a"}');
+    expect(published('{"code":"a"}', "")).toBe('{"code":"a"}');
+
+    // Text that opens like an object but is not JSON is decidable immediately and must not be
+    // held: ordinary code-mode JavaScript reaches this function.
+    const program = "{ let x = 1; return x; }";
+    expect(published(program, "exec")).toBe(program);
+    expect(emissions(program, "exec").length).toBeGreaterThan(1);
+  });
+
+  test("canonical input and plain bodies stay progressive", () => {
+    // Holding an undecided object must not cost the progressive streaming these paths provide.
+    const canonical = '{"input":"line one\\nline two"}';
+    expect(emissions(canonical, "exec").length).toBeGreaterThan(1);
+    expect(published(canonical, "exec")).toBe("line one\nline two");
+    expect(emissions("text(1)", "exec").length).toBeGreaterThan(1);
+    expect(published("text(1)", "exec")).toBe("text(1)");
+  });
+
+  test("a preceding value larger than the scan budget holds rather than guessing", () => {
+    // Classification is bounded so the work per delta cannot grow with the arguments. Past the
+    // bound nothing is published at all, and the wrapper is still unwrapped by the
+    // authoritative completion: the budget costs preview, never agreement.
+    const pad = "x".repeat(MAX_FREEFORM_WRAPPER_SCAN_CHARS + 1);
+    const body = '{"pad":"' + pad + '","input":"cmd"}';
+    expect(unwrapFreeformToolInput(body, "exec")).toBe("cmd");
+    expect(stream(body, "exec")).toEqual({ deltas: [], retractions: [] });
+
+    // Braces inside that oversized value must not tempt a release either. Reading the whole
+    // buffer on every delta whose last character happens to be a brace is the quadratic cost
+    // the bound exists to prevent, and a prefix ending in one is not a complete object.
+    const braces = "}".repeat(MAX_FREEFORM_WRAPPER_SCAN_CHARS + 1);
+    const braced = '{"pad":"' + braces + '","input":"cmd"}';
+    expect(unwrapFreeformToolInput(braced, "exec")).toBe("cmd");
+    expect(stream(braced, "exec")).toEqual({ deltas: [], retractions: [] });
+
+    // The same object under the bound still resolves, so the bound is what changed the answer
+    // and not the shape: this is the identical body with a value the scan can walk.
+    const small = '{"pad":"}}}}","input":"cmd"}';
+    expect(published(small, "exec")).toBe("cmd");
+  });
+
+  test("a fenced body inside a reordered wrapper still publishes nothing", () => {
+    // The fence hold is decided on the DECODED value, so reaching the canonical key through a
+    // reordered object must not let fence bytes out that completion strips.
+    const fence = "\u0060\u0060\u0060";
+    const body = JSON.stringify({ metadata: 1, input: fence + "js\nconst x = 1;\n" + fence });
+    expect(unwrapFreeformToolInput(body, "exec")).toBe("const x = 1;");
+    expect(published(body, "exec")).toBe("");
+  });
+
+  test("the documented preview limits are unchanged by reordering", () => {
+    // A duplicate key: JSON.parse keeps the last one after the first was already streamed.
+    // Closing this means holding every canonical wrapper until it parses, which is the
+    // progressive streaming the first case above requires.
+    const duplicate = '{"metadata":1,"input":"first","input":"second"}';
+    expect(published(duplicate, "exec")).toBe("first");
+    expect(unwrapFreeformToolInput(duplicate, "exec")).toBe("second");
+
+    // A wrapper that turns invalid after the preview committed: the preview stops at the last
+    // decodable character and completion keeps the raw text. No rewind, nothing invented.
+    const lateInvalid = '{"metadata":1,"input":"safe\\q"}';
+    expect(published(lateInvalid, "exec")).toBe("safe");
+    expect(unwrapFreeformToolInput(lateInvalid, "exec")).toBe(lateInvalid);
+  });
+});
diff --git a/tests/responses/responses-function-tool-repair.test.ts b/tests/responses/responses-function-tool-repair.test.ts
index 2f9343cd3d2..599e9cd9fa9 100644
--- a/tests/responses/responses-function-tool-repair.test.ts
+++ b/tests/responses/responses-function-tool-repair.test.ts
@@ -1,6 +1,6 @@
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import {
   collectFunctionCallRepairSchemas,
   repairFunctionCalls,
@@ -10,6 +10,18 @@ import { createResponsesFunctionToolRepairBlockRewrite } from "../../src/server/
 import { createTranslatorBudget, TranslatorBudgetExceededError } from "../../src/lib/translator-budget";
 import { sseDataPayload } from "../../src/server/sse-payload-rewrite";
 import { currentTurnWireToolCatalogBody } from "../../src/server/responses-undeclared-tool-guard";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
+afterEach(() => {
+  // Release first so a failed dispatch cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 const parameters = { type: "object", properties: {
   cell_id: { type: "string" }, yield_time_ms: { type: "integer" },
@@ -391,6 +403,7 @@ test("native Responses JSON/SSE and replay share the original function schema re
         method: "POST", headers: { "content-type": "application/json" },
         body: JSON.stringify({ model: "fixture/grok-probe", stream, input: [{ role: "user", content: "synthetic" }], tools, ...extra }),
       });
+      takeSpendHome();
       const response = await handleResponses(request(), config, { model: "", provider: "" });
       expect(response.status).toBe(200);
       const raw = await response.text();
diff --git a/tests/responses/responses-hosted-tool-min-spread.test.ts b/tests/responses/responses-hosted-tool-min-spread.test.ts
new file mode 100644
index 00000000000..316a8539898
--- /dev/null
+++ b/tests/responses/responses-hosted-tool-min-spread.test.ts
@@ -0,0 +1,97 @@
+import { describe, expect, test } from "bun:test";
+import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
+import { preferConfiguredHostedTools } from "../../src/adapters/openai-responses/image-gen";
+import type { OcxProviderConfig } from "../../src/types";
+import { withTestTranslatorBudget } from "../helpers/translator-budget";
+
+/**
+ * #5132. The pre-fix additional_tools restoration collected every stripped container index
+ * in a Set and spread it into Math.min. A request carrying enough additional_tools containers
+ * exceeds the argument-count limit and throws RangeError, so an attacker-sized request becomes
+ * a denial of service. Indices arrive in order, so the tracked first index is the minimum.
+ *
+ * This case lives in its own file rather than in
+ * tests/responses/openai-responses-passthrough.test.ts: that file is exactly at its
+ * file-size ratchet cap (4,809 lines in tests/fixtures/file-size-baseline.json), and the
+ * cap only ever moves downward, so appending there would fail the ratchet for every later
+ * pull request.
+ */
+
+const createResponsesPassthroughAdapter = (
+  ...args: Parameters<typeof createResponsesPassthroughAdapterProduction>
+) => withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args));
+
+describe("OpenAI Responses hosted-tool name conflicts", () => {
+  const keyedProvider = {
+    adapter: "openai-responses",
+    baseUrl: "https://api.openai.example/v1",
+    authMode: "key" as const,
+    apiKey: "sk-test",
+  };
+  const meta = { headers: new Headers({ authorization: "Bearer token" }) };
+
+  test("additional_tools restoration does not spread stripped indices into Math.min", () => {
+    // The pre-fix code collected every stripped container index in a Set and spread it
+    // into Math.min. A request carrying enough additional_tools containers exceeds the
+    // argument-count limit and throws RangeError — an attacker-sized request becomes a
+    // denial of service. Indices arrive in order, so the tracked first index is the min.
+    const adapter = createResponsesPassthroughAdapter({
+      ...keyedProvider,
+      modelPreferHostedTools: { "provider-image-model": ["image_generation"] },
+    });
+    const input = Array.from({ length: 3 }, () => ({
+      type: "additional_tools",
+      tools: [{ type: "namespace", name: "image_gen", tools: [] }],
+    }));
+    const originalMin = Math.min;
+    Math.min = (...values: number[]) => {
+      if (values.length > 2) throw new RangeError("too many arguments");
+      return originalMin(...values);
+    };
+
+    try {
+      expect(() => adapter.buildRequest({
+        modelId: "provider-image-model",
+        context: { messages: [] },
+        stream: true,
+        options: {},
+        _rawBody: { model: "provider-image-model", input },
+      }, meta)).not.toThrow();
+    } finally {
+      Math.min = originalMin;
+    }
+  });
+
+  test("the hosted declaration is restored into the first stripped container only", () => {
+    // The restoration path claims two things: the declaration lands in the FIRST stripped
+    // container, and it lands exactly once. The Math.min case above proves neither, because
+    // every container in it is stripped — index 0 and "first stripped" are the same number
+    // there, so a regression that replaced the scalar with a literal 0 would still pass it.
+    // Here the first container is not a carrier and the second carries nothing to strip, so
+    // the first stripped index is 2 and the two claims become separable.
+    const provider = {
+      modelPreferHostedTools: { "provider-image-model": ["image_generation"] },
+    } as unknown as OcxProviderConfig;
+    const execTool = { type: "function", name: "exec_command", parameters: {} };
+    const imageGenTool = { type: "function", name: "image_gen.imagegen", parameters: {} };
+    const next = preferConfiguredHostedTools({
+      model: "provider-image-model",
+      input: [
+        { type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] },
+        { type: "additional_tools", tools: [execTool] },
+        { type: "additional_tools", tools: [imageGenTool, execTool] },
+        { type: "additional_tools", tools: [imageGenTool] },
+      ],
+    }, provider, "provider-image-model") as {
+      input: Array<{ type: string; tools?: Array<{ type: string; name?: string }> }>;
+    };
+
+    expect(next.input[1]?.tools).toEqual([execTool]);
+    expect(next.input[2]?.tools).toEqual([execTool, { type: "image_generation" }]);
+    expect(next.input[3]?.tools).toEqual([]);
+    const hosted = next.input
+      .flatMap(item => item.tools ?? [])
+      .filter(tool => tool.type === "image_generation");
+    expect(hosted).toHaveLength(1);
+  });
+});
diff --git a/tests/responses/responses-image-gen-repair.test.ts b/tests/responses/responses-image-gen-repair.test.ts
index f5f358081ea..dfafde3725d 100644
--- a/tests/responses/responses-image-gen-repair.test.ts
+++ b/tests/responses/responses-image-gen-repair.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import {
   imageGenToolCallAliases,
   relaySseWithImageGenCallRestore as relaySseWithImageGenCallRestoreProduction,
@@ -8,6 +8,18 @@ import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
 import { finalizeTranslatorBudgetResponse } from "../../src/lib/translator-budget";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
+afterEach(() => {
+  // Release first so a failed dispatch cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 function relaySseWithImageGenCallRestore(
   body: ReadableStream<Uint8Array>,
@@ -185,6 +197,7 @@ describe("Responses image-gen call restoration", () => {
     } as OcxConfig;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -245,6 +258,7 @@ describe("Responses image-gen call restoration", () => {
     } as OcxConfig;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -317,6 +331,7 @@ describe("Responses image-gen call restoration", () => {
     } as OcxConfig;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/responses/responses-inbound-store-default.test.ts b/tests/responses/responses-inbound-store-default.test.ts
index 23bcc6aee10..7f370de68c2 100644
--- a/tests/responses/responses-inbound-store-default.test.ts
+++ b/tests/responses/responses-inbound-store-default.test.ts
@@ -18,6 +18,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { CODEX_FORWARD_BASE_URL } from "../../src/providers/openai-tiers";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 function providerConfig(overrides: Partial<OcxProviderConfig> = {}): OcxConfig {
   return {
@@ -36,7 +37,13 @@ function providerConfig(overrides: Partial<OcxProviderConfig> = {}): OcxConfig {
 
 describe("/v1/responses defaults store:false only for the canonical forward Codex backend", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  let releaseSpendHome: (() => void) | undefined;
+  afterEach(() => {
+    // Release first so a failed dispatch cannot leak writer ownership into the next case.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   function captureUpstream(): { urls: string[]; bodies: string[] } {
     const urls: string[] = [];
@@ -61,7 +68,9 @@ describe("/v1/responses defaults store:false only for the canonical forward Code
     store: unknown,
   ): Promise<{ url: string; body: Record<string, unknown> | null }> {
     const { urls, bodies } = captureUpstream();
-    await handleResponses(
+    // Direct dispatch needs the writer lease to prevent spend-ledger ownership failures.
+    releaseSpendHome = acquireOwnedSpendHome();
+    const turn = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -75,6 +84,10 @@ describe("/v1/responses defaults store:false only for the canonical forward Code
       config,
       { model: "", provider: "" },
     );
+    // Every row here asks for a stream and then reads only the captured upstream REQUEST, so
+    // the turn's own body was left live. Draining it lets the parser, the completion callbacks
+    // and the lifetime cleanup finish before the teardown below hands back the writer lease.
+    await turn.text();
     let parsed: Record<string, unknown> | null = null;
     try { parsed = bodies[0] ? (JSON.parse(bodies[0]) as Record<string, unknown>) : null; } catch { parsed = null; }
     return { url: urls[0] ?? "", body: parsed };
diff --git a/tests/responses/responses-legacy-dotted-tool-name-repair.test.ts b/tests/responses/responses-legacy-dotted-tool-name-repair.test.ts
new file mode 100644
index 00000000000..b0c3eed9946
--- /dev/null
+++ b/tests/responses/responses-legacy-dotted-tool-name-repair.test.ts
@@ -0,0 +1,158 @@
+/**
+ * #5095, recovery half. The emit-side fix stops new `default.`-prefixed call names from being
+ * created; a conversation that already contains one is still permanently unusable, because the
+ * upstream refuses EVERY later request that replays the item:
+ *
+ *   Invalid 'input[877].name': string does not match pattern '^[a-zA-Z0-9_-]+$'.
+ *
+ * That is what killed a side chat opened from an 11h43m parent task, on a plain OpenAI model, from
+ * history a routed provider had damaged. These pin what may and may not be rewritten on the way
+ * out. The line is fail-closed in both directions: a dotted spelling the caller's own catalog
+ * declares is a real tool identity and is never stripped, an ambiguous suffix is left alone, and
+ * only a suffix naming exactly one declared tool or one of the bounded code-mode helper spellings
+ * resolves. There is deliberately no "strip everything before the first dot" rule.
+ */
+import { describe, expect, test } from "bun:test";
+import { repairLegacyDottedToolCallNames } from "../../src/responses/legacy-dotted-tool-name-repair";
+
+const DAMAGED_VIEW_IMAGE = { type: "function_call", call_id: "call_a", name: "default.view_image", arguments: "{}" };
+const DAMAGED_APPLY_PATCH = { type: "function_call", call_id: "call_b", name: "default.apply_patch", arguments: "{}" };
+
+/** Codex code mode: one freeform `exec`; the helpers are nested and never declared. */
+const CODE_MODE_TOOLS = [{ type: "custom", name: "exec", description: "code mode" }];
+
+/** The classic Codex catalog, where both damaged names are declared top-level tools. */
+const CLASSIC_TOOLS = [
+  { type: "function", name: "view_image", parameters: { type: "object" } },
+  { type: "custom", name: "apply_patch" },
+];
+
+function replay(tools: unknown[], input: unknown[]): Record<string, unknown> {
+  return { model: "gpt-5.6-luna", tools, input };
+}
+
+function namesAfter(body: Record<string, unknown>): unknown[] {
+  const repaired = repairLegacyDottedToolCallNames(body) as { input: Array<{ name?: unknown }> };
+  return repaired.input.map(item => item.name);
+}
+
+describe("replaying a damaged history", () => {
+  test("the two reported names are repaired under a code-mode catalog", () => {
+    expect(namesAfter(replay(CODE_MODE_TOOLS, [DAMAGED_VIEW_IMAGE, DAMAGED_APPLY_PATCH])))
+      .toEqual(["view_image", "apply_patch"]);
+  });
+
+  test("a suffix naming exactly one declared tool resolves to it", () => {
+    expect(namesAfter(replay(CLASSIC_TOOLS, [DAMAGED_VIEW_IMAGE]))).toEqual(["view_image"]);
+  });
+
+  test("a declared bare tool is found through an additional_tools catalog too", () => {
+    const body = replay([], [
+      { type: "additional_tools", tools: [{ type: "function", name: "lookup", parameters: { type: "object" } }] },
+      { type: "function_call", call_id: "call_c", name: "default.lookup", arguments: "{}" },
+    ]);
+    expect(namesAfter(body)).toEqual([undefined, "lookup"]);
+  });
+
+  test("the whole bounded helper vocabulary resolves without being declared", () => {
+    const helpers = ["exec_command", "shell_command", "write_stdin", "apply_patch", "view_image"];
+    const input = helpers.map((helper, index) => ({
+      type: "function_call", call_id: `call_${index}`, name: `default.${helper}`, arguments: "{}",
+    }));
+    expect(namesAfter(replay(CODE_MODE_TOOLS, input))).toEqual(helpers);
+  });
+
+  test("a call_id survives the rewrite, so the paired output still matches its call", () => {
+    const output = { type: "function_call_output", call_id: "call_a", output: "unsupported call: default.view_image" };
+    const repaired = repairLegacyDottedToolCallNames(
+      replay(CODE_MODE_TOOLS, [DAMAGED_VIEW_IMAGE, output]),
+    ) as { input: Array<Record<string, unknown>> };
+    expect(repaired.input[0]).toEqual({ type: "function_call", call_id: "call_a", name: "view_image", arguments: "{}" });
+    expect(repaired.input[1]).toBe(output);
+  });
+});
+
+describe("names the repair refuses to guess at", () => {
+  test("a suffix that names no declared tool and no helper is left alone", () => {
+    const damaged = { type: "function_call", call_id: "call_d", name: "default.lookup", arguments: "{}" };
+    expect(namesAfter(replay(CODE_MODE_TOOLS, [damaged]))).toEqual(["default.lookup"]);
+  });
+
+  test("a suffix claimed by two declared identities is ambiguous and is left alone", () => {
+    const body = replay([
+      { type: "namespace", name: "alpha", tools: [{ type: "function", name: "view_image", parameters: { type: "object" } }] },
+      { type: "namespace", name: "beta", tools: [{ type: "function", name: "view_image", parameters: { type: "object" } }] },
+    ], [DAMAGED_VIEW_IMAGE]);
+    expect(namesAfter(body)).toEqual(["default.view_image"]);
+  });
+
+  test("a dotted name the caller itself declared is a real identity, not damage", () => {
+    const body = replay([
+      { type: "namespace", name: "default", tools: [{ type: "function", name: "view_image", parameters: { type: "object" } }] },
+    ], [DAMAGED_VIEW_IMAGE]);
+    expect(repairLegacyDottedToolCallNames(body)).toBe(body);
+  });
+
+  test("a suffix that is itself still invalid is not a repair", () => {
+    const damaged = { type: "function_call", call_id: "call_e", name: "default.view.image", arguments: "{}" };
+    expect(namesAfter(replay(CODE_MODE_TOOLS, [damaged]))).toEqual(["default.view.image"]);
+  });
+
+  test("an item carrying an explicit namespace is not the flattened shape", () => {
+    const body = replay(CODE_MODE_TOOLS, [
+      { type: "function_call", call_id: "call_f", name: "default.view_image", namespace: "mcp__x", arguments: "{}" },
+    ]);
+    expect(repairLegacyDottedToolCallNames(body)).toBe(body);
+  });
+
+  test("a name invalid for a reason other than the legacy namespace is left alone", () => {
+    for (const name of ["view image", "view_image!", "other.view_image"]) {
+      const damaged = { type: "function_call", call_id: "call_g", name, arguments: "{}" };
+      expect(namesAfter(replay(CLASSIC_TOOLS, [damaged]))).toEqual([name]);
+    }
+  });
+});
+
+describe("the undamaged path", () => {
+  test("a history with no legacy name is returned by reference", () => {
+    const body = replay(CLASSIC_TOOLS, [
+      { type: "message", role: "user", content: [{ type: "input_text", text: "hi" }] },
+      { type: "function_call", call_id: "call_h", name: "view_image", arguments: "{\"path\":\"a.png\"}" },
+      { type: "function_call_output", call_id: "call_h", output: "ok" },
+    ]);
+    expect(repairLegacyDottedToolCallNames(body)).toBe(body);
+  });
+
+  test("a body with no input array is returned by reference", () => {
+    const body = { model: "gpt-5.6-luna", tools: CLASSIC_TOOLS };
+    expect(repairLegacyDottedToolCallNames(body)).toBe(body);
+    expect(repairLegacyDottedToolCallNames(undefined)).toBeUndefined();
+  });
+
+  test("a mixed replay repairs only the damaged item and preserves the rest by reference", () => {
+    const message = { type: "message", role: "assistant", content: [{ type: "output_text", text: "done" }] };
+    const healthy = { type: "function_call", call_id: "call_i", name: "view_image", arguments: "{\"path\":\"b.png\"}" };
+    const body = replay(CLASSIC_TOOLS, [message, DAMAGED_APPLY_PATCH, healthy]);
+    const repaired = repairLegacyDottedToolCallNames(body) as Record<string, unknown>;
+    const input = repaired.input as unknown[];
+    expect(repaired).not.toBe(body);
+    expect(input[0]).toBe(message);
+    expect(input[1]).toEqual({ type: "function_call", call_id: "call_b", name: "apply_patch", arguments: "{}" });
+    expect(input[2]).toBe(healthy);
+  });
+
+  test("the caller's tool catalog is never rewritten", () => {
+    const tools = [...CLASSIC_TOOLS, { type: "function", name: "default.reporting", parameters: { type: "object" } }];
+    const body = replay(tools, [DAMAGED_VIEW_IMAGE]);
+    const repaired = repairLegacyDottedToolCallNames(body) as Record<string, unknown>;
+    expect(repaired.tools).toBe(tools);
+  });
+
+  test("a call for a dotted tool the caller declared at top level stays that call", () => {
+    const tools = [{ type: "function", name: "default.reporting", parameters: { type: "object" } }];
+    const body = replay(tools, [
+      { type: "function_call", call_id: "call_j", name: "default.reporting", arguments: "{}" },
+    ]);
+    expect(repairLegacyDottedToolCallNames(body)).toBe(body);
+  });
+});
diff --git a/tests/responses/responses-muse-tool-name-alias.test.ts b/tests/responses/responses-muse-tool-name-alias.test.ts
index 655165d3944..30f76330d48 100644
--- a/tests/responses/responses-muse-tool-name-alias.test.ts
+++ b/tests/responses/responses-muse-tool-name-alias.test.ts
@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import { createResponsesPassthroughAdapter as createResponsesPassthroughAdapterProduction } from "../../src/adapters/openai-responses";
 import {
   buildMuseToolNameAliasPlan,
@@ -11,8 +11,20 @@ import {
 import { expandPreviousResponseInput } from "../../src/responses/state";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { withTestTranslatorBudget } from "../helpers/translator-budget";
 
+let releaseSpendHome: (() => void) | undefined;
+
+// Direct physical dispatch needs the writer lease to prevent spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
+afterEach(() => {
+  // Release first so a failed dispatch cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
+
 const createResponsesPassthroughAdapter = (...args: Parameters<typeof createResponsesPassthroughAdapterProduction>) =>
   withTestTranslatorBudget(createResponsesPassthroughAdapterProduction(...args));
 
@@ -270,6 +282,7 @@ describe("muse tool-name inbound restore through handleResponses", () => {
       }), { headers: { "content-type": "application/json" } });
     }) as typeof fetch;
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -304,6 +317,7 @@ describe("muse tool-name inbound restore through handleResponses", () => {
       return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
     }) as typeof fetch;
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -338,6 +352,7 @@ describe("muse tool-name inbound restore through handleResponses", () => {
       return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
     }) as typeof fetch;
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -389,6 +404,7 @@ describe("muse tool-name inbound restore through handleResponses", () => {
       return new Response(upstream, { headers: { "content-type": "text/event-stream" } });
     }) as typeof fetch;
     try {
+      takeSpendHome();
       const turn1 = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/responses/responses-native-main-refresh.test.ts b/tests/responses/responses-native-main-refresh.test.ts
index f70bc07f1ee..3a318cc0830 100644
--- a/tests/responses/responses-native-main-refresh.test.ts
+++ b/tests/responses/responses-native-main-refresh.test.ts
@@ -14,12 +14,14 @@ import { tryAdmitTurn } from "../../src/server/lifecycle";
 import { handleResponses, handleResponsesCompact } from "../../src/server/responses";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const originalFetch = globalThis.fetch;
 let home = "";
 let previousOcxHome: string | undefined;
 let previousCodexHome: string | undefined;
+let releaseSpendHome: (() => void) | undefined;
 const OTHER_ACCOUNT_ID = "other";
 
 function config(options: { secondAccount?: boolean } = {}): OcxConfig {
@@ -57,6 +59,8 @@ beforeEach(() => {
   previousCodexHome = process.env.CODEX_HOME;
   process.env.OPENCODEX_HOME = home;
   process.env.CODEX_HOME = home;
+  // Take the writer lease after this case installs its home so direct handler dispatch can open the spend journal.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
   clearAccountNeedsReauth(OTHER_ACCOUNT_ID);
   clearCodexUpstreamHealth();
@@ -71,6 +75,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
   clearAccountNeedsReauth(OTHER_ACCOUNT_ID);
diff --git a/tests/responses/responses-opaque-blob-recovery.test.ts b/tests/responses/responses-opaque-blob-recovery.test.ts
index a47a155f387..1fcf62d7ab4 100644
--- a/tests/responses/responses-opaque-blob-recovery.test.ts
+++ b/tests/responses/responses-opaque-blob-recovery.test.ts
@@ -14,14 +14,22 @@ import {
 } from "../../src/server/responses/core";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import { markBodyNonPersistable, rememberResponseState, previousResponseProviderState } from "../../src/responses/state";
 
 const originalFetch = globalThis.fetch;
 const originalOpenCodexHome = process.env.OPENCODEX_HOME;
 const BLOB = "provider-minted-opaque-state";
-// Synthetic Fernet-shaped data must survive the outbound ciphertext shape gate.
-const FUNCTION_OUTPUT_BLOB = `g${"A".repeat(127)}`;
+// Canonical key-independent Fernet structure; authenticity is deliberately not needed in tests.
+const FUNCTION_OUTPUT_BLOB = `${Buffer.concat([
+  Buffer.from([0x80]),
+  Buffer.alloc(8),
+  Buffer.alloc(16),
+  Buffer.alloc(16),
+  Buffer.alloc(32),
+]).toString("base64url")}==`;
+const FERNET_SHAPED_PLAINTEXT = `gAAAAA${"A".repeat(189)}`;
 const FUNCTION_OUTPUT_DECRYPT_MESSAGE = "Encrypted function output content could not be decrypted or decoded.";
 const OPENAI_BLOB_ERROR = JSON.stringify({
   error: {
@@ -66,15 +74,21 @@ const CALLER_MISMATCH_BLOB_ERROR = JSON.stringify({
 });
 
 let testDir = "";
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   testDir = mkdtempSync(join(tmpdir(), "ocx-opaque-blob-recovery-"));
   process.env.OPENCODEX_HOME = testDir;
+  // Take the writer lease after this case installs its home so direct handler dispatch can open the spend journal.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearReasoningReplayCacheForTests();
   resetThoughtSignatureReplayForTests();
 });
 
 afterEach(() => {
+  // Release before restoring or removing the home to prevent Windows removal failures and POSIX unlinked databases.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearReasoningReplayCacheForTests();
   resetThoughtSignatureReplayForTests();
@@ -363,6 +377,13 @@ function streamedFunctionOutputDecryptErrorEvent(
   );
 }
 
+function streamedFunctionOutputDecryptDetailEvent(): Response {
+  return decryptStreamResponse(
+    `event: error\ndata: ${JSON.stringify({ type: "error", detail: FUNCTION_OUTPUT_DECRYPT_MESSAGE })}\n\n`,
+    "text/event-stream",
+  );
+}
+
 function streamedSuccess(id: string): Response {
   const completed = {
     type: "response.completed",
@@ -537,6 +558,44 @@ describe("opaque blob recovery trigger", () => {
 });
 
 describe("opaque blob recovery through /v1/responses", () => {
+  test("lowers Fernet-shaped agent plaintext before native dispatch", async () => {
+    const outbound: Array<Record<string, unknown>> = [];
+    globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+      outbound.push(JSON.parse(String(init?.body)) as Record<string, unknown>);
+      return success("resp-agent-plaintext");
+    }) as typeof fetch;
+
+    const request = new Request("http://localhost/v1/responses", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-codex-parent-thread-id": "thread-agent-plaintext",
+        authorization: "Bearer caller-codex-token",
+      },
+      body: JSON.stringify({
+        model: "gpt-5.5",
+        stream: false,
+        store: false,
+        input: [{
+          type: "agent_message",
+          author: "/root/child_task",
+          recipient: "/root",
+          content: [{ type: "encrypted_content", encrypted_content: FERNET_SHAPED_PLAINTEXT }],
+        }],
+      }),
+    });
+
+    const response = await handleResponses(request, nativeConfig(), { model: "", provider: "" });
+    expect(response.status).toBe(200);
+    await response.text();
+    expect(outbound).toHaveLength(1);
+    expect(outbound[0]?.input).toEqual([{
+      type: "message",
+      role: "user",
+      content: [{ type: "input_text", text: FERNET_SHAPED_PLAINTEXT }],
+    }]);
+  });
+
   test("recovers a zero-output streamed function-output decrypt failure before client relay", async () => {
     const outbound: Array<Record<string, unknown>> = [];
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
@@ -782,6 +841,27 @@ describe("opaque blob recovery through /v1/responses", () => {
     expect(retriedInput?.at(1)).toEqual(recoveredFunctionOutput());
   });
 
+  test("recovers a WebSocket-style detail decrypt error before client relay", async () => {
+    const outbound: Array<Record<string, unknown>> = [];
+    globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+      outbound.push(JSON.parse(String(init?.body)) as Record<string, unknown>);
+      return outbound.length === 1
+        ? streamedFunctionOutputDecryptDetailEvent()
+        : streamedSuccess("resp-stream-detail-recovered");
+    }) as typeof fetch;
+
+    const logCtx: RequestLogContext = { model: "", provider: "" };
+    const response = await handleResponses(functionOutputRequest(true), config(), logCtx);
+    const body = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(body).toContain("response.completed");
+    expect(body).not.toContain(FUNCTION_OUTPUT_DECRYPT_MESSAGE);
+    expect(outbound).toHaveLength(2);
+    expect(JSON.stringify(outbound[1])).not.toContain(FUNCTION_OUTPUT_BLOB);
+    expect(logCtx.activeAttempt?.recoveryKinds).toEqual(["opaque-blob-rejection"]);
+  });
+
   for (const streamMode of ["legacy-tee", "eager-relay"] as const) {
     test(`preserves non-decrypt failed SSE with encrypted history (${streamMode})`, async () => {
       const failed = { type: "response.failed", response: {
diff --git a/tests/responses/responses-passthrough-transient-policy.test.ts b/tests/responses/responses-passthrough-transient-policy.test.ts
index c598ac4fa1c..77bc00487fe 100644
--- a/tests/responses/responses-passthrough-transient-policy.test.ts
+++ b/tests/responses/responses-passthrough-transient-policy.test.ts
@@ -175,3 +175,10 @@ describe("a configured ladder is bounded by the request budget", () => {
     expect(budget.reserveSpent).toBe(false);
   });
 });
+
+  const goPacked = dense(readResponsesCoreModule("passthrough-dispatch.ts"));
+describe("the Go destination replays ambiguous resets on the initial send", () => {
+  test("replaySafe is destination-scoped to exactly one leg", () => {
+    expect(occurrences(goPacked, "replaySafe:isOpenCodeGoDestination(route.provider)")).toBe(1);
+  });
+});
diff --git a/tests/responses/responses-pool-401-refresh.test.ts b/tests/responses/responses-pool-401-refresh.test.ts
index b1043cc2dd4..2fc4409c130 100644
--- a/tests/responses/responses-pool-401-refresh.test.ts
+++ b/tests/responses/responses-pool-401-refresh.test.ts
@@ -33,6 +33,7 @@ import {
   encryptedInput,
   recoverySse,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /**
@@ -51,6 +52,7 @@ const originalFetch = globalThis.fetch;
 let home = "";
 let previousOcxHome: string | undefined;
 let previousCodexHome: string | undefined;
+let releaseSpendHome: (() => void) | undefined;
 
 function config(options: { secondAccount?: boolean } = {}): OcxConfig {
   return {
@@ -306,6 +308,8 @@ beforeEach(() => {
   previousCodexHome = process.env.CODEX_HOME;
   process.env.OPENCODEX_HOME = home;
   process.env.CODEX_HOME = home;
+  // Direct handler dispatches need the writer lease that startServer normally holds.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearAccountNeedsReauth(ACCOUNT_ID);
   clearAccountNeedsReauth(OTHER_ACCOUNT_ID);
   clearCodexUpstreamHealth();
@@ -316,6 +320,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearCompactHandoffRoutesForTests();
   clearAccountNeedsReauth(ACCOUNT_ID);
diff --git a/tests/responses/responses-preview-main-read-fence.test.ts b/tests/responses/responses-preview-main-read-fence.test.ts
index b0156293459..d7380c778d2 100644
--- a/tests/responses/responses-preview-main-read-fence.test.ts
+++ b/tests/responses/responses-preview-main-read-fence.test.ts
@@ -40,6 +40,7 @@ import {
   encryptedInput,
   recoverySse,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /**
@@ -184,15 +185,22 @@ async function postSpawn(
   const requestHeaders = new Headers(headers);
   requestHeaders.set("content-type", "application/json");
   requestHeaders.set("x-openai-subagent", "collab_spawn");
-  const response = await handleResponses(new Request("http://localhost/v1/responses", {
-    method: "POST",
-    headers: requestHeaders,
-    body: JSON.stringify({ model, input, stream: false }),
-  }), config, logCtx, options);
-  // handleResponses owns its translator budget through the returned body lifecycle. Draining the
-  // body also lets completed Responses schedule their state write before afterEach cancels it.
-  await response.arrayBuffer();
-  return response;
+  // Acquire on this case's installed home so direct dispatch can open the shared spend journal.
+  const releaseSpendHome = acquireOwnedSpendHome();
+  try {
+    const response = await handleResponses(new Request("http://localhost/v1/responses", {
+      method: "POST",
+      headers: requestHeaders,
+      body: JSON.stringify({ model, input, stream: false }),
+    }), config, logCtx, options);
+    // handleResponses owns its translator budget through the returned body lifecycle. Draining the
+    // body also lets completed Responses schedule their state write before afterEach cancels it.
+    await response.arrayBuffer();
+    return response;
+  } finally {
+    // Release before afterEach removes this home to prevent Windows removal failures.
+    releaseSpendHome();
+  }
 }
 
 beforeEach(() => {
diff --git a/tests/responses/responses-reasoning-effort-downgrade.test.ts b/tests/responses/responses-reasoning-effort-downgrade.test.ts
index ee18288fce7..e609d2f6e80 100644
--- a/tests/responses/responses-reasoning-effort-downgrade.test.ts
+++ b/tests/responses/responses-reasoning-effort-downgrade.test.ts
@@ -6,6 +6,7 @@ import { handleResponses } from "../../src/server/responses/core";
 import { resetReasoningMetadataCachesForTests } from "../../src/providers/reasoning-metadata";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 /**
  * Rejected-rung learning on the request path: a rung the catalog advertises can still be refused
@@ -27,6 +28,7 @@ const REFUSAL = JSON.stringify({
 const UNRELATED = JSON.stringify({ error: { type: "invalid_request_error", message: "Invalid upload request." } });
 
 let testDir = "";
+let releaseSpendHome: (() => void) | undefined;
 
 function writeSnapshot(values: string[]): void {
   writeFileSync(join(testDir, "reasoning-metadata-cache.json"), JSON.stringify({
@@ -101,10 +103,15 @@ function success(): Response {
 beforeEach(() => {
   testDir = mkdtempSync(join(tmpdir(), "ocx-reasoning-downgrade-"));
   process.env.OPENCODEX_HOME = testDir;
+  // Direct handler dispatches need the writer lease that startServer normally holds.
+  releaseSpendHome = acquireOwnedSpendHome();
   resetReasoningMetadataCachesForTests();
 });
 
 afterEach(() => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   resetReasoningMetadataCachesForTests();
   if (originalOpenCodexHome === undefined) delete process.env.OPENCODEX_HOME;
diff --git a/tests/responses/responses-reasoning-summary-passthrough.test.ts b/tests/responses/responses-reasoning-summary-passthrough.test.ts
index ab6e099bcc7..dfebadfd066 100644
--- a/tests/responses/responses-reasoning-summary-passthrough.test.ts
+++ b/tests/responses/responses-reasoning-summary-passthrough.test.ts
@@ -3,6 +3,9 @@ import { providerConfigSeed } from "../../src/providers/derive";
 import { getProviderRegistryEntry } from "../../src/providers/registry";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
 
 /**
  * The passthrough relay for DeepSeek's native /responses endpoint emits
@@ -59,6 +62,8 @@ async function runHandleResponses(body: Record<string, unknown>, upstreamBody: u
     { status: 200, headers: { "content-type": contentType } },
   )) as typeof fetch;
   const config = { providers: { deepseek: deepseekSeed() } } as unknown as OcxConfig;
+  // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+  releaseSpendHome = acquireOwnedSpendHome();
   return handleResponses(
     new Request("http://localhost/v1/responses", {
       method: "POST",
@@ -73,7 +78,12 @@ async function runHandleResponses(body: Record<string, unknown>, upstreamBody: u
 
 describe("passthrough reasoning summary rewrite honors hideThinkingSummary", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Release the lease before later teardown can replace the preload sandbox home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   test("SSE: hidden thinking stays on the content channel", async () => {
     // No reasoning.summary in the request -> parseRequest sets hideThinkingSummary.
diff --git a/tests/responses/responses-self-named-namespace-scrub.test.ts b/tests/responses/responses-self-named-namespace-scrub.test.ts
index df187d48d1e..410ed394bac 100644
--- a/tests/responses/responses-self-named-namespace-scrub.test.ts
+++ b/tests/responses/responses-self-named-namespace-scrub.test.ts
@@ -10,9 +10,18 @@ import { afterEach, expect, test } from "bun:test";
 import { handleResponses } from "../../src/server/responses";
 import { scrubSelfNamedToolCallNamespace } from "../../src/server/responses-self-named-namespace-scrub";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
-afterEach(() => { globalThis.fetch = originalFetch; });
+let releaseSpendHome: (() => void) | undefined;
+// Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  globalThis.fetch = originalFetch;
+});
 
 function forwardConfig(): OcxConfig {
   return {
@@ -79,6 +88,7 @@ test("a self-named namespace on a passthrough custom_tool_call is scrubbed befor
     status: 200, headers: { "content-type": "text/event-stream" },
   })) as typeof fetch;
 
+  takeSpendHome();
   const res = await handleResponses(request(), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -116,6 +126,7 @@ test("a self-named namespace declared by the current turn is preserved", async (
     ],
   };
 
+  takeSpendHome();
   const res = await handleResponses(request(body), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -143,6 +154,7 @@ test("the reserved functions namespace does not create a same-name collision", a
     ],
   };
 
+  takeSpendHome();
   const res = await handleResponses(request(body), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -155,6 +167,7 @@ test("a self-named namespace on a passthrough bare function_call is scrubbed", a
     status: 200, headers: { "content-type": "text/event-stream" },
   })) as typeof fetch;
 
+  takeSpendHome();
   const res = await handleResponses(request(), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -178,6 +191,7 @@ test("a Chat-shaped function declaration still authorizes the bare function scru
     status: 200, headers: { "content-type": "text/event-stream" },
   })) as typeof fetch;
 
+  takeSpendHome();
   const res = await handleResponses(request(chatShaped), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -214,6 +228,7 @@ test("tool_choice for a namespaced custom tool cannot authorize a colliding bare
     ],
   };
 
+  takeSpendHome();
   const res = await handleResponses(request(body), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -248,6 +263,7 @@ test("mixed custom and function collisions are scoped to the response item type"
     ],
   };
 
+  takeSpendHome();
   const res = await handleResponses(request(body), forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const text = await res.text();
@@ -271,6 +287,7 @@ test("a genuine MCP namespace on a passthrough call is left alone", async () =>
     status: 200, headers: { "content-type": "text/event-stream" },
   })) as typeof fetch;
 
+  takeSpendHome();
   const res = await handleResponses(request(), forwardConfig(), { model: "", provider: "" });
   const text = await res.text();
   expect(text).toContain('"namespace":"mcp__docs"');
@@ -287,6 +304,7 @@ test("the bounded JSON (stream:false) passthrough path scrubs the same shape (#3
     headers: { "content-type": "application/json", authorization: "Bearer test", "chatgpt-account-id": "acct" },
     body: JSON.stringify({ ...requestBody, stream: false }),
   });
+  takeSpendHome();
   const res = await handleResponses(req, forwardConfig(), { model: "", provider: "" });
   expect(res.status).toBe(200);
   const body = await res.json() as { output: Array<Record<string, unknown>> };
diff --git a/tests/responses/responses-send-budget-counts.test.ts b/tests/responses/responses-send-budget-counts.test.ts
index 10b08864f36..b97e6f57832 100644
--- a/tests/responses/responses-send-budget-counts.test.ts
+++ b/tests/responses/responses-send-budget-counts.test.ts
@@ -8,6 +8,15 @@ import { handleResponses } from "../../src/server/responses/core";
 import { COMBO_TARGET_BASE_SENDS, comboExecutionBudgetPolicy } from "../../src/server/responses/core-combo";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
+import { DEVIN_API_SERVER } from "../../src/adapters/devin";
+import { setCachedCatalogForTests } from "../../src/adapters/devin/cloud-direct/catalog";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { saveCredential } from "../../src/oauth/store";
+import { createRequestExecutionBudget } from "../../src/lib/request-execution-budget";
 
 /**
  * One logical request, one send budget -- asserted as a COUNT, because the defect in #4546 is a
@@ -23,6 +32,16 @@ import type { OcxConfig } from "../../src/types";
  */
 const originalFetch = globalThis.fetch;
 
+// Every dispatching row below calls the handler directly, so it takes the spend-journal writer
+// lease that startServer would have taken for it. Per row rather than per file: two rows install
+// their own OPENCODEX_HOME, and a lease is bound to the directory in effect when it was taken.
+// The teardown drop is a backstop for a row that throws mid-assertion, because a lease left
+// behind makes the NEXT row's different home read as an ownership conflict rather than as this
+// row's failure.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome = acquireOwnedSpendHome(); };
+const dropSpendHome = (): void => { releaseSpendHome?.(); releaseSpendHome = undefined; };
+
 beforeEach(() => {
   clearComboSelectionState();
   clearComboTargetCooldowns();
@@ -30,7 +49,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  dropSpendHome();
   globalThis.fetch = originalFetch;
+  setCachedCatalogForTests(null);
   clearComboSelectionState();
   clearComboTargetCooldowns();
   clearKeyCooldowns();
@@ -91,10 +112,161 @@ const totalSends = (logCtx: RequestLogContext): number =>
   sendCounts(logCtx).reduce((sum, count) => sum + count, 0);
 
 describe("upstream sends per logical request", () => {
+  test("Devin's initial inner send is recorded once, not omitted or double-counted", async () => {
+    const previousHome = process.env.OPENCODEX_HOME;
+    const previousJwtFlag = process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const home = mkdtempSync(join(tmpdir(), "devin-send-count-"));
+    process.env.OPENCODEX_HOME = home;
+    // Taken on the home this row just installed, and dropped in its finally before that home
+    // is removed: an open lease inside a directory being deleted fails the removal on Windows.
+    takeSpendHome();
+    delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const apiKey = "devin-count-test";
+    // Devin is an OAuth-kind provider: the key the adapter ends up using is injected onto the
+    // row from the stored credential, so a config that only carries `apiKey` never routes. The
+    // credential is what makes this the path production takes.
+    await saveCredential("devin", {
+      access: apiKey,
+      refresh: apiKey,
+      expires: Number.MAX_SAFE_INTEGER,
+      source: "oauth",
+      apiBaseUrl: DEVIN_API_SERVER,
+    });
+    setCachedCatalogForTests({
+      apiKey,
+      host: DEVIN_API_SERVER,
+      fetchedAt: Date.now(),
+      byUid: new Map([["swe-2", { modelUid: "swe-2", label: "SWE-2", disabled: false }]]),
+    });
+    const urls: string[] = [];
+    globalThis.fetch = (async input => {
+      urls.push(String(input));
+      return new Response("busy", { status: 500 });
+    }) as typeof fetch;
+    const logCtx: RequestLogContext = { model: "", provider: "" };
+    const config = {
+      defaultProvider: "devin",
+      providers: {
+        devin: {
+          adapter: "devin", baseUrl: DEVIN_API_SERVER, models: ["swe-2"],
+        },
+      },
+    } as unknown as OcxConfig;
+
+    try {
+      const response = await handleResponses(responsesRequest("devin/swe-2"), config, logCtx);
+      const body = await response.text();
+
+      // Reported together, with the status, so a turn that never reaches the adapter says so
+      // instead of presenting as an empty URL list.
+      expect({
+        chatCalls: urls.filter(url => url.includes("GetChatMessage")).length,
+        totalSends: totalSends(logCtx),
+      }, `status ${response.status}: ${body.slice(0, 200)}`).toEqual({ chatCalls: 1, totalSends: 1 });
+    } finally {
+      dropSpendHome();
+      if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousHome;
+      if (previousJwtFlag === undefined) delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+      else process.env.OPENCODEX_DEVIN_SEND_USER_JWT = previousJwtFlag;
+      removeTreeWithRetry(home);
+    }
+  });
+
+  test("a Devin turn the budget refuses logs no send at the request boundary", async () => {
+    // The defect this pins lives in the outer runTurn path, not in the adapter: the attempt's
+    // first send was logged before the adapter ran, so a request with nothing left to spend
+    // recorded a send Devin never made. The direct-adapter case in tests/adapters covers the
+    // executor side; only this one can see `sendCount`. The budget is handed in already spent
+    // rather than arranged through combo arithmetic, which is how an earlier attempt at this
+    // case ended up admitting the send it meant to refuse.
+    const previousHome = process.env.OPENCODEX_HOME;
+    const previousJwtFlag = process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const home = mkdtempSync(join(tmpdir(), "devin-send-denied-"));
+    process.env.OPENCODEX_HOME = home;
+    takeSpendHome();
+    delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+    const apiKey = "devin-denied-test";
+    await saveCredential("devin", {
+      access: apiKey,
+      refresh: apiKey,
+      expires: Number.MAX_SAFE_INTEGER,
+      source: "oauth",
+      apiBaseUrl: DEVIN_API_SERVER,
+    });
+    setCachedCatalogForTests({
+      apiKey,
+      host: DEVIN_API_SERVER,
+      fetchedAt: Date.now(),
+      byUid: new Map([["swe-2", { modelUid: "swe-2", label: "SWE-2", disabled: false }]]),
+    });
+    const urls: string[] = [];
+    globalThis.fetch = (async input => {
+      urls.push(String(input));
+      return new Response(JSON.stringify({ error: { message: "busy", type: "server_error" } }), {
+        status: 502,
+        headers: { "content-type": "application/json" },
+      });
+    }) as typeof fetch;
+    const logCtx: RequestLogContext = { model: "", provider: "" };
+    const config = {
+      defaultProvider: "devin",
+      providers: { devin: { adapter: "devin", baseUrl: DEVIN_API_SERVER, models: ["swe-2"] } },
+    } as unknown as OcxConfig;
+    // The real budget factory with nothing to give: the state an earlier combo fan-out or
+    // empty-response recovery leaves behind, stated directly instead of inferred.
+    const spent = createRequestExecutionBudget({
+      maxTotalModelSends: 0,
+      baseSendAllowance: 0,
+      finalRecoveryAllowance: 0,
+      maxAlternateTargetSends: 0,
+      maxTargetTransitions: 0,
+    }, "devin-denied-initial-send");
+
+    try {
+      const response = await handleResponses(
+        responsesRequest("devin/swe-2"), config, logCtx, { sendBudget: spent },
+      );
+      const body = await response.text();
+      const attempts = logCtx.attempts ?? [];
+
+      // The attempt must EXIST and be empty. An absent attempt would satisfy a zero count
+      // without proving the refusal was recorded against the turn that was refused.
+      expect(attempts).toHaveLength(1);
+      expect({
+        // Pinned, not merely reported in the failure message. The refusal reaches the client as
+        // an error code on a buffered FAILED response, so the outer HTTP status stays 200; a
+        // reader who assumes 429 here would be describing a transport this path never uses.
+        status: response.status,
+        adapter: attempts[0]?.adapter,
+        sendCount: attempts[0]?.sendCount,
+        chatCalls: urls.filter(url => url.includes("GetChatMessage")).length,
+        totalSends: totalSends(logCtx),
+        refused: body.includes("request_send_budget_exhausted"),
+      }, `status ${response.status}: ${body.slice(0, 240)}`).toEqual({
+        status: 200,
+        adapter: "devin",
+        sendCount: 0,
+        chatCalls: 0,
+        totalSends: 0,
+        refused: true,
+      });
+    } finally {
+      dropSpendHome();
+      if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousHome;
+      if (previousJwtFlag === undefined) delete process.env.OPENCODEX_DEVIN_SEND_USER_JWT;
+      else process.env.OPENCODEX_DEVIN_SEND_USER_JWT = previousJwtFlag;
+      setCachedCatalogForTests(null);
+      removeTreeWithRetry(home);
+    }
+  });
+
   test("a 5xx streak on a single target spends the base allowance and stops", async () => {
     const upstream = alwaysFailing(502, "upstream busy");
     const logCtx: RequestLogContext = { model: "", provider: "" };
 
+    takeSpendHome();
     const response = await handleResponses(
       responsesRequest("t0/model-t0"),
       { defaultProvider: "t0", providers: { t0: transientChatProvider("t0") } } as unknown as OcxConfig,
@@ -114,6 +286,7 @@ describe("upstream sends per logical request", () => {
     const upstream = alwaysFailing(502, "upstream busy");
     const logCtx: RequestLogContext = { model: "", provider: "" };
 
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), comboOverTargets(1), logCtx);
 
     expect(response.status).toBe(502);
@@ -128,6 +301,7 @@ describe("upstream sends per logical request", () => {
     const upstream = alwaysFailing(502, "upstream busy");
     const logCtx: RequestLogContext = { model: "", provider: "" };
 
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), comboOverTargets(3), logCtx);
 
     expect(response.status).toBe(502);
@@ -158,6 +332,7 @@ describe("upstream sends per logical request", () => {
     const upstream = alwaysFailing(502, "upstream busy");
     const logCtx: RequestLogContext = { model: "", provider: "" };
 
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), comboOverTargets(13), logCtx);
 
     expect(response.status).toBe(502);
@@ -195,6 +370,7 @@ describe("ambiguous reset safety across Responses recovery", () => {
           throw Object.assign(new Error("The socket connection was closed unexpectedly."), { code: "ECONNRESET" });
         }) as typeof fetch;
         const logCtx: RequestLogContext = { model: "", provider: "" };
+        takeSpendHome();
         const response = await handleResponses(
           responsesRequest(combo ? "combo/fan" : "t0/model-t0"), config, logCtx,
         );
@@ -219,6 +395,7 @@ describe("ambiguous reset safety across Responses recovery", () => {
       throw Object.assign(new Error("connection reset by peer"), { code: "ECONNRESET" });
     }) as typeof fetch;
     const logCtx: RequestLogContext = { model: "", provider: "" };
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), comboOverTargets(2), logCtx);
     expect(response.status).toBe(429);
     expect((await response.json()).error.code).toBe("upstream_reset_replay_refused");
@@ -234,6 +411,7 @@ describe("ambiguous reset safety across Responses recovery", () => {
       sends += 1;
       throw Object.assign(new Error("reset"), { code: "ECONNRESET" });
     }) as typeof fetch;
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), config, { model: "", provider: "" });
     expect(response.status).toBe(429);
     expect((await response.json()).error.code).toBe("upstream_reset_replay_refused");
@@ -254,6 +432,7 @@ describe("ambiguous reset safety after outer recovery", () => {
       throw Object.assign(new Error("connection reset by peer"), { code: "ECONNRESET" });
     }) as typeof fetch;
     const logCtx: RequestLogContext = { model: "", provider: "" };
+    takeSpendHome();
     const response = await handleResponses(responsesRequest("combo/fan"), config, logCtx);
     expect(response.status).toBe(429);
     expect((await response.json()).error.code).toBe("upstream_reset_replay_refused");
@@ -282,6 +461,7 @@ describe("ambiguous reset safety after outer recovery", () => {
         throw Object.assign(new Error("connection reset by peer"), { code: "ECONNRESET" });
       }) as typeof fetch;
       const logCtx: RequestLogContext = { model: "", provider: "" };
+      takeSpendHome();
       const response = await handleResponses(responsesRequest("t0/model-t0"), config, logCtx);
 
       expect(response.status).toBe(429);
diff --git a/tests/responses/responses-shadow-intercept.test.ts b/tests/responses/responses-shadow-intercept.test.ts
index feafd404dfc..d5cbdd680c4 100644
--- a/tests/responses/responses-shadow-intercept.test.ts
+++ b/tests/responses/responses-shadow-intercept.test.ts
@@ -14,10 +14,17 @@ import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig } from "../../src/types";
 import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
+// Taken only by rows that reach upstream through the direct handler helper.
+const takeSpendHome = (): void => { releaseSpendHome = acquireOwnedSpendHome(); };
 
 afterEach(() => {
+  // Released first so a failed dispatch cannot leak the writer lease into the next row.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
 });
 
@@ -137,6 +144,7 @@ async function post(
 
 describe("shadow call intercept request path (issue #311)", () => {
   test("rewrites a gpt-5.6-luna helper call without overriding configured effort (#2706)", async () => {
+    takeSpendHome();
     const bodies: Array<Record<string, unknown>> = [];
     globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
       bodies.push(JSON.parse(String(init?.body ?? "{}")) as Record<string, unknown>);
@@ -157,6 +165,7 @@ describe("shadow call intercept request path (issue #311)", () => {
   });
 
   test("a self-target is a no-op instead of an intercept loop (#2706)", async () => {
+    takeSpendHome();
     const bodies: Array<Record<string, unknown>> = [];
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
@@ -183,6 +192,7 @@ describe("shadow call intercept request path (issue #311)", () => {
   });
 
   test("rewrites a gpt-5.6-luna turn request too (#1684)", async () => {
+    takeSpendHome();
     const bodies: Array<Record<string, unknown>> = [];
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async (_url: unknown, init?: RequestInit) => {
@@ -206,6 +216,7 @@ describe("shadow call intercept request path (issue #311)", () => {
   // Recording the operator-configured prefix instead of the caller's raw string removes the
   // class, rather than adding one more pattern to a deny-list.
   test("the recorded marker is the configured prefix, never the caller's raw model string", async () => {
+    takeSpendHome();
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async () => new Response(JSON.stringify({
       choices: [{ message: { role: "assistant", content: "ok" }, finish_reason: "stop" }],
@@ -222,6 +233,7 @@ describe("shadow call intercept request path (issue #311)", () => {
   });
 
   test("a configured non-default prefix is recorded as itself", async () => {
+    takeSpendHome();
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async () => new Response(JSON.stringify({
       choices: [{ message: { role: "assistant", content: "ok" }, finish_reason: "stop" }],
@@ -296,6 +308,7 @@ function chatOk(text: string): Response {
 
 describe("a combo shadow-call target enters the failover loop (#4129)", () => {
   test("a helper call rewritten to a combo hops past a 429 to the second target", async () => {
+    takeSpendHome();
     const urls: string[] = [];
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async (url: unknown) => {
@@ -327,6 +340,7 @@ describe("a combo shadow-call target enters the failover loop (#4129)", () => {
   });
 
   test("a combo whose first target intersects the source still routes as a combo", async () => {
+    takeSpendHome();
     const urls: string[] = [];
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async (url: unknown) => {
@@ -360,6 +374,7 @@ describe("a combo shadow-call target enters the failover loop (#4129)", () => {
   });
 
   test("a non-combo replacement still takes the ordinary late intercept", async () => {
+    takeSpendHome();
     const urls: string[] = [];
     const logCtx: RequestLogContext = { model: "", provider: "" };
     globalThis.fetch = (async (url: unknown) => {
diff --git a/tests/responses/responses-show-thinking-summary.test.ts b/tests/responses/responses-show-thinking-summary.test.ts
index a749518b63e..2fe5e8d5f07 100644
--- a/tests/responses/responses-show-thinking-summary.test.ts
+++ b/tests/responses/responses-show-thinking-summary.test.ts
@@ -6,6 +6,11 @@ import { providerConfigSeed } from "../../src/providers/derive";
 import { getProviderRegistryEntry } from "../../src/providers/registry";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseInheritedSpendHome: (() => void) | undefined;
+// Taken per inherited-home dispatch so mixed custom-home rows bind to their own directory.
+const takeInheritedSpendHome = (): void => { releaseInheritedSpendHome = acquireOwnedSpendHome(); };
 
 // Provider-opted visible thinking (showThinkingSummary): a provider that serves
 // genuine user-facing reasoning surfaces it on the summary channel even when the
@@ -57,9 +62,15 @@ async function runHandleResponses(body: Record<string, unknown>, seed: OcxProvid
 
 describe("showThinkingSummary provider option", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Released first so a failed row cannot leak ownership into the next sandbox case.
+    releaseInheritedSpendHome?.();
+    releaseInheritedSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   test("provider opt-in never relabels raw content as a summary", async () => {
+    takeInheritedSpendHome();
     const response = await runHandleResponses(
       { model: "deepseek-v4-flash", input: "ping", stream: true },
       shownSeed(),
@@ -70,6 +81,7 @@ describe("showThinkingSummary provider option", () => {
   });
 
   test("explicit client summary none keeps thinking hidden", async () => {
+    takeInheritedSpendHome();
     const response = await runHandleResponses(
       { model: "deepseek-v4-flash", input: "ping", stream: true, reasoning: { summary: "none" } },
       shownSeed(),
@@ -80,6 +92,7 @@ describe("showThinkingSummary provider option", () => {
   });
 
   test("without the provider option, omitted summary stays hidden", async () => {
+    takeInheritedSpendHome();
     const seed = { ...providerConfigSeed(getProviderRegistryEntry("deepseek")!), apiKey: "sk-test" } as OcxProviderConfig;
     const response = await runHandleResponses(
       { model: "deepseek-v4-flash", input: "ping", stream: true },
@@ -101,6 +114,8 @@ describe("showThinkingSummary provider option", () => {
     const home = mkdtempSync(join(tmpdir(), "ocx-show-thinking-"));
     const prevHome = process.env.OPENCODEX_HOME;
     process.env.OPENCODEX_HOME = home;
+    // Taken after this row installs its home so the direct dispatch owns that journal.
+    const releaseSpendHome = acquireOwnedSpendHome();
     writeFileSync(join(home, "auth.json"), JSON.stringify({
       "google-antigravity": {
         activeAccountId: "active",
@@ -165,6 +180,8 @@ describe("showThinkingSummary provider option", () => {
       if (stream) expect(text).toContain("response.completed");
       expect(text).toContain("OK");
     } finally {
+      // Released before restoring or removing the home so its lease files can be deleted.
+      releaseSpendHome();
       if (prevHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = prevHome;
       rmSync(home, { recursive: true, force: true });
diff --git a/tests/responses/responses-snapshot-repair-server.test.ts b/tests/responses/responses-snapshot-repair-server.test.ts
index f6e4ac0e92b..3b4f1230b0f 100644
--- a/tests/responses/responses-snapshot-repair-server.test.ts
+++ b/tests/responses/responses-snapshot-repair-server.test.ts
@@ -6,10 +6,18 @@ import { saveConfig } from "../../src/config";
 import { startServer } from "../../src/server";
 import { handleResponses } from "../../src/server/responses";
 import { isEagerRelaySseResponse } from "../../src/server/relay";
-import { createGrokResponsesControlFrameBlockRewrite } from "../../src/server/grok-responses-control-frame";
+import {
+  createGrokResponsesControlFrameBlockRewrite,
+  createGrokResponsesTimestampBlockRewrite,
+} from "../../src/server/grok-responses-control-frame";
 import type { OcxConfig } from "../../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+// Case-local, never file-wide: the other rows start a real server that takes the same lease.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 setDefaultTimeout(30_000);
 
@@ -70,15 +78,16 @@ const GROK_CONTROL_FRAME_EVENTS = [
 ];
 
 function sparseSseBody(
-  events: readonly Record<string, unknown>[] = SPARSE_EVENTS,
+  events: readonly (Record<string, unknown> | string)[] = SPARSE_EVENTS,
   includeEventNames = false,
 ): ReadableStream<Uint8Array> {
   return new ReadableStream<Uint8Array>({
     start(controller) {
       const encoder = new TextEncoder();
       for (const event of events) {
-        const eventLine = includeEventNames ? `event: ${event.type}\n` : "";
-        controller.enqueue(encoder.encode(`${eventLine}data: ${JSON.stringify(event)}\n\n`));
+        const eventLine = includeEventNames && typeof event !== "string" ? `event: ${event.type}\n` : "";
+        const payload = typeof event === "string" ? event : JSON.stringify(event);
+        controller.enqueue(encoder.encode(`${eventLine}data: ${payload}\n\n`));
       }
       controller.enqueue(encoder.encode("data: [DONE]\n\n"));
       controller.close();
@@ -88,7 +97,7 @@ function sparseSseBody(
 
 function stubSparseGateway(
   origin: string,
-  events: readonly Record<string, unknown>[] = SPARSE_EVENTS,
+  events: readonly (Record<string, unknown> | string)[] = SPARSE_EVENTS,
   includeEventNames = false,
 ): void {
   globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
@@ -114,6 +123,8 @@ beforeEach(() => {
 });
 
 afterEach(async () => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   await isolated.restore();
   removeTreeWithRetry(TEST_DIR);
@@ -174,6 +185,59 @@ for (const controlType of ["codex.rate_limits", "codex.response.metadata"]) {
   });
 }
 
+test("Grok receives integer response timestamps from Responses streams", () => {
+  const block = "event: response.created\ndata: { \"type\": \"response.created\", \"response\": {\"id\":\"resp_float_timestamp\",\"created_at\":1789740485.0}, \"unrelated\": 9007199254740993 }";
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([
+    "event: response.created\ndata: { \"type\": \"response.created\", \"response\": {\"id\":\"resp_float_timestamp\",\"created_at\":1789740485}, \"unrelated\": 9007199254740993 }",
+  ]);
+});
+
+test("Grok normalizes timestamps in JSON split across data fields", () => {
+  const block = [
+    "event: response.created",
+    'data: {"type":"response.created","response":{"id":"resp_split",',
+    'data: "created_at":1789740485.0},"unrelated":9007199254740993}',
+    "id: split",
+  ].join("\r\n");
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([[
+    "event: response.created",
+    'data: {"type":"response.created","response":{"id":"resp_split",',
+    'data: "created_at":1789740485},"unrelated":9007199254740993}',
+    "id: split",
+  ].join("\r\n")]);
+});
+
+test("Grok leaves an unrelated same-valued floating timestamp unchanged", () => {
+  const block = 'data: {"type":"response.created","response":{"created_at":1789740485},"metadata":{"created_at":1789740485.0}}';
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([block]);
+});
+
+test("Grok normalizes only the direct timestamp when a nested timestamp shares its value", () => {
+  const block = 'data: {"type":"response.created","response":{"created_at":1789740485.0,"metadata":{"created_at":1789740485.0}}}';
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([
+    'data: {"type":"response.created","response":{"created_at":1789740485,"metadata":{"created_at":1789740485.0}}}',
+  ]);
+});
+
+test.each([
+  "data: not-json",
+  "data: {\"type\":\"response.output_text.delta\",\"delta\":\"1789740485.0\"}",
+  "data: {\"type\":\"response.created\",\"response\":{\"created_at\":1789740485}}",
+  "data: {\"type\":\"response.created\",\"response\":{\"created_at\":1789740485.5}}",
+  "data: {\"type\":\"response.created\",\"response\":{\"created_at\":-1.0}}",
+  "data: {\"type\":\"response.created\",\"response\":{\"created_at\":9007199254740992.0}}",
+  "data: {\"type\":\"response.created\",\"response\":{\"created_at\":1789740485},\"text\":\"\\\"created_at\\\":1789740485.0\"}",
+])("Grok timestamp normalization preserves unsupported payload %s", block => {
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([block]);
+});
+
+test("Grok receives an integer completed_at timestamp", () => {
+  const block = 'data: {"type":"response.completed","response":{"created_at":1789740485,"completed_at":1789740486.0}}';
+  expect(createGrokResponsesTimestampBlockRewrite()(block)).toEqual([
+    'data: {"type":"response.completed","response":{"created_at":1789740485,"completed_at":1789740486}}',
+  ]);
+});
+
 describe("responsesSnapshotRepair through /v1/responses", () => {
   test.skipIf(process.platform !== "darwin")(
     "Darwin eager-relay applies snapshot repair inline before bytes reach the client",
@@ -195,6 +259,9 @@ describe("responsesSnapshotRepair through /v1/responses", () => {
         },
       } as OcxConfig;
 
+      // This row calls the handler directly instead of going through the server the other rows
+      // start, so it takes the writer lease itself. Dropped in the file's own teardown.
+      takeSpendHome();
       const response = await handleResponses(
         new Request("http://localhost/v1/responses", {
           method: "POST",
@@ -399,7 +466,12 @@ describe("responsesSnapshotRepair through /v1/responses", () => {
   });
   test.each([true, false])("the Grok marker filters Codex control frames at the client boundary (event names: %s)", async includeEventNames => {
     const gateway = "https://grok-control-frame.example.test";
-    stubSparseGateway(gateway, GROK_CONTROL_FRAME_EVENTS, includeEventNames);
+    const floatTimestampEvent = '{"type":"response.created","response":{"id":"resp_float_timestamp","created_at":1789740485.0}}';
+    stubSparseGateway(gateway, [
+      ...GROK_CONTROL_FRAME_EVENTS.slice(0, -1),
+      floatTimestampEvent,
+      GROK_CONTROL_FRAME_EVENTS.at(-1)!,
+    ], includeEventNames);
     saveConfig({
       port: 0,
       defaultProvider: "sparse",
@@ -430,12 +502,14 @@ describe("responsesSnapshotRepair through /v1/responses", () => {
       expect(grokText).not.toContain("codex.rate_limits");
       expect(grokText).not.toContain("codex.response.metadata");
       expect(grokText).toContain('"type":"response.completed"');
+      expect(grokText).toContain('"created_at":1789740485}');
 
       const ordinaryResponse = await request(false);
       expect(ordinaryResponse.status).toBe(200);
       const ordinaryText = await ordinaryResponse.text();
       expect(ordinaryText).toContain("codex.rate_limits");
       expect(ordinaryText).toContain("codex.response.metadata");
+      expect(ordinaryText).toContain('"created_at":1789740485.0}');
     } finally {
       await server.stop(true);
     }
@@ -444,6 +518,8 @@ describe("responsesSnapshotRepair through /v1/responses", () => {
 
 test("sparse JSON completion inference precedes function repair in client output and replay", async () => {
   const expected = '{"cell_id":"4","yield_time_ms":120000}';
+  // Dispatches directly rather than through a server, so it takes the lease itself.
+  takeSpendHome();
   const item = { type: "function_call", id: "fc_sparse_wait", call_id: "call_sparse_wait", name: "wait", arguments: '{"cell_id":4,"yield_time_ms":120000.0}' };
   let responseId = `resp_sparse_${crypto.randomUUID()}`;
   let capturedInput: Array<Record<string, unknown>> = [];
diff --git a/tests/responses/responses-state.test.ts b/tests/responses/responses-state.test.ts
index c1eaa5770cd..12ed243b5bb 100644
--- a/tests/responses/responses-state.test.ts
+++ b/tests/responses/responses-state.test.ts
@@ -235,7 +235,7 @@ async function runShutdownBudgetChild(
 async function runNeverSettlingAclChild(
   mode: "principal" | "icacls",
 ): Promise<NeverSettlingAclChildResult> {
-  const timeoutMs = watchdogMs(1_500);
+  const timeoutMs = watchdogMs(8_000);
   const child = Bun.spawn([
     process.execPath,
     helperPath("responses-state-never-settling-acl-child.ts"),
@@ -356,7 +356,7 @@ describe("Responses previous_response_id state", () => {
       model: "cursor/auto",
       previous_response_id: first.id,
       input: [{ type: "function_call_output", call_id: "call_1", output: "ok" }],
-    }) as { input: unknown[] };
+    }, "   ") as { input: unknown[] };
 
     expect(expanded.input).toEqual([
       { role: "user", content: "use ping" },
@@ -376,13 +376,10 @@ describe("Responses previous_response_id state", () => {
       model: "cursor/auto",
       previous_response_id: first.id,
       input: "continue task A",
-    }, "task-a") as { previous_response_id?: string; input: unknown[] };
+    }, "  task-a  ") as { previous_response_id?: string; input: unknown[] };
     expect(sameTask.previous_response_id).toBe(first.id);
-    expect(sameTask.input).toEqual([
-      { role: "user", content: "private task A history" },
-      first.output[0],
-      { role: "user", content: "continue task A" },
-    ]);
+    expect(sameTask.input).toEqual([{ role: "user", content: "private task A history" }, first.output[0],
+      { role: "user", content: "continue task A" }]);
     expect(previousResponseScopeMismatch(sameTask)).toBe(false);
 
     const foreignTask = expandPreviousResponseInput({
@@ -390,10 +387,12 @@ describe("Responses previous_response_id state", () => {
       previous_response_id: first.id,
       input: "brand-new task B",
     }, "task-b") as { previous_response_id?: string; input: string };
-    expect(foreignTask).toEqual({ model: "cursor/auto", input: "brand-new task B" });
+    expect(foreignTask).toEqual({ model: "cursor/auto", previous_response_id: first.id, input: "brand-new task B" });
     expect(previousResponseScopeMismatch(foreignTask)).toBe(true);
-    expect(previousResponseReplayPrefixLength(foreignTask)).toBe(0);
-    expect(responseStateMetrics().replayScopeMismatchDrops).toBe(1);
+    expect(previousResponseReplayFailure(foreignTask)?.reason).toBe("scope_mismatch");
+    const unscopedTask = expandPreviousResponseInput({ previous_response_id: first.id, input: "unscoped" });
+    expect(previousResponseReplayFailure(unscopedTask)?.reason).toBe("scope_mismatch");
+    expect(responseStateMetrics().replayScopeMismatchDrops).toBe(2);
   });
 
   test("scoped tasks reject legacy unscoped continuation state", () => {
@@ -406,7 +405,7 @@ describe("Responses previous_response_id state", () => {
       previous_response_id: first.id,
       input: "new task",
     }, "task-new");
-    expect(freshTask).toEqual({ input: "new task" });
+    expect(freshTask).toEqual({ previous_response_id: first.id, input: "new task" });
     expect(previousResponseScopeMismatch(freshTask)).toBe(true);
   });
 
@@ -1246,7 +1245,7 @@ describe("Responses previous_response_id state", () => {
         metrics: { tombstoneCount: 2 },
       });
     }
-  }, { timeout: (2 * watchdogMs(1_500)) + 2_000 });
+  }, { timeout: (2 * watchdogMs(8_000)) + 2_000 });
 
   test("Windows pending spill publication cannot overwrite a newer same-id generation", async () => {
     forceWindowsAclLane();
@@ -1961,7 +1960,7 @@ describe("Responses previous_response_id state", () => {
       { previous_response_id: "resp_spill_restart", input: "foreign" },
       "task-other",
     );
-    expect(foreign).toEqual({ input: "foreign" });
+    expect(foreign).toEqual({ previous_response_id: "resp_spill_restart", input: "foreign" });
   });
 
   test("spill references bind the expected response id and use the locked digest basename", () => {
diff --git a/tests/responses/responses-stateless-dangling-call-repair.test.ts b/tests/responses/responses-stateless-dangling-call-repair.test.ts
index 13b30573d9b..8e8c52ba15c 100644
--- a/tests/responses/responses-stateless-dangling-call-repair.test.ts
+++ b/tests/responses/responses-stateless-dangling-call-repair.test.ts
@@ -13,8 +13,10 @@ import { providerConfigSeed } from "../../src/providers/derive";
 import { getProviderRegistryEntry } from "../../src/providers/registry";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const MODEL = "deepseek-v4-flash";
+let releaseSpendHome: (() => void) | undefined;
 
 function deepseekProvider(): ReturnType<typeof providerConfigSeed> & { apiKey: string } {
   return { ...providerConfigSeed(getProviderRegistryEntry("deepseek")!), apiKey: "sk-test" };
@@ -22,7 +24,12 @@ function deepseekProvider(): ReturnType<typeof providerConfigSeed> & { apiKey: s
 
 describe("stateless Responses wire repairs orphaned tool calls", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Release the lease before later teardown can replace the preload sandbox home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   async function drive(input: unknown[]): Promise<{ url: string; body: Record<string, unknown> }> {
     const requests: Array<{ url: string; body: Record<string, unknown> }> = [];
@@ -34,6 +41,8 @@ describe("stateless Responses wire repairs orphaned tool calls", () => {
       return Response.json({ id: "resp_deepseek", object: "response", status: "completed", output: [] });
     }) as typeof fetch;
     const config = { providers: { deepseek: deepseekProvider() } } as unknown as OcxConfig;
+    // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+    releaseSpendHome = acquireOwnedSpendHome();
     await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
diff --git a/tests/responses/responses-tool-search-repair.test.ts b/tests/responses/responses-tool-search-repair.test.ts
index d415fff16eb..392aa00a5ec 100644
--- a/tests/responses/responses-tool-search-repair.test.ts
+++ b/tests/responses/responses-tool-search-repair.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import { isTranslatorBudgetExceededError } from "../../src/lib/translator-budget";
 import {
   restoreRoutedToolSearchCallsInJson,
@@ -7,8 +7,16 @@ import {
 import { createRoutedToolSearchRestoreBlockRewrite } from "../../src/server/responses-tool-search-repair";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
 
+let releaseSpendHome: (() => void) | undefined;
+afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
+
 function frame(event: string, payload: Record<string, unknown>): string {
   return `event: ${event}\ndata: ${JSON.stringify({ type: event, ...payload })}`;
 }
@@ -349,6 +357,8 @@ describe("routed Responses tool-search compatibility", () => {
     }) as typeof fetch;
 
     try {
+      // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+      releaseSpendHome = acquireOwnedSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -395,6 +405,7 @@ describe("routed Responses tool-search compatibility", () => {
     }) as typeof fetch;
 
     try {
+      releaseSpendHome = acquireOwnedSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -433,6 +444,7 @@ describe("routed Responses tool-search compatibility", () => {
     }) as typeof fetch;
 
     try {
+      releaseSpendHome = acquireOwnedSpendHome();
       await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -495,6 +507,7 @@ describe("routed Responses tool-search compatibility", () => {
     }), { headers: { "content-type": "application/json" } })) as typeof fetch;
 
     try {
+      releaseSpendHome = acquireOwnedSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/responses/responses-undeclared-tool-guard.test.ts b/tests/responses/responses-undeclared-tool-guard.test.ts
index d0e4000bde1..99a50b2b1a7 100644
--- a/tests/responses/responses-undeclared-tool-guard.test.ts
+++ b/tests/responses/responses-undeclared-tool-guard.test.ts
@@ -4,7 +4,7 @@
  * with the target file untouched. The bridged paths already fail closed on the same condition
  * (`declaredToolNames`, src/bridge/sse.ts); these pin the passthrough's equivalent.
  */
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import {
   collectDeclaredNamelessClientCallTypes,
   collectDeclaredBareWireToolNames,
@@ -25,6 +25,15 @@ import { handleResponses } from "../../src/server/responses";
 import { expandPreviousResponseInput } from "../../src/responses/state";
 import type { OcxConfig } from "../../src/types";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { readAll, streamFromText } from "../helpers/sse-stream";
+
+// A case that calls handleResponses directly never runs startServer, so it never takes the
+// spend-journal writer lease and its dispatch is refused before it reaches its own contract.
+// Dropped in teardown so a case that throws mid-assertion cannot leave the lease behind.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+afterEach(() => { releaseSpendHome?.(); releaseSpendHome = undefined; });
 
 /** One SSE event block without its blank-line delimiter. */
 function frame(type: string, payload: Record<string, unknown>): string {
@@ -36,33 +45,6 @@ function sse(type: string, payload: Record<string, unknown>): string {
   return `${frame(type, payload)}\n\n`;
 }
 
-function streamFromText(text: string): ReadableStream<Uint8Array> {
-  const chunk = new TextEncoder().encode(text);
-  let sent = false;
-  return new ReadableStream<Uint8Array>({
-    pull(controller) {
-      if (sent) {
-        controller.close();
-        return;
-      }
-      sent = true;
-      controller.enqueue(chunk);
-    },
-  });
-}
-
-async function readAll(stream: ReadableStream<Uint8Array>): Promise<string> {
-  const reader = stream.getReader();
-  const decoder = new TextDecoder();
-  let text = "";
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    text += decoder.decode(value, { stream: true });
-  }
-  return text;
-}
-
 async function relay(
   upstream: string,
   declared: Iterable<string>,
@@ -810,6 +792,7 @@ describe("the reported turn, end to end through handleResponses", () => {
     const savedFetch = globalThis.fetch;
     globalThis.fetch = (async () => upstream()) as typeof fetch;
     try {
+      takeSpendHome();
       return await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -949,6 +932,7 @@ describe("a refused turn does not become continuation state", () => {
       { headers: { "content-type": "application/json" } },
     )) as typeof fetch;
     try {
+      takeSpendHome();
       return await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -1056,6 +1040,7 @@ describe("a refused turn does not become continuation state", () => {
     })) as typeof fetch;
     let response: Response;
     try {
+      takeSpendHome();
       response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -1119,6 +1104,7 @@ describe("a refused turn does not become continuation state", () => {
     })) as typeof fetch;
     let response: Response;
     try {
+      takeSpendHome();
       response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -1208,6 +1194,7 @@ describe("real relay and continuation caller normalization (#4176 / #4181)", ()
         }),
       });
 
+      takeSpendHome();
       const turn1Res = await handleResponses(turn1Req, config, { model: "", provider: "" });
       expect(turn1Res.status).toBe(200);
       const clientStreamText = await turn1Res.text();
@@ -1240,6 +1227,7 @@ describe("real relay and continuation caller normalization (#4176 / #4181)", ()
         }),
       });
 
+      takeSpendHome();
       const turn2Res = await handleResponses(turn2Req, config, { model: "", provider: "" });
       expect(turn2Res.status).toBe(200);
       await turn2Res.json();
@@ -1278,6 +1266,7 @@ describe("real relay and continuation caller normalization (#4176 / #4181)", ()
     })) as typeof fetch;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -1315,6 +1304,7 @@ describe("real relay and continuation caller normalization (#4176 / #4181)", ()
     })) as typeof fetch;
 
     try {
+      takeSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -1389,6 +1379,7 @@ describe("empty and absent tool catalogs", () => {
     const savedFetch = globalThis.fetch;
     globalThis.fetch = (async () => upstream()) as typeof fetch;
     try {
+      takeSpendHome();
       return await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -2324,6 +2315,7 @@ describe("xAI hosted-call authorization through handleResponses", () => {
       });
     }) as typeof fetch;
     try {
+      takeSpendHome();
       return await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/responses/sse-failed-tail.test.ts b/tests/responses/sse-failed-tail.test.ts
index 0a38424f424..dfa030dd681 100644
--- a/tests/responses/sse-failed-tail.test.ts
+++ b/tests/responses/sse-failed-tail.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { relaySseWithFailedTail, relayWithAbort } from "../../src/server";
 import { relaySseEagerBounded, type EagerRelayHooks } from "../../src/server/relay-eager";
 import { MAX_TAIL_ERROR_MESSAGE_CHARS } from "../../src/server/relay";
+import { TERMINAL_REFUSAL_FALLBACK_MESSAGE } from "../../src/lib/errors";
 import { TranslatorBudgetExceededError } from "../../src/lib/translator-budget";
 
 const encoder = new TextEncoder();
@@ -462,3 +463,231 @@ describe("optional Codex hint filtering preserves relay semantics", () => {
     });
   }
 });
+
+/**
+ * #5176: a final upstream refusal must end the turn rather than restart it.
+ *
+ * Codex classifies a `response.failed` terminal by `error.code` alone
+ * (codex-rs/codex-api/src/sse/responses.rs:417-467). Only the codes collected in
+ * CODEX_TERMINAL_CODES below end the turn; every other code falls through to the
+ * trailing `_ => ApiError::Retryable` arm, which the client retries up to
+ * `stream_max_retries` and renders as `Reconnecting N/5`. Codex has no handler
+ * for a bare `error` event at all, so the terminal this relay synthesizes is the
+ * only thing that carries the refusal to the client.
+ *
+ * `upstreamErrorTailFrame` (src/server/relay.ts) used to stamp
+ * `upstream_server_error` on that terminal unconditionally, so the upstream
+ * message survived and its verdict did not, and a refusal arrived as a retryable
+ * transport failure. It now carries the verdict when the upstream gave one, and
+ * leaves everything else classified exactly as before.
+ */
+describe("upstream refusal terminal mapping (#5176)", () => {
+  // codex-rs/codex-api/src/sse/responses.rs:423-450, in branch order.
+  const CODEX_TERMINAL_CODES = new Set([
+    "context_length_exceeded",
+    "insufficient_quota",
+    "usage_not_included",
+    "cyber_policy",
+    "misalignment_policy_violation",
+    "invalid_prompt",
+    "bio_policy",
+  ]);
+
+  // The upstream copy quoted in #5176, and the code Codex pairs with safety-refusal
+  // copy in its own fixture (responses.rs:1358-1366).
+  const SAFETY_REFUSAL_MESSAGE =
+    "This request was blocked by our safety systems. Reason: Potentially unintended activity.";
+  const SAFETY_REFUSAL_CODE = "invalid_prompt";
+
+  const synthesizedError = (out: string): { code: string; message: string; type: string } => {
+    const dataLine = out.split("event: response.failed\ndata: ")[1]?.split("\n")[0];
+    if (!dataLine) throw new Error("missing synthesized response.failed payload");
+    const parsed = JSON.parse(dataLine) as {
+      response: { error: { code: string; message: string; type: string } };
+    };
+    return parsed.response.error;
+  };
+
+  const relayFor = (mode: "tee" | "eager", chunks: string[]) => mode === "tee"
+    ? relaySseWithFailedTail(sourceStream(chunks), new AbortController())
+    : relaySseEagerBounded(sourceStream(chunks), new AbortController(), parityHooks);
+
+  test.each([
+    ["tee", "flat"],
+    ["tee", "nested"],
+    ["eager", "flat"],
+    ["eager", "nested"],
+  ] as const)("%s %s bare refusal ends the turn with the upstream verdict", async (mode, shape) => {
+    const bare = shape === "flat"
+      ? { type: "error", code: SAFETY_REFUSAL_CODE, message: SAFETY_REFUSAL_MESSAGE }
+      : {
+        type: "error",
+        error: {
+          type: "invalid_request_error",
+          code: SAFETY_REFUSAL_CODE,
+          message: SAFETY_REFUSAL_MESSAGE,
+        },
+      };
+    const original = 'data: {"type":"response.in_progress"}\n\n'
+      + "data: " + JSON.stringify(bare) + "\n\n";
+
+    const out = await drain(relayFor(mode, [original]));
+    const error = synthesizedError(out);
+
+    // The refusal text survives, which is why the client quotes it verbatim.
+    expect(error.message).toBe(SAFETY_REFUSAL_MESSAGE);
+    // ... and so does the verdict, so the client stops instead of reconnecting.
+    expect(error.code).toBe(SAFETY_REFUSAL_CODE);
+    expect(CODEX_TERMINAL_CODES.has(error.code)).toBe(true);
+    expect(error.type).toBe("invalid_request_error");
+    expect(out).toContain('"retryable":false');
+  });
+
+  test.each(["tee", "eager"] as const)(
+    "%s recognizes refusal copy the upstream sent without a code",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({ type: "error", message: SAFETY_REFUSAL_MESSAGE }) + "\n\n";
+
+      const error = synthesizedError(await drain(relayFor(mode, [original])));
+
+      expect(error.code).toBe(SAFETY_REFUSAL_CODE);
+      expect(CODEX_TERMINAL_CODES.has(error.code)).toBe(true);
+    },
+  );
+
+  // The mirror-image defect this fix must not introduce: a real outage is not a
+  // refusal, and giving it a terminal code would strand a turn that a reconnect
+  // would have completed.
+  test.each(["tee", "eager"] as const)(
+    "%s leaves a transient upstream failure retryable",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({
+          type: "error",
+          code: "upstream_reset",
+          message: "Upstream stream terminated unexpectedly: socket closed",
+        }) + "\n\n";
+
+      const out = await drain(relayFor(mode, [original]));
+      const error = synthesizedError(out);
+
+      expect(error.code).toBe("upstream_server_error");
+      expect(error.type).toBe("upstream_error");
+      expect(CODEX_TERMINAL_CODES.has(error.code)).toBe(false);
+      expect(out).not.toContain('"retryable":false');
+    },
+  );
+
+  // Refusal copy quoted inside a transport diagnostic must not outrank the code
+  // the upstream actually sent, or the mirror-image defect returns through text.
+  test.each(["tee", "eager"] as const)(
+    "%s keeps an explicit non-refusal code over refusal copy in its message",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({
+          type: "error",
+          code: "upstream_reset",
+          message: "Transport failed while forwarding: " + SAFETY_REFUSAL_MESSAGE,
+        }) + "\n\n";
+
+      const out = await drain(relayFor(mode, [original]));
+      const error = synthesizedError(out);
+
+      expect(error.code).toBe("upstream_server_error");
+      expect(CODEX_TERMINAL_CODES.has(error.code)).toBe(false);
+      expect(out).not.toContain('"retryable":false');
+    },
+  );
+
+  // Codex accepts a refusal code with no message and supplies its own copy
+  // (sse/responses.rs:446-451), so this shape must still end the turn rather
+  // than fall through to the adapter_eof incomplete.
+  test.each(["tee", "eager"] as const)(
+    "%s ends the turn on a refusal code sent without a message",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({ type: "error", code: SAFETY_REFUSAL_CODE }) + "\n\n";
+
+      const out = await drain(relayFor(mode, [original]));
+      const error = synthesizedError(out);
+
+      expect(error.code).toBe(SAFETY_REFUSAL_CODE);
+      expect(error.message).toBe(TERMINAL_REFUSAL_FALLBACK_MESSAGE);
+      expect(out).not.toContain('"reason":"adapter_eof"');
+    },
+  );
+
+  // Code and message must be read from the same places. When the message is
+  // nested under response.error and the code scan does not look there, the
+  // event contributes text while its verdict goes unseen.
+  test.each(["tee", "eager"] as const)(
+    "%s reads a refusal nested under response.error",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({
+          type: "error",
+          response: {
+            error: {
+              type: "invalid_request_error",
+              code: SAFETY_REFUSAL_CODE,
+              message: "Invalid prompt.",
+            },
+          },
+        }) + "\n\n";
+
+      const error = synthesizedError(await drain(relayFor(mode, [original])));
+
+      expect(error.code).toBe(SAFETY_REFUSAL_CODE);
+      expect(error.message).toBe("Invalid prompt.");
+    },
+  );
+
+  // Code and message share one precedence order. When two envelopes disagree,
+  // the one that supplies the message supplies the verdict, so a refusal nested
+  // below a transient code cannot promote the turn to terminal.
+  test.each(["tee", "eager"] as const)(
+    "%s takes the verdict from the envelope that supplied the message",
+    async (mode) => {
+      const original = 'data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({
+          type: "error",
+          error: { type: "upstream_error", code: "upstream_reset", message: "socket closed" },
+          response: {
+            error: { code: SAFETY_REFUSAL_CODE, message: "Invalid prompt." },
+          },
+        }) + "\n\n";
+
+      const out = await drain(relayFor(mode, [original]));
+      const error = synthesizedError(out);
+
+      expect(error.message).toBe("socket closed");
+      expect(error.code).toBe("upstream_server_error");
+      expect(CODEX_TERMINAL_CODES.has(error.code)).toBe(false);
+      expect(out).not.toContain('"retryable":false');
+    },
+  );
+
+  // The upstream ended the turn before the socket did, so the reset that
+  // followed must not replace the refusal with a retryable upstream_reset.
+  test.each(["tee", "eager"] as const)(
+    "%s keeps a captured refusal when the upstream read then fails",
+    async (mode) => {
+      const chunks = ['data: {"type":"response.in_progress"}\n\n'
+        + "data: " + JSON.stringify({
+          type: "error",
+          code: SAFETY_REFUSAL_CODE,
+          message: SAFETY_REFUSAL_MESSAGE,
+        }) + "\n\n"];
+      const source = () => sourceStream(chunks, { failAfter: true });
+      const out = await drain(mode === "tee"
+        ? relaySseWithFailedTail(source(), new AbortController())
+        : relaySseEagerBounded(source(), new AbortController(), parityHooks));
+      const error = synthesizedError(out);
+
+      expect(error.code).toBe(SAFETY_REFUSAL_CODE);
+      expect(error.message).toBe(SAFETY_REFUSAL_MESSAGE);
+      expect(out).not.toContain('"code":"upstream_reset"');
+    },
+  );
+});
diff --git a/tests/responses/ws-endpoint.test.ts b/tests/responses/ws-endpoint.test.ts
index fd9472d747a..bf90559bd92 100644
--- a/tests/responses/ws-endpoint.test.ts
+++ b/tests/responses/ws-endpoint.test.ts
@@ -55,7 +55,7 @@ describe("WS endpoint re-framer (120/132)", () => {
       "src/server/index/websocket-handler.ts",
     ].map(rel => readFileSync(new URL("../../" + rel, import.meta.url), "utf8")).join("\n");
     expect(source).toContain("const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;");
-    expect(source).toContain("websocket: createWebsocketHandler(ctx),");
+    expect(source).toContain("websocket: createWebsocketHandler(ctx, requestMetrics),");
     expect(source).toContain("idleTimeout: WEBSOCKET_IDLE_TIMEOUT_SECONDS,");
     expect(source).toContain("finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {");
     expect(source).toContain("if (!logged) finalizeLog(turnAbort.signal.aborted ? 499 : response.status);");
diff --git a/tests/responses/ws-native-steering.test.ts b/tests/responses/ws-native-steering.test.ts
index e2e99831093..dfa89bed85d 100644
--- a/tests/responses/ws-native-steering.test.ts
+++ b/tests/responses/ws-native-steering.test.ts
@@ -10,6 +10,15 @@ import { getRequestLogEntries, clearRequestLogsForTests } from "../../src/server
 import { runOptionalShutdownHooks } from "../../src/lib/optional-shutdown-hooks";
 import { MAX_ACTIVE_TURNS, tryAdmitTurn } from "../../src/server/lifecycle";
 import { configSchema } from "../../src/config/schema/config-schema";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+// The websocket handler dispatches through the real request path, so it reaches the shared spend
+// journal and needs the writer lease startServer would have taken. Without it the turn is refused
+// and the symptom is this file's own waitFor timing out, which names nothing.
+let releaseSpendHome: (() => void) | undefined;
+// Every synthetic client this file opens, so teardown can close them before the lease is given
+// back rather than leaving a handler mid-turn against a journal nobody owns.
+const clients: Array<ServerWebSocket<WsData>> = [];
 
 type Frame = Record<string, any>;
 const realSocket = globalThis.WebSocket;
@@ -48,12 +57,14 @@ const waitFor = async (condition: () => boolean) => {
   throw new Error("fixture condition timed out");
 };
 function downstream(fields: Frame = {}, settings = config(), credential = "test") {
+  releaseSpendHome ??= acquireOwnedSpendHome();
   const handler = createWebsocketHandler({ config: settings, deps: {} } as ServeOptionsContext);
   const sent: Frame[] = [];
   const ws = { readyState: 1, data: { headers: new Headers({ authorization: `Bearer ${credential}`, "thread-id": `fixture-${credential}`, session_id: `fixture-${credential}` }) } as WsData,
     send: (text: string) => { sent.push(JSON.parse(text)); return 1; }, close() { handler.close(ws); },
   } as unknown as ServerWebSocket<WsData>;
   const send = (frame: Frame) => handler.message(ws, JSON.stringify(frame));
+  clients.push(ws);
   send({ type: "response.create", model: "gpt-5.5", input: "initial", ...fields });
   return { ws, sent, send, handler };
 }
@@ -78,13 +89,40 @@ beforeEach(() => {
   globalThis.fetch = (async () => { fallbackCalls++; throw new Error("unexpected network/fallback in native steering fixture"); }) as typeof fetch;
   clearRequestLogsForTests();
 });
-afterEach(() => {
-  for (const socket of Socket.all) socket.close();
-  Socket.all = [];
-  runOptionalShutdownHooks();
-  globalThis.WebSocket = realSocket;
-  globalThis.fetch = realFetch;
-  for (const key of proxyKeys) { delete process.env[key]; if (savedProxy[key] !== undefined) process.env[key] = savedProxy[key]; }
+afterEach(async () => {
+  // handler.close only STARTS the pump cancellation. Waiting for the socket to drop its stream
+  // cancel and its native control is what proves the turn finished accounting; releasing the
+  // lease before that leaves a reader settling against a journal nobody owns.
+  //
+  // The rest runs even when that wait gives up, and the failure still propagates. A wait that
+  // expired is NOT evidence the turn settled: it means this fixture could not prove it, and the
+  // case should say so while still handing back the lease and the globals it replaced.
+  let failure: unknown;
+  const note = (error: unknown): void => { failure ??= error; };
+  try {
+    // Every client gets its close and its wait even after an earlier one gave up. Stopping at
+    // the first failure left the rest open for the next case to inherit.
+    for (const client of clients.splice(0)) {
+      // Separate guards: close() runs the production handler, so a throw there would otherwise
+      // skip this client's completion wait as well as its own failure.
+      try { client.close(); } catch (error) { note(error); }
+      try {
+        await waitFor(() => client.data.cancel === undefined && client.data.nativeControl === undefined);
+      } catch (error) { note(error); }
+    }
+    for (const socket of Socket.all) {
+      try { socket.close(); } catch (error) { note(error); }
+    }
+    Socket.all = [];
+    try { runOptionalShutdownHooks(); } catch (error) { note(error); }
+    // The release itself can throw, and it used to take the global restore down with it.
+    try { releaseSpendHome?.(); } catch (error) { note(error); } finally { releaseSpendHome = undefined; }
+  } finally {
+    globalThis.WebSocket = realSocket;
+    globalThis.fetch = realFetch;
+    for (const key of proxyKeys) { delete process.env[key]; if (savedProxy[key] !== undefined) process.env[key] = savedProxy[key]; }
+  }
+  if (failure !== undefined) throw failure;
 });
 
 test("configuration is explicit opt-in and malformed values fail closed", () => {
diff --git a/tests/responses/ws-upstream.test.ts b/tests/responses/ws-upstream.test.ts
index c9afb0cd7d9..8ea36d1349b 100644
--- a/tests/responses/ws-upstream.test.ts
+++ b/tests/responses/ws-upstream.test.ts
@@ -30,9 +30,10 @@ import {
 } from "../../src/server/responses/ws-upstream";
 import type { OcxProviderConfig } from "../../src/types";
 import type { OcxConfig } from "../../src/types";
+import { BOUNDED_WS_RUNTIME, codexWsUpstreamFetch, shouldUseCodexWsUpstream, streamingInit } from "../helpers/ws-upstream-fixtures";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const CODEX_URL = "https://chatgpt.com/backend-api/codex/responses";
-const BOUNDED_WS_RUNTIME = "1.4.0";
 
 // #864 keeps win32 rewrite traffic out of the tee()+JS-pull chain, so
 // `isWin32EagerRewrite(platform, needsClientRewrite)` sends it through the eager
@@ -45,26 +46,6 @@ const BOUNDED_WS_RUNTIME = "1.4.0";
 // constant that only held before the backfill landed.
 const EAGER_RELAY_FORCED_BY_PLATFORM = isWin32EagerRewrite(process.platform, true);
 
-function shouldUseCodexWsUpstream(url: string, init?: RequestInit, upstreamWebsocket = false): boolean {
-  return rawShouldUseCodexWsUpstream(url, init, BOUNDED_WS_RUNTIME, upstreamWebsocket);
-}
-
-function codexWsUpstreamFetch(
-  url: string,
-  init: RequestInit,
-  fallback: typeof fetch,
-): Promise<Response> {
-  return rawCodexWsUpstreamFetch(url, init, fallback, BOUNDED_WS_RUNTIME);
-}
-
-function streamingInit(body: Record<string, unknown> = {}): RequestInit {
-  return {
-    method: "POST",
-    headers: { "content-type": "application/json", authorization: "Bearer test" },
-    body: JSON.stringify({ model: "gpt-5.5", stream: true, ...body }),
-  };
-}
-
 describe("shouldUseCodexWsUpstream", () => {
   test("uses HTTP SSE on runtimes without a bounded response sink", async () => {
     expect(bunSupportsBoundedCodexWsRelay("1.3.14")).toBe(false);
@@ -150,11 +131,15 @@ describe("shouldUseCodexWsUpstream", () => {
     expect(shouldUseCodexWsUpstream(CODEX_URL, { method: "POST", body: "{\"stream\":true" })).toBe(false);
   });
 
-  test("opt-in upstream WebSocket only for configured OpenAI-compatible Responses endpoints", () => {
+  test("keeps configured provider endpoints on bounded HTTP SSE", () => {
     // The canonical backend ignores the flag.
     expect(shouldUseCodexWsUpstream(CODEX_URL, streamingInit(), false)).toBe(true);
-    // Configured providers join the WS lane on their own /v1/responses path.
-    expect(shouldUseCodexWsUpstream("https://sub2api.example.com/v1/responses", streamingInit(), true)).toBe(true);
+    // Bun cannot reject oversized messages before assembling them, so even an
+    // opted-in provider cannot join the WebSocket lane.
+    expect(shouldUseCodexWsUpstream("https://sub2api.example.com/v1/responses", streamingInit(), true)).toBe(false);
+    // The first-party api.openai.com lane still honors the operator opt-in.
+    expect(shouldUseCodexWsUpstream("https://api.openai.com/v1/responses", streamingInit(), true)).toBe(true);
+    expect(shouldUseCodexWsUpstream("https://api.openai.com/v1/responses", streamingInit(), false)).toBe(false);
     // Plain HTTP stays on SSE; never send credentials or request data through ws://.
     expect(shouldUseCodexWsUpstream("http://10.0.0.5:8080/v1/responses", streamingInit(), true)).toBe(false);
     expect(shouldUseCodexWsUpstream("https://sub2api.example.com/v1/responses", streamingInit(), false)).toBe(false);
@@ -230,7 +215,14 @@ beforeEach(() => {
   for (const key of PROXY_ENV_KEYS) delete process.env[key];
 });
 
+// A case that calls handleResponses directly never takes the writer lease startServer takes,
+// so its dispatch is refused. Dropped in teardown so a throwing case cannot leave it behind.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+
 afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.WebSocket = RealWebSocket;
   globalThis.fetch = RealFetch;
   FakeWebSocket.instances = [];
@@ -297,11 +289,7 @@ describe("providerFetch routing", () => {
     expect(FakeWebSocket.instances).toHaveLength(1);
   });
 
-  test("routes an opt-in provider's Responses streams over its upstream WS", async () => {
-    installFake(ws => {
-      ws.emit("open", {});
-      ws.emit("message", { data: JSON.stringify({ type: "response.completed", response: { id: "r1" } }) });
-    });
+  test("routes an opt-in provider's Responses streams over bounded HTTP SSE", async () => {
     const baseCalls: string[] = [];
     const sentinel = new Response("base");
     const provider = {
@@ -313,16 +301,15 @@ describe("providerFetch routing", () => {
     } as unknown as OcxProviderConfig;
     const wrapped = providerFetch(provider, BOUNDED_WS_RUNTIME);
 
-    const wsResponse = await wrapped("https://sub2api.example.com/v1/responses", streamingInit());
-    expect(wsResponse.headers.get("content-type")).toContain("text/event-stream");
-    expect(baseCalls).toHaveLength(0);
-    expect(FakeWebSocket.instances).toHaveLength(1);
-    expect(FakeWebSocket.instances[0]!.url).toBe("wss://sub2api.example.com/v1/responses");
+    const response = await wrapped("https://sub2api.example.com/v1/responses", streamingInit());
+    expect(await response.text()).toBe("base");
+    expect(baseCalls).toHaveLength(1);
+    expect(FakeWebSocket.instances).toHaveLength(0);
 
     // The same provider's non-Responses paths (images/search/chat) stay on the base fetch.
     await wrapped("https://sub2api.example.com/v1/images", streamingInit());
-    expect(baseCalls).toHaveLength(1);
-    expect(FakeWebSocket.instances).toHaveLength(1);
+    expect(baseCalls).toHaveLength(2);
+    expect(FakeWebSocket.instances).toHaveLength(0);
   });
 });
 
@@ -468,6 +455,7 @@ describe("handleResponses Codex WS relay selection", () => {
     const config = { ...forwardConfig(), plaintextV2AgentMessages: true } as OcxConfig;
     const request = plaintextV2CollaborationRequest();
 
+    takeSpendHome();
     const response = await handleResponses(request, config, { model: "", provider: "" }, {
       codexWsRuntimeIdentity: BOUNDED_WS_RUNTIME,
     });
@@ -533,6 +521,7 @@ describe("handleResponses Codex WS relay selection", () => {
     });
     const config = { ...forwardConfig(), plaintextV2AgentMessages: true } as OcxConfig;
 
+    takeSpendHome();
     const response = await handleResponses(
       plaintextV2CollaborationRequest(),
       config,
@@ -559,6 +548,7 @@ describe("handleResponses Codex WS relay selection", () => {
       });
     });
 
+    takeSpendHome();
     const response = await handleResponses(request(), forwardConfig(), { model: "", provider: "" }, {
       codexWsRuntimeIdentity: BOUNDED_WS_RUNTIME,
     });
@@ -581,6 +571,7 @@ describe("handleResponses Codex WS relay selection", () => {
       { status: 200, headers: { "content-type": "text/event-stream" } },
     )) as typeof fetch;
 
+    takeSpendHome();
     const response = await handleResponses(request(), forwardConfig(), { model: "", provider: "" }, {
       codexWsRuntimeIdentity: BOUNDED_WS_RUNTIME,
     });
@@ -602,6 +593,7 @@ describe("handleResponses Codex WS relay selection", () => {
     });
 
     const logCtx = { model: "", provider: "" };
+    takeSpendHome();
     const response = await handleResponses(request(), forwardConfig(), logCtx, {
       codexWsRuntimeIdentity: BOUNDED_WS_RUNTIME,
     });
@@ -621,6 +613,7 @@ describe("handleResponses Codex WS relay selection", () => {
     });
 
     const logCtx = { model: "", provider: "" };
+    takeSpendHome();
     const response = await handleResponses(request(), forwardConfig(), logCtx, {
       codexWsRuntimeIdentity: BOUNDED_WS_RUNTIME,
     });
@@ -645,6 +638,7 @@ describe("handleResponses Codex WS relay selection", () => {
         { status: 200, headers: { "content-type": "text/event-stream" } },
       )) as typeof fetch;
 
+      takeSpendHome();
       const response = await handleResponses(request(), forwardConfig(), { model: "", provider: "" });
 
       expect(FakeWebSocket.instances).toHaveLength(0);
@@ -682,6 +676,7 @@ describe("handleResponses Codex WS relay selection", () => {
       { status: 200, headers: { "content-type": "text/event-stream" } },
     )) as typeof fetch;
 
+    takeSpendHome();
     const response = await handleResponses(request(), forwardConfig(), { model: "", provider: "" });
     const text = await response.text();
 
@@ -730,6 +725,7 @@ describe("codexWsUpstreamFetch", () => {
       ws.emit("message", { data: JSON.stringify({ type: "response.completed", response: { id: "r1", status: "completed", output: [] } }) });
     };
     globalThis.WebSocket = CapturingSocket as unknown as typeof WebSocket;
+    takeSpendHome();
     const response = await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { authorization: "Bearer fixture", "content-type": "application/json", "x-openai-internal-codex-responses-lite": "true" },
@@ -1064,12 +1060,12 @@ describe("codexWsUpstreamFetch", () => {
       });
 
     test("keeps noncanonical providers on the stream path", async () => {
-      const response = await receive(refusal, [], "https://gateway.example/v1/responses");
+      const response = await receive(refusal, [], "https://api.openai.com/v1/responses");
       expect(response.status).toBe(200);
       expect(await response.text()).toContain("event: error");
     });
 
-    test.each([CODEX_URL, "https://gateway.example/v1/responses"])(
+    test.each([CODEX_URL, "https://api.openai.com/v1/responses"])(
       "settles synchronous error/send-throw/close races and detaches deadlines for %s", async url => {
         jest.useFakeTimers();
         const abort = new AbortController();
@@ -1953,24 +1949,15 @@ describe("oversized Codex create frames", () => {
     expect(stage?.relayedEvents).toBeGreaterThan(0);
   });
 
-  test("dials the configured provider's own wss URL for an opt-in upstream", async () => {
-    process.env.HTTPS_PROXY = "http://proxy.example:8080";
-    process.env.NO_PROXY = "sub2api.example.com:443";
-    installFake(ws => {
-      ws.emit("open", {});
-      ws.emit("message", { data: JSON.stringify({ type: "response.completed", response: { id: "r-ws" } }) });
-    });
+  test("falls back before dialing a custom upstream URL", async () => {
     const sentinel = new Response("fallback");
     const response = await codexWsUpstreamFetch(
       "https://sub2api.example.com/v1/responses",
       streamingInit(),
       (async () => sentinel) as typeof fetch,
     );
-    expect(FakeWebSocket.instances).toHaveLength(1);
-    expect(FakeWebSocket.instances[0]!.url).toBe("wss://sub2api.example.com/v1/responses");
-    expect(FakeWebSocket.instances[0]!.options?.proxy).toBeUndefined();
-    expect(response.headers.get("content-type")).toContain("text/event-stream");
-    expect(await response.text()).toContain("response.completed");
+    expect(FakeWebSocket.instances).toHaveLength(0);
+    expect(response).toBe(sentinel);
   });
 
   test("response.done normalization keeps unknown usage fields (#41980 parity)", async () => {
diff --git a/tests/routing/combo-management-api.test.ts b/tests/routing/combo-management-api.test.ts
index ba6bd7e2d03..7bdd2fb69e1 100644
--- a/tests/routing/combo-management-api.test.ts
+++ b/tests/routing/combo-management-api.test.ts
@@ -41,6 +41,7 @@ import type { OcxConfig } from "../../src/types";
 import { syncCatalogModels } from "../../src/codex/catalog";
 import { injectClaudeAgentDefs } from "../../src/claude/agents-inject";
 import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const VALID_COMBO = { targets: [{ provider: "a", model: "m1" }] };
@@ -1250,6 +1251,8 @@ describe("supported disabled-provider activation", () => {
           return Response.json({ error: { message: "default provider must not be reached" } }, { status: 500 });
         },
       });
+      // Taken after withTempHome installs this case's home so physical dispatch owns its ledger.
+      const releaseSpendHome = acquireOwnedSpendHome();
       try {
         const config = baseConfig({
           defaultProvider: "c",
@@ -1283,9 +1286,13 @@ describe("supported disabled-provider activation", () => {
           headers: { "content-type": "application/json" },
           body: JSON.stringify({ model: "combo/free", input: "hello", stream: false }),
         }), config, { model: "", provider: "" });
-        expect(routed.status).toBe(200);
-        expect(bHits).toBe(1);
-        expect(cHits).toBe(0);
+        try {
+          expect(routed.status).toBe(200);
+          expect(bHits).toBe(1);
+          expect(cHits).toBe(0);
+        } finally {
+          await routed.body?.cancel();
+        }
 
         expect((await comboApi(config, "PATCH", "/api/providers?name=b", { disabled: true }))?.status).toBe(200);
         const diagnostics = readConfigDiagnostics();
@@ -1305,6 +1312,8 @@ describe("supported disabled-provider activation", () => {
         expect(bHits).toBe(1);
         expect(cHits).toBe(0);
       } finally {
+        // Released before withTempHome removes the directory, preventing a live database there.
+        releaseSpendHome();
         await upstreamB.stop(true);
         await upstreamC.stop(true);
       }
@@ -1335,6 +1344,8 @@ describe("combo response-path strategy accounting", () => {
     let bHits = 0;
     const upstreamA = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch() { aHits += 1; return completion("a"); } });
     const upstreamB = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch() { bHits += 1; return completion("b"); } });
+    // Taken after the inherited test home is in effect so both physical dispatches can record.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const config = baseConfig({
         providers: {
@@ -1343,10 +1354,22 @@ describe("combo response-path strategy accounting", () => {
         },
         combos: { free: { strategy: "least-used", targets: [{ provider: "a", model: "m1" }, { provider: "b", model: "m2" }] } },
       });
-      expect((await handleResponses(responseRequest(), config, { model: "", provider: "" })).status).toBe(200);
-      expect((await handleResponses(responseRequest(), config, { model: "", provider: "" })).status).toBe(200);
+      const first = await handleResponses(responseRequest(), config, { model: "", provider: "" });
+      try {
+        expect(first.status).toBe(200);
+      } finally {
+        await first.body?.cancel();
+      }
+      const second = await handleResponses(responseRequest(), config, { model: "", provider: "" });
+      try {
+        expect(second.status).toBe(200);
+      } finally {
+        await second.body?.cancel();
+      }
       expect({ aHits, bHits }).toEqual({ aHits: 1, bHits: 1 });
     } finally {
+      // Released after both bodies are cancelled so no stream retains the ledger owner.
+      releaseSpendHome();
       await upstreamA.stop(true);
       await upstreamB.stop(true);
     }
@@ -1361,6 +1384,8 @@ describe("combo response-path strategy accounting", () => {
       fetch() { aHits += 1; return Response.json({ error: { message: "busy" } }, { status: 429, headers: { "retry-after": "60" } }); },
     });
     const upstreamB = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch() { bHits += 1; return completion("b"); } });
+    // Taken after the inherited test home is in effect so failover dispatch can record its sends.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const config = baseConfig({
         providers: {
@@ -1370,10 +1395,16 @@ describe("combo response-path strategy accounting", () => {
         combos: { free: { strategy: "reset-window", targets: [{ provider: "a", model: "m1" }, { provider: "b", model: "m2" }] } },
       });
       const response = await handleResponses(responseRequest(), config, { model: "", provider: "" });
-      expect(response.status).toBe(200);
-      expect({ aHits, bHits }).toEqual({ aHits: 1, bHits: 1 });
-      expect(isComboTargetInCooldown("free", { provider: "a", model: "m1" })).toBe(true);
+      try {
+        expect(response.status).toBe(200);
+        expect({ aHits, bHits }).toEqual({ aHits: 1, bHits: 1 });
+        expect(isComboTargetInCooldown("free", { provider: "a", model: "m1" })).toBe(true);
+      } finally {
+        await response.body?.cancel();
+      }
     } finally {
+      // Released after the response body is cancelled so no stream retains the ledger owner.
+      releaseSpendHome();
       await upstreamA.stop(true);
       await upstreamB.stop(true);
     }
diff --git a/tests/routing/fastwire-characterization-wire.test.ts b/tests/routing/fastwire-characterization-wire.test.ts
index 7d3c01d0dc1..5f4d3f6380e 100644
--- a/tests/routing/fastwire-characterization-wire.test.ts
+++ b/tests/routing/fastwire-characterization-wire.test.ts
@@ -6,10 +6,17 @@ import * as adapterResolveModule from "../../src/server/adapter-resolve";
 import type { RequestLogContext } from "../../src/server/request-log";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
+// Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
 });
 
@@ -45,7 +52,8 @@ async function driveResponses(args: {
     ...(args.callerTier === undefined ? {} : { service_tier: args.callerTier }),
   };
 
-  await handleResponses(
+  takeSpendHome();
+  const turn = await handleResponses(
     new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -56,6 +64,9 @@ async function driveResponses(args: {
     {},
   );
 
+  // The turn's body is a live stream. Releasing it here means no reader is still attached when
+  // the lease is dropped, which is what turns a finished case into a pending one.
+  await turn.body?.cancel();
   expect(bodies).toHaveLength(1);
   return { outboundBody: bodies[0]!, logCtx };
 }
@@ -355,7 +366,9 @@ describe("FastWire characterization: rawBody observation point", () => {
         }),
       });
 
-      await handleResponses(request, config, { model: "", provider: "" }, {});
+      takeSpendHome();
+      const turn = await handleResponses(request, config, { model: "", provider: "" }, {});
+      await turn.body?.cancel();
       expect(outboundBody?.service_tier).toBe("priority");
       expect(adapterRawBody?.service_tier).toBe("flex");
     } finally {
diff --git a/tests/routing/fastwire-observability.test.ts b/tests/routing/fastwire-observability.test.ts
index 0ced61dd44e..587f98242fd 100644
--- a/tests/routing/fastwire-observability.test.ts
+++ b/tests/routing/fastwire-observability.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import type { AdapterRequest } from "../../src/adapters/base";
 import { createOpenAIChatAdapter } from "../../src/adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "../../src/adapters/openai-responses";
@@ -26,6 +26,14 @@ import { estimateComboCost, serviceTierContextFromOutcome } from "../../src/usag
 import type { ExpectedPriceOverlay } from "../../src/usage/expected-prices";
 import { normalizeUsageEntryForTest } from "../../src/usage/log";
 import { createTestTranslatorBudget, withTestTranslatorBudget } from "../helpers/translator-budget";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
+afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 const SERVICE_WIRE = {
   kind: "service-tier" as const,
@@ -491,6 +499,8 @@ describe("FastWire logging and persistence", () => {
       }) as typeof fetch;
       const logCtx: RequestLogContext = { model: "", provider: "" };
       try {
+        // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+        releaseSpendHome = acquireOwnedSpendHome();
         const response = await handleResponses(
           new Request("http://localhost/v1/responses", {
             method: "POST",
diff --git a/tests/routing/probe-lease-dispatch-wiring.test.ts b/tests/routing/probe-lease-dispatch-wiring.test.ts
index 00c4a6b942e..e1d372ddb39 100644
--- a/tests/routing/probe-lease-dispatch-wiring.test.ts
+++ b/tests/routing/probe-lease-dispatch-wiring.test.ts
@@ -30,6 +30,7 @@ import { saveCodexAccountCredential } from "../../src/codex/account-store";
 import { clearAccountQuota, updateAccountQuota } from "../../src/codex/auth-api";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 /**
@@ -104,6 +105,8 @@ describe("recovery limiter wiring is reachable from production (#4701)", () => {
       },
     } as OcxConfig;
 
+    // Acquire on the installed test home so this physical dispatch can open the spend journal.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -115,6 +118,8 @@ describe("recovery limiter wiring is reachable from production (#4701)", () => {
       expect(response.status).toBe(200);
       expect(sharedPoolBackpressure().state().initialSends).toBe(1);
     } finally {
+      // Release before afterEach removes the home to prevent Windows removal failures.
+      releaseSpendHome();
       globalThis.fetch = originalFetch;
     }
   });
diff --git a/tests/routing/resolved-model-policy-consumers.test.ts b/tests/routing/resolved-model-policy-consumers.test.ts
new file mode 100644
index 00000000000..87f64cadc03
--- /dev/null
+++ b/tests/routing/resolved-model-policy-consumers.test.ts
@@ -0,0 +1,133 @@
+import { describe, expect, test } from "bun:test";
+import { routeModel } from "../../src/router";
+import { resolveWireProtocolOverride } from "../../src/server/adapter-resolve";
+import { applyOpenAiVirtualModel } from "../../src/providers/openai-virtual-models";
+import { PROVIDER_REGISTRY } from "../../src/providers/registry";
+import { captureProviderGather } from "../../src/codex/catalog/gather-capture";
+import { fetchProviderModelsWithAuth, refreshingModelsAuthResolver } from "../../src/codex/catalog/provider-models";
+import { applyProviderConfigHints } from "../../src/codex/catalog/model-hints";
+import type { OcxConfig, OcxParsedRequest } from "../../src/types";
+import type { RequestLogContext } from "../../src/server/request-log";
+
+describe("resolved static policy consumers", () => {
+  test("route capture is frozen and late credential replacement cannot change static policy", () => {
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: "fixture",
+      providers: {
+        fixture: {
+          adapter: "openai-chat",
+          baseUrl: "https://fixture.invalid/v1",
+          authMode: "key",
+          apiKey: "first-private-key",
+          modelSupportsVerbosity: { "model-a": false },
+          modelAdapters: { "model-a": "openai-responses" },
+        },
+      },
+    };
+    const route = routeModel(config, "fixture/model-a");
+    const captured = route.staticPolicy;
+    route.provider = { ...route.provider, apiKey: "second-private-key" };
+    expect(route.staticPolicy).toBe(captured);
+    expect(route.staticPolicy.model.supportsVerbosity).toBe(false);
+    expect(Object.isFrozen(route.staticPolicy)).toBe(true);
+    expect(JSON.stringify(route.staticPolicy)).not.toContain("private-key");
+    expect(resolveWireProtocolOverride(
+      route.providerName,
+      route.modelId,
+      route.provider,
+      "responses",
+      route.staticPolicy,
+    ).adapter).toBe(route.staticPolicy.model.adapter);
+  });
+
+  test("virtual rewrite atomically replaces selected-model policy with wire-model policy", () => {
+    const entry = PROVIDER_REGISTRY.find(candidate => candidate.virtualModels !== undefined)!;
+    const selectedModelId = Object.keys(entry.virtualModels!)[0]!;
+    const config: OcxConfig = {
+      port: 10100,
+      defaultProvider: entry.id,
+      providers: {
+        [entry.id]: {
+          adapter: entry.adapter,
+          baseUrl: entry.baseUrl,
+          authMode: entry.authKind,
+          apiKey: "private-key",
+          models: [selectedModelId],
+        },
+      },
+    };
+    const route = routeModel(config, `${entry.id}/${selectedModelId}`);
+    const selectedPolicy = route.staticPolicy;
+    const parsed = {
+      modelId: selectedModelId,
+      _rawBody: { model: selectedModelId },
+      options: {},
+    } as unknown as OcxParsedRequest;
+    const logCtx = { model: selectedModelId, provider: entry.id } as unknown as RequestLogContext;
+    const resolution = applyOpenAiVirtualModel(parsed, route, logCtx)!;
+    expect(route.modelId).toBe(resolution.wireModelId);
+    expect(route.staticPolicy.modelId).toBe(resolution.wireModelId);
+    expect(route.staticPolicy).not.toBe(selectedPolicy);
+    expect(logCtx.model).toBe(resolution.selectedModelId);
+    expect(logCtx.resolvedModel).toBe(resolution.wireModelId);
+    expect(parsed._openAiVirtualSelectedModelId).toBe(resolution.selectedModelId);
+  });
+
+  test("OpenAI API gather capture and catalog rows apply positive context and input caps", async () => {
+    const modelId = "gpt-6-astra";
+    const cases = [
+      { name: "below", configuredContext: 200_000, configuredInput: 150_000, expectedContext: 200_000, expectedInput: 150_000 },
+      { name: "above", configuredContext: 1_100_000, configuredInput: 950_000, expectedContext: 1_050_000, expectedInput: 922_000 },
+    ] as const;
+
+    for (const limits of cases) {
+      const captured = captureProviderGather("openai-apikey", {
+        adapter: "openai-responses",
+        baseUrl: "https://api.openai.com/v1",
+        authMode: "key",
+        apiKey: "test-key",
+        liveModels: false,
+        models: [modelId],
+        modelContextWindows: { [modelId]: limits.configuredContext },
+        modelMaxInputTokens: { [modelId]: limits.configuredInput },
+      }, refreshingModelsAuthResolver);
+      const { models } = await fetchProviderModelsWithAuth(captured, 0, undefined, refreshingModelsAuthResolver);
+      const row = models.find(model => model.id === modelId);
+
+      expect({
+        name: limits.name,
+        capturedContext: captured.provider.modelContextWindows?.[modelId],
+        capturedInput: captured.provider.modelMaxInputTokens?.[modelId],
+        emittedContext: row?.contextWindow,
+        emittedInput: row?.maxInputTokens,
+      }).toEqual({
+        name: limits.name,
+        capturedContext: limits.expectedContext,
+        capturedInput: limits.expectedInput,
+        emittedContext: limits.expectedContext,
+        emittedInput: limits.expectedInput,
+      });
+    }
+  });
+
+  test("Anthropic family context outranks provider-wide and observed date-model limits", () => {
+    const modelId = "claude-sonnet-4-20250514";
+    const captured = captureProviderGather("anthropic", {
+      adapter: "anthropic",
+      baseUrl: "https://api.anthropic.com",
+      authMode: "oauth",
+      liveModels: false,
+      models: [modelId],
+      contextWindow: 111_000,
+      modelContextWindows: { "claude-sonnet-4": 222_000 },
+    }, refreshingModelsAuthResolver);
+
+    const projected = applyProviderConfigHints("anthropic", captured.provider, {
+      provider: "anthropic",
+      id: modelId,
+      contextWindow: 333_000,
+    });
+    expect(projected.contextWindow).toBe(222_000);
+  });
+});
diff --git a/tests/routing/router-combo-failover-classification.test.ts b/tests/routing/router-combo-failover-classification.test.ts
index d91c6947464..68f39401a39 100644
--- a/tests/routing/router-combo-failover-classification.test.ts
+++ b/tests/routing/router-combo-failover-classification.test.ts
@@ -222,8 +222,17 @@ const unsupportedImage = {
   message: "Model 'gpt-5.3-codex-spark' does not support image inputs. Try again with a vision model.",
 };
 
+const responsesToolRoutingMismatch = {
+  type: "invalid_request_error", code: null, param: "reasoning_effort",
+  message: "Function tools with reasoning_effort are not supported for gpt-6-astra in /v1/chat/completions. To use function tools, use /v1/responses or set reasoning_effort to 'none'.",
+};
+const datedResponsesToolRoutingMismatch = {
+  ...responsesToolRoutingMismatch,
+  message: responsesToolRoutingMismatch.message.replace("gpt-6-astra", "gpt-6-astra-2026-09-03"),
+};
+
 describe("request-local optional control incompatibility", () => {
-  test.each([unsupportedUser, unsupportedEffort, unsupportedImage])("hops a structured target-local request rejection without cooling: %j", error => {
+  test.each([unsupportedUser, unsupportedEffort, unsupportedImage, responsesToolRoutingMismatch, datedResponsesToolRoutingMismatch])("hops a structured target-local request rejection without cooling: %j", error => {
     const body = JSON.stringify({ error });
     for (const message of [body, `Provider error 400: ${body}`]) {
       expect(comboFailureDecision(400, message, { code: "invalid_request_error" })).toBe("hop");
@@ -241,6 +250,12 @@ describe("request-local optional control incompatibility", () => {
     { ...unsupportedEffort, param: "input" },
     { ...unsupportedEffort, code: "unknown_terminal_code" },
     { ...unsupportedEffort, code: "cyber_policy" },
+    { ...responsesToolRoutingMismatch, param: "tools" },
+    { ...responsesToolRoutingMismatch, code: "unsupported_value" },
+    { ...responsesToolRoutingMismatch, code: undefined },
+    { ...responsesToolRoutingMismatch, message: responsesToolRoutingMismatch.message.replace("gpt-6-astra", "gpt-6-astra-preview") },
+    { ...responsesToolRoutingMismatch, message: responsesToolRoutingMismatch.message.replace("gpt-6-astra", "gpt-6-astra-2026-9-3") },
+    { ...responsesToolRoutingMismatch, message: "Function tools are not supported." },
   ])("does not relax an unrelated or conflicting refusal: %j", error => {
     expect(comboFailureDecision(400, JSON.stringify({ error }))).toBe("stop");
   });
diff --git a/tests/routing/routing-policy-fallback.test.ts b/tests/routing/routing-policy-fallback.test.ts
index bb52481b3f6..347b9bdaaac 100644
--- a/tests/routing/routing-policy-fallback.test.ts
+++ b/tests/routing/routing-policy-fallback.test.ts
@@ -9,6 +9,7 @@ import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import {
   handleResponsesWithPolicyFallback,
   rankPolicyFallbackCandidates,
+  type PolicyFallbackDeps,
 } from "../../src/server/responses/policy-fallback";
 
 function policyTrace(): RouteDecisionTraceV1 {
@@ -61,6 +62,7 @@ describe("policy candidate fallback", () => {
       port: 0, defaultProvider: "provider-a", providers: {},
     }, log, {}, {
       runCore: async (req, _config, context, options) => {
+        options.onRequestBodyParsed?.(await req.json());
         snapshots.push(options.openAiSidecarAuth);
         primaryAuth.push(req.headers.get("authorization"));
         context.routeDecision = policyTrace();
@@ -86,6 +88,28 @@ describe("policy candidate fallback", () => {
     ]);
   });
 
+  test("leaves request body parsing to the core handler", async () => {
+    const req = request();
+    let cloneCalls = 0;
+    Object.defineProperty(req, "clone", {
+      value: () => {
+        cloneCalls += 1;
+        throw new Error("fallback wrapper must not clone the request body");
+      },
+    });
+
+    const response = await handleResponsesWithPolicyFallback(
+      req,
+      {} as OcxConfig,
+      {} as RequestLogContext,
+      {},
+      { runCore: async () => new Response(null, { status: 204 }) },
+    );
+
+    expect(response.status).toBe(204);
+    expect(cloneCalls).toBe(0);
+  });
+
   test("a local input-admission refusal hops instead of ending the chain (#1524)", async () => {
     // #1524: a candidate whose context window cannot fit the request used to TERMINATE the
     // fallback chain. It is a local preflight verdict about ONE candidate, not about the
@@ -93,8 +117,9 @@ describe("policy candidate fallback", () => {
     const trace = policyTrace();
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     const seenModels: string[] = [];
-    const runCore = async (req: Request, _config: OcxConfig, ctx: RequestLogContext) => {
+    const runCore: NonNullable<PolicyFallbackDeps["runCore"]> = async (req, _config, ctx, options) => {
       const body = await req.clone().json() as { model?: string };
+      options.onRequestBodyParsed?.(body);
       seenModels.push(String(body.model));
       ctx.routeDecision = trace;
       seedAttempt(ctx, "provider", String(body.model));
@@ -126,8 +151,9 @@ describe("policy candidate fallback", () => {
     const trace = policyTrace();
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     const seenModels: string[] = [];
-    const runCore = async (req: Request, _config: OcxConfig, ctx: RequestLogContext) => {
+    const runCore: NonNullable<PolicyFallbackDeps["runCore"]> = async (req, _config, ctx, options) => {
       const body = await req.clone().json() as { model?: string };
+      options.onRequestBodyParsed?.(body);
       seenModels.push(String(body.model));
       ctx.routeDecision = trace;
       seedAttempt(ctx, "provider", String(body.model));
@@ -149,8 +175,9 @@ describe("policy candidate fallback", () => {
     const trace = policyTrace();
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     const seenModels: string[] = [];
-    const runCore = async (req: Request, _config: OcxConfig, ctx: RequestLogContext) => {
+    const runCore: NonNullable<PolicyFallbackDeps["runCore"]> = async (req, _config, ctx, options) => {
       const body = await req.clone().json() as { model?: string };
+      options.onRequestBodyParsed?.(body);
       seenModels.push(String(body.model));
       ctx.routeDecision = trace;
       seedAttempt(ctx, "provider", String(body.model));
@@ -193,6 +220,7 @@ describe("policy candidate fallback", () => {
         seenAuthorization.push(req.headers.get("authorization"));
         seenAccountIds.push(req.headers.get("chatgpt-account-id"));
         const body = await req.json() as { model: string };
+        options.onRequestBodyParsed?.(body);
         seenModels.push(body.model);
         seenTerminalCodes.push(childLog.terminalErrorCode);
         const first = seenModels.length === 1;
@@ -237,6 +265,7 @@ describe("policy candidate fallback", () => {
     }, {
       runCore: async (req, _config, childLog, options) => {
         const body = await req.json() as { model: string };
+        options.onRequestBodyParsed?.(body);
         seenModels.push(body.model);
         childLog.routeDecision = trace;
         seedAttempt(childLog, "provider-a", "model-a");
@@ -258,8 +287,9 @@ describe("policy candidate fallback", () => {
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     let calls = 0;
     const response = await handleResponsesWithPolicyFallback(request(), {} as OcxConfig, logCtx, {}, {
-      runCore: async () => {
+      runCore: async (req, _config, _ctx, options) => {
         calls += 1;
+        options.onRequestBodyParsed?.(await req.json());
         throw new RequestPacingQueueOverloadError("provider-a", "queue_full", 2);
       },
     });
@@ -273,8 +303,9 @@ describe("policy candidate fallback", () => {
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     let calls = 0;
     const response = await handleResponsesWithPolicyFallback(request(), {} as OcxConfig, logCtx, {}, {
-      runCore: async (_req, _config, childLog) => {
+      runCore: async (req, _config, childLog, options) => {
         calls += 1;
+        options.onRequestBodyParsed?.(await req.json());
         childLog.requestedModel = "policy/daily";
         childLog.routeDecision = trace;
         return new Response(JSON.stringify({ error: { message: "invalid request", type: "invalid_request_error" } }), {
@@ -293,8 +324,9 @@ describe("policy candidate fallback", () => {
     const logCtx = { requestedModel: "policy/daily", routeDecision: trace, attempts: [] } as unknown as RequestLogContext;
     let calls = 0;
     const response = await handleResponsesWithPolicyFallback(request(controller.signal), {} as OcxConfig, logCtx, {}, {
-      runCore: async (_req, _config, childLog) => {
+      runCore: async (req, _config, childLog, options) => {
         calls += 1;
+        options.onRequestBodyParsed?.(await req.json());
         childLog.routeDecision = trace;
         controller.abort();
         return new Response(JSON.stringify({ error: { type: "rate_limit_error" } }), { status: 429 });
@@ -310,8 +342,9 @@ describe("policy candidate fallback", () => {
     let calls = 0;
     const body = "data: {\"type\":\"response.output_text.delta\",\"delta\":\"hello\"}\n\ndata: {\"type\":\"response.failed\"}\n\n";
     const response = await handleResponsesWithPolicyFallback(request(), {} as OcxConfig, logCtx, {}, {
-      runCore: async (_req, _config, childLog) => {
+      runCore: async (req, _config, childLog, options) => {
         calls += 1;
+        options.onRequestBodyParsed?.(await req.json());
         childLog.routeDecision = trace;
         return new Response(body, { status: 200, headers: { "content-type": "text/event-stream" } });
       },
diff --git a/tests/routing/routing-policy-surface-parity.test.ts b/tests/routing/routing-policy-surface-parity.test.ts
index d73c5ff483f..5bdd93161a7 100644
--- a/tests/routing/routing-policy-surface-parity.test.ts
+++ b/tests/routing/routing-policy-surface-parity.test.ts
@@ -11,6 +11,7 @@ import type { AdapterEvent, OcxConfig, OcxProviderConfig } from "../../src/types
 import { clearRequestLogsForTests, type RequestLogContext } from "../../src/server/request-log";
 import { readUsageEntries } from "../../src/usage/log";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const MODEL = "policy/daily";
 const EXPECTED_RICH_EVIDENCE = {
@@ -125,8 +126,15 @@ mock.module("../../src/server/adapter-resolve", () => ({
 const { handleResponses, handleResponsesCompact } = await import("../../src/server/responses");
 const { handleChatCompletions } = await import("../../src/server/chat-completions");
 const { handleClaudeMessages } = await import("../../src/server/claude-messages");
+let releaseSpendHome: (() => void) | undefined;
+
+// Taken only by handler rows whose fixture adapter produces a dispatched response.
+const takeSpendHome = (): void => { releaseSpendHome = acquireOwnedSpendHome(); };
 
 afterEach(() => {
+  // Released first so a failed handler row cannot leak ownership into the next case.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   adapterFactory = undefined;
 });
 
@@ -224,6 +232,7 @@ describe("routing policy request evidence parity (via dev handlers)", () => {
     }
   });
   test("rich evidence (tools + image) produces identical route decision across all three surfaces", async () => {
+    takeSpendHome();
     adapterFactory = minimalSuccessAdapter;
     const config = testConfig();
 
@@ -345,6 +354,7 @@ describe("routing policy request evidence parity (via dev handlers)", () => {
   });
 
   test("plain text with no tools produces no hard requirements on every surface", async () => {
+    takeSpendHome();
     adapterFactory = minimalSuccessAdapter;
     const config = testConfig();
 
diff --git a/tests/routing/subagent-fallback-handle-responses.test.ts b/tests/routing/subagent-fallback-handle-responses.test.ts
index fb236802e1d..cc7eca13c0a 100644
--- a/tests/routing/subagent-fallback-handle-responses.test.ts
+++ b/tests/routing/subagent-fallback-handle-responses.test.ts
@@ -9,6 +9,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { setRelayPlatformForTests } from "../../src/server/responses/passthrough-delivery";
 import {
   clearAccountQuota,
   updateAccountQuota,
@@ -43,6 +44,7 @@ import {
   encryptedInput as recoverableEncryptedInput,
   recoverySse,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 setDefaultTimeout(30_000);
@@ -52,6 +54,7 @@ const originalNow = Date.now;
 let testDir: string;
 let previousOpencodexHome: string | undefined;
 let previousCodexHome: string | undefined;
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   testDir = mkdtempSync(join(tmpdir(), "ocx-subagent-hr-"));
@@ -59,6 +62,8 @@ beforeEach(() => {
   previousCodexHome = process.env.CODEX_HOME;
   process.env.OPENCODEX_HOME = testDir;
   process.env.CODEX_HOME = testDir;
+  // Direct handler dispatches need the writer lease that startServer normally holds.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearThreadAccountMap();
   clearCodexUpstreamHealth();
   clearAccountQuota();
@@ -71,6 +76,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   Date.now = originalNow;
   clearThreadAccountMap();
@@ -2150,9 +2158,16 @@ describe("native passthrough terminal finalization", () => {
     const terminals: ResponsesTerminalStatus[] = [];
     mockSseUpstream(sseBody);
 
-    const platformDescriptor = Object.getOwnPropertyDescriptor(process, "platform");
-    // Force win32 so eager-relay decision path is reachable via streamMode override.
-    Object.defineProperty(process, "platform", { value: "win32", configurable: true });
+    // darwin, not win32, because this pair is about streamMode choosing the path. On win32 a
+    // turn that needs a client rewrite takes the eager relay unconditionally (#864), so the
+    // legacy half could never be legacy there and the marker assertion below would be a lie.
+    // darwin is the platform where the configured mode actually decides.
+    //
+    // The claim is also narrowed to the relay decision itself: overwriting process.platform
+    // globally redirects filesystem, ACL and state-directory identity too, and the spend-ledger
+    // owner lowercases its home on win32, which on a case-sensitive filesystem is a different
+    // directory. That made the send unreservable and the turn delivered no terminal at all.
+    setRelayPlatformForTests("darwin");
     try {
       const response = await postSpawn(
         cfg,
@@ -2161,6 +2176,12 @@ describe("native passthrough terminal finalization", () => {
           onNativePassthroughTerminal: (status) => terminals.push(status),
         },
       );
+      // Asserted before the callback is inspected, so a turn that never delivered says so
+      // instead of presenting as a missing callback.
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toContain("text/event-stream");
+      // The relay path this case exists to exercise, proven rather than assumed.
+      expect(isEagerRelaySseResponse(response)).toBe(streamMode === "eager-relay");
       const responseText = await response.text();
       // Allow inspection consumer microtasks to settle.
       await Bun.sleep(20);
@@ -2170,7 +2191,7 @@ describe("native passthrough terminal finalization", () => {
         responseText,
       };
     } finally {
-      if (platformDescriptor) Object.defineProperty(process, "platform", platformDescriptor);
+      setRelayPlatformForTests(undefined);
     }
   }
 
diff --git a/tests/routing/subagent-model-fallback.test.ts b/tests/routing/subagent-model-fallback.test.ts
index 7834db68efb..d68330dc83c 100644
--- a/tests/routing/subagent-model-fallback.test.ts
+++ b/tests/routing/subagent-model-fallback.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, setDefaultTimeout, test } from "bun:test";
-import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -1337,6 +1337,18 @@ test("the native-main drain sentinel covers the flagships without widening to gp
     expect(readCodexAgentModelFallback("empty_fallback", dir)).toEqual([]);
   });
 
+  test("scanCodexAgentRolesWithTomlModelFallback tolerates a malformed agents path", () => {
+    const dir = codexHomeFixture();
+    rmSync(join(dir, "agents"), { recursive: true });
+    writeFileSync(join(dir, "agents"), "not a directory", "utf8");
+    let scanError: unknown;
+
+    expect(scanCodexAgentRolesWithTomlModelFallback(dir, cause => {
+      scanError = cause;
+    })).toEqual([]);
+    expect(scanError).toBeInstanceOf(Error);
+  });
+
   test("scanCodexAgentRolesWithTomlModelFallback recognizes quoted model_fallback keys", () => {
     const dir = codexHomeFixture();
     writeFileSync(join(dir, "agents", "quoted_key.toml"), [
diff --git a/tests/server/agent-task-recovery-cache.test.ts b/tests/server/agent-task-recovery-cache.test.ts
index 35b5ba70501..1b5c5567fef 100644
--- a/tests/server/agent-task-recovery-cache.test.ts
+++ b/tests/server/agent-task-recovery-cache.test.ts
@@ -17,9 +17,20 @@ import {
   recoverySse,
   routedConfig,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const realDateNow = Date.now;
 
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is refused.
+let releaseSpendHome: (() => void) | undefined;
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
+
 describe("agent task recovery cache", () => {
   beforeEach(() => resetAgentTaskRecoveryCache());
 
diff --git a/tests/server/agent-task-recovery-combo.test.ts b/tests/server/agent-task-recovery-combo.test.ts
index 8823270ff26..7df943326bc 100644
--- a/tests/server/agent-task-recovery-combo.test.ts
+++ b/tests/server/agent-task-recovery-combo.test.ts
@@ -25,8 +25,15 @@ import {
   recoverySse,
   routedConfig,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is
+// refused. Taken inside the block below rather than here, because that block installs its own
+// OPENCODEX_HOME after this hook would have run, and a lease binds the directory in effect when
+// it was taken.
+let releaseSpendHome: (() => void) | undefined;
+
 function providerCompletion(): Response {
   return Response.json({
     id: "chatcmpl_combo_recovery",
@@ -58,6 +65,7 @@ describe("combo path encrypted agent task recovery", () => {
   beforeEach(() => {
     home = mkdtempSync(join(tmpdir(), "ocx-agent-task-combo-"));
     process.env["OPENCODEX_HOME"] = home;
+    releaseSpendHome = acquireOwnedSpendHome();
     clearResponseStateMemoryForTests();
     resetAgentTaskRecoveryState();
     clearCachedProviderQuotas();
@@ -70,6 +78,9 @@ describe("combo path encrypted agent task recovery", () => {
     clearCachedProviderQuotas();
     clearComboTargetCooldowns();
     clearResponseStateForTests();
+    // Released after the state flush and before the directory holding it is removed.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     removeTreeWithRetry(home);
     if (priorHome === undefined) delete process.env["OPENCODEX_HOME"];
     else process.env["OPENCODEX_HOME"] = priorHome;
diff --git a/tests/server/agent-task-recovery-fallback.test.ts b/tests/server/agent-task-recovery-fallback.test.ts
index 19495add896..1bb983c13ec 100644
--- a/tests/server/agent-task-recovery-fallback.test.ts
+++ b/tests/server/agent-task-recovery-fallback.test.ts
@@ -13,6 +13,17 @@ import {
   recoverySse,
   routedConfig,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is refused.
+let releaseSpendHome: (() => void) | undefined;
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 describe("agent task recovery fallback routing", () => {
   beforeEach(() => {
diff --git a/tests/server/agent-task-recovery-security.test.ts b/tests/server/agent-task-recovery-security.test.ts
index c7a5ede55db..e478a160c89 100644
--- a/tests/server/agent-task-recovery-security.test.ts
+++ b/tests/server/agent-task-recovery-security.test.ts
@@ -19,9 +19,20 @@ import {
   routedConfig,
   ROUTING_ENVELOPE,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const realDateNow = Date.now;
 
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is refused.
+let releaseSpendHome: (() => void) | undefined;
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
+
 describe("agent task recovery security", () => {
   beforeEach(() => resetAgentTaskRecoveryState());
 
diff --git a/tests/server/agent-task-recovery.test.ts b/tests/server/agent-task-recovery.test.ts
index faf117f1a76..ffbeb296279 100644
--- a/tests/server/agent-task-recovery.test.ts
+++ b/tests/server/agent-task-recovery.test.ts
@@ -26,6 +26,17 @@ import {
   ROUTING_ENVELOPE,
   SECOND_FERNET_TASK,
 } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is refused.
+let releaseSpendHome: (() => void) | undefined;
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 describe("agent task recovery (opt-in, default off)", () => {
   beforeEach(() => {
diff --git a/tests/server/aside-profiles-routes.test.ts b/tests/server/aside-profiles-routes.test.ts
index a21f0168b64..2c202e13130 100644
--- a/tests/server/aside-profiles-routes.test.ts
+++ b/tests/server/aside-profiles-routes.test.ts
@@ -1,11 +1,12 @@
 import { loadConfig } from "../../src/config";
 import { afterEach, beforeEach, expect, test } from "bun:test";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { handleManagementAPI } from "../../src/server/management-api";
 import { MANAGEMENT_JSON_BODY_MAX_BYTES } from "../../src/server/management/body";
 import { setIntegrationMutationFlightTestHooks, setIntegrationPathTestHooks } from "../../src/server/management/integration-routes";
+import { defaultIntegrationIO } from "../../src/integrations/config-io";
 import { createIntegrationStateStore, type IntegrationStateStore } from "../../src/integrations/store";
 import { applyIntegration } from "../../src/integrations/writer";
 import { refreshOwnedCatalogIntegrations } from "../../src/integrations/catalog-refresh";
@@ -13,6 +14,10 @@ import type { OcxConfig } from "../../src/types";
 import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { exportSnapshotIdentity, loadExportModels, previewExportSnapshot, resetExportSnapshotForTests } from "../../src/server/management/model-rows";
+import { asideGuardFor } from "../../src/server/management/aside-profile-routes";
+import { previewIntegration, type IntegrationMutationPlan } from "../../src/integrations/mutation-plan";
+import { setCached } from "../../src/codex/model-cache";
 
 let root: string;
 let home: string;
@@ -21,6 +26,12 @@ let config: OcxConfig;
 let isolation: IsolatedCodexHome;
 let priorOcxHome: string | undefined;
 let saved: OcxConfig | undefined;
+/**
+ * Runs inside the preference write, which is where the window this fixture exercises lives: the
+ * confirmation has been checked, nothing has been written to the client yet, and an editor outside
+ * this process can still change the target.
+ */
+let onPersist: (() => void) | undefined;
 const env: NodeJS.ProcessEnv = {};
 
 beforeEach(() => {
@@ -43,6 +54,7 @@ beforeEach(() => {
     fixture: { adapter: "openai-chat", baseUrl: "https://fixture.invalid/v1", liveModels: false, models: ["one","two"] },
   } } as OcxConfig;
   saved = undefined;
+  onPersist = undefined;
   setIntegrationPathTestHooks({ home, env });
   setIntegrationMutationFlightTestHooks({ store });
 });
@@ -57,6 +69,26 @@ afterEach(() => {
 });
 
 function path(id: number): string { return join(home, ".aside", "u", String(id), "models.json"); }
+
+/** Whole-tree content, so an appended journal row or replaced snapshot cannot hide. */
+function treeWitness(dir: string): string {
+  if (!existsSync(dir)) return "";
+  return readdirSync(dir, { recursive: true })
+    .map(entry => String(entry))
+    .sort()
+    .map(entry => {
+      const full = join(dir, entry);
+      if (!existsSync(full) || statSync(full).isDirectory()) return `${entry}/`;
+      return `${entry}:${readFileSync(full, "utf8")}`;
+    })
+    .join("\u0000");
+}
+
+/** A preview only answers from a roster an authoritative load already finished. */
+async function seedRoster(): Promise<void> {
+  resetExportSnapshotForTests();
+  await loadExportModels(config, []);
+}
 function document(id: number) { return JSON.parse(readFileSync(path(id), "utf8")); }
 async function api(pathname: string, method = "GET", body?: unknown) {
   return rawApi(pathname, method, body === undefined ? undefined : JSON.stringify(body));
@@ -67,7 +99,7 @@ async function rawApi(pathname: string, method: string, body?: string) {
     method, headers: { Host: url.host, "content-type": "application/json" },
     ...(body === undefined ? {} : { body }),
   }), url, config, {
-    saveConfigPreservingClaudeCode: value => { saved = structuredClone(value); },
+    saveConfigPreservingClaudeCode: value => { saved = structuredClone(value); onPersist?.(); },
     createManagementConvergeCodex: catalogConvergenceFactory(),
     refreshOwnedCatalogIntegrations: input => refreshOwnedCatalogIntegrations({ ...input, store, env, home }),
   });
@@ -196,6 +228,141 @@ test("profile history and Undo cannot recreate an undone enable on the next sync
   expect(document(0).providers.opencodex).toBeUndefined();
 });
 
+test("profile zero can be planned; it is a real profile, not an absent one", async () => {
+  await seedRoster();
+  const response = await api("/api/client-integrations/aside/profiles/0/preview", "POST", { operation: "apply" });
+  expect(response.status).toBe(200);
+  const plan = await response.json() as { canApply: boolean; profileId?: number; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+  expect(plan.profileId).toBe(0);
+  // A plan names places, never the profile's location.
+  expect(JSON.stringify(plan)).not.toContain(home);
+});
+
+test("a previewed profile change commits once and then has no roster to replay against", async () => {
+  await seedRoster();
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", { operation: "apply" });
+  expect(preview.status).toBe(200);
+  const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+
+  const commit = await api("/api/client-integrations/aside/profiles/1", "PUT", {
+    enabled: true, operation: "apply", planFingerprint: plan.fingerprint,
+  });
+  expect(commit.status).toBe(200);
+  expect(document(1).providers.opencodex).toBeDefined();
+  const committed = readFileSync(path(1), "utf8");
+
+  // Replaying the same confirmation is refused before anything is written, and the reason is the
+  // earlier of the two: committing wrote the Aside preference into the configuration, so the
+  // roster this plan was bound to no longer describes the configuration in hand and there is
+  // nothing to replan against until the collection is read again. Production reaches the same
+  // point through the file, which the preference write also rewrites.
+  const replay = await api("/api/client-integrations/aside/profiles/1", "PUT", {
+    enabled: true, operation: "apply", planFingerprint: plan.fingerprint,
+  });
+  expect(replay.status).toBe(409);
+  expect((await replay.json() as { code: string }).code).toBe("integration_preview_unavailable");
+  expect(readFileSync(path(1), "utf8")).toBe(committed);
+  // The refusal must not touch a sibling profile either.
+  expect(document(2).providers.opencodex).toBeUndefined();
+});
+
+test("a stale profile confirmation is refused before the preference is written", async () => {
+  await seedRoster();
+  const preview = await api("/api/client-integrations/aside/profiles/2/preview", "POST", { operation: "apply" });
+  const plan = await preview.json() as { fingerprint: string };
+  const before = readFileSync(path(2), "utf8");
+  const homeBefore = treeWitness(join(home, ".aside"));
+  const storeBefore = treeWitness(join(root, "store"));
+
+  const response = await api("/api/client-integrations/aside/profiles/2", "PUT", {
+    enabled: true, operation: "apply", planFingerprint: `${plan.fingerprint}-not-current`,
+  });
+  expect(response.status).toBe(409);
+  expect((await response.json() as { code: string }).code).toBe("integration_preview_stale");
+  expect(readFileSync(path(2), "utf8")).toBe(before);
+  // Ownership records, snapshots and journal rows live in the store, and an Aside import writes
+  // history before any writer runs, so the target file alone would not see either of them.
+  expect(treeWitness(join(home, ".aside"))).toBe(homeBefore);
+  expect(treeWitness(join(root, "store"))).toBe(storeBefore);
+  // Aside persists its preference before any writer runs, so a check that fired later would have
+  // saved this already.
+  expect(saved).toBeUndefined();
+});
+
+test("a bound undo follows the copy resolution actually chose", async () => {
+  await seedRoster();
+  const original = readFileSync(path(1), "utf8");
+  const applied = await api("/api/client-integrations/aside/profiles/1", "PUT", { enabled: true });
+  expect(applied.status).toBe(200);
+  expect(document(1).providers.opencodex).toBeDefined();
+
+  const profileStore = join(root, "store", "aside-profiles", "1");
+  const rows = readFileSync(join(profileStore, "journal.jsonl"), "utf8");
+  const opId = JSON.parse(rows.trim().split("\n")[0] ?? "{}").opId as string;
+  expect(typeof opId).toBe("string");
+
+  /*
+   * The same operation can live in more than one store with different retention. Resolution
+   * prefers the copy whose snapshot still exists, so putting a stored copy in the root store and
+   * expiring the profile's own forces it to choose the alternate. If a preview and the mutation
+   * resolved independently they could pick different copies, and the confirmation would then
+   * describe an operation other than the one that runs.
+   */
+  writeFileSync(join(root, "store", "journal.jsonl"), rows);
+  const snapshotName = join("snapshots", "aside", opId);
+  mkdirSync(join(root, "store", "snapshots", "aside"), { recursive: true });
+  writeFileSync(join(root, "store", snapshotName), readFileSync(join(profileStore, snapshotName), "utf8"));
+  rmSync(join(profileStore, snapshotName));
+
+  const siblingBefore = treeWitness(join(root, "store", "aside-profiles", "2"));
+  const sibling2Before = readFileSync(path(2), "utf8");
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", { operation: "restore", opId });
+  expect(preview.status).toBe(200);
+  const plan = await preview.json() as {
+    canApply: boolean; fingerprint: string; profileId?: number;
+    changes: Array<{ kind: string; path: string }>;
+  };
+  expect(plan.canApply).toBe(true);
+  expect(plan.profileId).toBe(1);
+  /*
+   * This undo takes the managed block back out, because the apply it reverses had nothing of ours
+   * before it. Saying so requires reading the ownership of the file being rewritten, which lives
+   * in the profile's own store, while the row and its snapshot were resolved out of the root one.
+   * Reading the selected row's store instead would describe another file's ownership.
+   */
+  expect(plan.changes.some(change => change.kind === "remove")).toBe(true);
+  expect(plan.changes.some(change => change.kind === "add")).toBe(false);
+
+  const undo = await api("/api/client-integrations/aside/profiles/1/restore", "POST", {
+    opId, operation: "restore", planFingerprint: plan.fingerprint,
+  });
+  expect(undo.status).toBe(200);
+  const result = await undo.json() as { ok: boolean; changed: boolean; clientId: string; profileId: number; opId: string };
+  expect(result).toMatchObject({ ok: true, changed: true, clientId: "aside", profileId: 1 });
+  expect(typeof result.opId).toBe("string");
+
+  // Restored from the copy that was chosen, byte for byte.
+  expect(readFileSync(path(1), "utf8")).toBe(original);
+
+  // The undo is journalled in the profile's own store as a restore row, rather than inferred from
+  // a substring of two files concatenated together.
+  const profileRows = readFileSync(join(profileStore, "journal.jsonl"), "utf8")
+    .trim().split("\n").map(line => JSON.parse(line) as { kind: string; opId: string });
+  expect(profileRows.filter(row => row.kind === "restore")).toEqual([
+    expect.objectContaining({ kind: "restore", opId: result.opId }),
+  ]);
+  expect(profileRows.some(row => row.opId === opId)).toBe(true);
+
+  // The copy resolution chose is not rewritten, and the sibling profile is untouched in both its
+  // document and its store.
+  expect(readFileSync(join(root, "store", "journal.jsonl"), "utf8")).toBe(rows);
+  expect(readFileSync(join(root, "store", snapshotName), "utf8")).toBe(original);
+  expect(readFileSync(path(2), "utf8")).toBe(sibling2Before);
+  expect(treeWitness(join(root, "store", "aside-profiles", "2"))).toBe(siblingBefore);
+});
+
 test.each(["../0", "01", "-1", "9007199254740992"])("rejects invalid profile %s before file mutation", async id => {
   const before = [0,1,2].map(i => readFileSync(path(i), "utf8"));
   const response = await api(`/api/client-integrations/aside?profile=${encodeURIComponent(id)}`, "PUT", { enabled: true });
@@ -250,3 +417,245 @@ test("dedicated nested paths retain profile scope for status, history and restor
   expect(document(2).providers.opencodex).toBeUndefined();
   expect(document(0).providers.opencodex).toBeUndefined();
 });
+
+test("a bound confirmation is refused when the roster it was planned against has moved", async () => {
+  // The guard the route installs, exercised with the input a mutation would be written from. Only
+  // the rows are carried into the mutation, so an ordinary load completing while it prepares can
+  // replace or retire the snapshot without the carried rows noticing.
+  resetExportSnapshotForTests();
+  // A roster with rows in it, so the plan below is a real apply rather than a noop.
+  await loadExportModels(config, [{ id: "one", provider: "fixture" }]);
+  const identity = exportSnapshotIdentity(config);
+  expect(identity).not.toBeNull();
+  const roster = previewExportSnapshot(config);
+  expect(roster).not.toBeNull();
+
+  const profileStore = createIntegrationStateStore(join(root, "store", "aside-profiles", "1"));
+  const prepared = {
+    clientId: "aside" as const,
+    config,
+    models: roster!.models,
+    port: 10100,
+    env,
+    home,
+    store: profileStore,
+    resolvedPaths: { configPath: path(1), detectDir: join(home, ".aside", "u", "1") },
+  };
+  const plan = previewIntegration(prepared, { operation: "apply" as const, profileId: 1 });
+  expect(plan.canApply).toBe(true);
+
+  const capture: { plan: IntegrationMutationPlan | null } = { plan: null };
+  const guard = asideGuardFor({ config }, identity!, 1, { operation: "apply", fingerprint: plan.fingerprint }, {}, capture);
+
+  // Current roster, matching fingerprint: the confirmation stands.
+  expect(await guard(prepared)).toBeNull();
+
+  // A discovery publishes while this change is in flight. The rows the guard holds are unchanged,
+  // and they are no longer the roster the operator was shown.
+  expect(setCached("fixture", [{ id: "published-mid-flight", provider: "fixture" }])).toBe(true);
+  expect(exportSnapshotIdentity(config)).toBeNull();
+  const refused = await guard(prepared);
+  expect(refused).toMatchObject({ ok: false, reason: "conflict", clientId: "aside", profileId: 1 });
+  expect(refused?.message).toContain("roster changed");
+  expect(capture.plan).not.toBeNull();
+});
+
+test("a confirmed disable of a profile with nothing applied saves the preference and touches no file", async () => {
+  /*
+   * willChange: false is a statement about the managed client document, and the plan says so. The
+   * change still records the operator's desired sync preference for that profile, which happens
+   * before any client document is touched, so the document and its history stay exactly as they
+   * were while the preference is saved.
+   */
+  await seedRoster();
+  const before = readFileSync(path(1), "utf8");
+  const profileStoreBefore = treeWitness(join(root, "store", "aside-profiles", "1"));
+  const rootStoreBefore = treeWitness(join(root, "store"));
+
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", { operation: "disable" });
+  expect(preview.status).toBe(200);
+  const plan = await preview.json() as { canApply: boolean; willChange: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+  expect(plan.willChange).toBe(false);
+
+  const disabled = await api("/api/client-integrations/aside?profile=1", "PUT", {
+    enabled: false, operation: "disable", planFingerprint: plan.fingerprint,
+  });
+  expect(disabled.status).toBe(200);
+
+  // Nothing in the client's document or in either store moved.
+  expect(readFileSync(path(1), "utf8")).toBe(before);
+  expect(treeWitness(join(root, "store", "aside-profiles", "1"))).toBe(profileStoreBefore);
+  expect(treeWitness(join(root, "store"))).toBe(rootStoreBefore);
+
+  // The preference is the one thing that was written, and it is what the operator asked for.
+  expect(saved?.asideProfileSync?.profiles?.["1"]).toBe(false);
+  expect(config.asideProfileSync?.profiles?.["1"]).toBe(false);
+});
+
+test("a target edited while the preference is being saved is not overwritten by the old confirmation", async () => {
+  /*
+   * Aside takes no writer lock, and its preference write sits between the confirmation check and
+   * the write that check authorizes. An overwrite does not ask the writer's own conflict question,
+   * so without a second look the confirmation about the earlier file would land on the later one.
+   */
+  await seedRoster();
+  const foreign = JSON.stringify({ theme: "keep", providers: { opencodex: { models: [{ id: "written-by-someone-else" }] } } });
+  writeFileSync(path(1), foreign);
+
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", { operation: "overwrite" });
+  expect(preview.status).toBe(200);
+  const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+
+  const edited = JSON.stringify({ theme: "edited-after-the-check", providers: { opencodex: { models: [{ id: "still-not-ours" }] } } });
+  onPersist = () => { writeFileSync(path(1), edited); };
+
+  const commit = await api("/api/client-integrations/aside?profile=1", "PUT", {
+    enabled: true, overwriteConflict: true, operation: "overwrite", planFingerprint: plan.fingerprint,
+  });
+
+  expect(commit.status).toBe(409);
+  expect((await commit.json() as { code: string }).code).toBe("integration_preview_stale");
+  // The file the editor wrote is the file that is still there.
+  expect(readFileSync(path(1), "utf8")).toBe(edited);
+});
+
+test("an unchanged target still commits the same confirmed overwrite", async () => {
+  // The control for the case above: nothing moves in the window, and the confirmation stands.
+  await seedRoster();
+  writeFileSync(path(1), JSON.stringify({ theme: "keep", providers: { opencodex: { models: [{ id: "written-by-someone-else" }] } } }));
+
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", { operation: "overwrite" });
+  const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+
+  const commit = await api("/api/client-integrations/aside?profile=1", "PUT", {
+    enabled: true, overwriteConflict: true, operation: "overwrite", planFingerprint: plan.fingerprint,
+  });
+
+  expect(commit.status).toBe(200);
+  // The block that was there is the one the overwrite was for, and it is gone.
+  expect(JSON.stringify(document(1))).not.toContain("written-by-someone-else");
+  expect(document(1).providers.opencodex).toBeDefined();
+});
+
+test("a confirmed drift restore does not rewrite a target edited while preferences were saved", async () => {
+  /*
+   * Confirming drift says the operator accepted the difference they were shown. It does not say
+   * they accepted one that appeared afterwards, and the snapshot checks say nothing about the
+   * target file.
+   *
+   * The row is left only in the root store, so a restore that proceeded would copy it and its
+   * snapshot into this profile's own store first. That copy is history, and the coordinated
+   * restore cannot take it back: a refusal from inside it returns before the restore transaction
+   * begins, so nothing compensates. The refusal therefore has to happen before the copy, and the
+   * store witnesses below are what say it did.
+   */
+  const enabled = await (await api("/api/client-integrations/aside?profile=1", "PUT", { enabled: true })).json();
+  expect(enabled.ok).toBe(true);
+  const opId = enabled.opId as string;
+
+  const profileStore = join(root, "store", "aside-profiles", "1");
+  const snapshotName = join("snapshots", "aside", opId);
+  writeFileSync(join(root, "store", "journal.jsonl"), readFileSync(join(profileStore, "journal.jsonl"), "utf8"));
+  mkdirSync(join(root, "store", "snapshots", "aside"), { recursive: true });
+  writeFileSync(join(root, "store", snapshotName), readFileSync(join(profileStore, snapshotName), "utf8"));
+  rmSync(join(profileStore, snapshotName));
+
+  writeFileSync(path(1), JSON.stringify({ theme: "drifted-before-the-preview" }));
+  await seedRoster();
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", {
+    operation: "restore", opId, confirmDrift: true,
+  });
+  expect(preview.status).toBe(200);
+  const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+
+  const profileStoreBefore = treeWitness(profileStore);
+  const rootStoreBefore = treeWitness(join(root, "store"));
+  const edited = JSON.stringify({ theme: "edited-after-the-check" });
+  onPersist = () => { writeFileSync(path(1), edited); };
+
+  const undo = await api("/api/client-integrations/aside/profiles/1/restore", "POST", {
+    opId, operation: "restore", confirmDrift: true, planFingerprint: plan.fingerprint,
+  });
+
+  expect(undo.status).toBe(409);
+  expect((await undo.json() as { code: string }).code).toBe("integration_preview_stale");
+  // The editor's file is the one still there, and no history was written on the way to refusing.
+  expect(readFileSync(path(1), "utf8")).toBe(edited);
+  expect(treeWitness(profileStore)).toBe(profileStoreBefore);
+  expect(treeWitness(join(root, "store"))).toBe(rootStoreBefore);
+});
+
+test("a target edited after the history copy is still not rewritten by the old confirmation", async () => {
+  /*
+   * The copy and the restore are two moments, and an edit can land between them: the coordinated
+   * restore has no writer lock to hold one out, and it still awaits before beginning. The check
+   * before the copy accepts the file as it was; the one inside the coordinated restore is what has
+   * to see the file as it became.
+   */
+  const enabled = await (await api("/api/client-integrations/aside?profile=1", "PUT", { enabled: true })).json();
+  expect(enabled.ok).toBe(true);
+  const opId = enabled.opId as string;
+
+  const profileStore = join(root, "store", "aside-profiles", "1");
+  const snapshotName = join("snapshots", "aside", opId);
+  writeFileSync(join(root, "store", "journal.jsonl"), readFileSync(join(profileStore, "journal.jsonl"), "utf8"));
+  mkdirSync(join(root, "store", "snapshots", "aside"), { recursive: true });
+  writeFileSync(join(root, "store", snapshotName), readFileSync(join(profileStore, snapshotName), "utf8"));
+  rmSync(join(profileStore, snapshotName));
+
+  writeFileSync(path(1), JSON.stringify({ theme: "drifted-before-the-preview" }));
+  await seedRoster();
+  const preview = await api("/api/client-integrations/aside/profiles/1/preview", "POST", {
+    operation: "restore", opId, confirmDrift: true,
+  });
+  const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+  expect(plan.canApply).toBe(true);
+
+  // The absent destination snapshot is the observable boundary. Neither restore preflight nor
+  // either pre-import check can trigger the edit; only a read after the real copy can do so.
+  const copiedSnapshotPath = join(profileStore, snapshotName);
+  const sourceSnapshot = readFileSync(join(root, "store", snapshotName), "utf8");
+  expect(existsSync(copiedSnapshotPath)).toBe(false);
+  const edited = JSON.stringify({ theme: "edited-after-the-copy" });
+  let editedAfterCopy = false;
+  /*
+   * A file-level seam only. The Aside layer rebinds the journal and record writers to the
+   * profile's own store whatever io it is handed, so the history assertions below still describe
+   * the store they name.
+   */
+  const base = defaultIntegrationIO(store);
+  setIntegrationMutationFlightTestHooks({
+    store,
+    io: {
+      ...base,
+      readText: (target: string) => {
+        if (target === path(1) && !editedAfterCopy && existsSync(copiedSnapshotPath)) {
+          expect(readFileSync(copiedSnapshotPath, "utf8")).toBe(sourceSnapshot);
+          editedAfterCopy = true;
+          writeFileSync(path(1), edited);
+        }
+        return base.readText(target);
+      },
+    },
+  });
+
+  const undo = await api("/api/client-integrations/aside/profiles/1/restore", "POST", {
+    opId, operation: "restore", confirmDrift: true, planFingerprint: plan.fingerprint,
+  });
+
+  expect(editedAfterCopy).toBe(true);
+  expect(readFileSync(copiedSnapshotPath, "utf8")).toBe(sourceSnapshot);
+  expect(saved?.asideProfileSync?.profiles?.["1"]).toBe(false);
+  expect(undo.status).toBe(409);
+  expect((await undo.json() as { code: string }).code).toBe("integration_preview_stale");
+  // The editor's file survives: no restore transaction ran.
+  expect(readFileSync(path(1), "utf8")).toBe(edited);
+  // The copied history and the saved preference may remain; what must not is a restore row.
+  const profileRows = readFileSync(join(profileStore, "journal.jsonl"), "utf8")
+    .trim().split("\n").map(line => JSON.parse(line) as { kind: string });
+  expect(profileRows.some(row => row.kind === "restore")).toBe(false);
+});
diff --git a/tests/server/cancel-body-on-abort.test.ts b/tests/server/cancel-body-on-abort.test.ts
index 075fb80c084..24f1df143c1 100644
--- a/tests/server/cancel-body-on-abort.test.ts
+++ b/tests/server/cancel-body-on-abort.test.ts
@@ -1,8 +1,16 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import { cancelBodyOnAbort } from "../../src/lib/abort";
 import { handleLive, readBodyCapped } from "../../src/server/live";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
+afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
 
 function bodyWithCancelSpy(): { body: ReadableStream<Uint8Array>; cancelled: () => boolean } {
   let cancelled = false;
@@ -197,6 +205,8 @@ describe("readBodyCapped settles the stream when a read throws", () => {
     } as OcxConfig;
 
     try {
+      // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+      releaseSpendHome = acquireOwnedSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -258,6 +268,7 @@ describe("readBodyCapped settles the stream when a read throws", () => {
     } as OcxConfig;
 
     try {
+      releaseSpendHome = acquireOwnedSpendHome();
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
diff --git a/tests/server/context-history-ownership.test.ts b/tests/server/context-history-ownership.test.ts
index 3a1df4253f1..04c10475847 100644
--- a/tests/server/context-history-ownership.test.ts
+++ b/tests/server/context-history-ownership.test.ts
@@ -16,6 +16,7 @@ import { resetContextRelayActivationForTests } from "../../src/codex/context-com
 const principal = "principal-a";
 const keyAdmission: DataPlaneAdmission = { kind: "configured", keyId: "k1", source: "dedicated", contextPrincipalId: principal };
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const destination = "https://chatgpt.com/backend-api/codex";
@@ -25,6 +26,7 @@ let previousCodexHome: string | undefined;
 let home = "";
 let sent: Array<{ url: string; headers: Headers }> = [];
 let failFirstAccount: string | undefined;
+let releaseSpendHome: (() => void) | undefined;
 
 function install(id: string, owner: string, token = `${id}-token`): void {
   saveCodexAccountCredential(id, { accessToken: token, refreshToken: `${id}-refresh`,
@@ -75,6 +77,8 @@ beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME; previousCodexHome = process.env.CODEX_HOME;
   home = mkdtempSync(join(tmpdir(), "ocx-context-owner-"));
   process.env.OPENCODEX_HOME = home; process.env.CODEX_HOME = home;
+  // Direct handler dispatches need the writer lease that startServer normally holds.
+  releaseSpendHome = acquireOwnedSpendHome();
   setContextFeature(true);
   clearContextSessionOwnersForTests(); clearAccountQuota(); clearThreadAccountMap(); clearCodexUpstreamHealth();
   for (const id of ["pool-a", "pool-b", "__main__"]) clearAccountNeedsReauth(id);
@@ -98,6 +102,9 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearContextSessionOwnersForTests(); clearAccountQuota(); clearThreadAccountMap(); clearCodexUpstreamHealth();
   removeTreeWithRetry(home);
diff --git a/tests/server/management-google-tool-schema-policy.test.ts b/tests/server/management-google-tool-schema-policy.test.ts
new file mode 100644
index 00000000000..31f3ba41965
--- /dev/null
+++ b/tests/server/management-google-tool-schema-policy.test.ts
@@ -0,0 +1,104 @@
+import { expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { loadConfig, saveConfig } from "../../src/config";
+import { validateConfigCandidate } from "../../src/config/diagnostics";
+import * as destinationPolicy from "../../src/lib/destination-policy";
+import { providerEditorConfigDTO } from "../../src/server/auth-cors";
+import { handleManagementAPI } from "../../src/server/management-api";
+import type { OcxConfig } from "../../src/types";
+import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
+import { ManagementRequest as Request } from "../helpers/management-auth";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+function config(policy?: "compatible" | "reject-lossy"): OcxConfig {
+  return {
+    port: 0,
+    defaultProvider: "google",
+    providers: {
+      google: {
+        adapter: "google",
+        baseUrl: "https://generativelanguage.googleapis.com",
+        apiKey: "test-key",
+        googleMode: "ai-studio",
+        ...(policy ? { googleToolSchemaPolicy: policy } : {}),
+      },
+    },
+  };
+}
+
+test("Google tool-schema policy validates, persists, and stays absent when omitted", () => {
+  const testDir = mkdtempSync(join(tmpdir(), "ocx-google-tool-schema-policy-"));
+  const previousHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = testDir;
+  try {
+    for (const policy of ["compatible", "reject-lossy"] as const) {
+      saveConfig(config(policy));
+      const loaded = loadConfig();
+      expect(loaded.providers.google?.googleToolSchemaPolicy).toBe(policy);
+      saveConfig(loaded);
+      expect(loadConfig().providers.google?.googleToolSchemaPolicy).toBe(policy);
+    }
+
+    saveConfig(config());
+    const omitted = loadConfig();
+    expect(omitted.providers.google?.googleToolSchemaPolicy).toBeUndefined();
+    saveConfig(omitted);
+    expect(loadConfig().providers.google?.googleToolSchemaPolicy).toBeUndefined();
+
+    const invalid = config() as unknown as Record<string, unknown>;
+    (invalid.providers as Record<string, Record<string, unknown>>).google!.googleToolSchemaPolicy = "silent-loss";
+    const validation = validateConfigCandidate(invalid);
+    expect(validation.ok).toBe(false);
+    if (!validation.ok) expect(validation.error).toContain("googleToolSchemaPolicy");
+  } finally {
+    if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousHome;
+    removeTreeWithRetry(testDir);
+  }
+});
+
+test("provider editor round-trips valid policy and rejects an unknown value without mutation", async () => {
+  const testDir = mkdtempSync(join(tmpdir(), "ocx-google-tool-schema-editor-"));
+  const previousHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = testDir;
+  const live = config("compatible");
+  saveConfig(live);
+  const resolved = spyOn(destinationPolicy, "providerDestinationResolvedError").mockResolvedValue(null);
+  const request = async (body: unknown) => {
+    const url = new URL("http://localhost/api/providers");
+    return (await handleManagementAPI(new Request(url, {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    }), url, live, { createManagementConvergeCodex: catalogConvergenceFactory() }))!;
+  };
+  try {
+    const baseline = providerEditorConfigDTO(loadConfig());
+    expect(baseline.providers.google?.googleToolSchemaPolicy).toBe("compatible");
+    const next = structuredClone(baseline);
+    next.providers.google!.googleToolSchemaPolicy = "reject-lossy";
+    const accepted = await request({ baseline, next });
+    expect(accepted.status, await accepted.text()).toBe(200);
+    expect(live.providers.google?.googleToolSchemaPolicy).toBe("reject-lossy");
+    expect(loadConfig().providers.google?.googleToolSchemaPolicy).toBe("reject-lossy");
+
+    const stable = providerEditorConfigDTO(loadConfig());
+    const invalid = structuredClone(stable) as unknown as {
+      providers: Record<string, Record<string, unknown>>;
+    };
+    invalid.providers.google!.googleToolSchemaPolicy = "silent-loss";
+    const beforeBytes = readFileSync(join(testDir, "config.json"), "utf8");
+    const rejected = await request({ baseline: stable, next: invalid });
+    expect(rejected.status).toBe(400);
+    expect(live.providers.google?.googleToolSchemaPolicy).toBe("reject-lossy");
+    expect(readFileSync(join(testDir, "config.json"), "utf8")).toBe(beforeBytes);
+  } finally {
+    resolved.mockRestore();
+    if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousHome;
+    removeTreeWithRetry(testDir);
+  }
+});
diff --git a/tests/server/management-integration-routes.test.ts b/tests/server/management-integration-routes.test.ts
index e0d6563aeaa..23d3c4b2ab0 100644
--- a/tests/server/management-integration-routes.test.ts
+++ b/tests/server/management-integration-routes.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
@@ -11,6 +11,7 @@ import { createIntegrationStateStore, type IntegrationStateStore } from "../../s
 import { applyIntegration } from "../../src/integrations/writer";
 import type { IntegrationWriterLockSeams } from "../../src/integrations/writer-lock";
 import { handleManagementAPI } from "../../src/server/management-api";
+import { loadExportModels, resetExportSnapshotForTests } from "../../src/server/management/model-rows";
 import {
   setIntegrationMutationFlightTestHooks,
   setIntegrationPathTestHooks,
@@ -141,6 +142,28 @@ function hermesConfigPath(): string {
   return INTEGRATION_CLIENTS.hermes.configPath(routeEnv, home);
 }
 
+/** Whole-store content, so an append or an overwrite cannot hide behind an unchanged file list. */
+function storeContentWitness(root: string): string {
+  if (!existsSync(root)) return "";
+  return readdirSync(root, { recursive: true })
+    .map(entry => String(entry))
+    .sort()
+    .map(entry => {
+      const full = join(root, entry);
+      if (!existsSync(full) || statSync(full).isDirectory()) return `${entry}/`;
+      return `${entry}:${readFileSync(full, "utf8")}`;
+    })
+    .join("\u0000");
+}
+
+async function previewApi(path: string, body: unknown): Promise<Response> {
+  return api(path, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
 async function rawApi(path: string, init: RequestInit = {}): Promise<Response | null> {
   const url = new URL(`http://127.0.0.1:10100${path}`);
   return handleManagementAPI(
@@ -1212,3 +1235,307 @@ describe("admission", () => {
     }
   });
 });
+
+describe("integration previews are reads", () => {
+  test("planning without a cached roster refuses rather than gathering one", async () => {
+    const configPath = installHermes();
+    const before = existsSync(configPath) ? readFileSync(configPath, "utf8") : null;
+
+    const response = await previewApi("/api/client-integrations/preview", { clientId: "hermes", operation: "apply" });
+    // Discovery refreshes credentials and writes the provider cache, so a preview may not perform
+    // one to manufacture a roster. With nothing cached there is no honest snapshot to plan
+    // against, and saying so is the correct answer.
+    expect(response.status).toBe(409);
+    const body = await response.json() as { code: string };
+    expect(body.code).toBe("integration_preview_unavailable");
+    expect(JSON.stringify(body)).not.toContain(home);
+
+    const after = existsSync(configPath) ? readFileSync(configPath, "utf8") : null;
+    expect(after).toBe(before);
+  });
+
+  test("a previewed change commits exactly once and then reports itself stale", async () => {
+    const configPath = installHermes();
+    resetExportSnapshotForTests();
+    // A preview reads only a roster an authoritative load already finished, so give it one.
+    await loadExportModels(config, []);
+
+    const preview = await previewApi("/api/client-integrations/preview", { clientId: "hermes", operation: "apply" });
+    expect(preview.status).toBe(200);
+    const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+    expect(plan.canApply).toBe(true);
+
+    const commit = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: plan.fingerprint }),
+    });
+    expect(commit.status).toBe(200);
+    const committed = readFileSync(configPath, "utf8");
+
+    // The same confirmation replayed now describes a file that no longer exists in that state.
+    // Without a real fingerprint comparison this would apply a second time.
+    const replay = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: plan.fingerprint }),
+    });
+    expect(replay.status).toBe(409);
+    expect((await replay.json() as { code: string }).code).toBe("integration_preview_stale");
+    expect(readFileSync(configPath, "utf8")).toBe(committed);
+  });
+
+  test("a roster replaced while the lock is taken refuses instead of writing", async () => {
+    const configPath = installDsh();
+    resetExportSnapshotForTests();
+    await loadExportModels(config, []);
+
+    const preview = await previewApi("/api/client-integrations/preview", { clientId: "dsh", operation: "apply" });
+    expect(preview.status).toBe(200);
+    const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+    expect(plan.canApply).toBe(true);
+    const before = existsSync(configPath) ? readFileSync(configPath, "utf8") : null;
+    const storeBefore = storeContentWitness(storeRoot);
+
+    /*
+     * Publishing a new roster as the lock is acquired puts the replacement exactly where it is
+     * hardest to notice: after the request captured its input and before the guard runs under the
+     * lock. A check that re-read the roster at that moment would validate the new one and write
+     * the old, which is the failure this ordering exists to make impossible.
+     *
+     * The replacement has to be a different roster. Reloading the same rows publishes nothing an
+     * operator could see, and a confirmation is not stale because an unrelated read rebuilt the
+     * list it was already holding.
+     */
+    const lockSeams: IntegrationWriterLockSeams = {
+      writeFile: async () => {
+        await loadExportModels(config, [{ id: "published-under-the-lock", provider: "a" }]);
+      },
+      removeFile: async () => {},
+      now: () => 0,
+      delay: async () => {},
+      pid: 12,
+    };
+    setIntegrationMutationFlightTestHooks({ store, lockSeams });
+
+    const commit = await api("/api/client-integrations/dsh", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: plan.fingerprint }),
+    });
+    expect(commit.status).toBe(409);
+    expect((await commit.json() as { code: string }).code).toBe("integration_preview_stale");
+    expect(existsSync(configPath) ? readFileSync(configPath, "utf8") : null).toBe(before);
+    // The race has to leave the store alone too: a snapshot or journal row written before the
+    // guard refused would be invisible to a target-bytes check.
+    expect(storeContentWitness(storeRoot)).toBe(storeBefore);
+  });
+
+  test("a roster rebuilt unchanged while the lock is taken is not a replacement", async () => {
+    const configPath = installDsh();
+    resetExportSnapshotForTests();
+    await loadExportModels(config, []);
+
+    const preview = await previewApi("/api/client-integrations/preview", { clientId: "dsh", operation: "apply" });
+    const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+    expect(plan.canApply).toBe(true);
+
+    // The Integrations collection performs an ordinary load on every visit, and one can land in
+    // this window. It rebuilds the same rows, so the confirmation an operator is submitting still
+    // describes what they were shown, and refusing it would be a conflict they cannot act on.
+    const lockSeams: IntegrationWriterLockSeams = {
+      writeFile: async () => { await loadExportModels(config, []); },
+      removeFile: async () => {},
+      now: () => 0,
+      delay: async () => {},
+      pid: 12,
+    };
+    setIntegrationMutationFlightTestHooks({ store, lockSeams });
+
+    const commit = await api("/api/client-integrations/dsh", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: plan.fingerprint }),
+    });
+    expect(commit.status).toBe(200);
+    expect(existsSync(configPath)).toBe(true);
+  });
+
+  test("a previewed undo commits with its binding", async () => {
+    const configPath = installHermes();
+    resetExportSnapshotForTests();
+    await loadExportModels(config, []);
+
+    const applied = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true }),
+    });
+    expect(applied.status).toBe(200);
+    expect(existsSync(configPath)).toBe(true);
+
+    const opId = store.listOperations("hermes")[0]?.opId;
+    expect(opId).toBeDefined();
+
+    const preview = await previewApi("/api/client-integrations/restore/preview", { opId });
+    expect(preview.status).toBe(200);
+    const plan = await preview.json() as { canApply: boolean; fingerprint: string };
+    expect(plan.canApply).toBe(true);
+
+    // The binding has to carry a bound undo all the way through, not just refuse a bad one.
+    const undo = await api("/api/client-integrations/restore", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ opId, operation: "restore", planFingerprint: plan.fingerprint }),
+    });
+    expect(undo.status).toBe(200);
+    /*
+     * Hermes has no config file before the apply, so the snapshot that apply took is "none" and a
+     * successful undo DELETES the file rather than rewriting it. Reading bytes back here was
+     * wrong: the file is gone, and the evidence that the undo happened lives in the journal.
+     */
+    expect(existsSync(configPath)).toBe(false);
+    const rows = store.listOperations("hermes");
+    expect(rows.some(row => row.kind === "restore")).toBe(true);
+    expect(rows.some(row => row.opId === opId)).toBe(true);
+  });
+
+  test("a plan is refused before any planning when the request does not name a real operation", async () => {
+    const badOperation = await previewApi("/api/client-integrations/preview", { clientId: "hermes", operation: "launch" });
+    expect(badOperation.status).toBe(400);
+    expect((await badOperation.json() as { code: string }).code).toBe("invalid_preview_operation");
+
+    const badClient = await previewApi("/api/client-integrations/preview", { clientId: "not-a-client", operation: "apply" });
+    expect(badClient.status).toBeGreaterThanOrEqual(400);
+  });
+
+  test("planning an undo for an operation that is not there declines to read the journal back", async () => {
+    const response = await previewApi("/api/client-integrations/restore/preview", { opId: "no-such-operation" });
+    expect(response.status).toBe(404);
+    const body = await response.json() as { code: string };
+    expect(body.code).toBe("integration_operation_not_found");
+  });
+
+  test("a half-bound confirmation is rejected rather than quietly treated as unbound", async () => {
+    installHermes();
+    // Dropping one half would answer 200 to a caller who believed their confirmation was being
+    // checked, which is worse than refusing the request.
+    const onlyOperation = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply" }),
+    });
+    expect(onlyOperation.status).toBe(400);
+    expect((await onlyOperation.json() as { code: string }).code).toBe("invalid_preview_binding");
+
+    const onlyFingerprint = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, planFingerprint: "p1:whatever" }),
+    });
+    expect(onlyFingerprint.status).toBe(400);
+    expect((await onlyFingerprint.json() as { code: string }).code).toBe("invalid_preview_binding");
+  });
+
+  test("a confirmation naming a different operation than the request is not a confirmation of it", async () => {
+    installHermes();
+    const response = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: false, operation: "apply", planFingerprint: "p1:whatever" }),
+    });
+    expect(response.status).toBe(400);
+    expect((await response.json() as { code: string }).code).toBe("invalid_preview_operation");
+  });
+
+  test("a bound change cannot commit without a plan that still validates", async () => {
+    const configPath = installHermes();
+    const before = existsSync(configPath) ? readFileSync(configPath, "utf8") : null;
+    // Content, not names. A journal append, an overwritten ownership record and a replaced
+    // snapshot all leave the file list identical, and every one of them is a write.
+    const storeContents = (): string => {
+      if (!existsSync(storeRoot)) return "";
+      return readdirSync(storeRoot, { recursive: true })
+        .map(entry => String(entry))
+        .sort()
+        .map(entry => {
+          const full = join(storeRoot, entry);
+          if (!existsSync(full) || statSync(full).isDirectory()) return `${entry}/`;
+          return `${entry}:${readFileSync(full, "utf8")}`;
+        })
+        .join("\u0000");
+    };
+    resetExportSnapshotForTests();
+    await loadExportModels(config, []);
+    const storeBefore = storeContents();
+
+    const response = await api("/api/client-integrations/hermes", {
+      method: "PUT",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ enabled: true, operation: "apply", planFingerprint: "p1:not-the-current-plan" }),
+    });
+
+    // Whatever the reason the plan does not validate, the mutation does not happen. This is the
+    // case that would catch a refactor quietly dropping the binding on the way to the writer.
+    // With a roster present this can only be a fingerprint comparison, so the reason is exact.
+    expect(response.status).toBe(409);
+    const body = await response.json() as { code: string };
+    expect(body.code).toBe("integration_preview_stale");
+
+    const after = existsSync(configPath) ? readFileSync(configPath, "utf8") : null;
+    expect(after).toBe(before);
+    expect(storeContents()).toBe(storeBefore);
+  });
+});
+
+describe("the generic preview routes are not an unscoped door into Aside", () => {
+  /*
+   * Aside is a set of profiles, not one file. A plan built through the generic routes would
+   * describe the legacy single-account location, and no bound mutation accepts that: the mutation
+   * routes already refuse the unscoped spelling. Answering it here would hand an operator a
+   * confirmation nothing can carry out.
+   */
+  test("planning apply for aside without a profile is refused, and writes nothing", async () => {
+    const homeBefore = storeContentWitness(home);
+    const storeBefore = storeContentWitness(storeRoot);
+
+    const response = await previewApi("/api/client-integrations/preview", { clientId: "aside", operation: "apply" });
+
+    expect(response.status).toBe(400);
+    expect((await response.json() as { code: string }).code).toBe("invalid_aside_profile_path");
+    expect(storeContentWitness(home)).toBe(homeBefore);
+    expect(storeContentWitness(storeRoot)).toBe(storeBefore);
+  });
+
+  test("planning an undo of an aside operation without a profile is refused for what it is", async () => {
+    // The row is found first, so the answer names the unscoped path rather than reporting an
+    // operation that is plainly there as missing.
+    store.appendJournal({
+      opId: "aside-unscoped-op",
+      clientId: "aside",
+      kind: "apply",
+      at: new Date(0).toISOString(),
+      configPath: join(home, ".aside", "u", "1", "models.json"),
+      snapshot: { kind: "none" },
+      resultFingerprint: "0123456789abcdef",
+      resultAbsent: false,
+      priorRecord: null,
+    });
+    const homeBefore = storeContentWitness(home);
+    const storeBefore = storeContentWitness(storeRoot);
+
+    const response = await previewApi("/api/client-integrations/restore/preview", { opId: "aside-unscoped-op" });
+
+    expect(response.status).toBe(400);
+    expect((await response.json() as { code: string }).code).toBe("invalid_aside_profile_path");
+    expect(storeContentWitness(home)).toBe(homeBefore);
+    expect(storeContentWitness(storeRoot)).toBe(storeBefore);
+
+    // Narrow: an operation belonging to any other client still plans here.
+    installHermes();
+    resetExportSnapshotForTests();
+    await loadExportModels(config, []);
+    const ok = await previewApi("/api/client-integrations/preview", { clientId: "hermes", operation: "apply" });
+    expect(ok.status).toBe(200);
+  });
+});
diff --git a/tests/server/management-metrics-export.test.ts b/tests/server/management-metrics-export.test.ts
new file mode 100644
index 00000000000..cccc37dc546
--- /dev/null
+++ b/tests/server/management-metrics-export.test.ts
@@ -0,0 +1,1244 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { saveConfig } from "../../src/config";
+import { configDiagnosticsFromRaw, validateConfigCandidate } from "../../src/config/diagnostics";
+import { metricsExportEnabled } from "../../src/config/feature-flags";
+import { getDefaultConfig } from "../../src/config/proxy-env";
+import * as audioUpstream from "../../src/server/audio-upstream";
+import { MAX_ACTIVE_SESSION_LANES, tryAdmitTurn } from "../../src/server/lifecycle";
+import { handleManagementAPI } from "../../src/server/management-api";
+import { requireManagementAuth, type ManagementAuthState } from "../../src/server/management-auth";
+import {
+  addFinalRequestLog,
+  observeRequestLogsForTests,
+  type RequestLogContext,
+  type RequestLogEntry,
+} from "../../src/server/request-log";
+import { createRequestMetricsOwner } from "../../src/server/request-metrics";
+import { startServer } from "../../src/server";
+import type { OcxConfig } from "../../src/types";
+import type { AttemptRecoveryKind } from "../../src/usage/log";
+import { ManagementRequest } from "../helpers/management-auth";
+import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { repoPath } from "../helpers/repo-root";
+
+const ADMIN_TOKEN = "ocx_admin_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+const DATA_TOKEN = "ocx_data_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+const METRICS_UPSTREAM = "metrics-upstream.example";
+const OBSERVATION_TIMEOUT = Symbol("observation-timeout");
+
+function authState(): ManagementAuthState {
+  return {
+    available: true,
+    token: ADMIN_TOKEN,
+    source: "environment",
+    sessions: new Map(),
+    pairingGrants: new Map(),
+  };
+}
+
+function config(overrides: Partial<OcxConfig> = {}): OcxConfig {
+  return {
+    ...getDefaultConfig(),
+    apiKeys: [{ id: "data-key", key: DATA_TOKEN, name: "data key", createdAt: "2026-09-19T00:00:00.000Z" }],
+    ...overrides,
+  };
+}
+
+async function metricsRoute(snapshot?: () => string): Promise<Response> {
+  const req = new ManagementRequest("http://localhost/api/metrics");
+  const url = new URL(req.url);
+  const response = await handleManagementAPI(req, url, config(), snapshot ? {
+    requestMetrics: { snapshot },
+  } : {});
+  if (!response) throw new Error("metrics route was not handled");
+  return response;
+}
+
+async function authenticatedMetricsRoute(req: Request, snapshot: () => string): Promise<Response> {
+  const denied = requireManagementAuth(req, authState(), config());
+  if (denied) return denied;
+  const response = await handleManagementAPI(req, new URL(req.url), config(), {
+    requestMetrics: { snapshot },
+  });
+  if (!response) throw new Error("metrics route was not handled");
+  return response;
+}
+
+function sampleValue(text: string, prefix: string): number {
+  const line = text.split("\n").find(candidate => candidate.startsWith(prefix));
+  if (!line) throw new Error(`missing metric sample: ${prefix}`);
+  return Number(line.slice(line.lastIndexOf(" ") + 1));
+}
+
+function awaitBounded<T>(promise: Promise<T>, message: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error(message)), 5_000);
+    void promise.then(value => {
+      clearTimeout(timeout);
+      resolve(value);
+    }, error => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+  });
+}
+
+function awaitObservation<T>(promise: Promise<T>): Promise<T | typeof OBSERVATION_TIMEOUT> {
+  return new Promise(resolve => {
+    const timeout = setTimeout(() => resolve(OBSERVATION_TIMEOUT), 5_000);
+    void promise.then(value => {
+      clearTimeout(timeout);
+      resolve(value);
+    });
+  });
+}
+
+async function describeUpgradeRefusal(wsUrl: URL): Promise<string> {
+  const httpUrl = new URL(wsUrl);
+  httpUrl.protocol = "http:";
+  try {
+    const response = await fetch(httpUrl, {
+      headers: {
+        connection: "upgrade",
+        upgrade: "websocket",
+        "sec-websocket-version": "13",
+        "sec-websocket-key": Buffer.from("0123456789abcdef").toString("base64"),
+      },
+      signal: AbortSignal.timeout(1_000),
+    });
+    return `HTTP ${response.status}: ${(await response.text()).slice(0, 512)}`;
+  } catch (error) {
+    return `HTTP refusal unavailable: ${error instanceof Error ? error.message : String(error)}`;
+  }
+}
+
+function nextFinalRequestLog(
+  predicate: (entry: RequestLogEntry) => boolean,
+): { promise: Promise<RequestLogEntry>; dispose: () => void } {
+  let unsubscribe = () => {};
+  const dispose = (): void => { unsubscribe(); };
+  const promise = new Promise<RequestLogEntry>(resolve => {
+    unsubscribe = observeRequestLogsForTests(entry => {
+      if (!predicate(entry)) return;
+      dispose();
+      resolve(entry);
+    });
+  });
+  return { promise, dispose };
+}
+
+function attempt(sendCount: number, recoveryKinds: AttemptRecoveryKind[]) {
+  return {
+    ordinal: 1,
+    provider: "private-provider-canary",
+    model: "private-model-canary",
+    adapter: "openai-responses",
+    status: 200,
+    durationMs: 10,
+    sendCount,
+    recoveryKinds,
+    usageStatus: "unreported" as const,
+  };
+}
+
+function runtimeConfig(
+  adapter: "openai-chat" | "openai-responses",
+  metricsEnabled = true,
+): OcxConfig {
+  return {
+    port: 0,
+    codexAutoStart: false,
+    websockets: true,
+    metricsExport: { enabled: metricsEnabled },
+    defaultProvider: "fixture",
+    providers: {
+      fixture: {
+        adapter,
+        baseUrl: `https://${METRICS_UPSTREAM}/v1`,
+        apiKey: "sk-metrics-fixture",
+        transientRetryOn5xx: { enabled: true, attempts: 2 },
+      },
+    },
+  } as OcxConfig;
+}
+
+function liveMetricsConfig(): OcxConfig {
+  const config = runtimeConfig("openai-responses");
+  config.apiKeys = [{ id: "metrics-audio", name: "metrics audio", key: DATA_TOKEN, createdAt: "2026-09-19T00:00:00Z" }];
+  config.providers["openai-apikey"] = {
+    adapter: "openai-responses",
+    baseUrl: "https://api.openai.com/v1",
+    apiKey: "sk-metrics-fixture",
+    authMode: "key",
+  };
+  return config;
+}
+
+function upgradeRequestHeaders(): Record<string, string> {
+  return {
+    connection: "upgrade",
+    upgrade: "websocket",
+    "sec-websocket-version": "13",
+    "sec-websocket-key": Buffer.from("0123456789abcdef").toString("base64"),
+  };
+}
+
+function startLiveMetricsUpstream(): ReturnType<typeof Bun.serve> {
+  return Bun.serve({
+    port: 0,
+    fetch(req, server) {
+      if (req.headers.get("upgrade")?.toLowerCase() === "websocket"
+        && server.upgrade(req, { data: {} })) return undefined;
+      return new Response("upgrade required", { status: 426 });
+    },
+    websocket: { message() {} },
+  });
+}
+
+function stallAudioAcquisition(started: { resolve(): void }) {
+  return spyOn(audioUpstream, "resolveAudioUpstream").mockImplementation(async (_headers, _config, _log, options) => {
+    started.resolve();
+    await new Promise<void>(resolve => {
+      if (options.signal?.aborted) resolve();
+      else options.signal?.addEventListener("abort", () => resolve(), { once: true });
+    });
+    return new Response("acquisition interrupted", { status: 503 });
+  });
+}
+
+function completedResponseJson(text = "ok"): string {
+  return JSON.stringify({
+    type: "response.completed",
+    response: {
+      id: "resp_metrics",
+      object: "response",
+      status: "completed",
+      output: [{ type: "message", role: "assistant", content: [{ type: "output_text", text }] }],
+      usage: { input_tokens: 2, output_tokens: 1, total_tokens: 3 },
+    },
+  });
+}
+
+function responseSse(options: { terminal?: "completed" | "failed" | "incomplete"; output?: string } = {}): string {
+  const id = "resp_metrics_sse";
+  const events = [
+    `event: response.created\ndata: ${JSON.stringify({ type: "response.created", response: { id, status: "in_progress", output: [] } })}`,
+  ];
+  if (options.output !== undefined) {
+    events.push(`event: response.output_text.delta\ndata: ${JSON.stringify({ type: "response.output_text.delta", delta: options.output })}`);
+  }
+  if (options.terminal) {
+    events.push(`event: response.${options.terminal}\ndata: ${JSON.stringify({
+      type: `response.${options.terminal}`,
+      response: { id, status: options.terminal, output: [], usage: { input_tokens: 2, output_tokens: 1, total_tokens: 3 } },
+    })}`);
+  }
+  return `${events.join("\n\n")}\n\n${options.terminal ? "data: [DONE]\n\n" : ""}`;
+}
+
+function installUpstream(
+  originalFetch: typeof fetch,
+  responder: (send: number, request: Request) => Response | Promise<Response>,
+): () => number {
+  let sends = 0;
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const request = input instanceof Request ? input : new Request(input, init);
+    const url = new URL(request.url);
+    if (url.hostname === METRICS_UPSTREAM) {
+      sends += 1;
+      return responder(sends, request);
+    }
+    return originalFetch(input, init);
+  }) as typeof fetch;
+  return () => sends;
+}
+
+async function scrapeServer(server: ReturnType<typeof startServer>): Promise<string> {
+  const response = await fetch(new URL("/api/metrics", server.url), {
+    headers: { "x-opencodex-api-key": ADMIN_TOKEN },
+  });
+  expect(response.status).toBe(200);
+  return response.text();
+}
+
+async function sendResponsesRequest(
+  server: ReturnType<typeof startServer>,
+  stream = false,
+  signal?: AbortSignal,
+): Promise<Response> {
+  return fetch(new URL("/v1/responses", server.url), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ model: "fixture/metrics-model", input: "hello", stream }),
+    signal,
+  });
+}
+
+async function sendChatRequest(server: ReturnType<typeof startServer>): Promise<Response> {
+  return fetch(new URL("/v1/chat/completions", server.url), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ model: "fixture/metrics-model", messages: [{ role: "user", content: "hello" }] }),
+  });
+}
+
+async function runWebSocketTurn(server: ReturnType<typeof startServer>): Promise<void> {
+  const url = new URL("/v1/responses", server.url);
+  url.protocol = "ws:";
+  const socket = new WebSocket(url);
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("metrics websocket timeout")), 5_000);
+    socket.addEventListener("open", () => {
+      socket.send(JSON.stringify({
+        type: "response.create",
+        model: "fixture/metrics-model",
+        input: "hello",
+      }));
+    }, { once: true });
+    socket.addEventListener("message", event => {
+      const text = typeof event.data === "string" ? event.data : "";
+      if (!text.includes("response.completed")) return;
+      clearTimeout(timer);
+      socket.close();
+      resolve();
+    });
+    socket.addEventListener("error", () => {
+      clearTimeout(timer);
+      reject(new Error("metrics websocket failed"));
+    }, { once: true });
+  });
+}
+
+describe("request metrics aggregation", () => {
+  test("one finalized logical request counts once while attempts preserve physical sends and distinct recovery kinds", () => {
+    const metrics = createRequestMetricsOwner(123);
+    const logCtx: RequestLogContext = {
+      model: "private-model-canary",
+      provider: "private-provider-canary",
+      inboundProtocol: "responses",
+      requestMetricsRecorder: metrics,
+      attempts: [
+        attempt(2, ["connection-reset", "connection-reset"]),
+        { ...attempt(1, ["key-429", "rate-limit-429"]), ordinal: 2 },
+      ],
+    };
+
+    addFinalRequestLog("private-request-canary", Date.now() - 1_000, logCtx, 200, {
+      terminalStatus: "completed",
+      closeReason: "terminal",
+    }, () => {});
+
+    const output = metrics.snapshot();
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_physical_sends_total{protocol="responses"}')).toBe(3);
+    expect(sampleValue(output, 'opencodex_recoveries_total{protocol="responses",recovery="connection"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_recoveries_total{protocol="responses",recovery="rate_limit"}')).toBe(2);
+  });
+
+  test("a failed terminal carried over HTTP 200 is never counted as completed", () => {
+    const metrics = createRequestMetricsOwner(123);
+    metrics.recordFinalRequest({
+      protocol: "responses",
+      status: 200,
+      durationMs: 250,
+      firstOutputMs: 0,
+      terminalStatus: "failed",
+      closeReason: "terminal",
+    });
+    const output = metrics.snapshot();
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="responses",result="failed"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(0);
+    expect(sampleValue(output, 'opencodex_ttft_seconds_count{protocol="responses",result="failed"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_ttft_missing_total{protocol="responses",result="failed"}')).toBe(0);
+  });
+
+  test("terminal precedence keeps failed and incomplete 101 facts out of completed", () => {
+    const metrics = createRequestMetricsOwner(123);
+    metrics.recordFinalRequest({ status: 101, durationMs: 1, terminalStatus: "failed" });
+    metrics.recordFinalRequest({ status: 101, durationMs: 1, terminalStatus: "incomplete" });
+    const output = metrics.snapshot();
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+  });
+
+  test("incomplete, aborted, and missing TTFT denominators remain distinct", () => {
+    const metrics = createRequestMetricsOwner(123);
+    metrics.recordFinalRequest({ protocol: "chat", status: 502, durationMs: 100, terminalStatus: "incomplete" });
+    metrics.recordFinalRequest({ protocol: "chat", status: 499, durationMs: 200, closeReason: "client_cancel" });
+    const output = metrics.snapshot();
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="chat",result="incomplete"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_logical_requests_total{protocol="chat",result="aborted"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_request_duration_seconds_count{protocol="chat",result="incomplete"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_request_duration_seconds_count{protocol="chat",result="aborted"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_ttft_missing_total{protocol="chat",result="incomplete"}')).toBe(1);
+    expect(sampleValue(output, 'opencodex_ttft_missing_total{protocol="chat",result="aborted"}')).toBe(1);
+  });
+
+  test("series and labels stay bounded and privacy canaries never reach exposition", () => {
+    const metrics = createRequestMetricsOwner(123);
+    const canaries = [
+      "private-request-canary",
+      "private-logical-canary",
+      "private-key-canary",
+      "private-account-canary",
+      "private-model-canary",
+      "private-provider-canary",
+      "private-error-canary",
+      "private-prompt-canary",
+      "private-tool-body-canary",
+    ];
+    const logCtx = {
+      model: canaries[4],
+      provider: canaries[5],
+      logicalRequestId: canaries[1],
+      apiKeyId: canaries[2],
+      accountLogLabel: canaries[3],
+      upstreamError: canaries[6],
+      inboundProtocol: "messages",
+      requestMetricsRecorder: metrics,
+      prompt: canaries[7],
+      toolBody: canaries[8],
+    } as unknown as RequestLogContext;
+    addFinalRequestLog(canaries[0]!, Date.now() - 1, logCtx, 400, undefined, () => {});
+    for (let index = 0; index < 64; index += 1) {
+      addFinalRequestLog(`request-${index}`, Date.now() - 1, {
+        model: `model-${index}`,
+        provider: `provider-${index}`,
+        apiKeyId: `key-${index}`,
+        accountLogLabel: `account-${index}`,
+        requestMetricsRecorder: metrics,
+      }, 400, undefined, () => {});
+    }
+    const output = metrics.snapshot();
+    for (const canary of canaries) expect(output).not.toContain(canary);
+    const samples = output.split("\n").filter(line => line && !line.startsWith("#"));
+    expect(samples).toHaveLength(453);
+  });
+
+  test("text exposition has deterministic HELP/TYPE groups and cumulative +Inf buckets", () => {
+    const metrics = createRequestMetricsOwner(123);
+    metrics.recordFinalRequest({ protocol: "responses", status: 200, durationMs: 125, firstOutputMs: 75 });
+    const output = metrics.snapshot();
+    expect(output.endsWith("\n")).toBe(true);
+    expect(output.indexOf("# HELP opencodex_request_duration_seconds"))
+      .toBeLessThan(output.indexOf("opencodex_request_duration_seconds_bucket"));
+    expect(output.indexOf("# TYPE opencodex_request_duration_seconds histogram"))
+      .toBeLessThan(output.indexOf("opencodex_request_duration_seconds_bucket"));
+    const helpLines = output.split("\n").filter(line => line.startsWith("# HELP "));
+    const typeLines = output.split("\n").filter(line => line.startsWith("# TYPE "));
+    expect(helpLines).toHaveLength(7);
+    expect(typeLines).toHaveLength(7);
+    expect(new Set(helpLines.map(line => line.split(" ")[2])).size).toBe(7);
+    expect(new Set(typeLines.map(line => line.split(" ")[2])).size).toBe(7);
+    expect(sampleValue(output, 'opencodex_request_duration_seconds_bucket{protocol="responses",result="completed",le="+Inf"}'))
+      .toBe(sampleValue(output, 'opencodex_request_duration_seconds_count{protocol="responses",result="completed"}'));
+    expect(metrics.snapshot()).toBe(output);
+  });
+
+  test("a fresh owner documents process restart by resetting counters and changing start time", () => {
+    const first = createRequestMetricsOwner(100);
+    first.recordFinalRequest({ status: 200, durationMs: 1 });
+    const second = createRequestMetricsOwner(200);
+    expect(sampleValue(first.snapshot(), "opencodex_metrics_process_start_time_seconds")).toBe(100);
+    expect(sampleValue(second.snapshot(), "opencodex_metrics_process_start_time_seconds")).toBe(200);
+    expect(sampleValue(second.snapshot(), 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+  });
+});
+
+describe("metrics management boundary", () => {
+  test("admin authentication admits the route while absent and data-plane credentials do not", async () => {
+    const admin = new ManagementRequest("http://localhost/api/metrics", {
+      headers: { "x-opencodex-api-key": ADMIN_TOKEN },
+    });
+    const data = new ManagementRequest("http://localhost/api/metrics", {
+      headers: { "x-opencodex-api-key": DATA_TOKEN },
+    });
+    const absent = new ManagementRequest("http://localhost/api/metrics");
+    const metrics = createRequestMetricsOwner(123);
+    const snapshot = () => metrics.snapshot();
+    const response = await authenticatedMetricsRoute(admin, snapshot);
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("text/plain;version=0.0.4");
+    expect(await response.text()).not.toContain(DATA_TOKEN);
+    expect((await authenticatedMetricsRoute(data, snapshot)).status).toBe(401);
+    expect((await authenticatedMetricsRoute(absent, snapshot)).status).toBe(401);
+  });
+
+  test("disabled mode wires no snapshot route and returns the locked 404", async () => {
+    expect(metricsExportEnabled(config())).toBe(false);
+    const response = await metricsRoute();
+    expect(response.status).toBe(404);
+    expect((await response.json() as { error: { code: string } }).error.code).toBe("not_found");
+  });
+
+  test("the metrics modules contain no timer, listener, network, or module-global owner", () => {
+    const source = [
+      readFileSync(repoPath("src/server/request-metrics.ts"), "utf8"),
+      readFileSync(repoPath("src/server/management/metrics-routes.ts"), "utf8"),
+    ].join("\n");
+    for (const forbidden of ["setInterval(", "setTimeout(", "Bun.serve(", ".listen(", "fetch("]) {
+      expect(source).not.toContain(forbidden);
+    }
+    expect(source).not.toMatch(/(?:let|const)\s+activeRequestMetrics/);
+    const composition = readFileSync(repoPath("src/server/index/serve-options.ts"), "utf8");
+    expect(composition).toContain(
+      "metricsExportEnabled(config) ? createRequestMetricsOwner() : undefined",
+    );
+    expect(composition).toContain("requestMetrics ? { requestMetricsRecorder: requestMetrics } : {}");
+    expect(composition).toContain("createWebsocketHandler(ctx, requestMetrics)");
+    expect(readFileSync(repoPath("src/server/index/websocket-handler.ts"), "utf8"))
+      .toContain("requestMetricsRecorder ? { requestMetricsRecorder } : {}");
+  });
+});
+
+describe("metrics through live HTTP and WebSocket server flows", () => {
+  const originalFetch = globalThis.fetch;
+  const originalWebSocket = globalThis.WebSocket;
+  const previousOpenCodexHome = process.env.OPENCODEX_HOME;
+  const previousAdminToken = process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+  let openCodexHome = "";
+  let isolatedCodexHome: IsolatedCodexHome | null = null;
+  const liveServers = new Set<ReturnType<typeof startServer>>();
+
+  const startMetricsServer = (
+    deps?: Parameters<typeof startServer>[1],
+  ): ReturnType<typeof startServer> => {
+    const server = startServer(0, deps);
+    liveServers.add(server);
+    return server;
+  };
+
+  const startMetricsServerWithExpectedError = (
+    expected: Error,
+    observed: unknown[],
+    unexpected: unknown[],
+  ): ReturnType<typeof startServer> => {
+    const nativeServe = Bun.serve.bind(Bun);
+    const serveSpy = spyOn(Bun, "serve").mockImplementation(options => nativeServe({
+      ...options,
+      error(error) {
+        if (error === expected) observed.push(error);
+        else unexpected.push(error);
+        return new Response("expected metrics fixture server error", { status: 500 });
+      },
+    } as Parameters<typeof Bun.serve>[0]));
+    try {
+      return startMetricsServer();
+    } finally {
+      // startServer is synchronous; restore before any request or awaited cleanup.
+      serveSpy.mockRestore();
+    }
+  };
+
+  const startMetricsServerWithLiveRequestControl = (
+    control: "abort" | "upgrade-throw" | "upgrade-false",
+    deps?: Parameters<typeof startServer>[1],
+  ): ReturnType<typeof startServer> => {
+    const nativeServe = Bun.serve.bind(Bun);
+    const serveSpy = spyOn(Bun, "serve").mockImplementation(options => {
+      const fetchHandler = options.fetch;
+      if (typeof fetchHandler !== "function") return nativeServe(options);
+      return nativeServe({
+        ...options,
+        fetch(req, requestServer) {
+          if (new URL(req.url).pathname !== "/v1/realtime") {
+            return Reflect.apply(fetchHandler, requestServer, [req, requestServer]);
+          }
+          let routedRequest = req;
+          if (control === "abort") {
+            const abort = new AbortController();
+            abort.abort(new Error("metrics pre-upgrade cancellation"));
+            routedRequest = new Request(req, { signal: abort.signal });
+          }
+          const routedServer = control === "abort" ? requestServer : new Proxy(requestServer, {
+            get(target, property) {
+              if (property === "upgrade") return () => {
+                if (control === "upgrade-throw") throw new Error("metrics upgrade fixture failure");
+                return false;
+              };
+              const value = Reflect.get(target, property, target);
+              return typeof value === "function" ? value.bind(target) : value;
+            },
+          });
+          return Reflect.apply(fetchHandler, routedServer, [routedRequest, routedServer]);
+        },
+      } as Parameters<typeof Bun.serve>[0]);
+    });
+    try {
+      return startMetricsServer(deps);
+    } finally {
+      serveSpy.mockRestore();
+    }
+  };
+
+  const stopMetricsServer = async (server: ReturnType<typeof startServer>): Promise<void> => {
+    try {
+      await server.stop(true);
+    } finally {
+      liveServers.delete(server);
+    }
+  };
+
+  beforeEach(() => {
+    openCodexHome = mkdtempSync(join(tmpdir(), "ocx-metrics-export-"));
+    process.env.OPENCODEX_HOME = openCodexHome;
+    process.env.OPENCODEX_ADMIN_AUTH_TOKEN = ADMIN_TOKEN;
+    isolatedCodexHome = installIsolatedCodexHome("ocx-metrics-export-codex-");
+    globalThis.fetch = originalFetch;
+    globalThis.WebSocket = originalWebSocket;
+  });
+
+  afterEach(async () => {
+    // The server owns the spend-ledger lease until every listener and active body settles.
+    // Release it before changing/removing OPENCODEX_HOME so the next fixture acquires honestly.
+    const stops = await Promise.allSettled([...liveServers].map(stopMetricsServer));
+    try {
+      globalThis.fetch = originalFetch;
+      globalThis.WebSocket = originalWebSocket;
+      if (previousOpenCodexHome === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previousOpenCodexHome;
+      if (previousAdminToken === undefined) delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+      else process.env.OPENCODEX_ADMIN_AUTH_TOKEN = previousAdminToken;
+      isolatedCodexHome?.restore();
+      isolatedCodexHome = null;
+      if (openCodexHome) removeTreeWithRetry(openCodexHome);
+      openCodexHome = "";
+    } finally {
+      const failure = stops.find(result => result.status === "rejected");
+      if (failure?.status === "rejected") throw failure.reason;
+    }
+  });
+
+  test("HTTP retry flow records one logical request and both physical sends", async () => {
+    const sends = installUpstream(originalFetch, send => send === 1
+      ? Response.json({ error: { message: "retry" } }, { status: 500 })
+      : Response.json({
+        id: "chat_metrics",
+        object: "chat.completion",
+        choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }],
+        usage: { prompt_tokens: 2, completion_tokens: 1, total_tokens: 3 },
+      }));
+    saveConfig(runtimeConfig("openai-chat"));
+    const server = startMetricsServer();
+    try {
+      const response = await sendChatRequest(server);
+      expect(response.status).toBe(200);
+      await response.text();
+      const metrics = await scrapeServer(server);
+      expect(sends()).toBe(2);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="chat",result="completed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_physical_sends_total{protocol="chat"}')).toBe(2);
+      expect(sampleValue(metrics, 'opencodex_recoveries_total{protocol="chat",recovery="transient"}')).toBe(1);
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("WebSocket response.create finalizes into the shared metrics owner", async () => {
+    const sends = installUpstream(originalFetch, () => new Response(responseSse({
+      terminal: "completed",
+      output: "socket output",
+    }), { headers: { "content-type": "text/event-stream" } }));
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    try {
+      await runWebSocketTurn(server);
+      const metrics = await scrapeServer(server);
+      expect(sends()).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_physical_sends_total{protocol="responses"}')).toBe(1);
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("successful live sideband upgrade records HTTP 101 as completed", async () => {
+    const upstream = startLiveMetricsUpstream();
+    try {
+      saveConfig(liveMetricsConfig());
+      const upstreamUrl = new URL("/upstream", upstream.url);
+      upstreamUrl.protocol = "ws:";
+      let factoryCalls = 0;
+      let server: ReturnType<typeof startServer> | undefined;
+      try {
+        server = startMetricsServer({
+          liveSidebandWebSocketFactory: () => {
+            factoryCalls += 1;
+            return new WebSocket(upstreamUrl);
+          },
+        });
+        const finalized = nextFinalRequestLog(entry => entry.status === 101);
+        try {
+          const url = new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url);
+          url.protocol = "ws:";
+          let socket: WebSocket | undefined;
+          try {
+            const activeSocket = socket = new WebSocket(url);
+            await awaitBounded(new Promise<void>((resolve, reject) => {
+              activeSocket.addEventListener("open", () => resolve(), { once: true });
+              activeSocket.addEventListener("error", () => {
+                void describeUpgradeRefusal(url).then(detail => reject(new Error(`live sideband upgrade failed; ${detail}`)));
+              }, { once: true });
+            }), "live sideband client did not open");
+            const observedRow = await awaitObservation(finalized.promise);
+            expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+            if (observedRow === OBSERVATION_TIMEOUT) throw new Error("101 upgrade finalization was not observed");
+            expect(observedRow.status).toBe(101);
+            expect(factoryCalls).toBe(1);
+            const metrics = await scrapeServer(server);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(1);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(0);
+          } finally {
+            socket?.close();
+          }
+        } finally {
+          finalized.dispose();
+        }
+      } finally {
+        if (server) await stopMetricsServer(server);
+      }
+    } finally {
+      await upstream.stop(true);
+    }
+  });
+
+  test("pre-upgrade cancellation finalizes exactly one aborted live request", async () => {
+    saveConfig(liveMetricsConfig());
+    const server = startMetricsServerWithLiveRequestControl("abort", {
+      liveSidebandWebSocketFactory: () => { throw new Error("cancelled request reached upstream dial"); },
+    });
+    const finalized = nextFinalRequestLog(entry => entry.status === 499);
+    const rows: RequestLogEntry[] = [];
+    const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+    try {
+      const response = await fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+        headers: upgradeRequestHeaders(),
+      });
+      expect(response.status).toBe(499);
+      await response.text();
+      const observedRow = await awaitObservation(finalized.promise);
+      expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+      if (observedRow === OBSERVATION_TIMEOUT) throw new Error("499 upgrade cancellation was not finalized");
+      expect(observedRow.status).toBe(499);
+      expect(observedRow.closeReason).toBe("client_cancel");
+      expect(rows.map(entry => entry.status)).toEqual([499]);
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+    } finally {
+      disposeRows();
+      finalized.dispose();
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("client cancellation during acquisition finalizes exactly one aborted live request", async () => {
+    saveConfig(liveMetricsConfig());
+    const acquisitionStarted = Promise.withResolvers<void>();
+    const resolver = stallAudioAcquisition(acquisitionStarted);
+    try {
+      const server = startMetricsServer({
+        liveSidebandWebSocketFactory: () => { throw new Error("cancelled acquisition reached upstream dial"); },
+      });
+      try {
+        const finalized = nextFinalRequestLog(entry => entry.status === 499);
+        const rows: RequestLogEntry[] = [];
+        const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+        try {
+          const clientAbort = new AbortController();
+          try {
+            const clientOutcome = fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+              headers: { ...upgradeRequestHeaders(), "x-opencodex-api-key": DATA_TOKEN },
+              signal: clientAbort.signal,
+            }).catch(error => error);
+            await awaitBounded(acquisitionStarted.promise, "audio acquisition did not start");
+            clientAbort.abort(new Error("metrics acquisition client cancellation"));
+            const observedRow = await awaitObservation(finalized.promise);
+            expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+            if (observedRow === OBSERVATION_TIMEOUT) throw new Error("acquisition cancellation was not finalized");
+            expect(observedRow.status).toBe(499);
+            expect(observedRow.closeReason).toBe("client_cancel");
+            expect(rows.map(entry => entry.status)).toEqual([499]);
+            await awaitBounded(clientOutcome, "cancelled acquisition client did not settle");
+            const metrics = await scrapeServer(server);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(1);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(0);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+          } finally {
+            clientAbort.abort();
+          }
+        } finally {
+          disposeRows();
+          finalized.dispose();
+        }
+      } finally {
+        await stopMetricsServer(server);
+      }
+    } finally {
+      resolver.mockRestore();
+    }
+  });
+
+  test("acquisition deadline finalizes exactly one failed 504 live request", async () => {
+    saveConfig(liveMetricsConfig());
+    const acquisitionStarted = Promise.withResolvers<void>();
+    const resolver = stallAudioAcquisition(acquisitionStarted);
+    try {
+      const server = startMetricsServer({
+        liveSidebandWebSocketFactory: () => { throw new Error("expired acquisition reached upstream dial"); },
+      });
+      try {
+        const schedule = globalThis.setTimeout;
+        let expire: (() => void) | undefined;
+        const deadlineCaptured = Promise.withResolvers<void>();
+        const timers = spyOn(globalThis, "setTimeout").mockImplementation(((callback: (...args: unknown[]) => void, delay?: number, ...args: unknown[]) => {
+          if (delay === 120_000 && !expire) {
+            expire = () => callback(...args);
+            deadlineCaptured.resolve();
+          }
+          return schedule(callback, delay, ...args);
+        }) as typeof setTimeout);
+        try {
+          const finalized = nextFinalRequestLog(entry => entry.status === 504);
+          const rows: RequestLogEntry[] = [];
+          const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+          try {
+            const pending = fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+              headers: { ...upgradeRequestHeaders(), "x-opencodex-api-key": DATA_TOKEN },
+            }).then(response => ({ response }), error => ({ error }));
+            await awaitBounded(Promise.all([acquisitionStarted.promise, deadlineCaptured.promise]), "acquisition deadline was not armed");
+            expire!();
+            const outcome = await awaitBounded(pending, "expired acquisition did not return");
+            if (!("response" in outcome)) throw outcome.error;
+            const { response } = outcome;
+            expect(response.status).toBe(504);
+            await response.text();
+            const observedRow = await awaitObservation(finalized.promise);
+            expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+            if (observedRow === OBSERVATION_TIMEOUT) throw new Error("acquisition deadline was not finalized");
+            expect(observedRow.status).toBe(504);
+            expect(rows.map(entry => entry.status)).toEqual([504]);
+            const metrics = await scrapeServer(server);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(1);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(0);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+            expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+          } finally {
+            disposeRows();
+            finalized.dispose();
+          }
+        } finally {
+          timers.mockRestore();
+        }
+      } finally {
+        await stopMetricsServer(server);
+      }
+    } finally {
+      resolver.mockRestore();
+    }
+  });
+
+  test("active-turn capacity refusal finalizes exactly one failed 503 live request", async () => {
+    saveConfig(liveMetricsConfig());
+    const server = startMetricsServer({
+      liveSidebandWebSocketFactory: () => { throw new Error("capacity refusal reached upstream dial"); },
+    });
+    const leases: Array<{ release(): void }> = [];
+    const finalized = nextFinalRequestLog(entry => entry.status === 503);
+    const rows: RequestLogEntry[] = [];
+    const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+    try {
+      for (let index = 0; index < MAX_ACTIVE_SESSION_LANES; index += 1) {
+        const lease = tryAdmitTurn(`metrics-capacity-${index}`);
+        if (!lease) throw new Error(`failed to reserve capacity lane ${index}`);
+        leases.push(lease);
+      }
+      const response = await fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+        headers: { ...upgradeRequestHeaders(), "session-id": "metrics-capacity-overflow" },
+      });
+      expect(response.status).toBe(503);
+      await response.text();
+      const observedRow = await awaitObservation(finalized.promise);
+      expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+      if (observedRow === OBSERVATION_TIMEOUT) throw new Error("capacity refusal was not finalized");
+      expect(observedRow.status).toBe(503);
+      expect(rows.map(entry => entry.status)).toEqual([503]);
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+    } finally {
+      for (const lease of leases.reverse()) lease.release();
+      disposeRows();
+      finalized.dispose();
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("acquisition resolver exception finalizes one 500 row before rethrow", async () => {
+    saveConfig(liveMetricsConfig());
+    const fixtureError = new Error("metrics acquisition resolver failure");
+    const resolver = spyOn(audioUpstream, "resolveAudioUpstream").mockImplementation(async () => { throw fixtureError; });
+    try {
+      const observedErrors: unknown[] = [];
+      const unexpectedErrors: unknown[] = [];
+      const server = startMetricsServerWithExpectedError(fixtureError, observedErrors, unexpectedErrors);
+      try {
+        const finalized = nextFinalRequestLog(entry => entry.status === 500);
+        const rows: RequestLogEntry[] = [];
+        const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+        try {
+          const response = await fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+            headers: { ...upgradeRequestHeaders(), "x-opencodex-api-key": DATA_TOKEN },
+          });
+          expect(response.status).toBe(500);
+          await response.text();
+          const observedRow = await awaitObservation(finalized.promise);
+          expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+          if (observedRow === OBSERVATION_TIMEOUT) throw new Error("resolver exception was not finalized");
+          expect(observedRow.status).toBe(500);
+          expect(rows.map(entry => entry.status)).toEqual([500]);
+          expect(observedErrors).toEqual([fixtureError]);
+          expect(unexpectedErrors).toEqual([]);
+          const metrics = await scrapeServer(server);
+          expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(1);
+          expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(0);
+          expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+          expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+        } finally {
+          disposeRows();
+          finalized.dispose();
+        }
+      } finally {
+        await stopMetricsServer(server);
+      }
+    } finally {
+      resolver.mockRestore();
+    }
+  });
+
+  test.each([
+    ["upgrade-throw", 502],
+    ["upgrade-false", 426],
+  ] as const)("%s finalizes exactly one failed live request", async (control, expectedStatus) => {
+    const upstream = startLiveMetricsUpstream();
+    try {
+      saveConfig(liveMetricsConfig());
+      const upstreamUrl = new URL("/upstream", upstream.url);
+      upstreamUrl.protocol = "ws:";
+      let factoryCalls = 0;
+      const server = startMetricsServerWithLiveRequestControl(control, {
+        liveSidebandWebSocketFactory: () => {
+          factoryCalls += 1;
+          return new WebSocket(upstreamUrl);
+        },
+      });
+      const finalized = nextFinalRequestLog(entry => entry.status === expectedStatus);
+      const rows: RequestLogEntry[] = [];
+      const disposeRows = observeRequestLogsForTests(entry => { if (entry.model === "gpt-live") rows.push(entry); });
+      try {
+        const response = await fetch(new URL("/v1/realtime?model=fixture%2Fmetrics-model", server.url), {
+          headers: upgradeRequestHeaders(),
+        });
+        expect(response.status).toBe(expectedStatus);
+        await response.text();
+        const observedRow = await awaitObservation(finalized.promise);
+        expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+        if (observedRow === OBSERVATION_TIMEOUT) throw new Error(`${expectedStatus} upgrade refusal was not finalized`);
+        expect(observedRow.status).toBe(expectedStatus);
+        expect(rows.map(entry => entry.status)).toEqual([expectedStatus]);
+        expect(factoryCalls).toBe(1);
+        const metrics = await scrapeServer(server);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="failed"}')).toBe(1);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="completed"}')).toBe(0);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="aborted"}')).toBe(0);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="unknown",result="incomplete"}')).toBe(0);
+      } finally {
+        disposeRows();
+        finalized.dispose();
+        await stopMetricsServer(server);
+      }
+    } finally {
+      await upstream.stop(true);
+    }
+  });
+
+  test("buffered HTTP 200 response.failed is classified as failed", async () => {
+    installUpstream(originalFetch, () => Response.json({
+      type: "response.failed",
+      response: {
+        id: "resp_failed_metrics",
+        status: "failed",
+        error: { type: "server_error", code: "upstream_error", message: "bounded failure" },
+        output: [],
+      },
+    }));
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    try {
+      const response = await sendResponsesRequest(server);
+      expect(response.status).toBe(200);
+      await response.text();
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="failed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(0);
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("buffered HTTP 200 response.incomplete is classified as incomplete", async () => {
+    installUpstream(originalFetch, () => Response.json({
+      type: "response.incomplete",
+      response: {
+        id: "resp_incomplete_metrics",
+        status: "incomplete",
+        incomplete_details: { reason: "max_output_tokens" },
+        output: [],
+      },
+    }));
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    try {
+      const response = await sendResponsesRequest(server);
+      expect(response.status).toBe(200);
+      await response.text();
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="incomplete"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(0);
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("buffered read errors stay failed even after terminal-looking partial bytes", async () => {
+    const bytes = new TextEncoder().encode(completedResponseJson("partial"));
+    const fixtureError = new Error("fixture read failure");
+    const observedErrors: unknown[] = [];
+    const unexpectedErrors: unknown[] = [];
+    installUpstream(originalFetch, () => {
+      let delivered = false;
+      return new Response(new ReadableStream<Uint8Array>({
+        pull(controller) {
+          if (!delivered) {
+            delivered = true;
+            controller.enqueue(bytes);
+            return;
+          }
+          controller.error(fixtureError);
+        },
+      }), { headers: { "content-type": "application/json" } });
+    });
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServerWithExpectedError(fixtureError, observedErrors, unexpectedErrors);
+    const finalized = nextFinalRequestLog(entry => entry.status === 502 && entry.inboundProtocol === "responses");
+    try {
+      const response = await sendResponsesRequest(server);
+      expect(response.status).toBe(500);
+      await response.text();
+      expect(observedErrors).toEqual([fixtureError]);
+      expect(unexpectedErrors).toEqual([]);
+      const observedRow = await awaitObservation(finalized.promise);
+      expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+      if (observedRow === OBSERVATION_TIMEOUT) throw new Error("read-error finalization was not observed");
+      const row = observedRow;
+      expect(row).toMatchObject({ status: 502, closeReason: "non_stream" });
+      expect(row.firstOutputMs).toBeUndefined();
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="failed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="completed"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_physical_sends_total{protocol="responses"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_ttft_missing_total{protocol="responses",result="failed"}')).toBe(1);
+    } finally {
+      finalized.dispose();
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("a client abort during buffered JSON read is counted as aborted before rethrow", async () => {
+    let signalReadStarted: (() => void) | undefined;
+    let signalAbortObserved: (() => void) | undefined;
+    const readStarted = new Promise<void>(resolve => { signalReadStarted = resolve; });
+    const abortObserved = new Promise<void>(resolve => { signalAbortObserved = resolve; });
+    installUpstream(originalFetch, (_send, request) => {
+      const signal = request.signal;
+      return new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          const abort = () => {
+            signalAbortObserved?.();
+            try { controller.error(signal.reason); } catch { /* stream already settled */ }
+          };
+          if (signal.aborted) abort();
+          else signal.addEventListener("abort", abort, { once: true });
+        },
+        pull() {
+          signalReadStarted?.();
+          return new Promise<void>(() => {});
+        },
+      }), { headers: { "content-type": "application/json" } });
+    });
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    const clientAbort = new AbortController();
+    const finalized = nextFinalRequestLog(entry => entry.status === 499 && entry.closeReason === "client_cancel");
+    try {
+      const request = sendResponsesRequest(server, false, clientAbort.signal);
+      const requestOutcome = request.catch(error => error);
+      await awaitBounded(readStarted, "upstream buffer read did not start");
+      clientAbort.abort(new DOMException("client cancelled metrics request", "AbortError"));
+      await awaitBounded(abortObserved, "outgoing upstream signal did not observe client abort");
+      const outcome = await awaitBounded(requestOutcome, "client abort request did not settle");
+      expect(outcome).toBeInstanceOf(Error);
+      const observedRow = await awaitObservation(finalized.promise);
+      expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+      if (observedRow === OBSERVATION_TIMEOUT) throw new Error("buffered-abort finalization was not observed");
+      const row = observedRow;
+      expect(row).toMatchObject({ status: 499, closeReason: "client_cancel" });
+      expect(row.firstOutputMs).toBeUndefined();
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="aborted"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="failed"}')).toBe(0);
+      expect(sampleValue(metrics, 'opencodex_physical_sends_total{protocol="responses"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_ttft_missing_total{protocol="responses",result="aborted"}')).toBe(1);
+    } finally {
+      finalized.dispose();
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("terminal-free SSE EOF and downstream cancellation remain incomplete and aborted", async () => {
+    const encoder = new TextEncoder();
+    installUpstream(originalFetch, (send, request) => {
+      if (send === 1) {
+        return new Response(responseSse(), { headers: { "content-type": "text/event-stream" } });
+      }
+      const signal = request.signal;
+      return new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          const abort = () => {
+            try { controller.error(signal.reason); } catch { /* stream already settled */ }
+          };
+          if (signal.aborted) {
+            abort();
+            return;
+          }
+          signal.addEventListener("abort", abort, { once: true });
+          controller.enqueue(encoder.encode(responseSse()));
+        },
+      }), { headers: { "content-type": "text/event-stream" } });
+    });
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    try {
+      const incomplete = await sendResponsesRequest(server, true);
+      await incomplete.text();
+      const finalized = nextFinalRequestLog(entry => entry.status === 499 && entry.closeReason === "client_cancel");
+      const clientAbort = new AbortController();
+      const cancelled = await sendResponsesRequest(server, true, clientAbort.signal);
+      const reader = cancelled.body?.getReader();
+      try {
+        expect(reader).toBeDefined();
+        expect((await reader!.read()).done).toBe(false);
+        clientAbort.abort(new DOMException("client cancelled streaming metrics request", "AbortError"));
+        const observedRow = await awaitObservation(finalized.promise);
+        expect(observedRow).not.toBe(OBSERVATION_TIMEOUT);
+        if (observedRow === OBSERVATION_TIMEOUT) throw new Error("stream-cancel finalization was not observed");
+        const row = observedRow;
+        expect(row).toMatchObject({ status: 499, closeReason: "client_cancel" });
+        expect(row.firstOutputMs).toBeUndefined();
+        const metrics = await scrapeServer(server);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="incomplete"}')).toBe(1);
+        expect(sampleValue(metrics, 'opencodex_logical_requests_total{protocol="responses",result="aborted"}')).toBe(1);
+        expect(sampleValue(metrics, 'opencodex_ttft_missing_total{protocol="responses",result="incomplete"}')).toBe(1);
+        expect(sampleValue(metrics, 'opencodex_ttft_missing_total{protocol="responses",result="aborted"}')).toBe(1);
+      } finally {
+        await reader?.cancel().catch(() => {});
+        finalized.dispose();
+      }
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("real buffered and streaming flows distinguish missing TTFT from zero", async () => {
+    let send = 0;
+    installUpstream(originalFetch, () => {
+      send += 1;
+      return send === 1
+        ? new Response(completedResponseJson(), { headers: { "content-type": "application/json" } })
+        : new Response(responseSse({ terminal: "completed", output: "instant" }), {
+          headers: { "content-type": "text/event-stream" },
+        });
+    });
+    saveConfig(runtimeConfig("openai-responses"));
+    const server = startMetricsServer();
+    const realNow = Date.now;
+    try {
+      const buffered = await sendResponsesRequest(server);
+      await buffered.text();
+      Date.now = () => 1_900_000_000_000;
+      const streamed = await sendResponsesRequest(server, true);
+      await streamed.text();
+      Date.now = realNow;
+      const metrics = await scrapeServer(server);
+      expect(sampleValue(metrics, 'opencodex_ttft_missing_total{protocol="responses",result="completed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_ttft_seconds_count{protocol="responses",result="completed"}')).toBe(1);
+      expect(sampleValue(metrics, 'opencodex_ttft_seconds_bucket{protocol="responses",result="completed",le="0.05"}')).toBe(1);
+    } finally {
+      Date.now = realNow;
+      await stopMetricsServer(server);
+    }
+  });
+
+  test("disabled live server exposes no metrics owner and returns authenticated 404", async () => {
+    saveConfig(runtimeConfig("openai-responses", false));
+    const server = startMetricsServer();
+    try {
+      const response = await fetch(new URL("/api/metrics", server.url), {
+        headers: { "x-opencodex-api-key": ADMIN_TOKEN },
+      });
+      expect(response.status).toBe(404);
+      expect((await response.json() as { error: { code: string } }).error.code).toBe("not_found");
+    } finally {
+      await stopMetricsServer(server);
+    }
+  });
+});
+
+describe("metricsExport config admission", () => {
+  test("absence and false stay disabled while true enables the process-lifetime owner", () => {
+    expect(metricsExportEnabled(config())).toBe(false);
+    expect(metricsExportEnabled(config({ metricsExport: { enabled: false } }))).toBe(false);
+    expect(metricsExportEnabled(config({ metricsExport: { enabled: true } }))).toBe(true);
+  });
+
+  test("live writes reject malformed and unknown fields before the degrading schema", () => {
+    const base = getDefaultConfig();
+    expect(validateConfigCandidate({ ...base, metricsExport: { enabled: "yes" } })).toMatchObject({
+      ok: false,
+      error: "schema_invalid: metricsExport.enabled: must be a boolean",
+    });
+    expect(validateConfigCandidate({ ...base, metricsExport: { enabled: true, label: "private" } })).toMatchObject({
+      ok: false,
+      error: "schema_invalid: metricsExport: contains an unsupported field",
+    });
+  });
+
+  test("malformed persisted values degrade only metrics export to disabled", () => {
+    const base = getDefaultConfig();
+    for (const metricsExport of [{ enabled: "yes" }, { enabled: true, label: "private" }]) {
+      const diagnostics = configDiagnosticsFromRaw(JSON.stringify({ ...base, metricsExport }));
+      expect(diagnostics.config.metricsExport).toBeUndefined();
+      expect(diagnostics.config.providers).toEqual(base.providers);
+    }
+  });
+});
diff --git a/tests/server/management-model-roster-gather-race.test.ts b/tests/server/management-model-roster-gather-race.test.ts
new file mode 100644
index 00000000000..00d200597ac
--- /dev/null
+++ b/tests/server/management-model-roster-gather-race.test.ts
@@ -0,0 +1,224 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { withStubbedProviderFetch } from "../helpers/catalog-provider-fetch";
+import {
+  loadExportModels,
+  previewExportModels,
+  resetExportSnapshotForTests,
+} from "../../src/server/management/model-rows";
+import { clearGatherRoutedModelsInflight, resetCatalogRuntimeStateForTests } from "../../src/codex/catalog";
+import { clearModelCache, getStaleCached, setCached } from "../../src/codex/model-cache";
+import type { ExportModel } from "../../src/clients/config-export";
+import type { OcxConfig } from "../../src/types";
+
+/**
+ * Things can change inside one export load, and what it retains has to be identified by the state
+ * its rows were chosen under rather than by whatever is current when it finishes.
+ *
+ * The interleaving here is real. The load runs a two-provider gather, alpha answers immediately and
+ * beta is held open, so the load is still inside its own await after alpha has chosen, published
+ * and stamped its rows. Whatever the case does in that window lands where it matters.
+ */
+const ALPHA_HOST = "https://alpha.gather-race.test/v1";
+const BETA_HOST = "https://beta.gather-race.test/v1";
+const GAMMA_HOST = "https://gamma.gather-race.test/v1";
+
+const originalFetch = globalThis.fetch;
+let configRoot = "";
+let priorHome: string | undefined;
+
+function raceConfig(): OcxConfig {
+  return withStubbedProviderFetch({
+    port: 10100,
+    hostname: "127.0.0.1",
+    defaultProvider: "alpha",
+    providers: {
+      alpha: { adapter: "openai-chat", baseUrl: ALPHA_HOST, models: [] },
+      beta: { adapter: "openai-chat", baseUrl: BETA_HOST, models: [] },
+    },
+  } as OcxConfig);
+}
+
+/** Alpha answers at once; beta stays open until the returned release is called. */
+function holdBetaOpen(): () => void {
+  let release!: () => void;
+  const gate = new Promise<void>(resolve => { release = resolve; });
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const alpha = String(input).includes("alpha.");
+    if (!alpha) await gate;
+    return new Response(JSON.stringify({ data: [{ id: alpha ? "alpha-chosen" : "beta-only" }] }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+  return release;
+}
+
+/**
+ * Resolves once alpha's rows are published, which is also once they are stamped: the provider
+ * publishes and builds its result in one synchronous block, so a cache entry another task can see
+ * is proof the revision that vouches for those rows has already been taken.
+ */
+async function afterAlphaChoseItsRows(): Promise<void> {
+  for (let attempt = 0; attempt < 2_000; attempt += 1) {
+    if (getStaleCached("alpha") !== null) return;
+    await new Promise(resolve => setTimeout(resolve, 1));
+  }
+  throw new Error("alpha never published its rows");
+}
+
+/**
+ * Runs the supplied step in the window where alpha has chosen and beta has not answered, then lets
+ * the load finish.
+ *
+ * Beta is released in a finally and the load is awaited there too, because a failure inside the
+ * window would otherwise leave a gather in flight while teardown clears the caches it is about to
+ * publish into, and the next case would inherit it.
+ */
+async function loadWhileBetaIsHeld(
+  during: (config: OcxConfig) => void | Promise<void>,
+  prepare?: (config: OcxConfig) => void,
+): Promise<{ config: OcxConfig; exported: readonly ExportModel[] }> {
+  const release = holdBetaOpen();
+  const config = raceConfig();
+  prepare?.(config);
+  const load = loadExportModels(config);
+  const settled = load.catch(() => undefined);
+  try {
+    await afterAlphaChoseItsRows();
+    await during(config);
+  } finally {
+    release();
+    await settled;
+  }
+  return { config, exported: await load };
+}
+
+const alphaRows = (models: readonly ExportModel[]): string[] =>
+  models.filter(model => model.provider === "alpha").map(model => model.namespaced);
+
+beforeEach(() => {
+  configRoot = mkdtempSync(join(tmpdir(), "ocx-gather-race-"));
+  priorHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = configRoot;
+  resetExportSnapshotForTests();
+  clearModelCache();
+  clearGatherRoutedModelsInflight();
+  resetCatalogRuntimeStateForTests();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  resetExportSnapshotForTests();
+  clearModelCache();
+  clearGatherRoutedModelsInflight();
+  resetCatalogRuntimeStateForTests();
+  if (priorHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = priorHome;
+  removeTreeWithRetry(configRoot);
+});
+
+describe("an export load retains what its rows were chosen under", () => {
+  test("a load nothing competes with leaves a preview that serves exactly what it returned", async () => {
+    const { config, exported } = await loadWhileBetaIsHeld(() => {});
+
+    expect(alphaRows(exported)).toEqual(["alpha/alpha-chosen"]);
+    // The control for the two cases below. Without it, a preview refused for some unrelated reason
+    // would look like a race being closed.
+    expect(previewExportModels(config)).toEqual(exported);
+  });
+
+  test("rows chosen before a competing publication are never served as current", async () => {
+    const { config, exported } = await loadWhileBetaIsHeld(() => {
+      // The competing flight publishes here: alpha has chosen and stamped its rows, and this load
+      // has not reached its retention yet because beta is still open.
+      expect(setCached("alpha", [{ id: "alpha-superseded", provider: "alpha" }])).toBe(true);
+    });
+
+    // The load still returns the rows it fetched. Those rows are not wrong; they are simply no
+    // longer the current ones.
+    expect(alphaRows(exported)).toEqual(["alpha/alpha-chosen"]);
+    // What must not survive is the claim that they are current. Sampling the revision at retention
+    // would have read the competing publication's, matched it on the way out, and handed a preview
+    // these rows under an identity they never had.
+    expect(previewExportModels(config)).toBeNull();
+  });
+
+  test("a configuration edited during the load changes neither the rows nor what is retained", async () => {
+    const { config, exported } = await loadWhileBetaIsHeld(edited => {
+      // Management routes edit the live configuration in place. This edit would remove the row
+      // below from the projection, which is what makes it visible: the load gathered under the
+      // configuration it admitted and has to project under that same one.
+      edited.disabledModels = ["alpha/alpha-chosen"];
+    });
+
+    // Gathered under the admitted configuration and projected under it too. Reading the live
+    // object for the projection would have produced rows belonging to neither configuration.
+    expect(alphaRows(exported)).toEqual(["alpha/alpha-chosen"]);
+    // Retaining would record this roster under a configuration that does not produce it. Refusing
+    // costs one ordinary load and is the only honest answer.
+    expect(previewExportModels(config)).toBeNull();
+  });
+
+  test("replacing a provider's transport executor retires the roster it gathered", async () => {
+    const { config, exported } = await loadWhileBetaIsHeld(() => {});
+    expect(previewExportModels(config)).toEqual(exported);
+    const executor = (config.providers.alpha as { fetch?: typeof fetch }).fetch;
+    expect(typeof executor).toBe("function");
+
+    // The same executor is the same configuration: this is an identity, so putting back the very
+    // object that was there changes nothing.
+    (config.providers.alpha as { fetch?: typeof fetch }).fetch = executor;
+    expect(previewExportModels(config)).toEqual(exported);
+
+    // The executor is the one part of a provider that is not data, so it is held by reference
+    // rather than compared as content. A different executor can answer differently, so a roster
+    // gathered through the previous one is no longer a roster for this configuration.
+    // A wrapper that defers to the previous one would serialize identically and is still a
+    // different answer waiting to happen, which is why nothing here compares what it looks like.
+    (config.providers.alpha as { fetch?: typeof fetch }).fetch = ((input: RequestInfo | URL, init?: RequestInit) =>
+      executor!(input, init)) as typeof fetch;
+    expect(previewExportModels(config)).toBeNull();
+  });
+
+  test("a provider fetch value that is not an executor is ordinary configuration", async () => {
+    const { config, exported } = await loadWhileBetaIsHeld(() => {}, prepared => {
+      // A provider schema passes unknown keys through, so a configuration file can carry this and
+      // the transport never calls it. Refusing the admission over it would take previews away for
+      // a field nothing reads.
+      prepared.providers.gamma = {
+        adapter: "openai-chat", baseUrl: GAMMA_HOST, liveModels: false, models: ["gamma-static"],
+      } as OcxConfig["providers"][string];
+      (prepared.providers.gamma as { fetch?: unknown }).fetch = "https://not-an-executor.test/v1";
+    });
+
+    expect(exported.some(model => model.namespaced === "gamma/gamma-static")).toBe(true);
+    expect(previewExportModels(config)).toEqual(exported);
+
+    // Data, and compared as data: editing it is a configuration change like any other.
+    (config.providers.gamma as { fetch?: unknown }).fetch = "https://also-not-an-executor.test/v1";
+    expect(previewExportModels(config)).toBeNull();
+  });
+
+  test("a configuration carrying an accessor is refused without the accessor being read", async () => {
+    let reads = 0;
+    const { config, exported } = await loadWhileBetaIsHeld(edited => {
+      Object.defineProperty(edited, "disabledModels", {
+        configurable: true,
+        enumerable: true,
+        get: () => { reads += 1; return []; },
+      });
+    });
+
+    // The rows are still the ordinary answer; only the preview authority is withheld.
+    expect(alphaRows(exported)).toEqual(["alpha/alpha-chosen"]);
+    expect(previewExportModels(config)).toBeNull();
+    // A copier that serialized the configuration would have called this and then compared whatever
+    // it chose to return. Refusing without invoking it is the difference between reading a
+    // configuration and asking it what it would like to be.
+    expect(reads).toBe(0);
+  });
+});
diff --git a/tests/server/management-model-roster.test.ts b/tests/server/management-model-roster.test.ts
new file mode 100644
index 00000000000..493fb7f265c
--- /dev/null
+++ b/tests/server/management-model-roster.test.ts
@@ -0,0 +1,223 @@
+import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach } from "bun:test";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import {
+  exportSnapshotIdentity,
+  listManagementModelRows,
+  loadExportModels,
+  previewExportModels,
+  resetExportSnapshotForTests,
+} from "../../src/server/management/model-rows";
+import type { CatalogModel } from "../../src/codex/catalog";
+import type { OcxConfig } from "../../src/types";
+import { clearModelCache, reconcileModelCacheProviders, setCached } from "../../src/codex/model-cache";
+
+/**
+ * A read-only caller has to be able to see what a writer would write without performing the
+ * gather, because the gather reaches providers and can persist an initial model selection. What
+ * it must NOT get is a different projection, or a preview and the commit that follows it would
+ * disagree about the roster for a reason that has nothing to do with the roster changing.
+ */
+const CONFIG: OcxConfig = {
+  port: 10100,
+  hostname: "127.0.0.1",
+  defaultProvider: "supplied",
+  providers: { supplied: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1" } },
+} as OcxConfig;
+
+const SUPPLIED: CatalogModel[] = [{ id: "supplied-model", provider: "supplied" }];
+
+/**
+ * A roster is identified by the configuration it was admitted under, so these cases need their own
+ * configuration directory rather than whatever the machine running them happens to have.
+ */
+let configRoot = "";
+let priorHome: string | undefined;
+
+beforeEach(() => {
+  configRoot = mkdtempSync(join(tmpdir(), "ocx-roster-config-"));
+  priorHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = configRoot;
+  mkdirSync(configRoot, { recursive: true });
+});
+
+afterEach(() => {
+  if (priorHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = priorHome;
+  removeTreeWithRetry(configRoot);
+});
+
+describe("a supplied roster replaces the gather and keeps the projection", () => {
+  test("rows come from the roster the caller brought", async () => {
+    const rows = await listManagementModelRows(CONFIG, { models: SUPPLIED });
+    // No provider here serves this id, so a gather could not have produced this row. Its
+    // presence is what proves the supplied roster was used instead.
+    expect(rows.some(row => row.id === "supplied-model")).toBe(true);
+  });
+
+  test("the disabled computation still applies to a supplied roster", async () => {
+    const rows = await listManagementModelRows(
+      { ...CONFIG, disabledModels: ["supplied/supplied-model"] } as OcxConfig,
+      { models: SUPPLIED },
+    );
+    const row = rows.find(candidate => candidate.id === "supplied-model");
+    expect(row?.disabled).toBe(true);
+  });
+
+  test("the export projection accepts a supplied roster without gathering", async () => {
+    // Visibility and provider selection decide which rows survive here, so this asserts the call
+    // completes through the same path rather than pinning that policy from outside.
+    await expect(loadExportModels(CONFIG, SUPPLIED)).resolves.toBeInstanceOf(Array);
+  });
+});
+
+describe("a preview reads only a roster an authoritative load already finished", () => {
+  test("a cold process has none, and an ordinary load leaves the final projection behind", async () => {
+    resetExportSnapshotForTests();
+    // Recoverable rather than broken: the operator opens the models view and the snapshot appears.
+    expect(previewExportModels(CONFIG)).toBeNull();
+
+    const exported = await loadExportModels(CONFIG, SUPPLIED);
+    // The FINAL projection, not an input to it: rebuilding from raw provider caches would miss
+    // static and forward providers and skip the filtering this applies afterwards.
+    expect(previewExportModels(CONFIG)).toEqual(exported);
+  });
+
+  test("changing what the roster depends on retires the snapshot", async () => {
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // A blocklist edit changes which models a client would be given, so a plan built against the
+    // old roster no longer describes what the user has.
+    const blocked = { ...CONFIG, disabledModels: ["supplied/supplied-model"] } as OcxConfig;
+    expect(previewExportModels(blocked)).toBeNull();
+
+    const added = { ...CONFIG, customModels: [{ id: "c1", provider: "supplied", modelId: "extra" }] } as OcxConfig;
+    expect(previewExportModels(added)).toBeNull();
+  });
+
+  test("a preview is refused to a caller holding a different in-memory configuration", async () => {
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // Same configuration file, different configuration object. The file digest alone cannot see
+    // this, and neither could a hand-written list of the fields that seemed to matter: fastRows
+    // changes what the export projection emits and no such list ever mentioned it.
+    expect(previewExportModels({ ...CONFIG, fastRows: false } as OcxConfig)).toBeNull();
+
+    // A difference that changes nothing about the roster is still a different configuration. The
+    // identity is structural precisely so it does not depend on anyone deciding which fields count.
+    expect(previewExportModels({ ...CONFIG, shutdownTimeoutMs: 7_000 } as OcxConfig)).toBeNull();
+
+    // A separate object describing the same configuration is the same configuration: this is an
+    // identity of the content, not of the object a caller happens to be holding.
+    const equivalent = previewExportModels({ ...CONFIG } as OcxConfig);
+    expect(equivalent).not.toBeNull();
+    expect(equivalent).toEqual(previewExportModels(CONFIG));
+  });
+
+  test("a completed discovery retires the snapshot even though the config never changed", async () => {
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // The real trigger: a discovery that succeeded and published different rows. The config key
+    // cannot see it, and an authority generation does not move for it either.
+    expect(setCached("supplied", [{ id: "discovered-later", provider: "supplied" }])).toBe(true);
+    expect(previewExportModels(CONFIG)).toBeNull();
+  });
+
+  test("an unchanged roster keeps the identity a caller is already holding", async () => {
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    const held = exportSnapshotIdentity(CONFIG);
+    expect(held).not.toBeNull();
+
+    // An ordinary read rebuilds the same rows, and the Integrations collection performs one on
+    // every visit. Moving the identity for that turned a confirmation an operator was in the
+    // middle of submitting into a stale one, for no change they could see.
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(exportSnapshotIdentity(CONFIG)).toBe(held);
+
+    // A roster that genuinely differs still takes a new identity.
+    await loadExportModels(CONFIG, [...SUPPLIED, { id: "second-model", provider: "supplied" }]);
+    const moved = exportSnapshotIdentity(CONFIG);
+    expect(moved).not.toBeNull();
+    expect(moved).not.toBe(held);
+  });
+
+  test("a wholesale clear retires the snapshot even though no provider counter survives it", async () => {
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // The clear empties the map, so per-provider counters cannot record it. Only a global term
+    // can, and without one every derived roster would read as unchanged.
+    clearModelCache();
+    expect(previewExportModels(CONFIG)).toBeNull();
+  });
+
+  test("a provider that leaves and returns cannot match a roster built before it left", async () => {
+    resetExportSnapshotForTests();
+    // The provider has to be CACHED for reconciliation to have anything to remove. Supplying a
+    // roster skips the gather, so without this nothing tracks "supplied" and the prune is a no-op
+    // that proves nothing.
+    expect(setCached("supplied", [{ id: "cached-before-removal", provider: "supplied" }])).toBe(true);
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // Reconciliation drops the provider's revision entry. If that were the whole story the entry
+    // would come back at zero and the old stamp would match again, which is the ABA this guards.
+    reconcileModelCacheProviders(new Set<string>());
+    expect(previewExportModels(CONFIG)).toBeNull();
+
+    expect(setCached("supplied", [{ id: "cached-after-return", provider: "supplied" }])).toBe(true);
+    await loadExportModels(CONFIG, SUPPLIED);
+    const reborn = previewExportModels(CONFIG);
+    expect(reborn).not.toBeNull();
+  });
+
+  test("an absent config file is a configuration; an unreadable one is not", async () => {
+    // Absent means defaults, which is a fresh install and CI. Refusing there would make the
+    // feature look dead rather than safe.
+    resetExportSnapshotForTests();
+    await loadExportModels(CONFIG, SUPPLIED);
+    expect(previewExportModels(CONFIG)).not.toBeNull();
+
+    // A file that exists and cannot be parsed says nothing about which configuration this roster
+    // belongs to, so it fails closed.
+    writeFileSync(join(configRoot, "config.json"), "{ not valid json");
+    expect(previewExportModels(CONFIG)).toBeNull();
+  });
+
+  test("the snapshot does not share objects with the caller that produced it", async () => {
+    resetExportSnapshotForTests();
+    const exported = await loadExportModels(CONFIG, SUPPLIED);
+    const first = exported[0];
+    expect(first).toBeDefined();
+
+    // Freezing only the array left the models themselves shared, so a caller editing one in place
+    // would have rewritten what a later preview plans against, and moved the fingerprint with it.
+    if (first) first.id = "mutated-by-the-caller";
+    const snapshot = previewExportModels(CONFIG);
+    expect(snapshot?.some(model => model.id === "mutated-by-the-caller")).toBe(false);
+
+    // The same has to hold for a reader: holding the retained objects would let a consumer edit
+    // the roster every later preview plans against.
+    const read = previewExportModels(CONFIG);
+    const readFirst = read?.[0];
+    expect(readFirst).toBeDefined();
+    if (readFirst) {
+      readFirst.id = "mutated-by-a-reader";
+      readFirst.inputModalities = ["mutated"];
+    }
+    const fresh = previewExportModels(CONFIG);
+    expect(fresh?.some(model => model.id === "mutated-by-a-reader")).toBe(false);
+    expect(fresh?.some(model => model.inputModalities?.includes("mutated"))).toBe(false);
+  });
+});
diff --git a/tests/server/plaintext-v2-agent-messages-server.test.ts b/tests/server/plaintext-v2-agent-messages-server.test.ts
index cfbba40249c..46829c129fd 100644
--- a/tests/server/plaintext-v2-agent-messages-server.test.ts
+++ b/tests/server/plaintext-v2-agent-messages-server.test.ts
@@ -15,10 +15,19 @@ import {
 import { clearResponseStateForTests, expandPreviousResponseInput } from "../../src/responses/state";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
+let releaseInheritedSpendHome: (() => void) | undefined;
+// Taken per inherited-home dispatch because the pool retry row installs a different home. The
+// ??= keeps a second call inside one case idempotent rather than replacing the release callback
+// it would need; no row here calls it twice today, so this is defence, not a fixed regression.
+const takeInheritedSpendHome = (): void => { releaseInheritedSpendHome ??= acquireOwnedSpendHome(); };
 beforeEach(() => { clearResponseStateForTests(); });
 afterEach(() => {
+  // Released first so a failed row cannot leak its writer lease into the next case.
+  releaseInheritedSpendHome?.();
+  releaseInheritedSpendHome = undefined;
   globalThis.fetch = originalFetch;
   clearResponseStateForTests();
 });
@@ -89,12 +98,16 @@ async function withPoolHome<T>(run: () => Promise<T>): Promise<T> {
   const previousCodexHome = process.env.CODEX_HOME;
   process.env.OPENCODEX_HOME = home;
   process.env.CODEX_HOME = home;
+  // Taken after the pool case installs its home so its direct dispatch owns that journal.
+  const releaseSpendHome = acquireOwnedSpendHome();
   clearCodexUpstreamHealth();
   clearThreadAccountMap();
   clearAccountQuota();
   try {
     return await run();
   } finally {
+    // Released before removal or env restoration so the lease cannot outlive this home.
+    releaseSpendHome();
     clearCodexUpstreamHealth();
     clearThreadAccountMap();
     clearAccountQuota();
@@ -137,6 +150,7 @@ function overLimitResponsePayload(id = "resp-plaintext-v2-overflow") {
 
 describe("plaintext v2 agent messages at the Responses server boundary", () => {
   test.each(["json", "legacy-tee", "eager-relay"] as const)("null namespace restores before %s delivery and continuation storage", async mode => {
+    takeInheritedSpendHome();
     const id = `resp-null-namespace-${mode}`;
     const item = { ...completedResponsePayload(id).output[0]!, namespace: null };
     const payload = { id, status: "completed", output: [item] };
@@ -156,6 +170,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("rewrites the canonical request and restores every SSE response snapshot", async () => {
+    takeInheritedSpendHome();
     const sentBodies: string[] = [];
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
       sentBodies.push(typeof init?.body === "string" ? init.body : "");
@@ -207,6 +222,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("restores the namespace in bounded JSON responses", async () => {
+    takeInheritedSpendHome();
     globalThis.fetch = (async () => new Response(JSON.stringify(completedResponsePayload()), {
       status: 200,
       headers: { "content-type": "application/json" },
@@ -225,6 +241,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("rejects an unclassified successful response while restoration is required", async () => {
+    takeInheritedSpendHome();
     globalThis.fetch = (async () => new Response(
       JSON.stringify(completedResponsePayload()),
       { status: 200 },
@@ -244,6 +261,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("restores aliases after SSE snapshot repair copies request tools and tool choice", async () => {
+    takeInheritedSpendHome();
     globalThis.fetch = (async () => {
       const response = completedResponsePayload("resp-snapshot-sse");
       return new Response(
@@ -279,6 +297,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("restores aliases after bounded JSON snapshot repair", async () => {
+    takeInheritedSpendHome();
     globalThis.fetch = (async () => new Response(
       JSON.stringify(completedResponsePayload("resp-snapshot-json")),
       { status: 200, headers: { "content-type": "application/json" } },
@@ -304,6 +323,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("keeps the marker and reserved namespace when the option is disabled", async () => {
+    takeInheritedSpendHome();
     const sentBodies: string[] = [];
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
       sentBodies.push(typeof init?.body === "string" ? init.body : "");
@@ -324,6 +344,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("keeps the whole request unchanged when tool-search history conflicts with the alias", async () => {
+    takeInheritedSpendHome();
     const sentBodies: string[] = [];
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
       sentBodies.push(typeof init?.body === "string" ? init.body : "");
@@ -425,6 +446,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("fails closed for over-limit streamed responses in both relay modes", async () => {
+    takeInheritedSpendHome();
     for (const streamMode of ["legacy-tee", "eager-relay"] as const) {
       globalThis.fetch = (async () => new Response(
         `event: response.completed\ndata: ${JSON.stringify({
@@ -451,6 +473,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("rejects over-limit bounded JSON before HTTP or WebSocket reframing", async () => {
+    takeInheritedSpendHome();
     const fixtureId = "plaintext-v2-bounded-json-fixture";
     const fixtureModel = "fixture-model";
     const mutableRegistry = PROVIDER_REGISTRY as unknown as Array<Record<string, unknown>>;
@@ -503,6 +526,7 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
   });
 
   test("rejects an over-limit JSON response and does not retain it for continuation", async () => {
+    takeInheritedSpendHome();
     const sentBodies: string[] = [];
     let requestIndex = 0;
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
@@ -540,12 +564,14 @@ describe("plaintext v2 agent messages at the Responses server boundary", () => {
     const secondBody = await second.text();
     expect({ status: second.status, body: secondBody, sends: sentBodies.length }).toEqual({
       status: 400,
-      body: expect.stringContaining("continuation state is unavailable or expired"),
+      // One message for every local replay failure, so which one occurred is not readable here.
+      body: expect.stringContaining("Continuation state is unavailable or corrupt"),
       sends: 1,
     });
   });
 
   test.each([undefined, "websocket"] as const)("stores the client namespace across an option change on %s", async inboundTransport => {
+    takeInheritedSpendHome();
     const sentBodies: string[] = [];
     let requestIndex = 0;
     globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
@@ -604,6 +630,7 @@ test("plaintext startup warning requires explicit opt-in and names retention", (
 for (const streamMode of ["legacy-tee", "eager-relay"] as const) {
   for (const refusal of ["malformed", "unknown-alias", "conflicting-binding"] as const) {
     test(`${streamMode} ${refusal} is refused without caching or retry`, async () => {
+      takeInheritedSpendHome();
       let sends = 0;
       const sent: string[] = [];
       globalThis.fetch = (async (_url: RequestInfo | URL, init?: RequestInit) => {
@@ -634,6 +661,7 @@ for (const streamMode of ["legacy-tee", "eager-relay"] as const) {
 }
 
 test("malformed bounded JSON is a single-attempt 502", async () => {
+  takeInheritedSpendHome();
   let sends = 0;
   globalThis.fetch = (async () => { sends += 1; return new Response("{malformed", { headers: { "content-type": "application/json" } }); }) as typeof fetch;
   const response = await handleResponses(collaborationRequest(), config(true), { model: "", provider: "" });
@@ -643,6 +671,7 @@ test("malformed bounded JSON is a single-attempt 502", async () => {
 });
 
 test("cross-coordinate namespace conflict cannot publish continuation", async () => {
+  takeInheritedSpendHome();
   let sends = 0;
   globalThis.fetch = (async () => {
     sends += 1;
@@ -662,6 +691,7 @@ test("cross-coordinate namespace conflict cannot publish continuation", async ()
 
 
 test("concurrent native requests do not share plaintext alias metadata", async () => {
+  takeInheritedSpendHome();
   const pending: Array<{ enabled: boolean; resolve: (value: Response) => void }> = [];
   let bothReady!: () => void;
   const ready = new Promise<void>(resolve => { bothReady = resolve; });
diff --git a/tests/server/proxy-env.test.ts b/tests/server/proxy-env.test.ts
index c2584ffb2f3..340454dcfb6 100644
--- a/tests/server/proxy-env.test.ts
+++ b/tests/server/proxy-env.test.ts
@@ -315,16 +315,17 @@ describe("applyProxyEnv with proxy: \"auto\" (#1525)", () => {
   }
 
   test("parses bare, per-scheme, and socks-only ProxyServer values", () => {
-    expect(parseWindowsProxyServer("127.0.0.1:7890")).toEqual({ kind: "proxy", url: "http://127.0.0.1:7890" });
-    expect(parseWindowsProxyServer("http=10.0.0.5:3128;https=10.0.0.6:3129;ftp=x:1")).toEqual({ kind: "proxy", url: "http://10.0.0.6:3129" });
-    expect(parseWindowsProxyServer("http=10.0.0.5:3128")).toEqual({ kind: "proxy", url: "http://10.0.0.5:3128" });
+    expect(parseWindowsProxyServer("127.0.0.1:7890")).toEqual({ kind: "proxy", httpUrl: "http://127.0.0.1:7890", httpsUrl: "http://127.0.0.1:7890" });
+    expect(parseWindowsProxyServer("http=10.0.0.5:3128;https=10.0.0.6:3129;ftp=x:1")).toEqual({ kind: "proxy", httpUrl: "http://10.0.0.5:3128", httpsUrl: "http://10.0.0.6:3129" });
+    expect(parseWindowsProxyServer("http=10.0.0.5:3128")).toEqual({ kind: "proxy", httpUrl: "http://10.0.0.5:3128" });
+    expect(parseWindowsProxyServer("https=10.0.0.6:3129")).toEqual({ kind: "proxy", httpsUrl: "http://10.0.0.6:3129" });
     expect(parseWindowsProxyServer("socks=127.0.0.1:1080")).toEqual({ kind: "socks-only" });
     expect(parseWindowsProxyServer("")).toEqual({ kind: "disabled" });
   });
 
   test("readWindowsSystemProxy honors ProxyEnable and platform", () => {
     const on = () => ({ proxyEnable: "0x1", proxyServer: "127.0.0.1:7893" });
-    expect(readWindowsSystemProxy(on, "win32")).toEqual({ kind: "proxy", url: "http://127.0.0.1:7893" });
+    expect(readWindowsSystemProxy(on, "win32")).toEqual({ kind: "proxy", httpUrl: "http://127.0.0.1:7893", httpsUrl: "http://127.0.0.1:7893" });
     expect(readWindowsSystemProxy(() => ({ proxyEnable: "0x0", proxyServer: "127.0.0.1:7893" }), "win32")).toEqual({ kind: "disabled" });
     expect(readWindowsSystemProxy(() => null, "win32")).toEqual({ kind: "unreadable" });
     expect(readWindowsSystemProxy(on, "darwin")).toEqual({ kind: "unsupported" });
@@ -342,6 +343,27 @@ describe("applyProxyEnv with proxy: \"auto\" (#1525)", () => {
     expect(lines.join("\n")).not.toContain("secret-pass-91");
   });
 
+  test("auto preserves per-scheme Windows proxy scope", () => {
+    const lines = capture(() => applyProxyEnvWith(configWithProxy("auto"), {
+      platform: "win32",
+      reader: () => ({ proxyEnable: "0x1", proxyServer: "http=proxy-a:8080;https=user:secret-pass-92@proxy-b:8443" }),
+    }));
+    expect(process.env.HTTP_PROXY).toBe("http://proxy-a:8080");
+    expect(process.env.HTTPS_PROXY).toBe("http://user:secret-pass-92@proxy-b:8443");
+    expect(process.env.ALL_PROXY).toBeUndefined();
+    expect(lines.join("\n")).toContain("HTTP http://proxy-a:8080");
+    expect(lines.join("\n")).toContain("HTTPS http://proxy-b:8443");
+    expect(lines.join("\n")).not.toContain("secret-pass-92");
+
+    delete process.env.HTTP_PROXY; delete process.env.HTTPS_PROXY;
+    capture(() => applyProxyEnvWith(configWithProxy("auto"), {
+      platform: "win32",
+      reader: () => ({ proxyEnable: "0x1", proxyServer: "https=proxy-b:8443" }),
+    }));
+    expect(process.env.HTTP_PROXY).toBeUndefined();
+    expect(process.env.HTTPS_PROXY).toBe("http://proxy-b:8443");
+  });
+
   test("auto never leaks the literal into HTTP_PROXY when discovery yields nothing", () => {
     for (const [platform, reader] of [
       ["darwin", () => ({ proxyEnable: "0x1", proxyServer: "127.0.0.1:1" })],
diff --git a/tests/server/proxy-liveness.test.ts b/tests/server/proxy-liveness.test.ts
index 3d83e113ff8..d675f04c8b8 100644
--- a/tests/server/proxy-liveness.test.ts
+++ b/tests/server/proxy-liveness.test.ts
@@ -594,9 +594,32 @@ describe("runStartupReadinessSync", () => {
     expect(gate.getStatus()).toBe("failed");
   });
 
-  test("ok=true with nonempty warning → failed", async () => {
+  // #5181: a nonempty warning names a degradation of the LOCAL Codex home's artifacts that the
+  // sync itself continued past. Treating it as terminal permanently un-readied a proxy that was
+  // still serving every other provider, and in a single-replica Kubernetes deployment that
+  // removed the only Service endpoint. `ok` is the sync's verdict; `warning` is not.
+  test.each([
+    "catalog sync skipped: no Codex catalog source found; keeping Codex's native catalog.",
+    "1 combo omitted from the catalog because member capabilities are incomplete.",
+    "catalog sync skipped: refresh failed",
+    "Codex conversation-history relabel left to Codex's native writer: preflight refused.",
+  ])("ok=true with a local-artifact warning → ready (%s)", async warning => {
     const gate = createReadinessGate();
-    await runStartupReadinessSync(gate, async () => ({ ok: true, warning: "catalog sync skipped: no source" }));
+    await runStartupReadinessSync(gate, async () => ({ ok: true, warning }));
+    expect(gate.getStatus()).toBe("ready");
+  });
+
+  // The narrowing is to `warning` alone. A sync that reports the essential work unfinished is
+  // still terminal, warning or not, so a genuine startup failure cannot ride in as a degradation.
+  test("ok=false with a warning → still failed", async () => {
+    const gate = createReadinessGate();
+    await runStartupReadinessSync(gate, async () => ({ ok: false, warning: "catalog sync skipped: no source" }));
+    expect(gate.getStatus()).toBe("failed");
+  });
+
+  test("a result with no ok field at all → failed", async () => {
+    const gate = createReadinessGate();
+    await runStartupReadinessSync(gate, async () => ({ warning: "catalog sync skipped: no source" }));
     expect(gate.getStatus()).toBe("failed");
   });
 
diff --git a/tests/server/response-model-identity.test.ts b/tests/server/response-model-identity.test.ts
index 11d021563d8..319018c231d 100644
--- a/tests/server/response-model-identity.test.ts
+++ b/tests/server/response-model-identity.test.ts
@@ -2,10 +2,15 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { handleResponses } from "../../src/server/responses/core";
 import type { RequestLogContext } from "../../src/server/request-log";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
 
 afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
 });
 
@@ -85,6 +90,8 @@ async function post(args: {
   }) as typeof fetch;
 
   const logCtx = { model: "", provider: "" } as RequestLogContext;
+  // Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+  releaseSpendHome = acquireOwnedSpendHome();
   const response = await handleResponses(
     new Request("http://localhost/v1/responses", {
       method: "POST",
diff --git a/tests/server/server-agent-task-recovery-replay.test.ts b/tests/server/server-agent-task-recovery-replay.test.ts
index caaad660aad..9c660b2e292 100644
--- a/tests/server/server-agent-task-recovery-replay.test.ts
+++ b/tests/server/server-agent-task-recovery-replay.test.ts
@@ -1,4 +1,4 @@
-import { afterEach, expect, spyOn, test } from "bun:test";
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
 import { createKiroAdapter } from "../../src/adapters/kiro";
 import { ADAPTER_REGISTRY } from "../../src/adapters/registry";
 import { parseRequest } from "../../src/responses/parser";
@@ -7,8 +7,19 @@ import { conversationIdFromResponsesRequest } from "../../src/server/request-log
 import type { OcxParsedRequest } from "../../src/types";
 import { recoverEncryptedAgentTask, resetAgentTaskRecoveryState, restoreCachedEncryptedAgentTasks } from "../../src/server/responses/agent-task-recovery";
 import { codexHeaders, encryptedInput, fakeChatGptJwt, FERNET_TASK, SECOND_FERNET_TASK, originalFetch, recoverySse, routedConfig } from "../helpers/agent-task-recovery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 afterEach(() => { globalThis.fetch = originalFetch; resetAgentTaskRecoveryState(); });
 
+// Direct handler dispatch never takes the writer lease that startServer would take, so it is refused.
+let releaseSpendHome: (() => void) | undefined;
+beforeEach(() => {
+  releaseSpendHome = acquireOwnedSpendHome();
+});
+afterEach(() => {
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+});
+
 test("replay reuses admitted recovery after a tool result without another network call", async () => {
   let calls = 0;
   globalThis.fetch = (async () => { calls++; return new Response(recoverySse("Read nonce.txt exactly.")); }) as typeof fetch;
diff --git a/tests/server/server-auth.test.ts b/tests/server/server-auth.test.ts
index 1e226dd0b83..aec00ee0be2 100644
--- a/tests/server/server-auth.test.ts
+++ b/tests/server/server-auth.test.ts
@@ -36,6 +36,8 @@ import {
   startServer,
 } from "../../src/server";
 import { clearRequestLogsForTests, getRequestLogEntries } from "../../src/server/request-log";
+import { setRelayPlatformForTests } from "../../src/server/responses/passthrough-delivery";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { readUsageEntries } from "../../src/usage/log";
 import { handleManagementAPI } from "../../src/server/management-api";
 import { handleResponses, handleResponsesCompact } from "../../src/server/responses";
@@ -52,6 +54,7 @@ import { getDebugLogEntries, resetDebugLogBufferForTests } from "../../src/lib/d
 import { resetDebugSettingsForTests, setDebugSettings } from "../../src/lib/debug-settings";
 import { watchdogMs } from "../helpers/ci-watchdog";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { deferredResetSseUpstream } from "../helpers/deferred-reset-sse-upstream";
 const previousApiToken = process.env.OPENCODEX_API_AUTH_TOKEN;
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
 const originalGlobalFetch = globalThis.fetch;
@@ -752,6 +755,7 @@ describe("server local API auth", () => {
     };
     let acceptedCount = 0;
 
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -766,8 +770,10 @@ describe("server local API auth", () => {
       expect(response.status).toBe(429);
       expect(acceptedCount).toBe(1);
       expect(upstreamModels).toEqual(["first-model", "second-model"]);
+      await response.text();
     } finally {
       await upstream.stop(true);
+      releaseSpendHome();
     }
   });
 
@@ -3478,8 +3484,11 @@ describe("server local API auth", () => {
   });
 
   test("Activation E: both stream modes retry only before response relay construction", async () => {
-    const platformDescriptor = Object.getOwnPropertyDescriptor(process, "platform");
-    Object.defineProperty(process, "platform", { value: "win32", configurable: true });
+    // The relay decision only, not the whole process. A global platform override also changes
+    // state-directory identity, which is lowercased on win32 and so names a different directory
+    // on a case-sensitive filesystem: the server's own writer lease stopped matching and the
+    // retry was refused before it could reach the second account.
+    setRelayPlatformForTests("win32");
     try {
       for (const streamMode of ["legacy-tee", "eager-relay"] as const) {
         const positive = await startPoolRetryHarness(accountId => accountId === "acct-pool-a"
@@ -3511,7 +3520,7 @@ describe("server local API auth", () => {
         }
       }
     } finally {
-      if (platformDescriptor) Object.defineProperty(process, "platform", platformDescriptor);
+      setRelayPlatformForTests(undefined);
     }
   }, { timeout: SERVER_BUDGET_MS });
 
@@ -4245,23 +4254,14 @@ describe("server local API auth", () => {
   }, { timeout: SERVER_BUDGET_MS });
 
   test("native passthrough upstream reset still logs 502 and penalizes the pool", async () => {
-    const enc = new TextEncoder();
-    const source = Promise.withResolvers<ReadableStreamDefaultController<Uint8Array>>();
-    const harness = await startPoolRetryHarness(() => new Response(
-      new ReadableStream<Uint8Array>({
-        start(controller) {
-          source.resolve(controller);
-          controller.enqueue(enc.encode('data: {"type":"response.output_text.delta","delta":"hello"}\n\n'));
-        },
-      }),
-      { headers: { "content-type": "text/event-stream" } },
-    ), { secondAccount: false, streamMode: "legacy-tee" });
+    const upstream = deferredResetSseUpstream('data: {"type":"response.output_text.delta","delta":"hello"}\n\n');
+    const harness = await startPoolRetryHarness(() => upstream.response(), { secondAccount: false, streamMode: "legacy-tee" });
     try {
       const response = await harness.request({ stream: true });
       const requestId = response.headers.get("x-opencodex-request-id");
       const reader = response.body!.getReader();
       expect((await reader.read()).done).toBe(false);
-      (await source.promise).error(new Error("fixture upstream connection reset"));
+      upstream.reset();
       while (!(await reader.read()).done) { /* drain the synthetic failed terminal */ }
       const deadline = Date.now() + INTERNAL_DEADLINE_MS;
       while (!getRequestLogEntries().some(entry => entry.requestId === requestId) && Date.now() < deadline) {
diff --git a/tests/server/server-combo-failover-e2e.test.ts b/tests/server/server-combo-failover-e2e.test.ts
index 19c344003f8..f4904cb38dd 100644
--- a/tests/server/server-combo-failover-e2e.test.ts
+++ b/tests/server/server-combo-failover-e2e.test.ts
@@ -1,4 +1,5 @@
 import { registerComboForcedEffortCases } from "../helpers/combo-forced-effort-cases";
+import { registerComboToolRoutingCases } from "../helpers/combo-tool-routing-cases";
 import { comboProviderFactory } from "../helpers/combo-provider";
 import { registerComboContextOverflowCases } from "../helpers/combo-context-overflow-cases";
 import { registerComboContextHeadroomCases } from "../helpers/combo-context-headroom-cases";
@@ -38,6 +39,8 @@ import { startServer } from "../../src/server";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import { catalogConvergenceFactory } from "../helpers/catalog-convergence";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { chatErrorStream, chatStream, chatSuccess, chatTruncatedZeroOutputStream, responsesSuccess } from "../helpers/combo-failover-upstream";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { heldResponse } from "../helpers/held-response";
 import {
   clearResponseStateForTests,
@@ -142,6 +145,17 @@ let originalFetch: typeof fetch;
 let originalNow: () => number;
 const servers: Array<ReturnType<typeof Bun.serve>> = [];
 
+// A case that calls a handler directly never takes the writer lease startServer takes, so its
+// dispatch is refused. Taken at the dispatch helpers rather than file-wide: the cases that do
+// start a real server already own it, and this only ever adds a reference on the same home.
+let releaseSpendHome: (() => void) | undefined;
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
+// Every turn these helpers hand back. A row that asserts only on a status leaves a
+// transformed body unread, and cancelling those before the listeners stop is what keeps a
+// reader from settling against the journal after its lease is gone.
+const pendingTurns: Response[] = [];
+function trackTurn(response: Response): Response { pendingTurns.push(response); return response; }
+
 beforeEach(() => {
   originalFetch = globalThis.fetch;
   originalNow = Date.now;
@@ -168,11 +182,25 @@ beforeEach(() => {
 
 afterEach(async () => {
   let responseStatePending = true;
+  let cancelFailure: unknown;
   try {
+    // Rows that assert only on a status leave a transformed body unread. Cancelling those first
+    // means no reader is still attached when the listeners stop and the lease is given back. A
+    // cancel that throws fails the case rather than being swallowed, but not before every other
+    // turn and the listeners below have had their chance to close.
+    for (const turn of pendingTurns.splice(0)) {
+      if (turn.bodyUsed || !turn.body || turn.body.locked) continue;
+      try { await turn.body.cancel(); }
+      catch (error) { cancelFailure ??= error; }
+    }
     for (const server of servers.splice(0)) await server.stop(true);
     await flushResponseState();
     responseStatePending = responseStatePersistPendingForTests();
   } finally {
+    // After the listeners are stopped and the response state is flushed, both of which can
+    // still account against the journal, and before the home below is removed.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
     clearResponseStateForTests();
     clearCursorThreadContinuityForTests();
     globalThis.fetch = originalFetch;
@@ -191,6 +219,7 @@ afterEach(async () => {
     clearCodexUpstreamHealth();
     clearRequestLogsForTests();
   }
+  if (cancelFailure !== undefined) throw cancelFailure;
   expect(responseStatePending).toBe(false);
 });
 
@@ -204,60 +233,6 @@ function baseUrl(server: ReturnType<typeof Bun.serve>): string {
   return `${server.url.toString().replace(/\/$/, "")}/v1`;
 }
 
-function chatSuccess(text: string, model = "model"): Response {
-  return Response.json({
-    id: `chatcmpl-${model}`,
-    object: "chat.completion",
-    model,
-    choices: [{ index: 0, message: { role: "assistant", content: text }, finish_reason: "stop" }],
-    usage: { prompt_tokens: 2, completion_tokens: 1, total_tokens: 3 },
-  });
-}
-
-function chatStream(text: string): Response {
-  const frames = [
-    `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: text }, finish_reason: null }] })}\n\n`,
-    `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage: { prompt_tokens: 2, completion_tokens: 1, total_tokens: 3 } })}\n\n`,
-    "data: [DONE]\n\n",
-  ].join("");
-  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
-}
-
-function chatTruncatedZeroOutputStream(): Response {
-  const frames = [
-    `data: ${JSON.stringify({ choices: [{ index: 0, delta: {}, finish_reason: null }] })}\n\n`,
-  ].join("");
-  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
-}
-
-function chatErrorStream(message: string, prefix?: string): Response {
-  const frames = [
-    ...(prefix
-      ? [`data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: prefix }, finish_reason: null }] })}\n\n`]
-      : []),
-    `data: ${JSON.stringify({ error: { type: "server_error", code: "upstream_server_error", message } })}\n\n`,
-    "data: [DONE]\n\n",
-  ].join("");
-  return new Response(frames, { headers: { "content-type": "text/event-stream" } });
-}
-
-function responsesSuccess(text: string, model = "responses-model"): Record<string, unknown> {
-  return {
-    id: `resp-${model}`,
-    object: "response",
-    status: "completed",
-    model,
-    output: [{
-      id: "msg_backup",
-      type: "message",
-      role: "assistant",
-      status: "completed",
-      content: [{ type: "output_text", text, annotations: [] }],
-    }],
-    usage: { input_tokens: 2, output_tokens: 1, total_tokens: 3 },
-  };
-}
-
 function comboConfig(
   providers: OcxConfig["providers"],
   targets = Object.keys(providers).map((name, index) => ({ provider: name, model: `m${index + 1}` })),
@@ -277,11 +252,12 @@ async function post(
   options: HandleOptions = {},
   headers: Record<string, string> = {},
 ): Promise<Response> {
-  return handleResponses(new Request("http://localhost/v1/responses", {
+  takeSpendHome();
+  return trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
     method: "POST",
     headers: { "content-type": "application/json", ...headers },
     body: JSON.stringify({ model: "combo/free", input: "hello", stream: false, ...raw }),
-  }), config, { model: "", provider: "" }, options);
+  }), config, { model: "", provider: "" }, options));
 }
 
 let loggedRequestSequence = 0;
@@ -294,18 +270,19 @@ async function postLogged(
 ): Promise<Response> {
   const logCtx: RequestLogContext = { model: "", provider: "" };
   const start = Date.now();
+  takeSpendHome();
   const response = await handleResponses(new Request("http://localhost/v1/responses", {
     method: "POST",
     headers: { "content-type": "application/json", ...headers },
     body: JSON.stringify({ model: "combo/free", input: "hello", stream: false, ...raw }),
   }), config, logCtx, options);
   loggedRequestSequence += 1;
-  return responseWithDeferredRequestLog(
+  return trackTurn(responseWithDeferredRequestLog(
     response,
     `combo-test-${loggedRequestSequence}`,
     start,
     logCtx,
-  );
+  ));
 }
 
 async function postModelLogged(
@@ -317,18 +294,19 @@ async function postModelLogged(
 ): Promise<Response> {
   const logCtx: RequestLogContext = { model: "", provider: "" };
   const start = Date.now();
+  takeSpendHome();
   const response = await handleResponses(new Request("http://localhost/v1/responses", {
     method: "POST",
     headers: { "content-type": "application/json", ...headers },
     body: JSON.stringify({ model, input: "hello", stream: false, ...raw }),
   }), config, logCtx, options);
   loggedRequestSequence += 1;
-  return responseWithDeferredRequestLog(
+  return trackTurn(responseWithDeferredRequestLog(
     response,
     `direct-test-${loggedRequestSequence}`,
     start,
     logCtx,
-  );
+  ));
 }
 
 async function latestAttemptReceipts(config: OcxConfig) {
@@ -2063,6 +2041,7 @@ describe("server combo failover 030 activation matrix", () => {
       "chatgpt-account-id": authKind === "mismatched-account" ? "other-account"
         : authKind === "org-only-jwt" ? "org-foreign" : "acct-scoped-sidecar",
     };
+    takeSpendHome();
     const response = authKind === "chat-valid"
       ? await (await import("../../src/server/chat-completions")).handleChatCompletions(new Request("http://localhost/v1/chat/completions", {
         method: "POST", headers: { "content-type": "application/json", ...headers },
@@ -2444,23 +2423,36 @@ describe("server combo failover 030 activation matrix", () => {
     });
     const config = comboConfig({ a: provider("openai-chat", baseUrl(a), "key-a") });
     const headers = { "x-codex-parent-thread-id": "combo-task" };
-
     const legacyResponse = await post(config, {
       previous_response_id: "resp_combo_legacy_unscoped",
       input: "fresh scoped input",
     }, {}, headers);
+    const fullInput = [{ role: "user", content: "complete history" }, { role: "user", content: "current turn" }];
+    const fullMismatch = await post(config, {
+      previous_response_id: "resp_combo_scoped",
+      input: fullInput,
+    }, {}, { "x-codex-parent-thread-id": "other-task" });
+    const genericError = {
+      error: { message: "Continuation state is unavailable or corrupt; resend the full conversation without previous_response_id.",
+        type: "invalid_request_error", code: "previous_response_not_found" },
+    };
+    expect(legacyResponse.status).toBe(400);
+    expect(await legacyResponse.json()).toEqual(genericError);
+    expect(fullMismatch.status).toBe(400);
+    expect(await fullMismatch.json()).toEqual(genericError);
+    expect(bodies).toHaveLength(0);
+    const retried = await post(config, { input: fullInput }, {}, { "x-codex-parent-thread-id": "other-task" });
     const scopedResponse = await post(config, {
       previous_response_id: "resp_combo_scoped",
       input: "continue scoped task",
     }, {}, headers);
-
-    expect(legacyResponse.status).toBe(200);
-    expect(scopedResponse.status).toBe(200);
-    expect(bodies).toHaveLength(2);
-    expect(JSON.stringify(bodies[0])).not.toContain("legacy private history");
-    expect(JSON.stringify(bodies[0])).toContain("fresh scoped input");
+    const legacyUnscoped = await post(config, { previous_response_id: "resp_combo_legacy_unscoped",
+      input: "legacy continuation" });
+    expect([retried.status, scopedResponse.status, legacyUnscoped.status]).toEqual([200, 200, 200]);
+    expect(bodies).toHaveLength(3);
+    expect(JSON.stringify(bodies[0])).toContain("complete history");
     expect(JSON.stringify(bodies[1])).toContain("scoped private history");
-    expect(JSON.stringify(bodies[1])).toContain("continue scoped task");
+    expect(JSON.stringify(bodies[2])).toContain("legacy private history");
   });
 
   test("combo child preserves replay provenance for compaction and generated guidance", async () => {
@@ -3370,7 +3362,8 @@ describe("server combo failover 030 activation matrix", () => {
     let cancels = 0;
     const parent: RequestLogContext = { model: "", provider: "" };
     const snapshots: RequestLogContext[] = [];
-    const response = await handleResponses(new Request("http://localhost/v1/responses", {
+    takeSpendHome();
+    const response = trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST", headers: { "content-type": "application/json", session_id: "hop-recall" },
       body: JSON.stringify({ model: "combo/free", input: "hello", stream: true }),
     }), config, parent, {
@@ -3381,7 +3374,7 @@ describe("server combo failover 030 activation matrix", () => {
         finalized.resolve();
       },
       onNativePassthroughCancel: () => { cancels += 1; },
-    });
+    }));
     expect(response.status).toBe(200);
     await response.text();
     await within(finalized.promise);
@@ -3413,6 +3406,7 @@ describe("server combo failover 030 activation matrix", () => {
     const finalized = deferred();
     const observed: Array<{ status: number; log: RequestLogContext }> = [];
     try {
+      takeSpendHome();
       const response = await within(handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST", headers: { "content-type": "application/json" },
         body: JSON.stringify({ model: "combo/free", input: "hello", stream: true }),
@@ -3675,11 +3669,12 @@ describe("cursor conversation continuity across store:false chains", () => {
   }
 
   async function postCursor(config: OcxConfig, raw: Record<string, unknown>): Promise<Response> {
-    return handleResponses(new Request("http://localhost/v1/responses", {
+    takeSpendHome();
+    return trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({ stream: false, store: false, ...raw }),
-    }), config, { model: "", provider: "" }, {});
+    }), config, { model: "", provider: "" }, {}));
   }
 
   function cursorConfig(): OcxConfig {
@@ -3771,7 +3766,8 @@ describe("cursor conversation continuity across store:false chains", () => {
     const seen: string[] = [];
     customCursorTransportFactory = fakeCursorTransportFactory(seen);
     const config = cursorConfig();
-    const postThreadTurn = (input: unknown) => handleResponses(new Request("http://localhost/v1/responses", {
+    takeSpendHome();
+    const postThreadTurn = async (input: unknown) => trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -3784,7 +3780,7 @@ describe("cursor conversation continuity across store:false chains", () => {
         store: false,
         prompt_cache_key: "shared-cache-key",
       }),
-    }), config, { model: "", provider: "" }, {});
+    }), config, { model: "", provider: "" }, {}));
 
     expect((await postThreadTurn("start")).status).toBe(200);
     expect((await postThreadTurn([
@@ -3801,7 +3797,8 @@ describe("cursor conversation continuity across store:false chains", () => {
     const seen: string[] = [];
     customCursorTransportFactory = fakeCursorTransportFactory(seen);
     const config = cursorConfig();
-    const postDesktopTurn = (input: unknown) => handleResponses(new Request("http://localhost/v1/responses", {
+    takeSpendHome();
+    const postDesktopTurn = async (input: unknown) => trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -3814,7 +3811,7 @@ describe("cursor conversation continuity across store:false chains", () => {
         stream: false,
         store: false,
       }),
-    }), config, { model: "", provider: "" }, {});
+    }), config, { model: "", provider: "" }, {}));
 
     expect((await postDesktopTurn("start")).status).toBe(200);
     expect((await postDesktopTurn([
@@ -3831,7 +3828,8 @@ describe("cursor conversation continuity across store:false chains", () => {
     const seen: string[] = [];
     customCursorTransportFactory = fakeCursorTransportFactory(seen);
     const config = cursorConfig();
-    const postThreadTurn = (input: unknown) => handleResponses(new Request("http://localhost/v1/responses", {
+    takeSpendHome();
+    const postThreadTurn = async (input: unknown) => trackTurn(await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -3844,7 +3842,7 @@ describe("cursor conversation continuity across store:false chains", () => {
         store: false,
         prompt_cache_key: "shared-cache-key",
       }),
-    }), config, { model: "", provider: "" }, {});
+    }), config, { model: "", provider: "" }, {}));
 
     expect((await postThreadTurn("hello")).status).toBe(200);
     expect((await postThreadTurn([
@@ -3870,13 +3868,14 @@ describe("combo compact failover", () => {
   async function postCompactLogged(config: OcxConfig): Promise<Response> {
     const logCtx: RequestLogContext = { model: "", provider: "" };
     const start = Date.now();
+    takeSpendHome();
     const response = await handleResponsesCompact(compactRequest({
       model: "combo/free",
       stream: false,
       input: [{ type: "message", role: "user", content: [{ type: "input_text", text: "earlier turn" }] }],
     }), config, logCtx);
     loggedRequestSequence += 1;
-    return responseWithDeferredRequestLog(response, `combo-compact-${loggedRequestSequence}`, start, logCtx);
+    return trackTurn(responseWithDeferredRequestLog(response, `combo-compact-${loggedRequestSequence}`, start, logCtx));
   }
 
   function canonicalPoolConfig(
@@ -4111,6 +4110,8 @@ describe("optional-control rejection failover regression", () => {
       expect(isComboTargetInCooldown("free", { provider: "b", model: "m2" })).toBe(false);
     });
   }
+
+  registerComboToolRoutingCases({ serve, baseUrl, provider, comboConfig, post });
 });
 
 describe("image-capability rejection failover regression", () => {
diff --git a/tests/server/server-combo-reasoning-replay-eligibility.test.ts b/tests/server/server-combo-reasoning-replay-eligibility.test.ts
index 5f39d0a9251..38451a7f950 100644
--- a/tests/server/server-combo-reasoning-replay-eligibility.test.ts
+++ b/tests/server/server-combo-reasoning-replay-eligibility.test.ts
@@ -15,6 +15,7 @@ import { clearComboRecallForTests } from "../../src/server/responses/combo-sessi
 import { TARGET_INCOMPATIBLE_MESSAGE } from "../../src/server/responses/core-errors";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 type HandleOptions = NonNullable<Parameters<typeof handleResponses>[3]>;
@@ -23,6 +24,10 @@ let testDir = "";
 let previousHome: string | undefined;
 let isolatedCodexHome: IsolatedCodexHome | null = null;
 const servers: Array<ReturnType<typeof Bun.serve>> = [];
+let releaseSpendHome: (() => void) | undefined;
+
+// Acquire only for rows that physically dispatch, after their temporary home is installed.
+const takeSpendHome = (): void => { releaseSpendHome = acquireOwnedSpendHome(); };
 
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
@@ -38,6 +43,9 @@ beforeEach(() => {
 });
 
 afterEach(async () => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   let responseStatePending = true;
   try {
     for (const server of servers.splice(0)) await server.stop(true);
@@ -172,6 +180,7 @@ describe("combo mandatory reasoning replay failover", () => {
   });
 
   test("upstream_server_error failover to strict Responses preserves existing reasoning_text", async () => {
+    takeSpendHome();
     const failed = serve(() => Response.json({
       error: { type: "server_error", code: "upstream_server_error", message: "busy" },
     }, { status: 500 }));
@@ -208,6 +217,7 @@ describe("combo mandatory reasoning replay failover", () => {
   });
 
   test("a foreign opaque-only replay skips the strict target without forwarding or fabrication", async () => {
+    takeSpendHome();
     let firstTargetFails = false;
     const first = serve(() => firstTargetFails
       ? Response.json({ error: { type: "server_error", code: "upstream_server_error", message: "busy" } }, { status: 500 })
@@ -257,6 +267,7 @@ describe("combo mandatory reasoning replay failover", () => {
   });
 
   test("an exhausted combo reports target_incompatible when mandatory plaintext is unavailable", async () => {
+    takeSpendHome();
     let firstTargetFails = false;
     const first = serve(() => firstTargetFails
       ? Response.json({ error: { type: "server_error", code: "upstream_server_error", message: "busy" } }, { status: 500 })
diff --git a/tests/server/server-combo-zero-output-failover.test.ts b/tests/server/server-combo-zero-output-failover.test.ts
index 88adaf522db..a5a7a9fa292 100644
--- a/tests/server/server-combo-zero-output-failover.test.ts
+++ b/tests/server/server-combo-zero-output-failover.test.ts
@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { ManagementRequest as Request } from "../helpers/management-auth";
 import { comboProviderFactory } from "../helpers/combo-provider";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import { clearComboSelectionState, clearComboTargetCooldowns } from "../../src/combos";
 import { clearComboRecallForTests } from "../../src/server/responses/combo-session-recall";
@@ -43,12 +44,15 @@ let previousHome: string | undefined;
 let isolatedCodexHome: IsolatedCodexHome | null = null;
 const servers: Array<ReturnType<typeof Bun.serve>> = [];
 const provider = comboProviderFactory(() => undefined);
+let releaseSpendHome: (() => void) | undefined;
 
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
   isolatedCodexHome = installIsolatedCodexHome("ocx-combo-zero-output-codex-");
   testDir = mkdtempSync(join(tmpdir(), "ocx-combo-zero-output-"));
   process.env.OPENCODEX_HOME = testDir;
+  // Direct handler dispatches need the writer lease that startServer normally holds.
+  releaseSpendHome = acquireOwnedSpendHome();
   clearComboSelectionState();
   clearComboRecallForTests();
   clearComboTargetCooldowns();
@@ -59,6 +63,9 @@ beforeEach(() => {
 });
 
 afterEach(async () => {
+  // Release before home teardown to prevent Windows removal failures and a live unlinked database.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   let responseStatePending = true;
   try {
     for (const server of servers.splice(0)) await server.stop(true);
diff --git a/tests/server/server-live.test.ts b/tests/server/server-live.test.ts
index fe38564001c..7834021604d 100644
--- a/tests/server/server-live.test.ts
+++ b/tests/server/server-live.test.ts
@@ -33,6 +33,8 @@ import type { OcxConfig } from "../../src/types";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { phaseTimer } from "../helpers/phase-timing";
+import { expectSidebandUpgrade, openSidebandClient, redirectSidebandWebSocket, sidebandRelayUpstream } from "../helpers/sideband-relay-probe";
 
 const previousApiToken = process.env.OPENCODEX_API_AUTH_TOKEN;
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -607,94 +609,91 @@ test("call-create and its sideband join bind to the same pool account (openai/co
 }, { timeout: 20_000 });
 
 test("sideband GET /v1/live/{callId} relays the exact frame ceiling bidirectionally", async () => {
-  const seenPaths: string[] = [];
-  const seenUpgradeHeaders: Headers[] = [];
-  const upstream = Bun.serve({
-    port: 0,
-    fetch(req, server) {
-      const url = new URL(req.url);
-      if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
-        seenPaths.push(url.pathname);
-        seenUpgradeHeaders.push(req.headers);
-        if (server.upgrade(req, { data: {} })) return undefined as unknown as Response;
-        return new Response("upgrade failed", { status: 500 });
-      }
-      return new Response("not found", { status: 404 });
-    },
-    websocket: {
-      maxPayloadLength: MAX_WS_FRAME_BYTES,
-      message(ws, message) {
-        ws.send(typeof message === "string" ? `echo:${message}` : `bytes:${message.byteLength}`);
-      },
-    },
-  });
+  // The peer is a helper so it can report what it saw: this case's only symptom on failure is
+  // its own deadline, which names neither the slow leg nor whether the reply was ever sent.
+  const { server: upstream, seenPaths, seenUpgradeHeaders, probe } = sidebandRelayUpstream(MAX_WS_FRAME_BYTES);
 
-  saveConfig(forwardConfig());
-
-  // Redirect ChatGPT sideband WebSocket targets to the local mock (config stays canonical).
-  const RealWebSocket = globalThis.WebSocket;
-  const upstreamPort = upstream.port;
-  globalThis.WebSocket = class extends RealWebSocket {
-    constructor(url: string | URL, protocols?: string | string[] | Record<string, unknown>) {
-      const parsed = new URL(String(url));
-      const target =
-        parsed.hostname === "api.openai.com" && parsed.pathname.startsWith("/v1/live/")
-          ? `ws://127.0.0.1:${upstreamPort}${parsed.pathname}${parsed.search}`
-          : String(url);
-      super(target, protocols as string[]);
-    }
-  } as typeof WebSocket;
-
-  const server = startServer(0);
+  // Created inside the try: a startServer throw used to leak the peer and the socket override.
+  let restoreWebSocket: (() => void) | undefined;
+  let live: ReturnType<typeof startServer> | undefined;
   try {
-    const wsUrl = new URL(`/v1/live/rtc_sideband`, server.url);
-    wsUrl.protocol = "ws:";
-    const client = new RealWebSocket(wsUrl.toString(), {
-      headers: {
-        authorization: `Bearer ${DIRECT_CHATGPT_TOKEN}`,
-        "chatgpt-account-id": "acct-123",
-        "openai-alpha": "quicksilver=v2",
-        "x-session-id": "rts_side",
-      },
-    } as unknown as string[]);
-
-    await new Promise<void>((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error("sideband timeout")), 15_000);
-      let sawPing = false;
-      client.addEventListener("open", () => {
-        client.send("ping-sideband");
-      });
-      client.addEventListener("message", (event) => {
-        try {
-          if (!sawPing) {
-            expect(String(event.data)).toBe("echo:ping-sideband");
-            sawPing = true;
-            client.send(Buffer.alloc(MAX_WS_FRAME_BYTES));
-            return;
+    saveConfig(forwardConfig());
+    // Redirect ChatGPT sideband targets to the local mock; the config stays canonical. A sibling
+    // helper because this case is at its size cap and the repo answer is not to compress.
+    const { OriginalWebSocket, restore } = redirectSidebandWebSocket(upstream.port);
+    restoreWebSocket = restore;
+    const server = live = startServer(0);
+    const client = openSidebandClient(OriginalWebSocket, server.url, "/v1/live/rtc_sideband", DIRECT_CHATGPT_TOKEN);
+    // The try opens here, one statement after the client exists, so the timer and the phase
+    // recorder are both created inside the block that closes them.
+    let phase: ReturnType<typeof phaseTimer> | undefined;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      // Each leg is its own segment and the timer's ticks read the peer's event count, so a
+      // segment that reaches no further milestone is visible as such. That is weaker than proof
+      // of a stall: a tick without movement says no milestone was reached, not that nothing moved.
+      phase = phaseTimer("sideband 50MiB exact frame ceiling", probe.progress);
+      const leg = phase;
+      await new Promise<void>((resolve, reject) => {
+        const fail = (reason: string): void => reject(new Error(`${reason}; peer: ${probe.summary()}`));
+        timer = setTimeout(() => fail("sideband timeout"), 15_000);
+        let stage: "echo-roundtrip" | "await-ceiling-echo" | "done" = "echo-roundtrip";
+        leg.split("upgrade");
+        client.addEventListener("open", () => {
+          probe.noteClient("open");
+          leg.split("echo-roundtrip");
+          client.send("ping-sideband");
+        });
+        client.addEventListener("close", event => {
+          probe.noteClient("close=" + event.code);
+          // ANY close before this case settles is its own outcome, not a deadline. Keying that
+          // on the first echo left the harder half unreported: a close after the ping and
+          // before the ceiling echo -- the disconnect a 50MiB frame is most likely to cause --
+          // fell through to the 15s timeout and read as a slow peer.
+          if (stage !== "done") fail(`sideband closed during ${stage}`);
+        });
+        client.addEventListener("message", (event) => {
+          try {
+            probe.noteClient("message");
+            if (stage === "echo-roundtrip") {
+              expect(String(event.data)).toBe("echo:ping-sideband");
+              leg.split("allocate-ceiling-frame");
+              const frame = Buffer.alloc(MAX_WS_FRAME_BYTES);
+              // The send is synchronous, so allocating the frame, handing it to the socket and
+              // waiting for the acknowledgement are three separate costs. Timing them as one
+              // segment reported allocation time as wait time.
+              leg.split("send-ceiling-frame");
+              client.send(frame);
+              stage = "await-ceiling-echo";
+              leg.split("await-ceiling-echo");
+              return;
+            }
+            expect(String(event.data)).toBe(`bytes:${MAX_WS_FRAME_BYTES}`);
+            expectSidebandUpgrade({ seenPaths, seenUpgradeHeaders }, "/v1/live/rtc_sideband", DIRECT_CHATGPT_TOKEN);
+            stage = "done";
+            resolve();
+          } catch (err) {
+            reject(err);
           }
-          expect(String(event.data)).toBe(`bytes:${MAX_WS_FRAME_BYTES}`);
-          expect(seenPaths).toContain("/v1/live/rtc_sideband");
-          expect(seenUpgradeHeaders).toHaveLength(1);
-          expect(seenUpgradeHeaders[0].get("openai-alpha")).toBe("quicksilver=v2");
-          expect(seenUpgradeHeaders[0].get("x-session-id")).toBe("rts_side");
-          expect(seenUpgradeHeaders[0].get("authorization")).toBe(`Bearer ${DIRECT_CHATGPT_TOKEN}`);
-          clearTimeout(timer);
-          resolve();
-        } catch (err) {
-          clearTimeout(timer);
-          reject(err);
-        }
-      });
-      client.addEventListener("error", () => {
-        clearTimeout(timer);
-        reject(new Error("client websocket error"));
+        });
+        client.addEventListener("error", () => fail("client websocket error"));
       });
-    });
-    client.close();
+    } finally {
+      // The case owns both: leaving them for the runner to collect is a resource leak whatever
+      // it did or did not contribute to any particular deadline.
+      phase?.end();
+      clearTimeout(timer);
+      client.close();
+    }
   } finally {
-    globalThis.WebSocket = RealWebSocket;
-    await server.stop(true);
-    await upstream.stop(true);
+    restoreWebSocket?.();
+    // Nested so the peer is stopped even when stopping the proxy throws: one failed shutdown
+    // must not leave the other listener running for every case after this one.
+    try {
+      if (live) await live.stop(true);
+    } finally {
+      await upstream.stop(true);
+    }
   }
 }, { timeout: 20_000 });
 
@@ -1399,11 +1398,12 @@ test("frame diagnostics retain only metadata for text, binary, and bounded views
 // PRIVATE gate via createReadinessGate(); starting/failing a second server in the
 // same process can never reset or mutate the first server's gate.
 describe("GET /readyz", () => {
-  test("controlled startup sync drives the server gate to ready or failed", async () => {
+  test("startup sync drives the gate: ok=true is ready even with a warning, ok=false fails (#5181)", async () => {
     saveConfig(forwardConfig());
     const cases = [
       { outcome: { ok: true }, expectedStatus: "ready", expectedHttp: 200 },
-      { outcome: { ok: true, warning: "catalog sync blocked" }, expectedStatus: "failed", expectedHttp: 503 },
+      { outcome: { ok: true, warning: "catalog sync blocked" }, expectedStatus: "ready", expectedHttp: 200 },
+      { outcome: { ok: false }, expectedStatus: "failed", expectedHttp: 503 },
     ] as const;
 
     for (const { outcome, expectedStatus, expectedHttp } of cases) {
diff --git a/tests/server/server-management-auth.test.ts b/tests/server/server-management-auth.test.ts
index d5dae240414..a0554993819 100644
--- a/tests/server/server-management-auth.test.ts
+++ b/tests/server/server-management-auth.test.ts
@@ -1794,13 +1794,17 @@ describe("management and data-plane credential separation", () => {
     saveConfig(remoteConfig());
     process.env.USERNAME ??= "tester";
     setPlatformForTests("win32");
-    // Env-token init never needs file ACL. Time out management-token paths so a
-    // broken file-backed ACL cannot be what made management available; allow
-    // other file hardens so startServer → saveConfig works on real win32
-    // (config-mutation directory harden soft-fails home timeouts).
+    // Env-token init never needs file ACL. Time out the management TOKEN FILE so a broken
+    // file-backed ACL cannot be what made management available; the assertion that the state's
+    // source is "environment" is what proves which path answered.
+    //
+    // The state directory itself is no longer timed out. It was never load-bearing for this
+    // claim, and it is hardened with required: true by the spend-journal owner during
+    // startServer, which correctly refuses rather than soft-failing: an unverified ACL on the
+    // directory holding a secret is not something to proceed past.
     setIcaclsRunnerForTests(args => {
       const target = args[0] ?? "";
-      if (target === testHome || target.endsWith("admin-api-token")) {
+      if (target.endsWith("admin-api-token")) {
         return { success: false, exitCode: null, timedOut: true, stdout: "" };
       }
       return { success: true, exitCode: 0, timedOut: false, stdout: "" };
diff --git a/tests/server/spend-ledger-lifecycle.test.ts b/tests/server/spend-ledger-lifecycle.test.ts
new file mode 100644
index 00000000000..17154d46b8f
--- /dev/null
+++ b/tests/server/spend-ledger-lifecycle.test.ts
@@ -0,0 +1,101 @@
+/**
+ * The failed-start rollback owns two things at once: stopping whatever came up, and giving the
+ * state directory back. Doing the second before the first has finished is what single-writer
+ * ownership exists to prevent, and it cannot be observed from a passing startup.
+ */
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { acquireSpendLedgerServerLifecycle } from "../../src/server/index/spend-ledger-lifecycle";
+import { spendLedgerOwnerSnapshot } from "../../src/lib/spend-ledger-owner";
+import { resetSharedSpendLedgerForTest } from "../../src/lib/spend-reservation-ledger";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+let root = "";
+let home = "";
+let previousHome: string | undefined;
+const stopOrder: string[] = [];
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "ocx-spend-lifecycle-"));
+  home = join(root, "state");
+  previousHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = home;
+  stopOrder.length = 0;
+  resetSharedSpendLedgerForTest();
+});
+
+afterEach(() => {
+  resetSharedSpendLedgerForTest();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(root);
+});
+
+/** A listener whose stop stays pending until the case says otherwise, like a real drain. */
+function controlledListener(name: string, mode: "resolve" | "reject" = "resolve") {
+  let settle: () => void = () => {};
+  const stopped = new Promise<void>((resolve, reject) => {
+    settle = () => { if (mode === "reject") reject(new Error(`${name} stop failed`)); else resolve(); };
+  });
+  stopped.catch(() => { /* the rollback owns this rejection; the case must not be unhandled */ });
+  return {
+    settle,
+    server: {
+      stop(_closeActiveConnections?: boolean): Promise<void> {
+        stopOrder.push(name);
+        return stopped;
+      },
+    },
+  };
+}
+
+/** Let the rollback's allSettled continuation run without inventing a duration. */
+async function drainContinuations(): Promise<void> {
+  for (let turn = 0; turn < 8; turn += 1) await Promise.resolve();
+}
+
+test("a failed start keeps the lease until every listener has actually stopped", async () => {
+  const lifecycle = acquireSpendLedgerServerLifecycle(home);
+  const first = controlledListener("first");
+  const second = controlledListener("second");
+  lifecycle.track(first.server);
+  lifecycle.track(second.server);
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+
+  lifecycle.releaseAfterFailedStart();
+  // Newest first, and both asked before anything is awaited.
+  expect(stopOrder).toEqual(["second", "first"]);
+  await drainContinuations();
+  // Still held: neither stop has settled, so a listener could still be serving.
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+
+  first.settle();
+  await drainContinuations();
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+
+  second.settle();
+  await drainContinuations();
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("unheld");
+});
+
+test("a listener whose stop rejects still stops the rest and still returns the directory", async () => {
+  const lifecycle = acquireSpendLedgerServerLifecycle(home);
+  const failing = controlledListener("failing", "reject");
+  const healthy = controlledListener("healthy");
+  lifecycle.track(healthy.server);
+  lifecycle.track(failing.server);
+
+  lifecycle.releaseAfterFailedStart();
+  expect(stopOrder).toEqual(["failing", "healthy"]);
+
+  failing.settle();
+  await drainContinuations();
+  // One refusal does not strand the directory, and it does not skip the other listener either.
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+
+  healthy.settle();
+  await drainContinuations();
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("unheld");
+});
diff --git a/tests/server/spend-ledger-owner-startup.test.ts b/tests/server/spend-ledger-owner-startup.test.ts
new file mode 100644
index 00000000000..f8649f7e2f3
--- /dev/null
+++ b/tests/server/spend-ledger-owner-startup.test.ts
@@ -0,0 +1,106 @@
+/** startServer owns and releases the shared spend journal lease (#5123). */
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { existsSync, mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { saveConfig } from "../../src/config";
+import { flushConfigDirHardeningForTests } from "../../src/config/paths";
+import { flushNativeMainStartupReleases } from "../../src/codex/native-profile-startup";
+import {
+  SPEND_LEDGER_JOURNAL_FILENAME,
+  SPEND_LEDGER_SALT_FILENAME,
+  resetSharedSpendLedgerForTest,
+} from "../../src/lib/spend-reservation-ledger";
+import { acquireSpendLedgerOwner, spendLedgerOwnerSnapshot } from "../../src/lib/spend-ledger-owner";
+import { startServer } from "../../src/server";
+import type { OcxConfig } from "../../src/types";
+import { installIsolatedCodexHome, type IsolatedCodexHome } from "../helpers/isolated-codex-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+let home = "";
+let previousHome: string | undefined;
+let codexHome: IsolatedCodexHome | null = null;
+
+function config(): OcxConfig {
+  return {
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "kimi",
+    providers: { kimi: { adapter: "openai-chat", baseUrl: "https://kimi.test/v1", models: ["k3"] } },
+  };
+}
+
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "ocx-spend-owner-startup-"));
+  previousHome = process.env.OPENCODEX_HOME;
+  process.env.OPENCODEX_HOME = home;
+  codexHome = installIsolatedCodexHome("ocx-spend-owner-codex-");
+  resetSharedSpendLedgerForTest();
+  saveConfig(config());
+});
+
+afterEach(async () => {
+  await flushNativeMainStartupReleases();
+  await flushConfigDirHardeningForTests();
+  resetSharedSpendLedgerForTest();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  codexHome?.restore();
+  codexHome = null;
+  removeTreeWithRetry(home);
+});
+
+test("startServer acquires before serving and final stop releases", async () => {
+  const server = startServer(0);
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("held");
+  try {
+    const adminToken = readFileSync(join(home, "admin-api-token"), "utf8").trim();
+    const liveness = await fetch(new URL("/healthz", server.url));
+    expect(await liveness.json()).not.toHaveProperty("spendLedger");
+    const health = await fetch(new URL("/api/system/health", server.url), {
+      headers: { "x-opencodex-api-key": adminToken },
+    });
+    expect(await health.json()).toMatchObject({
+      spendLedger: {
+        ownership: "held",
+        initialized: false,
+        configured: false,
+        degraded: false,
+        persistFailures: 0,
+        corruptRecords: 0,
+      },
+    });
+    expect(existsSync(join(home, SPEND_LEDGER_JOURNAL_FILENAME))).toBe(false);
+    expect(existsSync(join(home, SPEND_LEDGER_SALT_FILENAME))).toBe(false);
+  } finally {
+    await server.stop(true);
+  }
+  expect(spendLedgerOwnerSnapshot().ownership).toBe("unheld");
+});
+
+/** Bounded wait: the rollback returns the directory on a continuation, not in the throw's turn. */
+async function waitForOwnership(expected: "held" | "unheld"): Promise<void> {
+  for (let turn = 0; turn < 200; turn += 1) {
+    if (spendLedgerOwnerSnapshot().ownership === expected) return;
+    await Bun.sleep(5);
+  }
+  expect(spendLedgerOwnerSnapshot().ownership).toBe(expected);
+}
+
+test("a partial start that bound public before an auxiliary failure releases ownership", async () => {
+  const blocker = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: () => new Response("blocked") });
+  try {
+    const candidate = config();
+    candidate.unauthenticatedLoopbackListener = { enabled: true, port: blocker.port };
+    saveConfig(candidate);
+    expect(() => startServer(0)).toThrow();
+    // The rollback stops the listener it already bound BEFORE it gives the directory back, so
+    // ownership returns once that stop settles rather than in the same turn as the throw.
+    // Asserting it synchronously passed only while the rollback discarded the stop promise.
+    await waitForOwnership("unheld");
+    const next = acquireSpendLedgerOwner();
+    next.release();
+  } finally {
+    await blocker.stop(true);
+  }
+});
diff --git a/tests/server/terminal-guard-server.test.ts b/tests/server/terminal-guard-server.test.ts
index e95a380ef45..22bac135c2e 100644
--- a/tests/server/terminal-guard-server.test.ts
+++ b/tests/server/terminal-guard-server.test.ts
@@ -7,6 +7,11 @@ import { clearKeyCooldowns } from "../../src/providers/key-failover";
 import { handleResponses } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseInheritedSpendHome: (() => void) | undefined;
+// Taken per inherited-home dispatch because one row below installs a different home.
+const takeInheritedSpendHome = (): void => { releaseInheritedSpendHome = acquireOwnedSpendHome(); };
 
 const config = {
   port: 0,
@@ -98,10 +103,14 @@ describe("server terminal guard integration", () => {
   });
 
   afterEach(() => {
+    // Released first so a failed row cannot carry its writer lease into the next case.
+    releaseInheritedSpendHome?.();
+    releaseInheritedSpendHome = undefined;
     globalThis.fetch = originalFetch;
   });
 
   test("re-asks Claude once inside the same Responses turn and forwards the tool call", async () => {
+    takeInheritedSpendHome();
     const response = await handleResponses(new Request("http://localhost/v1/responses", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -124,6 +133,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("terminal-guard continuation 429 replays on the same key before surfacing", async () => {
+    takeInheritedSpendHome();
     const retryConfig = {
       ...config,
       providers: {
@@ -175,6 +185,8 @@ describe("server terminal guard integration", () => {
     const previousHome = process.env.OPENCODEX_HOME;
     const home = mkdtempSync(join(tmpdir(), "ocx-terminal-guard-failover-"));
     process.env.OPENCODEX_HOME = home;
+    // Taken after this case installs its home so the direct dispatch owns that journal.
+    const releaseSpendHome = acquireOwnedSpendHome();
     clearKeyCooldowns("claude-se");
     const budgetConfig = {
       ...config,
@@ -221,6 +233,8 @@ describe("server terminal guard integration", () => {
       // A per-iteration budget would replay on the second key too (5+ sends).
       expect(sends).toBe(4);
     } finally {
+      // Released before restoring or removing the home so its lease files can be deleted.
+      releaseSpendHome();
       clearKeyCooldowns("claude-se");
       if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
       else process.env.OPENCODEX_HOME = previousHome;
@@ -229,6 +243,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("terminal-guard continuation shares the request-wide 429 budget with the main loop", async () => {
+    takeInheritedSpendHome();
     const budgetConfig = {
       ...config,
       providers: {
@@ -279,6 +294,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("terminal-guard continuation preserves structured cyber_policy semantics", async () => {
+    takeInheritedSpendHome();
     const secret = `OpenAI flagged this request for potential high-risk cybersecurity activity. Authorization: ${["Bear", "er"].join("")} continuationsecret123456`;
     let sends = 0;
     globalThis.fetch = (async () => {
@@ -316,6 +332,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("terminal-guard continuation abort during the 429 wait yields 499 without replaying", async () => {
+    takeInheritedSpendHome();
     const abortConfig = {
       ...config,
       providers: {
@@ -364,6 +381,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("a stalled continuation body reports 504 even when cancelling it aborts the client signal", async () => {
+    takeInheritedSpendHome();
     // Cancelling the stalled source can disconnect the client in the same tick. The
     // classifier has to read the thrown error first, or this timeout is reported as a
     // client cancellation and the caller loses the upstream stall signal.
@@ -397,6 +415,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("a stalled initial body fails with a 504 upstream error instead of a proxy error", async () => {
+    takeInheritedSpendHome();
     // The initial stream has no continuation classifier: without one the bridge catch
     // reports this upstream timeout as a 500 proxy_error.
     const stallConfig = { ...config, stallTimeoutSec: 1 } as unknown as OcxConfig;
@@ -424,6 +443,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("terminal-guard 429 wait longer than the stall budget still succeeds (heartbeats)", async () => {
+    takeInheritedSpendHome();
     const stallConfig = {
       ...config,
       stallTimeoutSec: 1,
@@ -471,6 +491,7 @@ describe("server terminal guard integration", () => {
   }, 5_000);
 
   test("openai-chat provider without terminalContinuationGuard does not re-ask", async () => {
+    takeInheritedSpendHome();
     const chatConfig = openAiChatConfig();
     let sends = 0;
     globalThis.fetch = (async () => {
@@ -497,6 +518,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("openai-chat provider with terminalContinuationGuard false does not re-ask", async () => {
+    takeInheritedSpendHome();
     const chatConfig = openAiChatConfig(false);
     let sends = 0;
     globalThis.fetch = (async () => {
@@ -522,6 +544,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("openai-chat provider with terminalContinuationGuard re-asks once and forwards the tool call", async () => {
+    takeInheritedSpendHome();
     const chatConfig = openAiChatConfig(true);
     let sends = 0;
     const bodies: Record<string, unknown>[] = [];
@@ -553,6 +576,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("combo attempts do not run an opted-in openai-chat terminal guard", async () => {
+    takeInheritedSpendHome();
     const comboConfig = {
       ...openAiChatConfig(true),
       combos: {
@@ -586,6 +610,7 @@ describe("server terminal guard integration", () => {
   });
 
   test("routed compaction does not run an opted-in openai-chat terminal guard", async () => {
+    takeInheritedSpendHome();
     const chatConfig = openAiChatConfig(true);
     let sends = 0;
     globalThis.fetch = (async () => {
diff --git a/tests/server/v2-agent-message-failfast.test.ts b/tests/server/v2-agent-message-failfast.test.ts
index 0e0dc66a24b..18aba6211bf 100644
--- a/tests/server/v2-agent-message-failfast.test.ts
+++ b/tests/server/v2-agent-message-failfast.test.ts
@@ -7,8 +7,12 @@ import {
 } from "../../src/server/responses";
 import type { OcxConfig } from "../../src/types";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 const originalFetch = globalThis.fetch;
+let releaseSpendHome: (() => void) | undefined;
+// Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 /**
  * Structurally faithful Fernet fixture: version + timestamp + IV + one AES-CBC
@@ -40,6 +44,9 @@ const ROUTING_ENVELOPE = [
 const MESSAGE_ROUTING_ENVELOPE = ROUTING_ENVELOPE.replace("NEW_TASK", "MESSAGE");
 
 afterEach(() => {
+  // Release the lease before later teardown can replace the preload sandbox home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
   globalThis.fetch = originalFetch;
 });
 
@@ -128,6 +135,16 @@ async function post(
   }), config, { model: "", provider: "" });
 }
 
+async function dispatchPost(
+  config: OcxConfig,
+  model: string,
+  input: unknown[],
+  headers: HeadersInit = {},
+): Promise<Response> {
+  takeSpendHome();
+  return post(config, model, input, headers);
+}
+
 describe("V2 routed agent-message ciphertext guard", () => {
   test("blocks a pure Fernet-only agent task", () => {
     expect(hasUnreadableEncryptedAgentTask(agentMessage([
@@ -233,7 +250,7 @@ describe("V2 routed agent-message ciphertext guard", () => {
       });
     }) as typeof fetch;
 
-    const response = await post(
+    const response = await dispatchPost(
       mixedComboConfig(),
       "combo/mixed",
       agentMessage([
@@ -313,7 +330,7 @@ describe("V2 routed agent-message ciphertext guard", () => {
       });
     }) as typeof fetch;
 
-    const response = await post(
+    const response = await dispatchPost(
       config,
       "combo/mixed",
       agentMessage([
@@ -500,7 +517,7 @@ describe("V2 routed agent-message ciphertext guard", () => {
       { type: "input_text", text: ROUTING_ENVELOPE },
       { type: "encrypted_content", encrypted_content: FERNET_TASK },
     ]);
-    const response = await post(nativeConfig(), "gpt-5.5", input, {
+    const response = await dispatchPost(nativeConfig(), "gpt-5.5", input, {
       authorization: "Bearer caller-codex-token",
     });
 
@@ -585,7 +602,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
   test("repairs a mixed child result replayed behind a later user turn", async () => {
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", [mixedChildResult(), userTurn]);
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [mixedChildResult(), userTurn]);
 
     expect(response.status).toBe(200);
     expect(outbound()).toHaveLength(1);
@@ -604,7 +621,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     expect(hasUnreadableEncryptedAgentTask(input)).toBe(false);
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", input);
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", input);
 
     expect(response.status).toBe(200);
     expect(outbound()[0]).not.toContain(FERNET_TASK);
@@ -618,7 +635,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     expect(hasUnreadableEncryptedAgentTask(input)).toBe(false);
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", input);
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", input);
 
     expect(response.status).toBe(200);
     expect(outbound()[0]).not.toContain(FERNET_TASK);
@@ -638,7 +655,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
   test("leaves a fully readable child result exactly as the adapter already lowered it", async () => {
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", [{
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
       type: "agent_message",
       author: "/root/child",
       recipient: "/root",
@@ -666,7 +683,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
       });
     }) as typeof fetch;
 
-    const response = await post(routedConfig(), "xai/grok-4.5", [mixedChildResult(), userTurn]);
+    const response = await dispatchPost(routedConfig(), "xai/grok-4.5", [mixedChildResult(), userTurn]);
 
     expect(response.status).toBe(200);
     expect(forwardedBody).toContain("the child finished the migration");
@@ -688,7 +705,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
       });
     }) as typeof fetch;
 
-    const response = await post(nativeConfig(), "gpt-5.5", [mixedChildResult(), userTurn], {
+    const response = await dispatchPost(nativeConfig(), "gpt-5.5", [mixedChildResult(), userTurn], {
       authorization: "Bearer caller-codex-token",
     });
 
@@ -710,7 +727,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     } as OcxConfig;
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(config, "relayfwd/child-model", [mixedChildResult(), userTurn]);
+    const response = await dispatchPost(config, "relayfwd/child-model", [mixedChildResult(), userTurn]);
 
     expect(response.status).toBe(200);
     expect(outbound()[0]).not.toContain(FERNET_TASK);
@@ -736,7 +753,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     } as OcxConfig;
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(config, "combo/routed", [mixedChildResult(), userTurn]);
+    const response = await dispatchPost(config, "combo/routed", [mixedChildResult(), userTurn]);
 
     expect(response.status).toBe(200);
     expect(outbound()).toHaveLength(1);
@@ -755,7 +772,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     expect(structurallyValidFernetTokens(`${first}${second}`)).toEqual([FERNET_TASK]);
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", [{
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
       type: "agent_message",
       author: "/root/child",
       recipient: "/root",
@@ -776,7 +793,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
   test("repairs a token embedded inside a text part and keeps the prose around it", async () => {
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", [{
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
       type: "agent_message",
       author: "/root/child",
       recipient: "/root",
@@ -801,7 +818,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     for (const [name, text] of Object.entries(readable)) {
       const outbound = captureOutbound("relay-model");
 
-      const response = await post(routedResponsesConfig(), "relay/child-model", [{
+      const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
         type: "agent_message",
         author: "/root/child",
         recipient: "/root",
@@ -819,7 +836,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
     // two ordinary encoded fragments do not become a marker merely by being adjacent.
     const outbound = captureOutbound("relay-model");
 
-    const response = await post(routedResponsesConfig(), "relay/child-model", [{
+    const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
       type: "agent_message",
       author: "/root/child",
       recipient: "/root",
@@ -847,7 +864,7 @@ describe("routed Responses agent-message ciphertext repair", () => {
       expect(structurallyValidFernetTokens(blob)).toEqual([]);
       const outbound = captureOutbound("relay-model");
 
-      const response = await post(routedResponsesConfig(), "relay/child-model", [{
+      const response = await dispatchPost(routedResponsesConfig(), "relay/child-model", [{
         type: "agent_message",
         author: "/root/child",
         recipient: "/root",
diff --git a/tests/service/service-tier-capability.test.ts b/tests/service/service-tier-capability.test.ts
index febdfc7a6e0..bb7080f4385 100644
--- a/tests/service/service-tier-capability.test.ts
+++ b/tests/service/service-tier-capability.test.ts
@@ -26,6 +26,11 @@ import {
 import { candidateCapabilityEvidence } from "../../src/routing/capability";
 import { resolveProductionBehaviorValues } from "../../src/routing/compatibility/behavior";
 import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+
+let releaseSpendHome: (() => void) | undefined;
+// Direct dispatch needs the writer lease that prevents spend-ledger ownership failures.
+const takeSpendHome = (): void => { releaseSpendHome ??= acquireOwnedSpendHome(); };
 
 describe("registry capability reaches saved configs without overriding them", () => {
   test("the registry holds the defaults; the seed stays free of them so explicit config stays distinguishable", () => {
@@ -34,6 +39,7 @@ describe("registry capability reaches saved configs without overriding them", ()
     expect(entry.preserveResponsesReasoningContent).toBe(true);
     expect(getProviderRegistryEntry("openai-apikey")!.supportsServiceTier).toBe(true);
     expect(getProviderRegistryEntry("volcengine-agent-plan")!.supportsServiceTier).toBe(false);
+    expect(getProviderRegistryEntry("volcengine-coding-plan")!.supportsServiceTier).toBe(false);
     // Registry-only metadata (same philosophy as modelWireDefaults): NOT seeded.
     const seed = providerConfigSeed(entry);
     expect(seed.supportsServiceTier).toBeUndefined();
@@ -389,7 +395,12 @@ describe("routing evidence uses the final model adapter", () => {
 
 describe("the gate fires on the live handleResponses path", () => {
   const originalFetch = globalThis.fetch;
-  afterEach(() => { globalThis.fetch = originalFetch; });
+  afterEach(() => {
+    // Release the lease before later teardown can replace the preload sandbox home.
+    releaseSpendHome?.();
+    releaseSpendHome = undefined;
+    globalThis.fetch = originalFetch;
+  });
 
   function captureBody(): { bodies: Record<string, unknown>[] } {
     const bodies: Record<string, unknown>[] = [];
@@ -409,7 +420,8 @@ describe("the gate fires on the live handleResponses path", () => {
   ): Promise<Record<string, unknown>> {
     const { bodies } = captureBody();
     const config = { providers: { [providerName]: provider }, ...(fastMode === undefined ? {} : { fastMode }) } as unknown as OcxConfig;
-    await handleResponses(
+    takeSpendHome();
+    const turn = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -419,6 +431,9 @@ describe("the gate fires on the live handleResponses path", () => {
       { model: "", provider: "" },
       {},
     );
+    // The turn's body is a live stream. Releasing it here means no reader is still attached
+    // when the lease is dropped, which is what turns a finished case into a pending one.
+    await turn.body?.cancel();
     return bodies[0] ?? {};
   }
 
@@ -458,7 +473,8 @@ describe("the gate fires on the live handleResponses path", () => {
   test("DeepSeek clears a stripped caller tier from request logging", async () => {
     const { bodies } = captureBody();
     const logCtx: RequestLogContext = { model: "", provider: "" };
-    await handleResponses(
+    takeSpendHome();
+    const turn = await handleResponses(
       new Request("http://localhost/v1/responses", {
         method: "POST",
         headers: { "content-type": "application/json" },
@@ -473,6 +489,7 @@ describe("the gate fires on the live handleResponses path", () => {
       logCtx,
       {},
     );
+    await turn.body?.cancel();
 
     const upstreamBody = bodies[0];
     expect(upstreamBody).toBeDefined();
diff --git a/tests/test-layout-tooling.test.ts b/tests/test-layout-tooling.test.ts
index c7e17d30433..792859a3683 100644
--- a/tests/test-layout-tooling.test.ts
+++ b/tests/test-layout-tooling.test.ts
@@ -262,6 +262,29 @@ describe("membership oracle", () => {
     expect({ unresolvedNew, missingFromTree, wrongTarget }).toEqual({ unresolvedNew: [], missingFromTree: [], wrongTarget: [] });
   });
 
+  // The regex seeds place a conventionally named file, so a regression test can sit in the tree,
+  // run in CI, and never appear in the authoritative table — which is how these three landed with
+  // their subjects (#5050, #5051, #5055) and stayed invisible to the inventory (#5059). The seeds
+  // are deliberately allowed to carry a brand-new file; what they must not do is carry a merged
+  // regression test indefinitely. Naming them here is the difference between "something resolves
+  // it" and "the table says which domain owns it".
+  test("the merged regression tests are classified explicitly, not by seed", () => {
+    const owners = {
+      "ci-structure-gate.test.ts": "ci-workflows",
+      "responses-code-mode-patch-compile.test.ts": "responses",
+      "gui-codex-usage-score-parity.test.ts": "gui",
+    } as const;
+    const classified = Object.fromEntries(
+      Object.keys(owners).map(name => [name, layout.explicit[name] ?? null]),
+    );
+    expect(classified).toEqual(owners);
+    // The file has to be where its registration says, or the registration is a claim about a
+    // tree that does not exist.
+    const live = new Set(listTestFiles(repoRoot()));
+    const placed = Object.entries(owners).map(([name, domain]) => `tests/${domain}/${name}`);
+    expect(placed.filter(rel => !live.has(rel))).toEqual([]);
+  });
+
   test("the fixture histogram never drops below the inventory in devlog 001 §2.B", () => {
     // 001 is a snapshot of 2026-09-05; files added on dev afterwards join the fixture and
     // raise a domain's count. A count that falls below the snapshot means a file was dropped
diff --git a/tests/usage/request-log.test.ts b/tests/usage/request-log.test.ts
index f27426480ad..ae4c9b9493d 100644
--- a/tests/usage/request-log.test.ts
+++ b/tests/usage/request-log.test.ts
@@ -41,25 +41,14 @@ import { mkdtempSync} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { log } from "../helpers/request-log-entry";
 import { decodeRequestLogCursor, selectRequestLogPoll } from "../../src/server/request-log-cursor";
 
 async function* replayAdapterEvents(events: AdapterEvent[]): AsyncGenerator<AdapterEvent> {
   for (const event of events) yield event;
 }
 
-function log(overrides: Partial<RequestLogEntry>): RequestLogEntry {
-  return {
-    requestId: "ocx-test",
-    timestamp: 1,
-    model: "gpt-test",
-    provider: "openai",
-    status: 200,
-    durationMs: 10,
-    usageStatus: "unreported",
-    ...overrides,
-  };
-}
-
 describe("request log metadata", () => {
   test("Claude evidence is normalized before direct ring ingress and cannot be mutated afterwards", () => {
     const previousHome = process.env.OPENCODEX_HOME;
@@ -240,6 +229,9 @@ describe("request log metadata", () => {
       },
     } as OcxConfig;
 
+    // This row calls the handler directly, so it takes the spend-journal writer lease that
+    // startServer would have taken. Released in the finally, before the fetch stub is restored.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -256,7 +248,11 @@ describe("request log metadata", () => {
         adapter: "openai-responses",
         sendCount: 1,
       })]);
+      // Read before the lease is released: the row asserts on metadata only, so without this it
+      // finishes with the turn's body still attached and the lease dropped underneath it.
+      await response.text();
     } finally {
+      releaseSpendHome();
       globalThis.fetch = originalFetch;
     }
   });
@@ -834,6 +830,10 @@ describe("request log metadata", () => {
       "Provider error 401: this model requires a subscription, upgrade for access",
     )).toBe("invalid_api_key");
     expect(requestLogErrorCode(429)).toBe("rate_limit_exceeded");
+    expect(requestLogErrorCode(
+      429,
+      "The upstream connection closed before a response was received. The request may already have been processed; automatic replay was stopped.",
+    )).toBe("upstream_reset_replay_refused");
     expect(requestLogErrorCode(499)).toBe("client_closed_request");
     expect(requestLogErrorCode(502, "client closed request during web-search")).toBe("client_closed_request");
     expect(requestLogErrorCode(400, "blocked", "cyber_policy")).toBe("cyber_policy");
diff --git a/tests/usage/usage-aggregate-cache.test.ts b/tests/usage/usage-aggregate-cache.test.ts
index c2a539bf945..d954a4de326 100644
--- a/tests/usage/usage-aggregate-cache.test.ts
+++ b/tests/usage/usage-aggregate-cache.test.ts
@@ -252,6 +252,36 @@ describe("retained usage aggregate cache", () => {
     }
   });
 
+  test("distinct filtered scans have bounded concurrency while identical callers share a flight", async () => {
+    writeFileSync(join(testDir, "usage.jsonl"), line("one"));
+    const originalScan = usageLedgerScannerModule.scanUsageLedgerCooperatively;
+    let releaseScans!: () => void;
+    const scansBlocked = new Promise<void>(resolve => { releaseScans = resolve; });
+    const scanSpy = spyOn(usageLedgerScannerModule, "scanUsageLedgerCooperatively")
+      .mockImplementation(async options => {
+        await scansBlocked;
+        return originalScan(options);
+      });
+    try {
+      const flights = Array.from({ length: 4 }, (_, index) =>
+        getFilteredUsageAggregate({ provider: `provider-${index}` }));
+      await Bun.sleep(0);
+      expect(scanSpy).toHaveBeenCalledTimes(4);
+
+      const shared = getFilteredUsageAggregate({ provider: "provider-0" });
+      await expect(getFilteredUsageAggregate({ provider: "provider-4" }))
+        .rejects.toThrow("too many concurrent filtered usage aggregates");
+      expect(scanSpy).toHaveBeenCalledTimes(4);
+
+      releaseScans();
+      const results = await Promise.all([...flights, shared]);
+      expect(results[4]!.accumulator).toBe(results[0]!.accumulator);
+    } finally {
+      releaseScans();
+      scanSpy.mockRestore();
+    }
+  });
+
   test("filtered retention invalidates when pricing inputs change", async () => {
     writeFileSync(join(testDir, "usage.jsonl"), line("one"));
     const originalScan = usageLedgerScannerModule.scanUsageLedgerCooperatively;
diff --git a/tests/vision/vision-custom-row-precedence.test.ts b/tests/vision/vision-custom-row-precedence.test.ts
new file mode 100644
index 00000000000..740c46c6295
--- /dev/null
+++ b/tests/vision/vision-custom-row-precedence.test.ts
@@ -0,0 +1,169 @@
+/**
+ * An explicit custom row outranks the provider-level vision hints.
+ *
+ * The reported defect: a model the operator had added as a manual custom row with
+ * `inputModalities: ["text", "image"]` still had every attachment replaced by the omission
+ * marker. The catalog half was already correct — `src/codex/catalog/routed-gather.ts` copies
+ * `customModels[].inputModalities` onto the advertised row, which is why the dashboard showed
+ * "text, image" — while the request path consulted only `providers[].noVisionModels` and
+ * `modelInputModalities` and concluded text-only. One config, two answers.
+ *
+ * These tests pin the precedence at the request-path seam (`requiresVisionPreprocessing`) and at
+ * the shared capability predicate (`modelAcceptsImageInput` / `isVisionSidecarConsumer`), which
+ * is what the sidecar picker and the web-search verbalizer read.
+ */
+import { describe, expect, test } from "bun:test";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import {
+  isVisionSidecarConsumer,
+  modelAcceptsImageInput,
+} from "../../src/vision/eligibility";
+import { planVisionSidecar, requiresVisionPreprocessing } from "../../src/vision/plan";
+import { parseRequest } from "../../src/responses/parser";
+
+const PROVIDER = "zen-go";
+const MODEL = "deepseek-v4.1-flash";
+
+/** The reported shape: the provider lists the model as text-only, the custom row says otherwise. */
+const provider: OcxProviderConfig = {
+  adapter: "openai-chat",
+  baseUrl: "https://opencode.ai/zen/go/v1",
+  noVisionModels: [MODEL],
+  modelInputModalities: { [MODEL]: ["text"] },
+};
+
+function configWith(
+  customModels?: OcxConfig["customModels"],
+  providerOverrides: Partial<OcxProviderConfig> = {},
+): OcxConfig {
+  return {
+    port: 10100,
+    defaultProvider: PROVIDER,
+    providers: { [PROVIDER]: { ...provider, ...providerOverrides } },
+    ...(customModels ? { customModels } : {}),
+  } as OcxConfig;
+}
+
+const imageRow: NonNullable<OcxConfig["customModels"]>[number] = {
+  id: "custom-image-row",
+  provider: PROVIDER,
+  modelId: MODEL,
+  inputModalities: ["text", "image"],
+};
+
+describe("custom row outranks provider vision hints", () => {
+  test("the provider hints alone are what strip the image (the reported defect)", () => {
+    const config = configWith();
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(false);
+  });
+
+  test("an explicit image declaration on the custom row turns preprocessing off", () => {
+    const config = configWith([imageRow]);
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(false);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(true);
+  });
+
+  test("the shared consumer predicate agrees, so the picker and verbalizer follow", () => {
+    expect(isVisionSidecarConsumer(configWith([imageRow]), PROVIDER, MODEL)).toBe(false);
+    expect(isVisionSidecarConsumer(configWith(), PROVIDER, MODEL)).toBe(true);
+  });
+
+  test("an explicit text-only custom row outranks provider hints that advertise image", () => {
+    // The mirror direction: the row must be able to declare text-only for a model the provider
+    // row happens to describe as image-capable, or the override would only work one way.
+    const config = configWith(
+      [{ ...imageRow, inputModalities: ["text"] }],
+      { noVisionModels: [], modelInputModalities: { [MODEL]: ["text", "image"] } },
+    );
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(false);
+  });
+
+  test("a custom row without a modality declaration stays silent instead of claiming text-only", () => {
+    const config = configWith(
+      [{ id: "custom-row", provider: PROVIDER, modelId: MODEL, contextWindow: 1_048_576 }],
+      { noVisionModels: [], modelInputModalities: { [MODEL]: ["text", "image"] } },
+    );
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(false);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(true);
+  });
+
+  test("an audio-only custom row is image-incapable in both predicates", () => {
+    // The declaration answers "can this model take an image", not "is it a text model". A row
+    // that lists only audio excludes image input exactly as `["text"]` does, so the wider
+    // `includes("text")` test this branch used to apply made the two predicates disagree and
+    // sent the attachment to a model that cannot read it.
+    const config = configWith([{ ...imageRow, inputModalities: ["audio"] }]);
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(false);
+  });
+
+  test("a custom row lets a provider-declared text-only model serve as the routed describer", () => {
+    // `usableRoutedVisionModel` used to AND a provider-only `isModelTextOnly` on top of
+    // `modelAcceptsImageInput`. That second check never saw a custom row, so a describer the
+    // operator had declared image-capable was refused for the very provider hint the row overrides.
+    const request = parseRequest({
+      model: "main/blind",
+      input: [{ type: "message", role: "user", content: [{ type: "input_image", image_url: "data:image/png;base64,aGVsbG8taW1hZ2U=" }] }],
+    });
+    const build = (customModels?: OcxConfig["customModels"]): OcxConfig => ({
+      port: 10100,
+      defaultProvider: "main",
+      providers: {
+        main: { adapter: "openai-chat", baseUrl: "https://main.test/v1", noVisionModels: ["blind"] },
+        [PROVIDER]: { ...provider },
+      },
+      visionSidecar: { enabled: true, backend: "routed", model: `${PROVIDER}/${MODEL}` },
+      ...(customModels ? { customModels } : {}),
+    } as OcxConfig);
+
+    const withRow = build([imageRow]);
+    const plan = planVisionSidecar(withRow, withRow.providers["main"]!, "blind", request, undefined, { providerName: "main" });
+    expect(plan?.backend).toBe("routed");
+    expect(plan?.routedModel).toBe(`${PROVIDER}/${MODEL}`);
+
+    // Without the row the provider hint stands, the describer is refused, and nothing else can
+    // describe the image on this config — so the whole plan is absent.
+    const withoutRow = build();
+    expect(planVisionSidecar(withoutRow, withoutRow.providers["main"]!, "blind", request, undefined, { providerName: "main" })).toBeUndefined();
+  });
+
+  test("modelCapabilities remains the top slot when it contradicts the custom row", () => {
+    // `modelCapabilities` is the dedicated capability axis and what `ocx provider edit --text-only`
+    // writes. Two explicit declarations that disagree resolve to the more specific axis.
+    const config = configWith([imageRow]);
+    config.providers[PROVIDER]!.modelCapabilities = { [MODEL]: { inputModalities: ["text"] } };
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL })).toBe(false);
+  });
+
+  test("the shared consumer predicate reads modelCapabilities ahead of the custom row", () => {
+    // The precedence is one contract, not one per predicate: a reader that consults the custom
+    // row first would answer the opposite of `modelAcceptsImageInput` for the same config.
+    const config = configWith([imageRow]);
+    config.providers[PROVIDER]!.modelCapabilities = { [MODEL]: { inputModalities: ["text"] } };
+    expect(isVisionSidecarConsumer(config, PROVIDER, MODEL)).toBe(true);
+  });
+
+  test("an explicit custom row outranks a noVisionModels listing on a native candidate", () => {
+    // The native arm used to check the sidecar hints before the custom row, so a listing the
+    // catalog had already overridden still forced text-only on the request path.
+    const config = configWith([imageRow]);
+    expect(modelAcceptsImageInput(config, { provider: PROVIDER, id: MODEL, native: true })).toBe(true);
+  });
+
+  test("a custom row for a different provider or model id does not leak", () => {
+    const otherProvider = configWith([{ ...imageRow, provider: "other-provider" }]);
+    expect(requiresVisionPreprocessing(otherProvider, otherProvider.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+    const otherModel = configWith([{ ...imageRow, modelId: "another-model" }]);
+    expect(requiresVisionPreprocessing(otherModel, otherModel.providers[PROVIDER]!, MODEL, PROVIDER)).toBe(true);
+  });
+
+  test("without a providerName the custom row is not consulted, preserving legacy callers", () => {
+    // The provider-only fallback exists for unit callers that never resolved a route. It must not
+    // start guessing which provider a bare model id belongs to.
+    const config = configWith([imageRow]);
+    expect(requiresVisionPreprocessing(config, config.providers[PROVIDER]!, MODEL)).toBe(true);
+  });
+});
diff --git a/tests/web-search/web-search-passthrough-bridge.test.ts b/tests/web-search/web-search-passthrough-bridge.test.ts
index 92d8a2e9ed3..05d06f4332a 100644
--- a/tests/web-search/web-search-passthrough-bridge.test.ts
+++ b/tests/web-search/web-search-passthrough-bridge.test.ts
@@ -32,6 +32,7 @@ import {
   waitForProviderRequestSlot,
 } from "../../src/providers/request-pacing";
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig, ProviderWebSearchBridgeBackend, ProviderWebSearchBridgeConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 /** One SSE event block without its blank-line delimiter. */
 function frame(type: string, payload: Record<string, unknown>): string {
@@ -1420,6 +1421,8 @@ describe("the reported turn, end to end through handleResponses", () => {
       hooks.onProviderResponse?.(leg);
       return new Response(text, { headers: { "content-type": "text/event-stream" } });
     }) as unknown as typeof fetch;
+    // Direct dispatch needs the writer lease that startServer normally owns for this home.
+    const releaseSpendHome = acquireOwnedSpendHome();
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
         method: "POST",
@@ -1428,6 +1431,8 @@ describe("the reported turn, end to end through handleResponses", () => {
       }), ocxConfig, { model: "", provider: "" });
       return { body: await response.text(), outbound, destinations, searches, searchUrls, searchHeaders };
     } finally {
+      // Release before later teardown can replace or remove the preload sandbox home.
+      releaseSpendHome();
       globalThis.fetch = savedFetch;
     }
   }
diff --git a/tests/web-search/web-search-retry-heartbeat.test.ts b/tests/web-search/web-search-retry-heartbeat.test.ts
new file mode 100644
index 00000000000..ff4d350a175
--- /dev/null
+++ b/tests/web-search/web-search-retry-heartbeat.test.ts
@@ -0,0 +1,116 @@
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { parseRequest } from "../../src/responses/parser";
+import { runWithWebSearch as runWithWebSearchProduction, type WebSearchLoopDeps } from "../../src/web-search/loop";
+import type { OcxProviderConfig } from "../../src/types";
+import type { ProviderAdapter } from "../../src/adapters/base";
+import { createTestTranslatorBudget } from "../helpers/translator-budget";
+import { phaseTimer } from "../helpers/phase-timing";
+
+/**
+ * Moved out of `web-search.test.ts` for issue #4997, unchanged.
+ *
+ * That file sits at exactly its recorded cap in `tests/fixtures/file-size-baseline.json`, and caps
+ * only move downward, so instrumenting this case in place was not available: a sibling file is the
+ * remedy AGENTS.md names for precisely this situation. Nothing about the case itself changed here.
+ *
+ * The case overran its own 5s bound at 6233ms in the first completed unsharded `macos control`
+ * run while passing in every sharded lane. Its intrinsic wait is a 1.5s backoff, so roughly 4.7s
+ * is unaccounted for, and a single duration cannot say whether that went to setup, to the wait
+ * being served late by a loaded event loop, or to teardown. The phase record answers that.
+ */
+
+const forwardProvider: OcxProviderConfig = {
+  adapter: "openai-responses",
+  baseUrl: "https://chatgpt.test/v1",
+  authMode: "forward",
+};
+
+/** Run the web-search loop with a default test translator budget. */
+function runWithWebSearch(
+  deps: Omit<WebSearchLoopDeps, "incomingMeta"> & { incomingMeta?: WebSearchLoopDeps["incomingMeta"] },
+): Promise<Response> {
+  return runWithWebSearchProduction({
+    ...deps,
+    incomingMeta: deps.incomingMeta ?? {
+      headers: new Headers(),
+      translatorBudget: createTestTranslatorBudget(),
+    },
+  });
+}
+
+async function collectSse(stream: ReadableStream<Uint8Array>): Promise<{ event?: string; data: Record<string, unknown> }[]> {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    text += decoder.decode(value, { stream: true });
+  }
+  return text.split("\n\n")
+    .map(frame => frame.trim())
+    .filter(frame => frame.length > 0 && frame !== "data: [DONE]")
+    .map(frame => {
+      const lines = frame.split("\n");
+      const event = lines.find(line => line.startsWith("event: "))?.slice(7);
+      const dataLine = lines.find(line => line.startsWith("data: "));
+      return { event, data: JSON.parse(dataLine?.slice(6) ?? "{}") as Record<string, unknown> };
+    });
+}
+
+const originalFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = originalFetch; });
+
+describe("web-search same-target 429 retry", () => {
+  test("retry wait longer than the stall budget still succeeds (heartbeats feed the watchdog)", async () => {
+    // `sends` is the only externally visible progress this case makes, so it is what separates a
+    // backoff being served late by a loaded event loop from a loop that stopped advancing.
+    let sends = 0;
+    const timing = phaseTimer("web-search heartbeat retry", () => sends);
+    timing.split("prepare");
+    globalThis.fetch = (() => Promise.resolve(new Response(
+      'event: response.completed\ndata: {"type":"response.completed"}\n\n',
+      { headers: { "Content-Type": "text/event-stream" } },
+    ))) as typeof fetch;
+
+    const retryingAdapter: ProviderAdapter = {
+      name: "mock-retry429",
+      buildRequest: () => ({ url: "https://routed.test/v1", method: "POST", headers: {}, body: "{}" }),
+      fetchResponse: async () => {
+        sends += 1;
+        if (sends === 1) {
+          return new Response("rate limited", { status: 429, headers: { "retry-after": "30" } });
+        }
+        return new Response("{}", { status: 200 });
+      },
+      async *parseStream() {
+        yield { type: "text_delta", text: "answer after long backoff" };
+        yield { type: "done" };
+      },
+      async parseResponse() { throw new Error("parseResponse must be unreachable"); },
+    };
+
+    // `phase` closes its segment through its own finally, so a throw inside the measured window
+    // still produces a closing line rather than a record that just stops.
+    timing.end();
+    const frames = await timing.phase("execute", async () => {
+      const response = await runWithWebSearch({
+        parsed: parseRequest({ model: "routed/model", input: "hi", stream: true, tools: [{ type: "web_search" }] }),
+        adapter: retryingAdapter,
+        forwardProvider,
+        hostedTool: { type: "web_search" },
+        selectedForwardHeaders: new Headers({ authorization: "Bearer token" }),
+        settings: { model: "gpt-5.6-luna", reasoning: "low", timeoutMs: 30_000 },
+        maxSearches: 1,
+        stallTimeoutSec: 1,
+        retryOn429Policy: { enabled: true, attempts: 1, intervalMs: 1_500, maxIntervalMs: 60_000, respectRetryAfter: false },
+      });
+      return collectSse(response.body!);
+    });
+    // A 1.5s backoff under a 1s stall budget must not trip upstream_stall_timeout.
+    expect(sends).toBe(2);
+    expect(frames.find(f => f.event === "response.completed")).toBeDefined();
+    expect(frames.find(f => f.event === "response.failed")).toBeUndefined();
+  }, 5_000);
+});
diff --git a/tests/web-search/web-search-sidecar-429.test.ts b/tests/web-search/web-search-sidecar-429.test.ts
new file mode 100644
index 00000000000..6956b855333
--- /dev/null
+++ b/tests/web-search/web-search-sidecar-429.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+import { runWebSearch as runOpenAiWebSearch } from "../../src/web-search/executor";
+import { listOpenAiForwardSidecarCandidates } from "../../src/providers/openai-sidecar";
+import type { OcxConfig } from "../../src/types";
+
+function testConfig(overrides: Partial<OcxConfig> = {}): OcxConfig {
+  return {
+    port: 10100,
+    defaultProvider: "routed",
+    providers: {},
+    ...overrides,
+  };
+}
+
+describe("web-search sidecar 429 replays", () => {
+  function sidecarProvider() {
+    const cfg = testConfig({
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode: "direct",
+        },
+      },
+    });
+    return listOpenAiForwardSidecarCandidates(cfg)[0]!.provider;
+  }
+
+  function sseDone(): Response {
+    return new Response("data: [DONE]\n\n", { headers: { "content-type": "text/event-stream" } });
+  }
+
+  function searchWith(fetchImpl: () => Promise<Response>) {
+    globalThis.fetch = fetchImpl as unknown as typeof fetch;
+    return runOpenAiWebSearch(
+      "current docs",
+      { type: "web_search" },
+      sidecarProvider(),
+      new Headers({ authorization: "Bearer selected-token" }),
+      { model: "gpt-5.6-luna", reasoning: "low", timeoutMs: 30_000 },
+    );
+  }
+
+  test("a burst 429 is replayed and the recovered answer is returned", async () => {
+    let calls = 0;
+    const outcome = await searchWith(async () => {
+      calls += 1;
+      if (calls === 1) return new Response("rate limited", { status: 429 });
+      return sseDone();
+    });
+    expect(calls).toBe(2);
+    expect(outcome.error).toBeUndefined();
+  });
+
+  test("a persistent 429 ends with the 429 after bounded attempts", async () => {
+    let calls = 0;
+    const outcome = await searchWith(async () => {
+      calls += 1;
+      return new Response("rate limited", { status: 429 });
+    });
+    expect(calls).toBe(3);
+    expect(outcome.error).toContain("429");
+  });
+
+  test("a Retry-After past the ceiling ends with the 429 without parking", async () => {
+    let calls = 0;
+    const outcome = await searchWith(async () => {
+      calls += 1;
+      return new Response("slow down", { status: 429, headers: { "retry-after": "120" } });
+    });
+    expect(calls).toBe(1);
+    expect(outcome.error).toContain("429");
+  });
+});
diff --git a/tests/web-search/web-search.test.ts b/tests/web-search/web-search.test.ts
index 1e5331da335..a027a980759 100644
--- a/tests/web-search/web-search.test.ts
+++ b/tests/web-search/web-search.test.ts
@@ -15,6 +15,7 @@ import type { OcxMessage, OcxParsedRequest } from "../../src/types";
 import { fakeChatGptJwt } from "../helpers/fake-chatgpt-jwt";
 import { createTestTranslatorBudget } from "../helpers/translator-budget";
 import { withUpstreamHttpVersion } from "../../src/lib/upstream-http-version";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 
 /**
  * Wrap a fetch so it applies the provider's HTTP-version pin the way `providerFetch` does in
@@ -566,7 +567,13 @@ describe("web-search sidecar planning", () => {
 });
 
 const originalFetch = globalThis.fetch;
-afterEach(() => { globalThis.fetch = originalFetch; });
+let releaseSpendHome: (() => void) | undefined;
+afterEach(() => {
+  // Release the preload-home lease before later teardown can replace or remove that home.
+  releaseSpendHome?.();
+  releaseSpendHome = undefined;
+  globalThis.fetch = originalFetch;
+});
 
 test("issue #2885 — Zhipu-shaped web-search routing preserves the provider HTTP version pin", async () => {
   let routedProtocol: string | undefined;
@@ -606,6 +613,8 @@ test("issue #2885 — Zhipu-shaped web-search routing preserves the provider HTT
     throw new Error("the routed web-search leg must use the provider fetch");
   }) as typeof fetch;
 
+  // Direct dispatch needs the writer lease that startServer normally owns for this home.
+  releaseSpendHome = acquireOwnedSpendHome();
   const response = await handleResponses(new Request("http://localhost/v1/responses", {
     method: "POST",
     headers: {
@@ -1076,6 +1085,11 @@ describe("web-search sidecar native web_search_call emission", () => {
 
     // First adapter always 429s via fetchResponse; the rotated adapter answers.
     const reasoningLogs: unknown[] = [];
+    const accountAConversationId = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+    const outerParsed = parseRequest({ model: "routed/model", input: "hi", stream: true, tools: [{ type: "web_search" }] });
+    outerParsed._kiroAuthContext = { apiRegion: "eu-west-1", profileArn: "account-a" };
+    outerParsed._providerContinuation = { kiro: { conversationId: accountAConversationId } };
+    let retryState: Pick<OcxParsedRequest, "_kiroAuthContext" | "_providerContinuation"> | undefined;
     const firstAdapter: ProviderAdapter = {
       name: "mock-429",
       buildRequest: () => ({
@@ -1095,17 +1109,20 @@ describe("web-search sidecar native web_search_call emission", () => {
     };
     const rotatedAdapter: ProviderAdapter = {
       name: "mock-rotated",
-      buildRequest: () => ({
-        url: "https://routed.test/v1",
-        method: "POST",
-        headers: {},
-        body: "{}",
-        reasoningLog: {
-          effectiveEffort: "high",
-          wireField: "reasoning_effort",
-          wireValue: "high",
-        },
-      }),
+      buildRequest: retryParsed => {
+        retryState = retryParsed;
+        return {
+          url: "https://routed.test/v1",
+          method: "POST",
+          headers: {},
+          body: "{}",
+          reasoningLog: {
+            effectiveEffort: "high",
+            wireField: "reasoning_effort",
+            wireValue: "high",
+          },
+        };
+      },
       fetchResponse: async () => new Response("{}", { status: 200 }),
       async *parseStream() {
         yield { type: "text_delta", text: "answer from rotated key" };
@@ -1116,7 +1133,7 @@ describe("web-search sidecar native web_search_call emission", () => {
     let rotations = 0;
 
     const response = await runWithWebSearch({
-      parsed: parseRequest({ model: "routed/model", input: "hi", stream: true, tools: [{ type: "web_search" }] }),
+      parsed: outerParsed,
       adapter: firstAdapter,
       forwardProvider,
       hostedTool: { type: "web_search" },
@@ -1124,10 +1141,13 @@ describe("web-search sidecar native web_search_call emission", () => {
       settings: { model: "gpt-5.6-luna", reasoning: "low", timeoutMs: 30_000 },
       maxSearches: 1,
       onRequestBuilt: request => reasoningLogs.push(request.reasoningLog),
-      on429: async retryAfter => {
+      on429: async (retryAfter, _responseHeaders, retryParsed) => {
         rotations++;
         expect(retryAfter).toBe("30");
         await Promise.resolve();
+        if (!retryParsed) throw new Error("the loop must pass the iteration request to on429");
+        retryParsed._kiroAuthContext = { apiRegion: "ap-southeast-2", profileArn: "account-b" };
+        delete retryParsed._providerContinuation;
         return rotatedAdapter;
       },
     });
@@ -1137,6 +1157,8 @@ describe("web-search sidecar native web_search_call emission", () => {
     const output = completed.output as { type: string; content?: { text?: string }[] }[];
     expect(output.find(o => o.type === "message")?.content?.[0]?.text).toBe("answer from rotated key");
     expect(rotations).toBe(1);
+    expect(retryState?._kiroAuthContext).toEqual({ apiRegion: "ap-southeast-2", profileArn: "account-b" });
+    expect(retryState?._providerContinuation).toBeUndefined();
     expect(reasoningLogs).toEqual([
       {
         effectiveEffort: "low",
@@ -1215,48 +1237,6 @@ describe("web-search sidecar native web_search_call emission", () => {
     expect(builds).toBe(1);
   });
 
-  test("retry wait longer than the stall budget still succeeds (heartbeats feed the watchdog)", async () => {
-    globalThis.fetch = (() => Promise.resolve(new Response(
-      'event: response.completed\ndata: {"type":"response.completed"}\n\n',
-      { headers: { "Content-Type": "text/event-stream" } },
-    ))) as typeof fetch;
-
-    let sends = 0;
-    const retryingAdapter: ProviderAdapter = {
-      name: "mock-retry429",
-      buildRequest: () => ({ url: "https://routed.test/v1", method: "POST", headers: {}, body: "{}" }),
-      fetchResponse: async () => {
-        sends += 1;
-        if (sends === 1) {
-          return new Response("rate limited", { status: 429, headers: { "retry-after": "30" } });
-        }
-        return new Response("{}", { status: 200 });
-      },
-      async *parseStream() {
-        yield { type: "text_delta", text: "answer after long backoff" };
-        yield { type: "done" };
-      },
-      async parseResponse() { throw new Error("parseResponse must be unreachable"); },
-    };
-
-    const response = await runWithWebSearch({
-      parsed: parseRequest({ model: "routed/model", input: "hi", stream: true, tools: [{ type: "web_search" }] }),
-      adapter: retryingAdapter,
-      forwardProvider,
-      hostedTool: { type: "web_search" },
-      selectedForwardHeaders: new Headers({ authorization: "Bearer token" }),
-      settings: { model: "gpt-5.6-luna", reasoning: "low", timeoutMs: 30_000 },
-      maxSearches: 1,
-      stallTimeoutSec: 1,
-      retryOn429Policy: { enabled: true, attempts: 1, intervalMs: 1_500, maxIntervalMs: 60_000, respectRetryAfter: false },
-    });
-    const frames = await collectSse(response.body!);
-    // A 1.5s backoff under a 1s stall budget must not trip upstream_stall_timeout.
-    expect(sends).toBe(2);
-    expect(frames.find(f => f.event === "response.completed")).toBeDefined();
-    expect(frames.find(f => f.event === "response.failed")).toBeUndefined();
-  }, 5_000);
-
   test("retry wait longer than connectTimeoutMs restarts the header deadline (no 504)", async () => {
     globalThis.fetch = (() => Promise.resolve(new Response(
       'event: response.completed\ndata: {"type":"response.completed"}\n\n',
diff --git a/tests/windows/windows-deploy-close-regressions.test.ts b/tests/windows/windows-deploy-close-regressions.test.ts
index 5d4504fea67..b65925b29be 100644
--- a/tests/windows/windows-deploy-close-regressions.test.ts
+++ b/tests/windows/windows-deploy-close-regressions.test.ts
@@ -90,7 +90,14 @@ describe("server bind canonicalizes explicit localhost but preserves wildcards (
     // loopback-only, so a bare substring ban would forbid the fix rather than the defect.
     // Pin the assertion to the public serve call instead: it must take bindHost and nothing
     // else.
-    expect(src).toContain("server = Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost });");
+    // Wrapper-aware, because the public listener is now handed to a lifecycle registrar as it is
+    // created. Both halves of the original claim are kept: the serve call's argument object is
+    // pinned exactly, so the public bind still takes bindHost and nothing else, and `server` is
+    // still what that call is assigned to, through at most one registrar call.
+    expect(src).toContain("Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost })");
+    expect(src).toMatch(
+      /\bserver = (?:[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\()?Bun\.serve<WsData>\(\{ \.\.\.serveOptions, port: listenPort, hostname: bindHost \}\)/,
+    );
     expect(src).not.toMatch(/port: listenPort,\s*\n\s*hostname: "127\.0\.0\.1"/);
     expect(src).not.toContain("port: listenPort, hostname: \"127.0.0.1\"");
   });
diff --git a/tests/windows/windows-tray.test.ts b/tests/windows/windows-tray.test.ts
index 60cfd9f3230..a0c8ce7e58b 100644
--- a/tests/windows/windows-tray.test.ts
+++ b/tests/windows/windows-tray.test.ts
@@ -380,6 +380,47 @@ describe("Windows tray packaging and command safety", () => {
     expect(source).not.toContain("Stop-Process");
   });
 
+  test("tray reads restart safety through the CLI instead of the admin-gated /api endpoint", () => {
+    const source = readFileSync(repoPath("src", "tray", "windows-tray.ps1"), "utf8");
+    // The management API is admin-token gated, and the tray runs without that token,
+    // so a plain GET /api/startup-health always 401s and leaves the tray stuck on the
+    // yellow warning icon. The tray must collect the same local diagnostic through the
+    // CLI's __startup-health internal command instead.
+    expect(source).toContain('@($CliPath, "__startup-health")');
+    expect(source).not.toContain('Read-JsonUrl "$origin/api/startup-health"');
+    // The local diagnostic does not re-run the Windows service-manager probe on every
+    // 3s tick, so its refresh cadence must stay throttled...
+    expect(source).toContain("$script:startupRefreshMs");
+    expect(source).toContain("$script:startupHealthCheckedAt -gt $script:startupRefreshMs");
+    // ...and it must not block the Windows Forms UI thread. The probe is a detached
+    // child whose stdout pipe is drained asynchronously; the 3s tick only touches the
+    // completed read task, so a slow or hung diagnostic can never freeze the tray menu.
+    expect(source).toContain("ReadToEndAsync()");
+    expect(source).toContain("$script:startupProbeProcess");
+    // A timed-out diagnostic must be terminated, not left to become an orphaned
+    // Bun process on the next refresh.
+    expect(source).toContain("startupProbeProcess.Kill()");
+    // A launch failure or invalid result must not start a new probe on the very next
+    // 3s tick: the refresh decides by the throttled attempt timestamp, never by a null
+    // cached health, and records the attempt before spawning the child.
+    expect(source).toContain("$script:startupHealthCheckedAt -eq 0 -or");
+    expect(source).toContain("# Record the attempt so launch failures and invalid results remain throttled.");
+    // A probe still in flight when the tray shuts down must not outlive it: the
+    // finally block kills the active probe, waits briefly, then completes it.
+    expect(source).toContain("terminating active startup-health probe on tray shutdown");
+    expect(source).toContain("startupProbeProcess.WaitForExit(3000)");
+    // Probe lifecycle maintenance runs even while the proxy is offline, so a hung
+    // diagnostic is cleaned up outside the online-only UI branch; new probes still
+    // start only while online.
+    expect(source).toContain("$script:online -and ($cameOnline -or $refreshDue)");
+    // The malformed-payload guard requires a real boolean, matching the shared
+    // server-side parser instead of accepting any non-null rebootSafe value.
+    expect(source).toContain("($parsed.rebootSafe -is [bool])");
+    // If the async pipe setup fails after the child started, the child must be
+    // terminated, not merely disposed and lost.
+    expect(source).toContain("would leave the Bun child running");
+  });
+
   // This test really does launch PowerShell, which really does launch a Bun child, and
   // then rebinds the port to prove the child did not inherit the listen socket. Those
   // processes ARE the assertion — there is no version of this proof that fakes them.